emdash 0.38.0 → 0.39.0

package/dist/redirects-ByItliuu.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirects-ByItliuu.mjs","names":[],"sources":["../src/redirects/loops.ts","../src/api/handlers/redirects.ts"],"sourcesContent":["/**\n * Redirect loop and chain detection utilities.\n *\n * Builds a directed graph from redirect rules and detects:\n * - Cycles (loops): /a → /b → /c → /a\n * - Long chains: /a → /b → /c → /d → /e (exceeding a warning threshold)\n *\n * Handles both exact and pattern redirects. When the walker encounters\n * a path with no exact source match, it tests against compiled pattern\n * sources and resolves the destination using captured parameters.\n */\n\nimport {\n\tcompilePattern,\n\tmatchPattern,\n\tinterpolateDestination,\n\ttype CompiledPattern,\n} from \"./patterns.js\";\n\nexport interface RedirectEdge {\n\tid: string;\n\tsource: string;\n\tdestination: string;\n\tenabled: boolean;\n\tisPattern: boolean;\n}\n\ninterface CompiledPatternRedirect {\n\tid: string;\n\tcompiled: CompiledPattern;\n\tdestination: string;\n}\n\n/**\n * Compile all enabled pattern redirects for matching during graph walks.\n */\nfunction compilePatterns(edges: RedirectEdge[]): CompiledPatternRedirect[] {\n\tconst result: CompiledPatternRedirect[] = [];\n\tfor (const edge of edges) {\n\t\tif (edge.enabled && edge.isPattern) {\n\t\t\tresult.push({\n\t\t\t\tid: edge.id,\n\t\t\t\tcompiled: compilePattern(edge.source),\n\t\t\t\tdestination: edge.destination,\n\t\t\t});\n\t\t}\n\t}\n\treturn result;\n}\n\n/** Single-segment dummy value for representative path generation */\nconst DUMMY_SEGMENT = \"__p__\";\n\n/** Splat pattern: [...paramName] */\nconst SPLAT_RE = /\\[\\.\\.\\.(\\w+)\\]/g;\n\n/** Param pattern: [paramName] */\nconst PARAM_RE = /\\[(\\w+)\\]/g;\n\n/**\n * Extract the literal prefix from a pattern source (everything before the\n * first placeholder), stripped of leading segments shared with a base path.\n * e.g., \"/new/docs/[slug]\" → \"docs/__p__\" (the part after \"/new/\")\n */\nfunction extractPatternSuffix(patternSource: string): string {\n\t// Replace placeholders with dummy values\n\tlet result = patternSource.replace(SPLAT_RE, DUMMY_SEGMENT);\n\tSPLAT_RE.lastIndex = 0;\n\tresult = result.replace(PARAM_RE, DUMMY_SEGMENT);\n\t// Strip leading slash and first segment (e.g., \"/new/docs/__p__\" → \"docs/__p__\")\n\tconst parts = result.split(\"/\").filter(Boolean);\n\treturn parts.slice(1).join(\"/\");\n}\n\n/**\n * Generate representative concrete paths from a template string.\n * Replaces [param] with a dummy segment and [...rest] with multiple\n * depth variants. For catch-alls, also generates representatives using\n * literal prefixes from existing pattern sources to catch cross-pattern loops.\n */\nfunction generateRepresentatives(template: string, existingEdges?: RedirectEdge[]): string[] {\n\tconst hasSplat = SPLAT_RE.test(template);\n\tSPLAT_RE.lastIndex = 0;\n\n\tif (hasSplat) {\n\t\t// Extract the static prefix before the catch-all (e.g., \"/old/\" from \"/old/[...path]\")\n\t\tconst splatIndex = template.indexOf(\"[...\");\n\t\tconst prefix = template.slice(0, splatIndex);\n\n\t\tconst reps = [\n\t\t\ttemplate.replace(SPLAT_RE, DUMMY_SEGMENT).replace(PARAM_RE, DUMMY_SEGMENT),\n\t\t\ttemplate\n\t\t\t\t.replace(SPLAT_RE, `${DUMMY_SEGMENT}/${DUMMY_SEGMENT}`)\n\t\t\t\t.replace(PARAM_RE, DUMMY_SEGMENT),\n\t\t\ttemplate\n\t\t\t\t.replace(SPLAT_RE, `${DUMMY_SEGMENT}/${DUMMY_SEGMENT}/${DUMMY_SEGMENT}`)\n\t\t\t\t.replace(PARAM_RE, DUMMY_SEGMENT),\n\t\t];\n\n\t\t// Add representatives derived from existing pattern sources' literal prefixes\n\t\tif (existingEdges) {\n\t\t\tfor (const edge of existingEdges) {\n\t\t\t\tif (edge.enabled && edge.isPattern && edge.source !== template) {\n\t\t\t\t\tconst suffix = extractPatternSuffix(edge.source);\n\t\t\t\t\tif (suffix) {\n\t\t\t\t\t\treps.push(`${prefix}${suffix}`);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn reps;\n\t}\n\n\treturn [template.replace(PARAM_RE, DUMMY_SEGMENT)];\n}\n\n/**\n * Resolve the next hop for a given path. Tries exact match first,\n * then pattern matching with parameter interpolation for concrete paths,\n * then representative-based matching for template strings.\n */\nfunction resolveNext(\n\tpath: string,\n\tgraph: Map<string, { destination: string; id: string }>,\n\tpatterns: CompiledPatternRedirect[],\n\tedges?: RedirectEdge[],\n): { destination: string; id: string } | null {\n\t// Exact match (fast) — works for both real paths and template strings\n\tconst exact = graph.get(path);\n\tif (exact) return exact;\n\n\tif (!path.includes(\"[\")) {\n\t\t// Concrete path — try pattern matching directly\n\t\tfor (const pr of patterns) {\n\t\t\tconst params = matchPattern(pr.compiled, path);\n\t\t\tif (params) {\n\t\t\t\tconst resolved = interpolateDestination(pr.destination, params);\n\t\t\t\treturn { destination: resolved, id: pr.id };\n\t\t\t}\n\t\t}\n\t} else {\n\t\t// Template string — generate representative paths and test against patterns\n\t\tconst representatives = generateRepresentatives(path, edges);\n\t\tfor (const pr of patterns) {\n\t\t\tfor (const rep of representatives) {\n\t\t\t\tconst params = matchPattern(pr.compiled, rep);\n\t\t\t\tif (params) {\n\t\t\t\t\tconst resolved = interpolateDestination(pr.destination, params);\n\t\t\t\t\treturn { destination: resolved, id: pr.id };\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\n/**\n * Build an adjacency map from redirect edges.\n * Includes both exact and pattern redirects — pattern redirects use their\n * template strings as literal graph edges, which works because EmDash\n * patterns pass parameters through without transformation.\n */\nfunction buildGraph(edges: RedirectEdge[]): Map<string, { destination: string; id: string }> {\n\tconst graph = new Map<string, { destination: string; id: string }>();\n\tfor (const edge of edges) {\n\t\tif (edge.enabled) {\n\t\t\tgraph.set(edge.source, { destination: edge.destination, id: edge.id });\n\t\t}\n\t}\n\treturn graph;\n}\n\n/**\n * Detect all redirect IDs that participate in cycles.\n * Walks every node in the graph once, collecting IDs from any cycles found.\n *\n * @returns Array of redirect IDs that are part of a loop\n */\nexport function detectLoops(edges: RedirectEdge[]): string[] {\n\tconst graph = buildGraph(edges);\n\tconst patterns = compilePatterns(edges);\n\tconst visited = new Set<string>();\n\tconst loopRedirectIds = new Set<string>();\n\n\tfor (const [startSource] of graph) {\n\t\tif (visited.has(startSource)) continue;\n\n\t\tconst path: string[] = [];\n\t\tconst pathSet = new Set<string>();\n\t\tconst pathIds: string[] = [];\n\t\tlet current: string | undefined = startSource;\n\n\t\twhile (current) {\n\t\t\tif (pathSet.has(current)) {\n\t\t\t\t// Found a cycle — collect IDs of redirects in the loop\n\t\t\t\tconst loopStart = path.indexOf(current);\n\t\t\t\tfor (const id of pathIds.slice(loopStart)) loopRedirectIds.add(id);\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tif (visited.has(current)) {\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tconst next = resolveNext(current, graph, patterns, edges);\n\t\t\tif (!next) break;\n\n\t\t\tpath.push(current);\n\t\t\tpathSet.add(current);\n\t\t\tpathIds.push(next.id);\n\t\t\tcurrent = next.destination;\n\t\t}\n\n\t\tfor (const node of path) visited.add(node);\n\t}\n\n\treturn [...loopRedirectIds];\n}\n\n/**\n * Find a compiled pattern redirect whose source matches the given resolved path,\n * returning the source template string for display purposes.\n */\nfunction findMatchingTemplate(\n\tresolvedPath: string,\n\tpatterns: CompiledPatternRedirect[],\n): string | null {\n\tfor (const pr of patterns) {\n\t\tif (matchPattern(pr.compiled, resolvedPath) !== null) {\n\t\t\treturn pr.compiled.source;\n\t\t}\n\t}\n\treturn null;\n}\n\n/**\n * Check if adding or updating a redirect would create a loop.\n *\n * Walks the chain from `destination` through existing redirects.\n * If it reaches `source`, a cycle would form.\n *\n * @returns The loop path if a cycle would be created, or null if safe\n */\nexport function wouldCreateLoop(\n\tsource: string,\n\tdestination: string,\n\texistingEdges: RedirectEdge[],\n\texcludeId?: string,\n): string[] | null {\n\tconst filtered = excludeId ? existingEdges.filter((e) => e.id !== excludeId) : existingEdges;\n\tconst graph = buildGraph(filtered);\n\tconst patterns = compilePatterns(filtered);\n\n\t// If the proposed source is a pattern, compile it so we can check\n\t// whether resolved paths would match it (not just string equality)\n\tconst sourceIsPattern = source.includes(\"[\");\n\tconst compiledSource = sourceIsPattern ? compilePattern(source) : null;\n\n\t// Determine starting points for the walk. If the destination is a\n\t// template, generate representative concrete paths AND find existing\n\t// exact sources in the graph that match the template.\n\tlet startingPoints: string[];\n\tif (destination.includes(\"[\")) {\n\t\tconst reps = generateRepresentatives(destination, filtered);\n\t\t// Also find existing exact graph keys that match this template\n\t\tconst compiled = compilePattern(destination);\n\t\tfor (const [key] of graph) {\n\t\t\tif (!key.includes(\"[\") && matchPattern(compiled, key) !== null) {\n\t\t\t\treps.push(key);\n\t\t\t}\n\t\t}\n\t\t// Always include the destination itself — it may be an exact graph key\n\t\t// (e.g., /a/sub/[...path] exists as a literal source in the graph)\n\t\treps.push(destination);\n\t\tstartingPoints = reps;\n\t} else {\n\t\tstartingPoints = [destination];\n\t}\n\n\tfor (const start of startingPoints) {\n\t\tconst path = [source, destination];\n\t\tlet current = start;\n\t\tconst seen = new Set<string>([source, destination, start]);\n\n\t\t// Walk the chain until it ends or we revisit a node\n\t\t// eslint-disable-next-line no-constant-condition -- terminates via return/break when chain ends or cycle found\n\t\twhile (true) {\n\t\t\tconst next = resolveNext(current, graph, patterns, filtered);\n\t\t\tif (!next) break; // chain ends, try next starting point\n\n\t\t\t// Check if we've looped back — either exact match or pattern match\n\t\t\tconst loopsBack =\n\t\t\t\tseen.has(next.destination) ||\n\t\t\t\t(compiledSource !== null && matchPattern(compiledSource, next.destination) !== null);\n\n\t\t\tif (loopsBack) {\n\t\t\t\t// Show the source template instead of dummy resolved path\n\t\t\t\tconst displayPath =\n\t\t\t\t\t!seen.has(next.destination) && compiledSource !== null ? source : next.destination;\n\t\t\t\tpath.push(displayPath);\n\t\t\t\treturn path; // cycle found\n\t\t\t}\n\n\t\t\t// If the resolved path contains dummy segments, try to find the\n\t\t\t// original pattern template that produced it for cleaner display\n\t\t\tconst cleanDest = next.destination.includes(DUMMY_SEGMENT)\n\t\t\t\t? (findMatchingTemplate(next.destination, patterns) ?? next.destination)\n\t\t\t\t: next.destination;\n\t\t\tpath.push(cleanDest);\n\t\t\tseen.add(next.destination);\n\t\t\tcurrent = next.destination;\n\t\t}\n\t}\n\n\treturn null;\n}\n","/**\n * Redirect CRUD and 404 log handlers\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../../database/repositories/options.js\";\nimport {\n\tRedirectRepository,\n\tRedirectWriteBusyError,\n\ttype RedirectWriteFence,\n\ttype Redirect,\n\ttype NotFoundEntry,\n\ttype NotFoundSummary,\n} from \"../../database/repositories/redirect.js\";\nimport { InvalidCursorError } from \"../../database/repositories/types.js\";\nimport type { FindManyResult } from \"../../database/repositories/types.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { invalidateRedirectCache } from \"../../redirects/cache.js\";\nimport { wouldCreateLoop, detectLoops, type RedirectEdge } from \"../../redirects/loops.js\";\nimport { validatePattern, validateDestinationParams, isPattern } from \"../../redirects/patterns.js\";\nimport { isTerminalStatus } from \"../../redirects/status.js\";\nimport type { ApiResult } from \"../types.js\";\n\nasync function withRedirectWriteLock<T>(\n\trepo: RedirectRepository,\n\taction: (fence: RedirectWriteFence, repository: RedirectRepository) => Promise<ApiResult<T>>,\n): Promise<ApiResult<T>> {\n\ttry {\n\t\treturn await repo.withWriteLock(action);\n\t} catch (error) {\n\t\tif (error instanceof RedirectWriteBusyError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"REDIRECT_BUSY\", message: \"Another redirect change is in progress\" },\n\t\t\t};\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Redirects\n// ---------------------------------------------------------------------------\n\n/**\n * List redirects with cursor pagination and optional filters\n */\nexport async function handleRedirectList(\n\tdb: Kysely<Database>,\n\tparams: {\n\t\tcursor?: string;\n\t\tlimit?: number;\n\t\tsearch?: string;\n\t\tgroup?: string;\n\t\tenabled?: boolean;\n\t\tauto?: boolean;\n\t},\n): Promise<ApiResult<FindManyResult<Redirect> & { loopRedirectIds?: string[] }>> {\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\t\tconst result = await repo.findMany(params);\n\n\t\tconst loopRedirectIds = await getLoopRedirectIds(db);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\t...result,\n\t\t\t\t...(loopRedirectIds.length > 0 ? { loopRedirectIds } : {}),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"REDIRECT_LIST_ERROR\", message: \"Failed to fetch redirects\" },\n\t\t};\n\t}\n}\n\n/**\n * Create a redirect rule\n */\nexport async function handleRedirectCreate(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tsource: string;\n\t\tdestination?: string;\n\t\ttype?: number;\n\t\tenabled?: boolean;\n\t\tgroupName?: string | null;\n\t},\n): Promise<ApiResult<Redirect>> {\n\ttry {\n\t\tconst lockRepo = new RedirectRepository(db);\n\t\tconst result = await withRedirectWriteLock(lockRepo, async (fence, repo) => {\n\t\t\tconst type = input.type ?? 301;\n\t\t\t// Terminal statuses (410 Gone / 451) are served directly and have no\n\t\t\t// destination — skip the destination/loop checks for them.\n\t\t\tconst terminal = isTerminalStatus(type);\n\t\t\tconst destination = terminal ? \"\" : (input.destination ?? \"\");\n\n\t\t\t// Source and destination must differ\n\t\t\tif (!terminal && input.source === destination) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: \"Source and destination must be different\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// If source looks like a pattern, validate it\n\t\t\tconst sourceIsPattern = isPattern(input.source);\n\t\t\tif (sourceIsPattern) {\n\t\t\t\tconst patternError = validatePattern(input.source);\n\t\t\t\tif (patternError) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: { code: \"VALIDATION_ERROR\", message: `Invalid source pattern: ${patternError}` },\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\t// Validate destination params reference valid source params\n\t\t\t\t// (terminal rules have no destination to interpolate)\n\t\t\t\tif (!terminal) {\n\t\t\t\t\tconst destError = validateDestinationParams(input.source, destination);\n\t\t\t\t\tif (destError) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\t\terror: { code: \"VALIDATION_ERROR\", message: destError },\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Check for duplicate source (exact match only for non-patterns)\n\t\t\tconst existing = await repo.findBySource(input.source);\n\t\t\tif (existing) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\t\t\tmessage: `A redirect from \"${input.source}\" already exists`,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Check for redirect loops (skip if creating as disabled, or terminal —\n\t\t\t// a Gone rule has no destination, so it can't form a loop)\n\t\t\tif (!terminal && input.enabled !== false) {\n\t\t\t\tconst edges = toEdges(await repo.findAllEnabled());\n\t\t\t\tconst loopPath = wouldCreateLoop(input.source, destination, edges);\n\t\t\t\tif (loopPath) return loopError(loopPath);\n\t\t\t}\n\n\t\t\tconst redirect = await repo.create(\n\t\t\t\t{\n\t\t\t\t\tsource: input.source,\n\t\t\t\t\tdestination,\n\t\t\t\t\ttype,\n\t\t\t\t\tisPattern: sourceIsPattern,\n\t\t\t\t\tenabled: input.enabled ?? true,\n\t\t\t\t\tgroupName: input.groupName ?? null,\n\t\t\t\t},\n\t\t\t\tfence,\n\t\t\t);\n\t\t\treturn { success: true, data: redirect };\n\t\t});\n\t\tif (result.success) invalidateRedirectCache();\n\t\treturn result;\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"REDIRECT_CREATE_ERROR\", message: \"Failed to create redirect\" },\n\t\t};\n\t}\n}\n\n/**\n * Get a redirect by ID\n */\nexport async function handleRedirectGet(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<Redirect>> {\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\t\tconst redirect = await repo.findById(id);\n\n\t\tif (!redirect) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Redirect \"${id}\" not found` },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: redirect };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"REDIRECT_GET_ERROR\", message: \"Failed to fetch redirect\" },\n\t\t};\n\t}\n}\n\n/**\n * Update a redirect by ID\n */\nexport async function handleRedirectUpdate(\n\tdb: Kysely<Database>,\n\tid: string,\n\tinput: {\n\t\tsource?: string;\n\t\tdestination?: string;\n\t\ttype?: number;\n\t\tenabled?: boolean;\n\t\tgroupName?: string | null;\n\t},\n\toptions?: { expectedRevision?: string },\n): Promise<ApiResult<Redirect>> {\n\ttry {\n\t\tconst lockRepo = new RedirectRepository(db);\n\t\tconst result = await withRedirectWriteLock(lockRepo, async (fence, repo) => {\n\t\t\tconst existing = await repo.findById(id);\n\t\t\tif (!existing) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: { code: \"NOT_FOUND\", message: `Redirect \"${id}\" not found` },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (options?.expectedRevision !== undefined) {\n\t\t\t\tconst currentRevision = await repo.findConfigRevision(id);\n\t\t\t\tif (currentRevision !== options.expectedRevision) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: { code: \"CONFLICT\", message: \"Redirect changed since it was read\" },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst newSource = input.source ?? existing.source;\n\t\t\tconst newType = input.type ?? existing.type;\n\t\t\tconst terminal = isTerminalStatus(newType);\n\t\t\tconst newDest = terminal ? \"\" : (input.destination ?? existing.destination);\n\t\t\tif (!terminal && !newDest) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: \"destination is required for redirect types (301, 302, 307, 308)\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Source and destination must differ\n\t\t\tif (!terminal && newSource === newDest) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: \"Source and destination must be different\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// If source is changing, validate patterns\n\t\t\tif (input.source !== undefined) {\n\t\t\t\tconst sourceIsPattern = isPattern(input.source);\n\t\t\t\tif (sourceIsPattern) {\n\t\t\t\t\tconst patternError = validatePattern(input.source);\n\t\t\t\t\tif (patternError) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\t\t\tmessage: `Invalid source pattern: ${patternError}`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Check for duplicate source (exclude self)\n\t\t\t\tconst dup = await repo.findBySource(input.source);\n\t\t\t\tif (dup && dup.id !== id) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\t\t\t\tmessage: `A redirect from \"${input.source}\" already exists`,\n\t\t\t\t\t\t},\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Validate destination params against the (possibly updated) source\n\t\t\tconst newSourceIsPattern = isPattern(newSource);\n\t\t\tif (newSourceIsPattern && !terminal) {\n\t\t\t\tconst destError = validateDestinationParams(newSource, newDest);\n\t\t\t\tif (destError) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: { code: \"VALIDATION_ERROR\", message: destError },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Check for redirect loops if source or destination changed\n\t\t\tconst willBeEnabled = input.enabled ?? existing.enabled;\n\t\t\tif (\n\t\t\t\t!terminal &&\n\t\t\t\twillBeEnabled &&\n\t\t\t\t(input.source !== undefined || input.destination !== undefined)\n\t\t\t) {\n\t\t\t\tconst edges = toEdges(await repo.findAllEnabled());\n\t\t\t\tconst loopPath = wouldCreateLoop(newSource, newDest, edges, id);\n\t\t\t\tif (loopPath) return loopError(loopPath);\n\t\t\t}\n\n\t\t\tconst updated = await repo.update(\n\t\t\t\tid,\n\t\t\t\t{\n\t\t\t\t\tsource: input.source,\n\t\t\t\t\tdestination: terminal ? \"\" : input.destination,\n\t\t\t\t\ttype: input.type,\n\t\t\t\t\tenabled: input.enabled,\n\t\t\t\t\tgroupName: input.groupName,\n\t\t\t\t},\n\t\t\t\toptions?.expectedRevision,\n\t\t\t\tfence,\n\t\t\t);\n\n\t\t\tif (!updated) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: options?.expectedRevision\n\t\t\t\t\t\t? { code: \"CONFLICT\", message: \"Redirect changed since it was read\" }\n\t\t\t\t\t\t: { code: \"REDIRECT_UPDATE_ERROR\", message: \"Failed to update redirect\" },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Recompute cache — redirect was modified, so re-fetch\n\t\t\tawait updateLoopCache(repo.db);\n\t\t\treturn { success: true, data: updated };\n\t\t});\n\t\tif (result.success) invalidateRedirectCache();\n\t\treturn result;\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"REDIRECT_UPDATE_ERROR\", message: \"Failed to update redirect\" },\n\t\t};\n\t}\n}\n\n/**\n * Delete a redirect by ID\n */\nexport async function handleRedirectDelete(\n\tdb: Kysely<Database>,\n\tid: string,\n\toptions?: { expectedRevision?: string },\n): Promise<ApiResult<{ deleted: true }>> {\n\ttry {\n\t\tconst lockRepo = new RedirectRepository(db);\n\t\tconst result = await withRedirectWriteLock<{ deleted: true }>(lockRepo, async (fence, repo) => {\n\t\t\tif (options?.expectedRevision !== undefined) {\n\t\t\t\tconst existing = await repo.findById(id);\n\t\t\t\tif (!existing) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: { code: \"NOT_FOUND\", message: `Redirect \"${id}\" not found` },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\tconst currentRevision = await repo.findConfigRevision(id);\n\t\t\t\tif (currentRevision !== options.expectedRevision) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\terror: { code: \"CONFLICT\", message: \"Redirect changed since it was read\" },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst deleted = await repo.delete(id, options?.expectedRevision, fence);\n\n\t\t\tif (!deleted) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: options?.expectedRevision\n\t\t\t\t\t\t? { code: \"CONFLICT\", message: \"Redirect changed since it was read\" }\n\t\t\t\t\t\t: { code: \"NOT_FOUND\", message: `Redirect \"${id}\" not found` },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tawait updateLoopCache(repo.db);\n\t\t\treturn { success: true, data: { deleted: true } };\n\t\t});\n\t\tif (result.success) invalidateRedirectCache();\n\t\treturn result;\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"REDIRECT_DELETE_ERROR\", message: \"Failed to delete redirect\" },\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Loop analysis cache\n// ---------------------------------------------------------------------------\n\nfunction loopError(loopPath: string[]): ApiResult<never> {\n\tconst hops = loopPath\n\t\t.slice(0, -1)\n\t\t.map((p, i) => `${p} \\u2192 ${loopPath[i + 1]}`)\n\t\t.join(\"\\n\");\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\tmessage: `This redirect would create a loop:\\n${hops}`,\n\t\t},\n\t};\n}\n\nfunction toEdges(redirects: Redirect[]): RedirectEdge[] {\n\treturn redirects.map((r) => ({\n\t\tid: r.id,\n\t\tsource: r.source,\n\t\tdestination: r.destination,\n\t\tenabled: r.enabled,\n\t\tisPattern: r.isPattern,\n\t}));\n}\n\nconst LOOP_CACHE_KEY = \"_redirect_loop_ids\";\n\n/**\n * Recompute loop redirect IDs and store in the options table.\n */\nasync function updateLoopCache(db: Kysely<Database>): Promise<void> {\n\ttry {\n\t\tconst options = new OptionsRepository(db);\n\t\tconst edges = toEdges(await new RedirectRepository(db).findAllEnabled());\n\t\tconst loopRedirectIds = detectLoops(edges);\n\t\tawait options.set(LOOP_CACHE_KEY, loopRedirectIds);\n\t} catch (error) {\n\t\tconsole.error(\"Failed to update redirect loop cache:\", error);\n\t}\n}\n\n/**\n * Get loop redirect IDs from cache, computing lazily on first access.\n */\nasync function getLoopRedirectIds(db: Kysely<Database>): Promise<string[]> {\n\ttry {\n\t\tconst options = new OptionsRepository(db);\n\t\tconst cached = await options.get<string[]>(LOOP_CACHE_KEY);\n\t\tif (cached !== null) return cached;\n\n\t\t// First access after upgrade — compute and cache\n\t\tawait updateLoopCache(db);\n\t\treturn (await options.get<string[]>(LOOP_CACHE_KEY)) ?? [];\n\t} catch {\n\t\treturn [];\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// 404 Log\n// ---------------------------------------------------------------------------\n\n/**\n * List 404 log entries with cursor pagination\n */\nexport async function handleNotFoundList(\n\tdb: Kysely<Database>,\n\tparams: { cursor?: string; limit?: number; search?: string },\n): Promise<ApiResult<FindManyResult<NotFoundEntry>>> {\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\t\tconst result = await repo.find404s(params);\n\t\treturn { success: true, data: result };\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"NOT_FOUND_LIST_ERROR\", message: \"Failed to fetch 404 log\" },\n\t\t};\n\t}\n}\n\n/**\n * Get 404 summary (grouped by path, sorted by count)\n */\nexport async function handleNotFoundSummary(\n\tdb: Kysely<Database>,\n\tlimit?: number,\n): Promise<ApiResult<{ items: NotFoundSummary[] }>> {\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\t\tconst items = await repo.get404Summary(limit);\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"NOT_FOUND_SUMMARY_ERROR\", message: \"Failed to fetch 404 summary\" },\n\t\t};\n\t}\n}\n\n/**\n * Clear all 404 log entries\n */\nexport async function handleNotFoundClear(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<{ deleted: number }>> {\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\t\tconst deleted = await repo.clear404s();\n\t\treturn { success: true, data: { deleted } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"NOT_FOUND_CLEAR_ERROR\", message: \"Failed to clear 404 log\" },\n\t\t};\n\t}\n}\n\n/**\n * Prune 404 log entries older than a given date\n */\nexport async function handleNotFoundPrune(\n\tdb: Kysely<Database>,\n\tolderThan: string,\n): Promise<ApiResult<{ deleted: number }>> {\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\t\tconst deleted = await repo.prune404s(olderThan);\n\t\treturn { success: true, data: { deleted } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"NOT_FOUND_PRUNE_ERROR\", message: \"Failed to prune 404 log\" },\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAS,gBAAgB,OAAkD;CAC1E,MAAM,SAAoC,EAAE;AAC5C,MAAK,MAAM,QAAQ,MAClB,KAAI,KAAK,WAAW,KAAK,UACxB,QAAO,KAAK;EACX,IAAI,KAAK;EACT,UAAU,eAAe,KAAK,OAAO;EACrC,aAAa,KAAK;EAClB,CAAC;AAGJ,QAAO;;;AAIR,MAAM,gBAAgB;;AAGtB,MAAM,WAAW;;AAGjB,MAAM,WAAW;;;;;;AAOjB,SAAS,qBAAqB,eAA+B;CAE5D,IAAI,SAAS,cAAc,QAAQ,UAAU,cAAc;AAC3D,UAAS,YAAY;AACrB,UAAS,OAAO,QAAQ,UAAU,cAAc;AAGhD,QADc,OAAO,MAAM,IAAI,CAAC,OAAO,QAAQ,CAClC,MAAM,EAAE,CAAC,KAAK,IAAI;;;;;;;;AAShC,SAAS,wBAAwB,UAAkB,eAA0C;CAC5F,MAAM,WAAW,SAAS,KAAK,SAAS;AACxC,UAAS,YAAY;AAErB,KAAI,UAAU;EAEb,MAAM,aAAa,SAAS,QAAQ,OAAO;EAC3C,MAAM,SAAS,SAAS,MAAM,GAAG,WAAW;EAE5C,MAAM,OAAO;GACZ,SAAS,QAAQ,UAAU,cAAc,CAAC,QAAQ,UAAU,cAAc;GAC1E,SACE,QAAQ,UAAU,GAAG,cAAc,GAAG,gBAAgB,CACtD,QAAQ,UAAU,cAAc;GAClC,SACE,QAAQ,UAAU,GAAG,cAAc,GAAG,cAAc,GAAG,gBAAgB,CACvE,QAAQ,UAAU,cAAc;GAClC;AAGD,MAAI,eACH;QAAK,MAAM,QAAQ,cAClB,KAAI,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW,UAAU;IAC/D,MAAM,SAAS,qBAAqB,KAAK,OAAO;AAChD,QAAI,OACH,MAAK,KAAK,GAAG,SAAS,SAAS;;;AAMnC,SAAO;;AAGR,QAAO,CAAC,SAAS,QAAQ,UAAU,cAAc,CAAC;;;;;;;AAQnD,SAAS,YACR,MACA,OACA,UACA,OAC6C;CAE7C,MAAM,QAAQ,MAAM,IAAI,KAAK;AAC7B,KAAI,MAAO,QAAO;AAElB,KAAI,CAAC,KAAK,SAAS,IAAI,CAEtB,MAAK,MAAM,MAAM,UAAU;EAC1B,MAAM,SAAS,aAAa,GAAG,UAAU,KAAK;AAC9C,MAAI,OAEH,QAAO;GAAE,aADQ,uBAAuB,GAAG,aAAa,OAAO;GAC/B,IAAI,GAAG;GAAI;;MAGvC;EAEN,MAAM,kBAAkB,wBAAwB,MAAM,MAAM;AAC5D,OAAK,MAAM,MAAM,SAChB,MAAK,MAAM,OAAO,iBAAiB;GAClC,MAAM,SAAS,aAAa,GAAG,UAAU,IAAI;AAC7C,OAAI,OAEH,QAAO;IAAE,aADQ,uBAAuB,GAAG,aAAa,OAAO;IAC/B,IAAI,GAAG;IAAI;;;AAM/C,QAAO;;;;;;;;AASR,SAAS,WAAW,OAAyE;CAC5F,MAAM,wBAAQ,IAAI,KAAkD;AACpE,MAAK,MAAM,QAAQ,MAClB,KAAI,KAAK,QACR,OAAM,IAAI,KAAK,QAAQ;EAAE,aAAa,KAAK;EAAa,IAAI,KAAK;EAAI,CAAC;AAGxE,QAAO;;;;;;;;AASR,SAAgB,YAAY,OAAiC;CAC5D,MAAM,QAAQ,WAAW,MAAM;CAC/B,MAAM,WAAW,gBAAgB,MAAM;CACvC,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,kCAAkB,IAAI,KAAa;AAEzC,MAAK,MAAM,CAAC,gBAAgB,OAAO;AAClC,MAAI,QAAQ,IAAI,YAAY,CAAE;EAE9B,MAAM,OAAiB,EAAE;EACzB,MAAM,0BAAU,IAAI,KAAa;EACjC,MAAM,UAAoB,EAAE;EAC5B,IAAI,UAA8B;AAElC,SAAO,SAAS;AACf,OAAI,QAAQ,IAAI,QAAQ,EAAE;IAEzB,MAAM,YAAY,KAAK,QAAQ,QAAQ;AACvC,SAAK,MAAM,MAAM,QAAQ,MAAM,UAAU,CAAE,iBAAgB,IAAI,GAAG;AAClE;;AAGD,OAAI,QAAQ,IAAI,QAAQ,CACvB;GAGD,MAAM,OAAO,YAAY,SAAS,OAAO,UAAU,MAAM;AACzD,OAAI,CAAC,KAAM;AAEX,QAAK,KAAK,QAAQ;AAClB,WAAQ,IAAI,QAAQ;AACpB,WAAQ,KAAK,KAAK,GAAG;AACrB,aAAU,KAAK;;AAGhB,OAAK,MAAM,QAAQ,KAAM,SAAQ,IAAI,KAAK;;AAG3C,QAAO,CAAC,GAAG,gBAAgB;;;;;;AAO5B,SAAS,qBACR,cACA,UACgB;AAChB,MAAK,MAAM,MAAM,SAChB,KAAI,aAAa,GAAG,UAAU,aAAa,KAAK,KAC/C,QAAO,GAAG,SAAS;AAGrB,QAAO;;;;;;;;;;AAWR,SAAgB,gBACf,QACA,aACA,eACA,WACkB;CAClB,MAAM,WAAW,YAAY,cAAc,QAAQ,MAAM,EAAE,OAAO,UAAU,GAAG;CAC/E,MAAM,QAAQ,WAAW,SAAS;CAClC,MAAM,WAAW,gBAAgB,SAAS;CAK1C,MAAM,iBADkB,OAAO,SAAS,IAAI,GACH,eAAe,OAAO,GAAG;CAKlE,IAAI;AACJ,KAAI,YAAY,SAAS,IAAI,EAAE;EAC9B,MAAM,OAAO,wBAAwB,aAAa,SAAS;EAE3D,MAAM,WAAW,eAAe,YAAY;AAC5C,OAAK,MAAM,CAAC,QAAQ,MACnB,KAAI,CAAC,IAAI,SAAS,IAAI,IAAI,aAAa,UAAU,IAAI,KAAK,KACzD,MAAK,KAAK,IAAI;AAKhB,OAAK,KAAK,YAAY;AACtB,mBAAiB;OAEjB,kBAAiB,CAAC,YAAY;AAG/B,MAAK,MAAM,SAAS,gBAAgB;EACnC,MAAM,OAAO,CAAC,QAAQ,YAAY;EAClC,IAAI,UAAU;EACd,MAAM,OAAO,IAAI,IAAY;GAAC;GAAQ;GAAa;GAAM,CAAC;AAI1D,SAAO,MAAM;GACZ,MAAM,OAAO,YAAY,SAAS,OAAO,UAAU,SAAS;AAC5D,OAAI,CAAC,KAAM;AAOX,OAHC,KAAK,IAAI,KAAK,YAAY,IACzB,mBAAmB,QAAQ,aAAa,gBAAgB,KAAK,YAAY,KAAK,MAEjE;IAEd,MAAM,cACL,CAAC,KAAK,IAAI,KAAK,YAAY,IAAI,mBAAmB,OAAO,SAAS,KAAK;AACxE,SAAK,KAAK,YAAY;AACtB,WAAO;;GAKR,MAAM,YAAY,KAAK,YAAY,SAAS,cAAc,GACtD,qBAAqB,KAAK,aAAa,SAAS,IAAI,KAAK,cAC1D,KAAK;AACR,QAAK,KAAK,UAAU;AACpB,QAAK,IAAI,KAAK,YAAY;AAC1B,aAAU,KAAK;;;AAIjB,QAAO;;;;;ACpSR,eAAe,sBACd,MACA,QACwB;AACxB,KAAI;AACH,SAAO,MAAM,KAAK,cAAc,OAAO;UAC/B,OAAO;AACf,MAAI,iBAAiB,uBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA0C;GACnF;AAEF,QAAM;;;;;;AAWR,eAAsB,mBACrB,IACA,QAQgF;AAChF,KAAI;EAEH,MAAM,SAAS,MADF,IAAI,mBAAmB,GAAG,CACb,SAAS,OAAO;EAE1C,MAAM,kBAAkB,MAAM,mBAAmB,GAAG;AAEpD,SAAO;GACN,SAAS;GACT,MAAM;IACL,GAAG;IACH,GAAI,gBAAgB,SAAS,IAAI,EAAE,iBAAiB,GAAG,EAAE;IACzD;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA6B;GAC5E;;;;;;AAOH,eAAsB,qBACrB,IACA,OAO+B;AAC/B,KAAI;EAEH,MAAM,SAAS,MAAM,sBADJ,IAAI,mBAAmB,GAAG,EACU,OAAO,OAAO,SAAS;GAC3E,MAAM,OAAO,MAAM,QAAQ;GAG3B,MAAM,WAAW,iBAAiB,KAAK;GACvC,MAAM,cAAc,WAAW,KAAM,MAAM,eAAe;AAG1D,OAAI,CAAC,YAAY,MAAM,WAAW,YACjC,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;GAIF,MAAM,kBAAkB,UAAU,MAAM,OAAO;AAC/C,OAAI,iBAAiB;IACpB,MAAM,eAAe,gBAAgB,MAAM,OAAO;AAClD,QAAI,aACH,QAAO;KACN,SAAS;KACT,OAAO;MAAE,MAAM;MAAoB,SAAS,2BAA2B;MAAgB;KACvF;AAKF,QAAI,CAAC,UAAU;KACd,MAAM,YAAY,0BAA0B,MAAM,QAAQ,YAAY;AACtE,SAAI,UACH,QAAO;MACN,SAAS;MACT,OAAO;OAAE,MAAM;OAAoB,SAAS;OAAW;MACvD;;;AAOJ,OADiB,MAAM,KAAK,aAAa,MAAM,OAAO,CAErD,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS,oBAAoB,MAAM,OAAO;KAC1C;IACD;AAKF,OAAI,CAAC,YAAY,MAAM,YAAY,OAAO;IACzC,MAAM,QAAQ,QAAQ,MAAM,KAAK,gBAAgB,CAAC;IAClD,MAAM,WAAW,gBAAgB,MAAM,QAAQ,aAAa,MAAM;AAClE,QAAI,SAAU,QAAO,UAAU,SAAS;;AAczC,UAAO;IAAE,SAAS;IAAM,MAXP,MAAM,KAAK,OAC3B;KACC,QAAQ,MAAM;KACd;KACA;KACA,WAAW;KACX,SAAS,MAAM,WAAW;KAC1B,WAAW,MAAM,aAAa;KAC9B,EACD,MACA;IACuC;IACvC;AACF,MAAI,OAAO,QAAS,0BAAyB;AAC7C,SAAO;SACA;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA6B;GAC9E;;;;;;AAOH,eAAsB,kBACrB,IACA,IAC+B;AAC/B,KAAI;EAEH,MAAM,WAAW,MADJ,IAAI,mBAAmB,GAAG,CACX,SAAS,GAAG;AAExC,MAAI,CAAC,SACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,aAAa,GAAG;IAAc;GACnE;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM;GAAU;SACjC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAsB,SAAS;IAA4B;GAC1E;;;;;;AAOH,eAAsB,qBACrB,IACA,IACA,OAOA,SAC+B;AAC/B,KAAI;EAEH,MAAM,SAAS,MAAM,sBADJ,IAAI,mBAAmB,GAAG,EACU,OAAO,OAAO,SAAS;GAC3E,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,OAAI,CAAC,SACJ,QAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAa,SAAS,aAAa,GAAG;KAAc;IACnE;AAGF,OAAI,SAAS,qBAAqB,QAEjC;QADwB,MAAM,KAAK,mBAAmB,GAAG,KACjC,QAAQ,iBAC/B,QAAO;KACN,SAAS;KACT,OAAO;MAAE,MAAM;MAAY,SAAS;MAAsC;KAC1E;;GAIH,MAAM,YAAY,MAAM,UAAU,SAAS;GAE3C,MAAM,WAAW,iBADD,MAAM,QAAQ,SAAS,KACG;GAC1C,MAAM,UAAU,WAAW,KAAM,MAAM,eAAe,SAAS;AAC/D,OAAI,CAAC,YAAY,CAAC,QACjB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;AAIF,OAAI,CAAC,YAAY,cAAc,QAC9B,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;AAIF,OAAI,MAAM,WAAW,QAAW;AAE/B,QADwB,UAAU,MAAM,OAAO,EAC1B;KACpB,MAAM,eAAe,gBAAgB,MAAM,OAAO;AAClD,SAAI,aACH,QAAO;MACN,SAAS;MACT,OAAO;OACN,MAAM;OACN,SAAS,2BAA2B;OACpC;MACD;;IAKH,MAAM,MAAM,MAAM,KAAK,aAAa,MAAM,OAAO;AACjD,QAAI,OAAO,IAAI,OAAO,GACrB,QAAO;KACN,SAAS;KACT,OAAO;MACN,MAAM;MACN,SAAS,oBAAoB,MAAM,OAAO;MAC1C;KACD;;AAMH,OAD2B,UAAU,UAAU,IACrB,CAAC,UAAU;IACpC,MAAM,YAAY,0BAA0B,WAAW,QAAQ;AAC/D,QAAI,UACH,QAAO;KACN,SAAS;KACT,OAAO;MAAE,MAAM;MAAoB,SAAS;MAAW;KACvD;;GAKH,MAAM,gBAAgB,MAAM,WAAW,SAAS;AAChD,OACC,CAAC,YACD,kBACC,MAAM,WAAW,UAAa,MAAM,gBAAgB,SACpD;IAED,MAAM,WAAW,gBAAgB,WAAW,SAD9B,QAAQ,MAAM,KAAK,gBAAgB,CAAC,EACU,GAAG;AAC/D,QAAI,SAAU,QAAO,UAAU,SAAS;;GAGzC,MAAM,UAAU,MAAM,KAAK,OAC1B,IACA;IACC,QAAQ,MAAM;IACd,aAAa,WAAW,KAAK,MAAM;IACnC,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,WAAW,MAAM;IACjB,EACD,SAAS,kBACT,MACA;AAED,OAAI,CAAC,QACJ,QAAO;IACN,SAAS;IACT,OAAO,SAAS,mBACb;KAAE,MAAM;KAAY,SAAS;KAAsC,GACnE;KAAE,MAAM;KAAyB,SAAS;KAA6B;IAC1E;AAIF,SAAM,gBAAgB,KAAK,GAAG;AAC9B,UAAO;IAAE,SAAS;IAAM,MAAM;IAAS;IACtC;AACF,MAAI,OAAO,QAAS,0BAAyB;AAC7C,SAAO;SACA;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA6B;GAC9E;;;;;;AAOH,eAAsB,qBACrB,IACA,IACA,SACwC;AACxC,KAAI;EAEH,MAAM,SAAS,MAAM,sBADJ,IAAI,mBAAmB,GAAG,EAC6B,OAAO,OAAO,SAAS;AAC9F,OAAI,SAAS,qBAAqB,QAAW;AAE5C,QAAI,CADa,MAAM,KAAK,SAAS,GAAG,CAEvC,QAAO;KACN,SAAS;KACT,OAAO;MAAE,MAAM;MAAa,SAAS,aAAa,GAAG;MAAc;KACnE;AAGF,QADwB,MAAM,KAAK,mBAAmB,GAAG,KACjC,QAAQ,iBAC/B,QAAO;KACN,SAAS;KACT,OAAO;MAAE,MAAM;MAAY,SAAS;MAAsC;KAC1E;;AAKH,OAAI,CAFY,MAAM,KAAK,OAAO,IAAI,SAAS,kBAAkB,MAAM,CAGtE,QAAO;IACN,SAAS;IACT,OAAO,SAAS,mBACb;KAAE,MAAM;KAAY,SAAS;KAAsC,GACnE;KAAE,MAAM;KAAa,SAAS,aAAa,GAAG;KAAc;IAC/D;AAGF,SAAM,gBAAgB,KAAK,GAAG;AAC9B,UAAO;IAAE,SAAS;IAAM,MAAM,EAAE,SAAS,MAAM;IAAE;IAChD;AACF,MAAI,OAAO,QAAS,0BAAyB;AAC7C,SAAO;SACA;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA6B;GAC9E;;;AAQH,SAAS,UAAU,UAAsC;AAKxD,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS,uCARE,SACX,MAAM,GAAG,GAAG,CACZ,KAAK,GAAG,MAAM,GAAG,EAAE,UAAU,SAAS,IAAI,KAAK,CAC/C,KAAK,KAAK;GAMV;EACD;;AAGF,SAAS,QAAQ,WAAuC;AACvD,QAAO,UAAU,KAAK,OAAO;EAC5B,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,aAAa,EAAE;EACf,SAAS,EAAE;EACX,WAAW,EAAE;EACb,EAAE;;AAGJ,MAAM,iBAAiB;;;;AAKvB,eAAe,gBAAgB,IAAqC;AACnE,KAAI;EACH,MAAM,UAAU,IAAI,kBAAkB,GAAG;EAEzC,MAAM,kBAAkB,YADV,QAAQ,MAAM,IAAI,mBAAmB,GAAG,CAAC,gBAAgB,CAAC,CAC9B;AAC1C,QAAM,QAAQ,IAAI,gBAAgB,gBAAgB;UAC1C,OAAO;AACf,UAAQ,MAAM,yCAAyC,MAAM;;;;;;AAO/D,eAAe,mBAAmB,IAAyC;AAC1E,KAAI;EACH,MAAM,UAAU,IAAI,kBAAkB,GAAG;EACzC,MAAM,SAAS,MAAM,QAAQ,IAAc,eAAe;AAC1D,MAAI,WAAW,KAAM,QAAO;AAG5B,QAAM,gBAAgB,GAAG;AACzB,SAAQ,MAAM,QAAQ,IAAc,eAAe,IAAK,EAAE;SACnD;AACP,SAAO,EAAE;;;;;;AAWX,eAAsB,mBACrB,IACA,QACoD;AACpD,KAAI;AAGH,SAAO;GAAE,SAAS;GAAM,MADT,MADF,IAAI,mBAAmB,GAAG,CACb,SAAS,OAAO;GACJ;UAC9B,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS;IAA2B;GAC3E;;;;;;AAOH,eAAsB,sBACrB,IACA,OACmD;AACnD,KAAI;AAGH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,OADlB,MADD,IAAI,mBAAmB,GAAG,CACd,cAAc,MAAM,EACN;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAA+B;GAClF;;;;;;AAOH,eAAsB,oBACrB,IAC0C;AAC1C,KAAI;AAGH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SADhB,MADH,IAAI,mBAAmB,GAAG,CACZ,WAAW,EACG;GAAE;SACpC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA2B;GAC5E;;;;;;AAOH,eAAsB,oBACrB,IACA,WAC0C;AAC1C,KAAI;AAGH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SADhB,MADH,IAAI,mBAAmB,GAAG,CACZ,UAAU,UAAU,EACN;GAAE;SACpC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA2B;GAC5E"}

package/dist/registry/testing.d.mts

@@ -0,0 +1,14 @@
+//#region src/registry/testing.d.ts
+interface RegistryAuthoritativeFixture {
+  publisherDid: string;
+  packageSlug: string;
+  version: string;
+  profileCid: string;
+  releaseCid: string;
+  profile: unknown;
+  release: unknown;
+}
+declare function installRegistryAuthoritativeFixture(input: unknown): void;
+//#endregion
+export { RegistryAuthoritativeFixture, installRegistryAuthoritativeFixture };
+//# sourceMappingURL=testing.d.mts.map

package/dist/registry/testing.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.mts","names":[],"sources":["../../src/registry/testing.ts"],"mappings":";UAOiB,4BAAA;EAChB,YAAA;EACA,WAAA;EACA,OAAA;EACA,UAAA;EACA,UAAA;EACA,OAAA;EACA,OAAA;AAAA;AAAA,iBAOe,mCAAA,CAAoC,KAAA"}

package/dist/registry/testing.mjs

@@ -0,0 +1,255 @@
+import { a as UNSUPPORTED_AUTH_MESSAGE, n as multihashFromBlobCid, o as unsupportedAuthDetails } from "../checksum-Bsi2D9M1.mjs";
+import "../ssrf-Co1GGFZz.mjs";
+import { n as setDefaultAuthoritativeRecordReaderForTesting } from "../authoritative-records-DbqshfKD.mjs";
+import { canonicalizeDeclaredAccess, isPluginSlug, isPluginVersion } from "@emdash-cms/plugin-types";
+import { NSID, PackageProfile, PackageProfileExtension, PackageRelease, PackageReleaseExtension } from "@emdash-cms/registry-lexicons";
+
+//#region ../registry-verification/dist/repository.js
+const TRAILING_SLASHES_RE = /\/+$/;
+/** Canonicalize a signed source repository URL, or return null when it is unsafe. */
+function canonicalizeRepositoryUrl(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.port) return null;
+		let path = url.pathname;
+		if (path !== "/") path = path.replace(TRAILING_SLASHES_RE, "") || "/";
+		return `https://${url.hostname.toLowerCase()}${path}`;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+//#region ../registry-verification/dist/records-entry.js
+const DEFAULT_POLICY = {
+	requireProvenance: false,
+	confirmation: "escalation-only",
+	approvers: []
+};
+/** Validate signed profile/release records without evaluating provenance evidence. */
+async function inspectPackageReleaseRecords(input) {
+	const profile = await parseLexicon(PackageProfile.mainSchema, input.profile);
+	if (!profile) return failed("PROFILE_LEXICON_INVALID", "The package profile is malformed.");
+	if (!isPluginSlug(input.package)) return failed("RELEASE_PACKAGE_MISMATCH", "The expected package slug is invalid.");
+	const expectedProfileId = `at://${input.publisherDid}/${NSID.packageProfile}/${input.package}`;
+	if (profile.id !== expectedProfileId || profile.slug !== void 0 && profile.slug !== input.package) return failed("PROFILE_ID_MISMATCH", "The profile does not match its authoritative record identity.");
+	let profileExtension = null;
+	let repository = null;
+	let policy = {
+		...DEFAULT_POLICY,
+		approvers: []
+	};
+	const rawProfileExtension = isRecord$1(profile.extensions) ? profile.extensions[NSID.packageProfileExtension] : void 0;
+	if (rawProfileExtension === void 0) {
+		if (profile.extensions !== void 0 && !isRecord$1(profile.extensions)) return failed("PROFILE_EXTENSION_INVALID", "The signed repository extension is malformed.");
+	} else {
+		profileExtension = await parseLexicon(PackageProfileExtension.mainSchema, rawProfileExtension);
+		if (!profileExtension) return failed("PROFILE_EXTENSION_INVALID", "The signed repository extension is malformed.");
+		repository = canonicalizeRepositoryUrl(profileExtension.repository);
+		if (!repository || repository !== profileExtension.repository) return failed("PROFILE_REPOSITORY_INVALID", "The signed repository anchor is not canonical HTTPS.");
+		const normalizedPolicy = normalizePolicy(profileExtension.releasePolicy);
+		if (!normalizedPolicy) return failed("PROFILE_POLICY_INVALID", "The signed release policy is invalid.");
+		policy = normalizedPolicy;
+	}
+	const release = await parseLexicon(PackageRelease.mainSchema, input.release);
+	if (!release) return failed("RELEASE_LEXICON_INVALID", "The package release is malformed.");
+	if (release.package !== input.package) return failed("RELEASE_PACKAGE_MISMATCH", "The release package does not match the requested package.");
+	if (!isComparablePluginVersion(release.version)) return failed("RELEASE_VERSION_INVALID", "The release version is not canonical semver.");
+	if (release.version !== input.version) return failed("RELEASE_VERSION_MISMATCH", "The release version does not match the requested version.");
+	if (input.rkey !== `${input.package}:${release.version}`) return failed("RELEASE_RKEY_MISMATCH", "The release record key does not match package and version.");
+	const artifactFailure = validateArtifacts(release);
+	if (artifactFailure) return failed(artifactFailure.code, artifactFailure.message);
+	const authFailure = unsupportedAuth(release);
+	if (authFailure) return failed(authFailure.code, authFailure.message, "not-checked", authFailure.details);
+	if (release.extensions === void 0) return failed("RELEASE_EXTENSION_MISSING", "The EmDash release extension is absent.");
+	if (!isRecord$1(release.extensions)) return failed("RELEASE_EXTENSION_INVALID", "The EmDash release extension is malformed.");
+	const rawReleaseExtension = release.extensions[NSID.packageReleaseExtension];
+	if (rawReleaseExtension === void 0) return failed("RELEASE_EXTENSION_MISSING", "The EmDash release extension is absent.");
+	const releaseExtension = await parseLexicon(PackageReleaseExtension.mainSchema, rawReleaseExtension);
+	if (!releaseExtension) return failed("RELEASE_EXTENSION_INVALID", "The EmDash release extension is malformed.");
+	const declaredAccess = canonicalizeDeclaredAccess(releaseExtension.declaredAccess);
+	return {
+		success: true,
+		status: "inspected",
+		code: "VERIFIED",
+		reasons: [{
+			code: "VERIFIED",
+			message: "The signed package records are valid."
+		}],
+		provenance: { status: "not-checked" },
+		value: {
+			profile,
+			release,
+			profileExtension,
+			releaseExtension,
+			repository,
+			policy,
+			declaredAccess
+		}
+	};
+}
+function normalizePolicy(value) {
+	if (!value) return {
+		...DEFAULT_POLICY,
+		approvers: []
+	};
+	const confirmation = value.confirmation ?? DEFAULT_POLICY.confirmation;
+	if (!isConfirmation(confirmation)) return null;
+	const approvers = value.approvers ?? [];
+	if (new Set(approvers).size !== approvers.length) return null;
+	return {
+		requireProvenance: value.requireProvenance ?? false,
+		confirmation,
+		approvers: [...approvers]
+	};
+}
+function isConfirmation(value) {
+	return value === "always" || value === "escalation-only";
+}
+function isComparablePluginVersion(value) {
+	if (!isPluginVersion(value)) return false;
+	const prereleaseSeparator = value.indexOf("-");
+	return value.slice(0, prereleaseSeparator === -1 ? void 0 : prereleaseSeparator).split(".").every((component) => Number.isSafeInteger(Number(component)));
+}
+function failed(code, message, provenance = "not-checked", details) {
+	return {
+		success: false,
+		status: "failed",
+		code,
+		reasons: [{
+			code,
+			message
+		}],
+		provenance: { status: provenance },
+		...details === void 0 ? {} : { details }
+	};
+}
+function validateArtifacts(release) {
+	const artifacts = [
+		release.artifacts.package,
+		release.artifacts.icon,
+		release.artifacts.banner,
+		...release.artifacts.screenshots ?? []
+	];
+	for (const value of artifacts) {
+		if (value === void 0) continue;
+		if (!isRecord$1(value)) return {
+			code: "RELEASE_LEXICON_INVALID",
+			message: "A release artifact is malformed."
+		};
+		const hasUrl = typeof value.url === "string" && value.url.length > 0;
+		const blob = value.blob;
+		const hasBlob = isRecord$1(blob);
+		if (!hasUrl && !hasBlob) return {
+			code: "RELEASE_ARTIFACT_SOURCE_MISSING",
+			message: "Every release artifact must provide a blob or URL."
+		};
+		if (hasBlob) {
+			const ref = blob.ref;
+			const cid = isRecord$1(ref) ? ref.$link : void 0;
+			if (typeof cid !== "string") return {
+				code: "BLOB_REF_INVALID",
+				message: "The blob reference CID is malformed."
+			};
+			const expected = multihashFromBlobCid(cid);
+			if (!expected.success) return expected.error;
+			if (value.checksum !== expected.value) return {
+				code: "CHECKSUM_MISMATCH",
+				message: "The artifact checksum does not match its blob reference CID."
+			};
+		}
+	}
+	return null;
+}
+function unsupportedAuth(release) {
+	const gated = [
+		release.artifacts.package,
+		release.artifacts.icon,
+		release.artifacts.banner,
+		...release.artifacts.screenshots ?? []
+	].some((artifact) => artifact?.requiresAuth === true);
+	if (release.auth === void 0 && !gated) return null;
+	const details = unsupportedAuthDetails(release.auth);
+	return {
+		code: "AUTH_METHOD_UNSUPPORTED",
+		message: UNSUPPORTED_AUTH_MESSAGE,
+		...details === void 0 ? {} : { details }
+	};
+}
+async function parseLexicon(schema, value) {
+	const result = await schema["~standard"].validate(value);
+	return result.issues ? null : result.value;
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+//#endregion
+//#region src/registry/testing.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function installRegistryAuthoritativeFixture(input) {
+	if (!isRecord(input) || typeof input.publisherDid !== "string" || typeof input.packageSlug !== "string" || typeof input.version !== "string" || typeof input.profileCid !== "string" || typeof input.releaseCid !== "string" || !("profile" in input) || !("release" in input)) throw new TypeError("Registry authoritative fixture is invalid");
+	const fixture = {
+		publisherDid: input.publisherDid,
+		packageSlug: input.packageSlug,
+		version: input.version,
+		profileCid: input.profileCid,
+		releaseCid: input.releaseCid,
+		profile: input.profile,
+		release: input.release
+	};
+	const reader = async (publisherDid, packageSlug, version) => {
+		if (publisherDid !== fixture.publisherDid || packageSlug !== fixture.packageSlug || version !== fixture.version) return {
+			success: false,
+			error: {
+				code: "RECORD_NOT_FOUND",
+				message: "The registry test fixture does not contain this package release."
+			}
+		};
+		const rkey = `${packageSlug}:${version}`;
+		const inspection = await inspectPackageReleaseRecords({
+			publisherDid,
+			package: packageSlug,
+			version,
+			rkey,
+			profileCid: fixture.profileCid,
+			profile: fixture.profile,
+			release: fixture.release
+		});
+		if (!inspection.success) return {
+			success: false,
+			error: {
+				code: inspection.code,
+				message: inspection.reasons[0]?.message ?? "The registry test fixture is invalid."
+			}
+		};
+		return {
+			success: true,
+			value: {
+				publisherDid,
+				packageSlug,
+				version,
+				profile: {
+					uri: `at://${publisherDid}/com.emdashcms.experimental.package.profile/${packageSlug}`,
+					cid: fixture.profileCid,
+					rkey: packageSlug,
+					value: inspection.value.profile
+				},
+				release: {
+					uri: `at://${publisherDid}/com.emdashcms.experimental.package.release/${rkey}`,
+					cid: fixture.releaseCid,
+					rkey,
+					value: inspection.value.release
+				},
+				inspection
+			}
+		};
+	};
+	setDefaultAuthoritativeRecordReaderForTesting(reader);
+}
+
+//#endregion
+export { installRegistryAuthoritativeFixture };
+//# sourceMappingURL=testing.mjs.map

package/dist/registry/testing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.mjs","names":["isRecord"],"sources":["../../../registry-verification/dist/repository.js","../../../registry-verification/dist/records-entry.js","../../src/registry/testing.ts"],"sourcesContent":["//#region src/repository.ts\nconst TRAILING_SLASHES_RE = /\\/+$/;\n/** Canonicalize a signed source repository URL, or return null when it is unsafe. */\nfunction canonicalizeRepositoryUrl(value) {\n\ttry {\n\t\tconst url = new URL(value);\n\t\tif (url.protocol !== \"https:\" || url.username || url.password || url.search || url.hash || url.port) return null;\n\t\tlet path = url.pathname;\n\t\tif (path !== \"/\") path = path.replace(TRAILING_SLASHES_RE, \"\") || \"/\";\n\t\treturn `https://${url.hostname.toLowerCase()}${path}`;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n//#endregion\nexport { canonicalizeRepositoryUrl };\n//# sourceMappingURL=repository.js.map","import { n as unsupportedAuthDetails, t as UNSUPPORTED_AUTH_MESSAGE } from \"./auth-B730dpJ4.js\";\nimport { compareDigestBytes, decodeMultihash, multihashFromBlobCid } from \"./checksum.js\";\nimport { canonicalizeRepositoryUrl } from \"./repository.js\";\nimport { NSID, PackageProfile, PackageProfileExtension, PackageRelease, PackageReleaseExtension } from \"@emdash-cms/registry-lexicons\";\nimport { canonicalizeDeclaredAccess, isPluginSlug, isPluginVersion } from \"@emdash-cms/plugin-types\";\n\n//#region src/records.ts\nconst DEFAULT_POLICY = {\n\trequireProvenance: false,\n\tconfirmation: \"escalation-only\",\n\tapprovers: []\n};\n/** Validate signed profile/release records without evaluating provenance evidence. */\nasync function inspectPackageReleaseRecords(input) {\n\tconst profile = await parseLexicon(PackageProfile.mainSchema, input.profile);\n\tif (!profile) return failed(\"PROFILE_LEXICON_INVALID\", \"The package profile is malformed.\");\n\tif (!isPluginSlug(input.package)) return failed(\"RELEASE_PACKAGE_MISMATCH\", \"The expected package slug is invalid.\");\n\tconst expectedProfileId = `at://${input.publisherDid}/${NSID.packageProfile}/${input.package}`;\n\tif (profile.id !== expectedProfileId || profile.slug !== void 0 && profile.slug !== input.package) return failed(\"PROFILE_ID_MISMATCH\", \"The profile does not match its authoritative record identity.\");\n\tlet profileExtension = null;\n\tlet repository = null;\n\tlet policy = {\n\t\t...DEFAULT_POLICY,\n\t\tapprovers: []\n\t};\n\tconst rawProfileExtension = isRecord(profile.extensions) ? profile.extensions[NSID.packageProfileExtension] : void 0;\n\tif (rawProfileExtension === void 0) {\n\t\tif (profile.extensions !== void 0 && !isRecord(profile.extensions)) return failed(\"PROFILE_EXTENSION_INVALID\", \"The signed repository extension is malformed.\");\n\t} else {\n\t\tprofileExtension = await parseLexicon(PackageProfileExtension.mainSchema, rawProfileExtension);\n\t\tif (!profileExtension) return failed(\"PROFILE_EXTENSION_INVALID\", \"The signed repository extension is malformed.\");\n\t\trepository = canonicalizeRepositoryUrl(profileExtension.repository);\n\t\tif (!repository || repository !== profileExtension.repository) return failed(\"PROFILE_REPOSITORY_INVALID\", \"The signed repository anchor is not canonical HTTPS.\");\n\t\tconst normalizedPolicy = normalizePolicy(profileExtension.releasePolicy);\n\t\tif (!normalizedPolicy) return failed(\"PROFILE_POLICY_INVALID\", \"The signed release policy is invalid.\");\n\t\tpolicy = normalizedPolicy;\n\t}\n\tconst release = await parseLexicon(PackageRelease.mainSchema, input.release);\n\tif (!release) return failed(\"RELEASE_LEXICON_INVALID\", \"The package release is malformed.\");\n\tif (release.package !== input.package) return failed(\"RELEASE_PACKAGE_MISMATCH\", \"The release package does not match the requested package.\");\n\tif (!isComparablePluginVersion(release.version)) return failed(\"RELEASE_VERSION_INVALID\", \"The release version is not canonical semver.\");\n\tif (release.version !== input.version) return failed(\"RELEASE_VERSION_MISMATCH\", \"The release version does not match the requested version.\");\n\tif (input.rkey !== `${input.package}:${release.version}`) return failed(\"RELEASE_RKEY_MISMATCH\", \"The release record key does not match package and version.\");\n\tconst artifactFailure = validateArtifacts(release);\n\tif (artifactFailure) return failed(artifactFailure.code, artifactFailure.message);\n\tconst authFailure = unsupportedAuth(release);\n\tif (authFailure) return failed(authFailure.code, authFailure.message, \"not-checked\", authFailure.details);\n\tif (release.extensions === void 0) return failed(\"RELEASE_EXTENSION_MISSING\", \"The EmDash release extension is absent.\");\n\tif (!isRecord(release.extensions)) return failed(\"RELEASE_EXTENSION_INVALID\", \"The EmDash release extension is malformed.\");\n\tconst rawReleaseExtension = release.extensions[NSID.packageReleaseExtension];\n\tif (rawReleaseExtension === void 0) return failed(\"RELEASE_EXTENSION_MISSING\", \"The EmDash release extension is absent.\");\n\tconst releaseExtension = await parseLexicon(PackageReleaseExtension.mainSchema, rawReleaseExtension);\n\tif (!releaseExtension) return failed(\"RELEASE_EXTENSION_INVALID\", \"The EmDash release extension is malformed.\");\n\tconst declaredAccess = canonicalizeDeclaredAccess(releaseExtension.declaredAccess);\n\treturn {\n\t\tsuccess: true,\n\t\tstatus: \"inspected\",\n\t\tcode: \"VERIFIED\",\n\t\treasons: [{\n\t\t\tcode: \"VERIFIED\",\n\t\t\tmessage: \"The signed package records are valid.\"\n\t\t}],\n\t\tprovenance: { status: \"not-checked\" },\n\t\tvalue: {\n\t\t\tprofile,\n\t\t\trelease,\n\t\t\tprofileExtension,\n\t\t\treleaseExtension,\n\t\t\trepository,\n\t\t\tpolicy,\n\t\t\tdeclaredAccess\n\t\t}\n\t};\n}\nasync function verifyPackageReleaseRecordsInternal(input, defaultVerifier) {\n\tconst inspection = await inspectPackageReleaseRecords(input);\n\tif (!inspection.success) return inspection;\n\tconst context = inspection.value;\n\tconst { policy, release, releaseExtension, repository } = context;\n\tif (!releaseExtension.provenance) {\n\t\tif (policy.requireProvenance) return failed(\"PROVENANCE_REQUIRED\", \"The signed policy requires provenance, but the release has none.\", \"absent-required\");\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tstatus: \"unattested\",\n\t\t\tcode: \"PROVENANCE_ABSENT_OPTIONAL\",\n\t\t\treasons: [{\n\t\t\t\tcode: \"PROVENANCE_ABSENT_OPTIONAL\",\n\t\t\t\tmessage: \"The release has no provenance and the signed policy permits it.\"\n\t\t\t}],\n\t\t\tprovenance: { status: \"absent-optional\" },\n\t\t\tvalue: context\n\t\t};\n\t}\n\tif (repository === null) return failed(\"PROVENANCE_UNVERIFIABLE\", \"The release supplies provenance, but its signed profile has no repository anchor.\", \"failed\");\n\tif (!input.provenance) return failed(\"PROVENANCE_UNVERIFIABLE\", \"The release supplies provenance, but no verification evidence was provided.\", \"failed\");\n\tconst artifactChecksum = decodeMultihash(release.artifacts.package.checksum);\n\tif (!artifactChecksum.success) return failed(artifactChecksum.error.code, artifactChecksum.error.message, \"failed\");\n\tif (!compareDigestBytes(input.provenance.artifactDigest, artifactChecksum.value.digest)) return failed(\"CHECKSUM_MISMATCH\", \"The artifact digest does not match the signed package checksum.\", \"failed\");\n\tconst verifier = input.provenance.verifier ?? defaultVerifier;\n\tif (!verifier) return failed(\"PROVENANCE_UNVERIFIABLE\", \"The supplied provenance verifier is unavailable.\", \"failed\");\n\tlet provenanceResult;\n\ttry {\n\t\tprovenanceResult = await verifier.verify({\n\t\t\tdocument: input.provenance.document,\n\t\t\treference: releaseExtension.provenance,\n\t\t\tartifactDigest: input.provenance.artifactDigest,\n\t\t\tartifactDigests: input.provenance.artifactDigests,\n\t\t\tprofileRepository: repository\n\t\t});\n\t} catch {\n\t\treturn failed(\"PROVENANCE_UNVERIFIABLE\", \"The supplied provenance could not be verified.\", \"failed\");\n\t}\n\tif (!provenanceResult.success) return failed(provenanceResult.error.code, provenanceResult.error.message, \"failed\");\n\treturn {\n\t\tsuccess: true,\n\t\tstatus: \"verified\",\n\t\tcode: \"VERIFIED\",\n\t\treasons: [{\n\t\t\tcode: \"VERIFIED\",\n\t\t\tmessage: \"The signed records and provenance are valid.\"\n\t\t}],\n\t\tprovenance: { status: \"verified\" },\n\t\tvalue: {\n\t\t\t...context,\n\t\t\tverifiedProvenance: provenanceResult.value\n\t\t}\n\t};\n}\nfunction verifyPackageReleaseRecordsWithVerifier(input) {\n\treturn verifyPackageReleaseRecordsInternal(input, null);\n}\nfunction normalizePolicy(value) {\n\tif (!value) return {\n\t\t...DEFAULT_POLICY,\n\t\tapprovers: []\n\t};\n\tconst confirmation = value.confirmation ?? DEFAULT_POLICY.confirmation;\n\tif (!isConfirmation(confirmation)) return null;\n\tconst approvers = value.approvers ?? [];\n\tif (new Set(approvers).size !== approvers.length) return null;\n\treturn {\n\t\trequireProvenance: value.requireProvenance ?? false,\n\t\tconfirmation,\n\t\tapprovers: [...approvers]\n\t};\n}\nfunction isConfirmation(value) {\n\treturn value === \"always\" || value === \"escalation-only\";\n}\nfunction isComparablePluginVersion(value) {\n\tif (!isPluginVersion(value)) return false;\n\tconst prereleaseSeparator = value.indexOf(\"-\");\n\treturn value.slice(0, prereleaseSeparator === -1 ? void 0 : prereleaseSeparator).split(\".\").every((component) => Number.isSafeInteger(Number(component)));\n}\nfunction failed(code, message, provenance = \"not-checked\", details) {\n\treturn {\n\t\tsuccess: false,\n\t\tstatus: \"failed\",\n\t\tcode,\n\t\treasons: [{\n\t\t\tcode,\n\t\t\tmessage\n\t\t}],\n\t\tprovenance: { status: provenance },\n\t\t...details === void 0 ? {} : { details }\n\t};\n}\nfunction validateArtifacts(release) {\n\tconst artifacts = [\n\t\trelease.artifacts.package,\n\t\trelease.artifacts.icon,\n\t\trelease.artifacts.banner,\n\t\t...release.artifacts.screenshots ?? []\n\t];\n\tfor (const value of artifacts) {\n\t\tif (value === void 0) continue;\n\t\tif (!isRecord(value)) return {\n\t\t\tcode: \"RELEASE_LEXICON_INVALID\",\n\t\t\tmessage: \"A release artifact is malformed.\"\n\t\t};\n\t\tconst hasUrl = typeof value.url === \"string\" && value.url.length > 0;\n\t\tconst blob = value.blob;\n\t\tconst hasBlob = isRecord(blob);\n\t\tif (!hasUrl && !hasBlob) return {\n\t\t\tcode: \"RELEASE_ARTIFACT_SOURCE_MISSING\",\n\t\t\tmessage: \"Every release artifact must provide a blob or URL.\"\n\t\t};\n\t\tif (hasBlob) {\n\t\t\tconst ref = blob.ref;\n\t\t\tconst cid = isRecord(ref) ? ref.$link : void 0;\n\t\t\tif (typeof cid !== \"string\") return {\n\t\t\t\tcode: \"BLOB_REF_INVALID\",\n\t\t\t\tmessage: \"The blob reference CID is malformed.\"\n\t\t\t};\n\t\t\tconst expected = multihashFromBlobCid(cid);\n\t\t\tif (!expected.success) return expected.error;\n\t\t\tif (value.checksum !== expected.value) return {\n\t\t\t\tcode: \"CHECKSUM_MISMATCH\",\n\t\t\t\tmessage: \"The artifact checksum does not match its blob reference CID.\"\n\t\t\t};\n\t\t}\n\t}\n\treturn null;\n}\nfunction unsupportedAuth(release) {\n\tconst gated = [\n\t\trelease.artifacts.package,\n\t\trelease.artifacts.icon,\n\t\trelease.artifacts.banner,\n\t\t...release.artifacts.screenshots ?? []\n\t].some((artifact) => artifact?.requiresAuth === true);\n\tif (release.auth === void 0 && !gated) return null;\n\tconst details = unsupportedAuthDetails(release.auth);\n\treturn {\n\t\tcode: \"AUTH_METHOD_UNSUPPORTED\",\n\t\tmessage: UNSUPPORTED_AUTH_MESSAGE,\n\t\t...details === void 0 ? {} : { details }\n\t};\n}\nasync function parseLexicon(schema, value) {\n\tconst result = await schema[\"~standard\"].validate(value);\n\treturn result.issues ? null : result.value;\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n//#endregion\n//#region src/records-entry.ts\nfunction verifyPackageReleaseRecords(input) {\n\treturn verifyPackageReleaseRecordsWithVerifier(input);\n}\n\n//#endregion\nexport { inspectPackageReleaseRecords, verifyPackageReleaseRecords };\n//# sourceMappingURL=records-entry.js.map","import { inspectPackageReleaseRecords } from \"@emdash-cms/registry-verification/records\";\n\nimport {\n\tsetDefaultAuthoritativeRecordReaderForTesting,\n\ttype AuthoritativeRecordReader,\n} from \"./authoritative-records.js\";\n\nexport interface RegistryAuthoritativeFixture {\n\tpublisherDid: string;\n\tpackageSlug: string;\n\tversion: string;\n\tprofileCid: string;\n\treleaseCid: string;\n\tprofile: unknown;\n\trelease: unknown;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function installRegistryAuthoritativeFixture(input: unknown): void {\n\tif (\n\t\t!isRecord(input) ||\n\t\ttypeof input.publisherDid !== \"string\" ||\n\t\ttypeof input.packageSlug !== \"string\" ||\n\t\ttypeof input.version !== \"string\" ||\n\t\ttypeof input.profileCid !== \"string\" ||\n\t\ttypeof input.releaseCid !== \"string\" ||\n\t\t!(\"profile\" in input) ||\n\t\t!(\"release\" in input)\n\t) {\n\t\tthrow new TypeError(\"Registry authoritative fixture is invalid\");\n\t}\n\tconst fixture: RegistryAuthoritativeFixture = {\n\t\tpublisherDid: input.publisherDid,\n\t\tpackageSlug: input.packageSlug,\n\t\tversion: input.version,\n\t\tprofileCid: input.profileCid,\n\t\treleaseCid: input.releaseCid,\n\t\tprofile: input.profile,\n\t\trelease: input.release,\n\t};\n\tconst reader: AuthoritativeRecordReader = async (publisherDid, packageSlug, version) => {\n\t\tif (\n\t\t\tpublisherDid !== fixture.publisherDid ||\n\t\t\tpackageSlug !== fixture.packageSlug ||\n\t\t\tversion !== fixture.version\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"RECORD_NOT_FOUND\",\n\t\t\t\t\tmessage: \"The registry test fixture does not contain this package release.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconst rkey = `${packageSlug}:${version}`;\n\t\tconst inspection = await inspectPackageReleaseRecords({\n\t\t\tpublisherDid,\n\t\t\tpackage: packageSlug,\n\t\t\tversion,\n\t\t\trkey,\n\t\t\tprofileCid: fixture.profileCid,\n\t\t\tprofile: fixture.profile,\n\t\t\trelease: fixture.release,\n\t\t});\n\t\tif (!inspection.success) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: inspection.code,\n\t\t\t\t\tmessage: inspection.reasons[0]?.message ?? \"The registry test fixture is invalid.\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: {\n\t\t\t\tpublisherDid,\n\t\t\t\tpackageSlug,\n\t\t\t\tversion,\n\t\t\t\tprofile: {\n\t\t\t\t\turi: `at://${publisherDid}/com.emdashcms.experimental.package.profile/${packageSlug}`,\n\t\t\t\t\tcid: fixture.profileCid,\n\t\t\t\t\trkey: packageSlug,\n\t\t\t\t\tvalue: inspection.value.profile,\n\t\t\t\t},\n\t\t\t\trelease: {\n\t\t\t\t\turi: `at://${publisherDid}/com.emdashcms.experimental.package.release/${rkey}`,\n\t\t\t\t\tcid: fixture.releaseCid,\n\t\t\t\t\trkey,\n\t\t\t\t\tvalue: inspection.value.release,\n\t\t\t\t},\n\t\t\t\tinspection,\n\t\t\t},\n\t\t};\n\t};\n\tsetDefaultAuthoritativeRecordReaderForTesting(reader);\n}\n"],"mappings":";;;;;;;AACA,MAAM,sBAAsB;;AAE5B,SAAS,0BAA0B,OAAO;AACzC,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,QAAQ,IAAI,KAAM,QAAO;EAC5G,IAAI,OAAO,IAAI;AACf,MAAI,SAAS,IAAK,QAAO,KAAK,QAAQ,qBAAqB,GAAG,IAAI;AAClE,SAAO,WAAW,IAAI,SAAS,aAAa,GAAG;SACxC;AACP,SAAO;;;;;;ACJT,MAAM,iBAAiB;CACtB,mBAAmB;CACnB,cAAc;CACd,WAAW,EAAE;CACb;;AAED,eAAe,6BAA6B,OAAO;CAClD,MAAM,UAAU,MAAM,aAAa,eAAe,YAAY,MAAM,QAAQ;AAC5E,KAAI,CAAC,QAAS,QAAO,OAAO,2BAA2B,oCAAoC;AAC3F,KAAI,CAAC,aAAa,MAAM,QAAQ,CAAE,QAAO,OAAO,4BAA4B,wCAAwC;CACpH,MAAM,oBAAoB,QAAQ,MAAM,aAAa,GAAG,KAAK,eAAe,GAAG,MAAM;AACrF,KAAI,QAAQ,OAAO,qBAAqB,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,MAAM,QAAS,QAAO,OAAO,uBAAuB,gEAAgE;CACxM,IAAI,mBAAmB;CACvB,IAAI,aAAa;CACjB,IAAI,SAAS;EACZ,GAAG;EACH,WAAW,EAAE;EACb;CACD,MAAM,sBAAsBA,WAAS,QAAQ,WAAW,GAAG,QAAQ,WAAW,KAAK,2BAA2B,KAAK;AACnH,KAAI,wBAAwB,KAAK,GAChC;MAAI,QAAQ,eAAe,KAAK,KAAK,CAACA,WAAS,QAAQ,WAAW,CAAE,QAAO,OAAO,6BAA6B,gDAAgD;QACzJ;AACN,qBAAmB,MAAM,aAAa,wBAAwB,YAAY,oBAAoB;AAC9F,MAAI,CAAC,iBAAkB,QAAO,OAAO,6BAA6B,gDAAgD;AAClH,eAAa,0BAA0B,iBAAiB,WAAW;AACnE,MAAI,CAAC,cAAc,eAAe,iBAAiB,WAAY,QAAO,OAAO,8BAA8B,uDAAuD;EAClK,MAAM,mBAAmB,gBAAgB,iBAAiB,cAAc;AACxE,MAAI,CAAC,iBAAkB,QAAO,OAAO,0BAA0B,wCAAwC;AACvG,WAAS;;CAEV,MAAM,UAAU,MAAM,aAAa,eAAe,YAAY,MAAM,QAAQ;AAC5E,KAAI,CAAC,QAAS,QAAO,OAAO,2BAA2B,oCAAoC;AAC3F,KAAI,QAAQ,YAAY,MAAM,QAAS,QAAO,OAAO,4BAA4B,4DAA4D;AAC7I,KAAI,CAAC,0BAA0B,QAAQ,QAAQ,CAAE,QAAO,OAAO,2BAA2B,+CAA+C;AACzI,KAAI,QAAQ,YAAY,MAAM,QAAS,QAAO,OAAO,4BAA4B,4DAA4D;AAC7I,KAAI,MAAM,SAAS,GAAG,MAAM,QAAQ,GAAG,QAAQ,UAAW,QAAO,OAAO,yBAAyB,6DAA6D;CAC9J,MAAM,kBAAkB,kBAAkB,QAAQ;AAClD,KAAI,gBAAiB,QAAO,OAAO,gBAAgB,MAAM,gBAAgB,QAAQ;CACjF,MAAM,cAAc,gBAAgB,QAAQ;AAC5C,KAAI,YAAa,QAAO,OAAO,YAAY,MAAM,YAAY,SAAS,eAAe,YAAY,QAAQ;AACzG,KAAI,QAAQ,eAAe,KAAK,EAAG,QAAO,OAAO,6BAA6B,0CAA0C;AACxH,KAAI,CAACA,WAAS,QAAQ,WAAW,CAAE,QAAO,OAAO,6BAA6B,6CAA6C;CAC3H,MAAM,sBAAsB,QAAQ,WAAW,KAAK;AACpD,KAAI,wBAAwB,KAAK,EAAG,QAAO,OAAO,6BAA6B,0CAA0C;CACzH,MAAM,mBAAmB,MAAM,aAAa,wBAAwB,YAAY,oBAAoB;AACpG,KAAI,CAAC,iBAAkB,QAAO,OAAO,6BAA6B,6CAA6C;CAC/G,MAAM,iBAAiB,2BAA2B,iBAAiB,eAAe;AAClF,QAAO;EACN,SAAS;EACT,QAAQ;EACR,MAAM;EACN,SAAS,CAAC;GACT,MAAM;GACN,SAAS;GACT,CAAC;EACF,YAAY,EAAE,QAAQ,eAAe;EACrC,OAAO;GACN;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACD;;AA2DF,SAAS,gBAAgB,OAAO;AAC/B,KAAI,CAAC,MAAO,QAAO;EAClB,GAAG;EACH,WAAW,EAAE;EACb;CACD,MAAM,eAAe,MAAM,gBAAgB,eAAe;AAC1D,KAAI,CAAC,eAAe,aAAa,CAAE,QAAO;CAC1C,MAAM,YAAY,MAAM,aAAa,EAAE;AACvC,KAAI,IAAI,IAAI,UAAU,CAAC,SAAS,UAAU,OAAQ,QAAO;AACzD,QAAO;EACN,mBAAmB,MAAM,qBAAqB;EAC9C;EACA,WAAW,CAAC,GAAG,UAAU;EACzB;;AAEF,SAAS,eAAe,OAAO;AAC9B,QAAO,UAAU,YAAY,UAAU;;AAExC,SAAS,0BAA0B,OAAO;AACzC,KAAI,CAAC,gBAAgB,MAAM,CAAE,QAAO;CACpC,MAAM,sBAAsB,MAAM,QAAQ,IAAI;AAC9C,QAAO,MAAM,MAAM,GAAG,wBAAwB,KAAK,KAAK,IAAI,oBAAoB,CAAC,MAAM,IAAI,CAAC,OAAO,cAAc,OAAO,cAAc,OAAO,UAAU,CAAC,CAAC;;AAE1J,SAAS,OAAO,MAAM,SAAS,aAAa,eAAe,SAAS;AACnE,QAAO;EACN,SAAS;EACT,QAAQ;EACR;EACA,SAAS,CAAC;GACT;GACA;GACA,CAAC;EACF,YAAY,EAAE,QAAQ,YAAY;EAClC,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;EACxC;;AAEF,SAAS,kBAAkB,SAAS;CACnC,MAAM,YAAY;EACjB,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,GAAG,QAAQ,UAAU,eAAe,EAAE;EACtC;AACD,MAAK,MAAM,SAAS,WAAW;AAC9B,MAAI,UAAU,KAAK,EAAG;AACtB,MAAI,CAACA,WAAS,MAAM,CAAE,QAAO;GAC5B,MAAM;GACN,SAAS;GACT;EACD,MAAM,SAAS,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,SAAS;EACnE,MAAM,OAAO,MAAM;EACnB,MAAM,UAAUA,WAAS,KAAK;AAC9B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO;GAC/B,MAAM;GACN,SAAS;GACT;AACD,MAAI,SAAS;GACZ,MAAM,MAAM,KAAK;GACjB,MAAM,MAAMA,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC7C,OAAI,OAAO,QAAQ,SAAU,QAAO;IACnC,MAAM;IACN,SAAS;IACT;GACD,MAAM,WAAW,qBAAqB,IAAI;AAC1C,OAAI,CAAC,SAAS,QAAS,QAAO,SAAS;AACvC,OAAI,MAAM,aAAa,SAAS,MAAO,QAAO;IAC7C,MAAM;IACN,SAAS;IACT;;;AAGH,QAAO;;AAER,SAAS,gBAAgB,SAAS;CACjC,MAAM,QAAQ;EACb,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,GAAG,QAAQ,UAAU,eAAe,EAAE;EACtC,CAAC,MAAM,aAAa,UAAU,iBAAiB,KAAK;AACrD,KAAI,QAAQ,SAAS,KAAK,KAAK,CAAC,MAAO,QAAO;CAC9C,MAAM,UAAU,uBAAuB,QAAQ,KAAK;AACpD,QAAO;EACN,MAAM;EACN,SAAS;EACT,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;EACxC;;AAEF,eAAe,aAAa,QAAQ,OAAO;CAC1C,MAAM,SAAS,MAAM,OAAO,aAAa,SAAS,MAAM;AACxD,QAAO,OAAO,SAAS,OAAO,OAAO;;AAEtC,SAASA,WAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;;;;AC/M5E,SAAS,SAAS,OAAkD;AACnE,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,oCAAoC,OAAsB;AACzE,KACC,CAAC,SAAS,MAAM,IAChB,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,gBAAgB,YAC7B,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,YAC5B,EAAE,aAAa,UACf,EAAE,aAAa,OAEf,OAAM,IAAI,UAAU,4CAA4C;CAEjE,MAAM,UAAwC;EAC7C,cAAc,MAAM;EACpB,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,YAAY,MAAM;EAClB,SAAS,MAAM;EACf,SAAS,MAAM;EACf;CACD,MAAM,SAAoC,OAAO,cAAc,aAAa,YAAY;AACvF,MACC,iBAAiB,QAAQ,gBACzB,gBAAgB,QAAQ,eACxB,YAAY,QAAQ,QAEpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAEF,MAAM,OAAO,GAAG,YAAY,GAAG;EAC/B,MAAM,aAAa,MAAM,6BAA6B;GACrD;GACA,SAAS;GACT;GACA;GACA,YAAY,QAAQ;GACpB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,CAAC;AACF,MAAI,CAAC,WAAW,QACf,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,WAAW;IACjB,SAAS,WAAW,QAAQ,IAAI,WAAW;IAC3C;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN;IACA;IACA;IACA,SAAS;KACR,KAAK,QAAQ,aAAa,8CAA8C;KACxE,KAAK,QAAQ;KACb,MAAM;KACN,OAAO,WAAW,MAAM;KACxB;IACD,SAAS;KACR,KAAK,QAAQ,aAAa,8CAA8C;KACxE,KAAK,QAAQ;KACb;KACA,OAAO,WAAW,MAAM;KACxB;IACD;IACA;GACD;;AAEF,+CAA8C,OAAO"}