emdash 0.39.0 → 0.40.0

package/dist/secrets-CIi0nFiR.mjs

@@ -0,0 +1,341 @@
+import { t as after } from "./after-PcEvMY_6.mjs";
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { a as encodeBase64url, r as decodeBase64url } from "./base64-DvnNgP7e.mjs";
+import { r as singleFlightCached, t as createSingleFlightCache } from "./single-flight-cache-B5O2qhO1.mjs";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+
+//#region src/config/secrets.ts
+/**
+* Centralized secrets module
+*
+* Single source of truth for site-level cryptographic secrets:
+*
+* - `EMDASH_ENCRYPTION_KEY` — primary key for encrypting plugin secrets at
+*   rest. A comma-separated list supports rotation: the first key encrypts
+*   new values and every listed key remains available for decryption. Format:
+*   `emdash_enc_v1_<43 base64url chars>` representing
+*   32 random bytes. **Operator-provided; never stored in the database.**
+*   Losing the key means losing every secret encrypted with it. Validated
+*   at runtime startup via `validateEncryptionKeyAtStartup` — request-time
+*   resolution does not depend on it, so a malformed key can't 500 the
+*   preview/comment hot paths for unrelated visitors.
+* - `EMDASH_IP_SALT` (optional) / DB-stored `emdash:ip_salt` — site-specific
+*   salt for hashing commenter IPs. Generated and persisted on first need
+*   if no env override is set. Replaces the previous hardcoded
+*   `"emdash-ip-salt"` constant which was correlatable across installs.
+* - `EMDASH_PREVIEW_SECRET` (optional) / DB-stored `emdash:preview_secret` —
+*   HMAC secret for signing preview URLs. Generated and persisted on first
+*   need if no env override is set. Replaces the previous empty-string
+*   fallback which silently disabled preview-token verification.
+*
+* The `EMDASH_AUTH_SECRET` env var is consulted only as a legacy fallback
+* source for the IP salt — that's the only path the prior code actually
+* read it from. New deployments don't need to set it.
+*
+* Modeled on `resolveS3Config` in `../storage/s3.ts`.
+*/
+/** v1 encryption key prefix. Bumping requires a separate KDF version. */
+const ENCRYPTION_KEY_PREFIX = "emdash_enc_v1_";
+/** 32 random bytes encoded as unpadded base64url = 43 chars. */
+const ENCRYPTION_KEY_BODY_LENGTH = 43;
+/**
+* Built from the prefix constant via interpolation. The prefix has no regex
+* metacharacters today (`emdash_enc_v1_`), but escaping is cheap defense
+* against anyone changing the prefix in a future bump without remembering.
+*/
+const ENCRYPTION_KEY_PATTERN = new RegExp(`^${ENCRYPTION_KEY_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[A-Za-z0-9_-]{${ENCRYPTION_KEY_BODY_LENGTH}}$`);
+/** Options-table key for the persisted commenter-IP salt. */
+const IP_SALT_OPTION_KEY = "emdash:ip_salt";
+/** Options-table key for the persisted preview HMAC secret. */
+const PREVIEW_SECRET_OPTION_KEY = "emdash:preview_secret";
+/** Length in bytes of generated values. 32 bytes = 256 bits. */
+const GENERATED_SECRET_BYTES = 32;
+/**
+* Class of validation failures raised by this module.
+*
+* Errors here are operator-facing config problems (malformed key, etc.).
+* They are thrown rather than soft-skipped so misconfiguration fails loudly
+* at startup instead of silently degrading at request time.
+*/
+var EmDashSecretsError = class extends Error {
+	name = "EmDashSecretsError";
+	code;
+	constructor(message, code) {
+		super(message);
+		this.code = code;
+	}
+};
+/**
+* Parse the `EMDASH_ENCRYPTION_KEY` env var.
+*
+* Accepts a single key or a comma-separated list. The first entry is the
+* primary (used for new writes); all entries are tried for decryption,
+* matched by `kid`. Whitespace around commas is tolerated. Empty entries
+* (e.g. trailing comma) are ignored.
+*
+* Returns `null` for an unset/empty input. Throws `EmDashSecretsError` on
+* any malformed entry — silent skipping would mask deployment mistakes.
+*/
+async function parseEncryptionKeys(raw) {
+	if (!raw) return null;
+	const entries = raw.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+	if (entries.length === 0) return null;
+	const parsed = [];
+	const seenKids = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (!ENCRYPTION_KEY_PATTERN.test(entry)) throw new EmDashSecretsError(`EMDASH_ENCRYPTION_KEY entry is malformed (expected "${ENCRYPTION_KEY_PREFIX}" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars). Generate one with \`emdash secrets generate\`.`, "INVALID_ENCRYPTION_KEY");
+		const body = entry.slice(14);
+		const key = decodeBase64urlStrict(body);
+		if (!key) throw new EmDashSecretsError("EMDASH_ENCRYPTION_KEY body is not valid base64url", "INVALID_ENCRYPTION_KEY");
+		if (key.length !== GENERATED_SECRET_BYTES) throw new EmDashSecretsError(`EMDASH_ENCRYPTION_KEY must decode to ${GENERATED_SECRET_BYTES} bytes, got ${key.length}`, "INVALID_ENCRYPTION_KEY");
+		if (encodeBase64url(key) !== body) throw new EmDashSecretsError("EMDASH_ENCRYPTION_KEY body is not canonical base64url. Generate one with `emdash secrets generate`.", "INVALID_ENCRYPTION_KEY");
+		const kid = fingerprintKeyBytes(key);
+		if (seenKids.has(kid)) continue;
+		seenKids.add(kid);
+		parsed.push({
+			kid,
+			key,
+			raw: entry
+		});
+	}
+	return parsed;
+}
+/**
+* Resolve the encryption keys used for plugin secret settings.
+*
+* This is deliberately separate from `resolveSecrets`: plugin settings are
+* not on the anonymous request path, and a missing or malformed key must only
+* fail operations that need encrypted plugin settings.
+*/
+function resolvePluginEncryptionKeys(env) {
+	return parseEncryptionKeys((env ?? readDefaultEnv()).EMDASH_ENCRYPTION_KEY);
+}
+/**
+* Compute the kid for a raw key string (the env-var form including the
+* `emdash_enc_v1_` prefix). Public so the CLI's `fingerprint` subcommand
+* and admin endpoints can show kids without exposing raw keys.
+*
+* The kid is derived from the decoded key **bytes**, not the raw string,
+* so admin endpoints / future rotation flows can match envelope kids
+* against bytes regardless of how the env var was originally spelled.
+*
+* Validates the same shape as `parseEncryptionKeys` — including canonical
+* base64url — so the CLI can't print a kid for a key the runtime would
+* later refuse to load.
+*
+* Throws `EmDashSecretsError` for malformed or non-canonical input.
+*/
+async function fingerprintKey(raw) {
+	if (!ENCRYPTION_KEY_PATTERN.test(raw)) throw new EmDashSecretsError(`Key must match "${ENCRYPTION_KEY_PREFIX}" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars`, "INVALID_ENCRYPTION_KEY");
+	const body = raw.slice(14);
+	const bytes = decodeBase64urlStrict(body);
+	if (!bytes || bytes.length !== GENERATED_SECRET_BYTES || encodeBase64url(bytes) !== body) throw new EmDashSecretsError(`Key body must decode to ${GENERATED_SECRET_BYTES} canonical base64url bytes`, "INVALID_ENCRYPTION_KEY");
+	return fingerprintKeyBytes(bytes);
+}
+/**
+* Internal: kid derivation from raw key bytes. The single source of truth
+* for what makes two keys "the same key" — used by both `parseEncryptionKeys`
+* and `fingerprintKey`.
+*/
+function fingerprintKeyBytes(key) {
+	return encodeHexLowerCase(sha256(key)).slice(0, 8);
+}
+/**
+* Generate a fresh `EMDASH_ENCRYPTION_KEY` value. Used by the CLI's
+* `secrets generate` subcommand and by `create-emdash` scaffolding.
+*/
+function generateEncryptionKey() {
+	const bytes = new Uint8Array(GENERATED_SECRET_BYTES);
+	crypto.getRandomValues(bytes);
+	return `${ENCRYPTION_KEY_PREFIX}${encodeBase64url(bytes)}`;
+}
+/**
+* Resolve site secrets. Reads env vars; for IP salt and preview secret,
+* falls back to a DB-stored value, generating one atomically on first need.
+*
+* Idempotent. Concurrent callers race on the atomic `setIfAbsent`; whichever
+* wins, all callers converge on the same stored value.
+*
+* Note: `EMDASH_ENCRYPTION_KEY` is **not** consumed here. It's validated
+* separately at runtime startup (see `validateEncryptionKeyAtStartup`) so a
+* malformed key can't take down preview-token verification or comment
+* submission for unrelated visitors. Plugin-secret encryption reads it
+* separately through `resolvePluginEncryptionKeys`.
+*/
+async function resolveSecrets(options) {
+	const env = options.env ?? readDefaultEnv();
+	const repo = options._repo ?? new OptionsRepository(options.db);
+	const previewEnvOverride = pickFirstNonEmpty(env.EMDASH_PREVIEW_SECRET, env.PREVIEW_SECRET);
+	const ipSaltEnvOverride = pickFirstNonEmpty(env.EMDASH_IP_SALT, env.EMDASH_AUTH_SECRET, env.AUTH_SECRET);
+	const [previewSecret, ipSalt] = await Promise.all([previewEnvOverride !== null ? Promise.resolve({
+		value: previewEnvOverride,
+		source: "env"
+	}) : ensureGeneratedOption(repo, PREVIEW_SECRET_OPTION_KEY), ipSaltEnvOverride !== null ? Promise.resolve({
+		value: ipSaltEnvOverride,
+		source: "env"
+	}) : ensureGeneratedOption(repo, IP_SALT_OPTION_KEY)]);
+	return {
+		previewSecret: previewSecret.value,
+		previewSecretSource: previewSecret.source,
+		ipSalt: ipSalt.value,
+		ipSaltSource: ipSalt.source
+	};
+}
+/**
+* Validate `EMDASH_ENCRYPTION_KEY` once at runtime startup. Logs an
+* operator-facing error if the value is malformed but does **not** throw —
+* plugin secret-setting operations fail closed at their own boundary when
+* the key is invalid. This way, deployment mistakes surface immediately in
+* startup logs without wedging unrelated request paths such as preview-token
+* verification or comment submission.
+*
+* Returns `true` if the key is unset or valid, `false` if it was malformed.
+*/
+async function validateEncryptionKeyAtStartup(env) {
+	const resolved = env ?? readDefaultEnv();
+	try {
+		await parseEncryptionKeys(resolved.EMDASH_ENCRYPTION_KEY);
+		return true;
+	} catch (error) {
+		if (error instanceof EmDashSecretsError) {
+			console.error(`[emdash] EMDASH_ENCRYPTION_KEY is invalid: ${error.message} Plugin secret settings are unavailable until this is fixed. Generate a fresh key with \`emdash secrets generate\`.`);
+			return false;
+		}
+		throw error;
+	}
+}
+/**
+* Per-DB cache of resolved secrets, keyed by Kysely instance identity.
+*
+* The resolved values are stable for the lifetime of the deployment (env
+* vars don't change without a restart, and DB-stored values are written
+* once via `setIfAbsent`). Caching avoids one options-table read per
+* request on the hot paths (preview verification, comment hashing).
+*
+* Lives on `globalThis` so module-duplication during SSR bundling can't
+* fragment the cache. See `request-context.ts` for the same pattern.
+*
+* Each db gets its own poison-immune single-flight cache (see
+* `utils/single-flight-cache.ts`): the resolved *value* is cached, never an
+* in-flight promise, so a request cancelled mid-resolve can't strand later
+* preview/comment requests on the isolate.
+*/
+const SECRETS_CACHE_KEY = Symbol.for("@emdash-cms/core/secrets-cache@2");
+function getSecretsCache() {
+	const holder = globalThis;
+	let entry = holder[SECRETS_CACHE_KEY];
+	if (!entry) {
+		entry = { cache: /* @__PURE__ */ new WeakMap() };
+		holder[SECRETS_CACHE_KEY] = entry;
+	}
+	return entry.cache;
+}
+/**
+* Memoized wrapper around `resolveSecrets`. Use this from request-time hot
+* paths (preview verification, comment IP hashing) so they don't reread
+* env / re-query options on every request.
+*
+* The cache is keyed by `Kysely` instance, so playground / per-DO / per-test
+* databases each get their own resolution. Concurrent cold callers coalesce
+* onto one resolution via the single-flight lock; a failed resolution
+* propagates to the caller and releases the lock so the next caller retries.
+*/
+function resolveSecretsCached(db) {
+	const caches = getSecretsCache();
+	let cache = caches.get(db);
+	if (!cache) {
+		cache = createSingleFlightCache();
+		caches.set(db, cache);
+	}
+	return singleFlightCached(cache, () => resolveSecrets({ db }), {
+		anchor: (promise) => after(() => promise),
+		ownerTimeoutMs: 3e4
+	});
+}
+/**
+* Read or generate-and-persist a random base64url secret stored in the
+* options table.
+*
+* Concurrency: `setIfAbsent` is an atomic INSERT...ON CONFLICT DO NOTHING.
+* On race, the loser re-reads to converge on the winner's value.
+*/
+async function ensureGeneratedOption(repo, optionKey) {
+	const existing = await repo.get(optionKey);
+	if (typeof existing === "string" && existing.length > 0) return {
+		value: existing,
+		source: "db"
+	};
+	const generated = generateRandomSecret();
+	if (await repo.setIfAbsent(optionKey, generated)) return {
+		value: generated,
+		source: "db"
+	};
+	const winner = await repo.get(optionKey);
+	if (typeof winner !== "string" || winner.length === 0) throw new EmDashSecretsError(`Failed to persist generated secret for "${optionKey}"`, "SECRET_PERSIST_FAILED");
+	return {
+		value: winner,
+		source: "db"
+	};
+}
+/** Generate 32 random bytes encoded as unpadded base64url. */
+function generateRandomSecret() {
+	const bytes = new Uint8Array(GENERATED_SECRET_BYTES);
+	crypto.getRandomValues(bytes);
+	return encodeBase64url(bytes);
+}
+/** Return the first non-empty string from `values`, or `null` if all are empty. */
+function pickFirstNonEmpty(...values) {
+	for (const value of values) if (typeof value === "string" && value.length > 0) return value;
+	return null;
+}
+const BASE64URL_CHARSET_PATTERN = /^[A-Za-z0-9_-]+$/;
+/**
+* Validate base64url shape and decode. Returns `null` on malformed input
+* (rather than throwing) so the caller can produce a config-specific error.
+*/
+function decodeBase64urlStrict(input) {
+	if (!BASE64URL_CHARSET_PATTERN.test(input)) return null;
+	try {
+		return decodeBase64url(input);
+	} catch {
+		return null;
+	}
+}
+/**
+* Default env reader.
+*
+* Reads **only** `process.env`. This module must never reference
+* `import.meta.env`: in an Astro/Vite production build the bare
+* `import.meta.env` expression is statically replaced with an object
+* literal built from the env loaded at build time, which (a) embeds any
+* secret present in `.env` on the build machine into the shipped server
+* bundle, and (b) makes that stale build-time value silently shadow the
+* real runtime secret configured on the deployment platform (e.g. via
+* `wrangler secret put`). See #2139.
+*
+* `process.env` is the runtime source on Node/container deployments and
+* on Cloudflare Workers with Node compatibility (the same source
+* `resolveS3Config` in `../storage/s3.ts` uses). The CLI surface
+* (`cli/commands/secrets.ts`) runs outside the bundle where
+* `process.env` is native.
+*
+* The convention documented in AGENTS.md ("import.meta.env.EMDASH_X ||
+* import.meta.env.X") is for public, build-time config in route
+* handlers; secrets are deliberately excluded from it.
+*/
+function readDefaultEnv() {
+	const proc = typeof process !== "undefined" && process.env ? process.env : {};
+	return {
+		EMDASH_ENCRYPTION_KEY: proc.EMDASH_ENCRYPTION_KEY,
+		EMDASH_PREVIEW_SECRET: proc.EMDASH_PREVIEW_SECRET,
+		PREVIEW_SECRET: proc.PREVIEW_SECRET,
+		EMDASH_IP_SALT: proc.EMDASH_IP_SALT,
+		EMDASH_AUTH_SECRET: proc.EMDASH_AUTH_SECRET,
+		AUTH_SECRET: proc.AUTH_SECRET
+	};
+}
+
+//#endregion
+export { resolveSecretsCached as a, resolvePluginEncryptionKeys as i, fingerprintKey as n, validateEncryptionKeyAtStartup as o, generateEncryptionKey as r, EmDashSecretsError as t };
+//# sourceMappingURL=secrets-CIi0nFiR.mjs.map

package/dist/secrets-CIi0nFiR.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-CIi0nFiR.mjs","names":[],"sources":["../src/config/secrets.ts"],"sourcesContent":["/**\n * Centralized secrets module\n *\n * Single source of truth for site-level cryptographic secrets:\n *\n * - `EMDASH_ENCRYPTION_KEY` — primary key for encrypting plugin secrets at\n *   rest. A comma-separated list supports rotation: the first key encrypts\n *   new values and every listed key remains available for decryption. Format:\n *   `emdash_enc_v1_<43 base64url chars>` representing\n *   32 random bytes. **Operator-provided; never stored in the database.**\n *   Losing the key means losing every secret encrypted with it. Validated\n *   at runtime startup via `validateEncryptionKeyAtStartup` — request-time\n *   resolution does not depend on it, so a malformed key can't 500 the\n *   preview/comment hot paths for unrelated visitors.\n * - `EMDASH_IP_SALT` (optional) / DB-stored `emdash:ip_salt` — site-specific\n *   salt for hashing commenter IPs. Generated and persisted on first need\n *   if no env override is set. Replaces the previous hardcoded\n *   `\"emdash-ip-salt\"` constant which was correlatable across installs.\n * - `EMDASH_PREVIEW_SECRET` (optional) / DB-stored `emdash:preview_secret` —\n *   HMAC secret for signing preview URLs. Generated and persisted on first\n *   need if no env override is set. Replaces the previous empty-string\n *   fallback which silently disabled preview-token verification.\n *\n * The `EMDASH_AUTH_SECRET` env var is consulted only as a legacy fallback\n * source for the IP salt — that's the only path the prior code actually\n * read it from. New deployments don't need to set it.\n *\n * Modeled on `resolveS3Config` in `../storage/s3.ts`.\n */\n\nimport { sha256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\nimport type { Kysely } from \"kysely\";\n\nimport { after } from \"../after.js\";\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\nimport { decodeBase64url, encodeBase64url } from \"../utils/base64.js\";\nimport {\n\tcreateSingleFlightCache,\n\ttype SingleFlightCache,\n\tsingleFlightCached,\n} from \"../utils/single-flight-cache.js\";\n\n/** v1 encryption key prefix. Bumping requires a separate KDF version. */\nexport const ENCRYPTION_KEY_PREFIX = \"emdash_enc_v1_\";\n\n/** 32 random bytes encoded as unpadded base64url = 43 chars. */\nconst ENCRYPTION_KEY_BODY_LENGTH = 43;\n\nconst REGEX_META_PATTERN = /[.*+?^${}()|[\\]\\\\]/g;\n\n/**\n * Built from the prefix constant via interpolation. The prefix has no regex\n * metacharacters today (`emdash_enc_v1_`), but escaping is cheap defense\n * against anyone changing the prefix in a future bump without remembering.\n */\nconst ENCRYPTION_KEY_PATTERN = new RegExp(\n\t`^${ENCRYPTION_KEY_PREFIX.replace(REGEX_META_PATTERN, \"\\\\$&\")}[A-Za-z0-9_-]{${ENCRYPTION_KEY_BODY_LENGTH}}$`,\n);\n\n/** Options-table key for the persisted commenter-IP salt. */\nexport const IP_SALT_OPTION_KEY = \"emdash:ip_salt\";\n\n/** Options-table key for the persisted preview HMAC secret. */\nexport const PREVIEW_SECRET_OPTION_KEY = \"emdash:preview_secret\";\n\n/** Length in bytes of generated values. 32 bytes = 256 bits. */\nconst GENERATED_SECRET_BYTES = 32;\n\n/**\n * A parsed encryption key with its kid (key id) fingerprint.\n *\n * `kid` is the first 8 chars of the SHA-256 hash of the decoded key bytes\n * (lowercase hex), used to tag envelopes so the decryptor can pick the right\n * key during rotation.\n */\nexport interface ParsedEncryptionKey {\n\t/** 8-char lowercase hex fingerprint derived from the decoded key bytes. */\n\tkid: string;\n\t/** The 32 raw key bytes, ready for `crypto.subtle.importKey`. */\n\tkey: Uint8Array;\n\t/** The original env-var-formatted string (kept for re-emit; never log). */\n\traw: string;\n}\n\n/** Resolved site secrets. */\nexport interface ResolvedSecrets {\n\t/** HMAC secret for preview URLs. Always non-empty after resolution. */\n\tpreviewSecret: string;\n\t/**\n\t * Source of `previewSecret`. Useful for diagnostics; never expose the\n\t * value itself, only the source.\n\t */\n\tpreviewSecretSource: \"env\" | \"db\";\n\t/** Salt for hashing commenter IPs. Always non-empty after resolution. */\n\tipSalt: string;\n\t/** Source of `ipSalt`. */\n\tipSaltSource: \"env\" | \"db\";\n}\n\n/** Inputs for `resolveSecrets`. */\nexport interface ResolveSecretsOptions {\n\t/**\n\t * The Kysely DB used to persist (and read back) generated salt/preview\n\t * secret values. Required — these values must be stable across requests\n\t * within a deployment.\n\t */\n\tdb: Kysely<Database>;\n\t/**\n\t * Optional explicit env override map. When omitted, falls back to\n\t * `process.env` via `readDefaultEnv` below (never `import.meta.env` —\n\t * see that function's docstring). Tests pass an explicit map to avoid\n\t * leaking process state.\n\t */\n\tenv?: SecretsEnv;\n\t/**\n\t * @internal Test seam: inject a custom OptionsRepository to exercise\n\t * the lost-race re-read branch. Production callers never set this.\n\t */\n\t_repo?: OptionsRepository;\n}\n\n/** Environment-variable shape consulted by the resolver. */\nexport interface SecretsEnv {\n\t/**\n\t * Read by `validateEncryptionKeyAtStartup` and the plugin-secret encryption\n\t * layer. **Not** consulted by `resolveSecrets`,\n\t * so a malformed value can't 500 the preview/comment hot paths.\n\t */\n\tEMDASH_ENCRYPTION_KEY?: string;\n\tEMDASH_PREVIEW_SECRET?: string;\n\t/** Legacy alias; new docs point at EMDASH_PREVIEW_SECRET. */\n\tPREVIEW_SECRET?: string;\n\tEMDASH_IP_SALT?: string;\n\t/**\n\t * Legacy fallback. Prior code derived the IP salt from\n\t * `EMDASH_AUTH_SECRET || AUTH_SECRET || \"emdash-ip-salt\"`. We preserve\n\t * the env-var fallback (so existing installs keep their stable salt)\n\t * but no longer read it from `import.meta.env` in route handlers.\n\t */\n\tEMDASH_AUTH_SECRET?: string;\n\t/** Legacy alias. */\n\tAUTH_SECRET?: string;\n}\n\n/**\n * Class of validation failures raised by this module.\n *\n * Errors here are operator-facing config problems (malformed key, etc.).\n * They are thrown rather than soft-skipped so misconfiguration fails loudly\n * at startup instead of silently degrading at request time.\n */\nexport class EmDashSecretsError extends Error {\n\toverride readonly name = \"EmDashSecretsError\";\n\treadonly code: string;\n\n\tconstructor(message: string, code: string) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Encryption key parsing\n// ---------------------------------------------------------------------------\n\n/**\n * Parse the `EMDASH_ENCRYPTION_KEY` env var.\n *\n * Accepts a single key or a comma-separated list. The first entry is the\n * primary (used for new writes); all entries are tried for decryption,\n * matched by `kid`. Whitespace around commas is tolerated. Empty entries\n * (e.g. trailing comma) are ignored.\n *\n * Returns `null` for an unset/empty input. Throws `EmDashSecretsError` on\n * any malformed entry — silent skipping would mask deployment mistakes.\n */\nexport async function parseEncryptionKeys(\n\traw: string | undefined,\n): Promise<ParsedEncryptionKey[] | null> {\n\tif (!raw) return null;\n\n\tconst entries = raw\n\t\t.split(\",\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n\n\tif (entries.length === 0) return null;\n\n\tconst parsed: ParsedEncryptionKey[] = [];\n\tconst seenKids = new Set<string>();\n\n\tfor (const entry of entries) {\n\t\tif (!ENCRYPTION_KEY_PATTERN.test(entry)) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t`EMDASH_ENCRYPTION_KEY entry is malformed (expected \"${ENCRYPTION_KEY_PREFIX}\" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars). Generate one with \\`emdash secrets generate\\`.`,\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\n\t\tconst body = entry.slice(ENCRYPTION_KEY_PREFIX.length);\n\t\tconst key = decodeBase64urlStrict(body);\n\t\tif (!key) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t\"EMDASH_ENCRYPTION_KEY body is not valid base64url\",\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\t\tif (key.length !== GENERATED_SECRET_BYTES) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t`EMDASH_ENCRYPTION_KEY must decode to ${GENERATED_SECRET_BYTES} bytes, got ${key.length}`,\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\n\t\t// Reject non-canonical base64url. 43 chars decode to 32 bytes but\n\t\t// the last char only carries 2 information bits — multiple raw\n\t\t// strings can decode to the same bytes. Forcing canonical form\n\t\t// guarantees `kid` (derived from bytes) is stable per key\n\t\t// material, regardless of how the operator pasted it.\n\t\tconst canonical = encodeBase64url(key);\n\t\tif (canonical !== body) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t\"EMDASH_ENCRYPTION_KEY body is not canonical base64url. Generate one with `emdash secrets generate`.\",\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\n\t\tconst kid = fingerprintKeyBytes(key);\n\t\tif (seenKids.has(kid)) {\n\t\t\t// Duplicate keys are user error (paste mistake during rotation).\n\t\t\t// We dedupe rather than throw — the rotation flow is forgiving.\n\t\t\tcontinue;\n\t\t}\n\t\tseenKids.add(kid);\n\t\tparsed.push({ kid, key, raw: entry });\n\t}\n\n\t// `parsed` always has at least one entry here: `entries` was non-empty\n\t// after filtering, the loop runs at least once, the first iteration\n\t// always passes the empty-`seenKids` check.\n\treturn parsed;\n}\n\n/**\n * Resolve the encryption keys used for plugin secret settings.\n *\n * This is deliberately separate from `resolveSecrets`: plugin settings are\n * not on the anonymous request path, and a missing or malformed key must only\n * fail operations that need encrypted plugin settings.\n */\nexport function resolvePluginEncryptionKeys(\n\tenv?: SecretsEnv,\n): Promise<ParsedEncryptionKey[] | null> {\n\treturn parseEncryptionKeys((env ?? readDefaultEnv()).EMDASH_ENCRYPTION_KEY);\n}\n\n/**\n * Compute the kid for a raw key string (the env-var form including the\n * `emdash_enc_v1_` prefix). Public so the CLI's `fingerprint` subcommand\n * and admin endpoints can show kids without exposing raw keys.\n *\n * The kid is derived from the decoded key **bytes**, not the raw string,\n * so admin endpoints / future rotation flows can match envelope kids\n * against bytes regardless of how the env var was originally spelled.\n *\n * Validates the same shape as `parseEncryptionKeys` — including canonical\n * base64url — so the CLI can't print a kid for a key the runtime would\n * later refuse to load.\n *\n * Throws `EmDashSecretsError` for malformed or non-canonical input.\n */\nexport async function fingerprintKey(raw: string): Promise<string> {\n\tif (!ENCRYPTION_KEY_PATTERN.test(raw)) {\n\t\tthrow new EmDashSecretsError(\n\t\t\t`Key must match \"${ENCRYPTION_KEY_PREFIX}\" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars`,\n\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t);\n\t}\n\tconst body = raw.slice(ENCRYPTION_KEY_PREFIX.length);\n\tconst bytes = decodeBase64urlStrict(body);\n\tif (!bytes || bytes.length !== GENERATED_SECRET_BYTES || encodeBase64url(bytes) !== body) {\n\t\tthrow new EmDashSecretsError(\n\t\t\t`Key body must decode to ${GENERATED_SECRET_BYTES} canonical base64url bytes`,\n\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t);\n\t}\n\treturn fingerprintKeyBytes(bytes);\n}\n\n/**\n * Internal: kid derivation from raw key bytes. The single source of truth\n * for what makes two keys \"the same key\" — used by both `parseEncryptionKeys`\n * and `fingerprintKey`.\n */\nfunction fingerprintKeyBytes(key: Uint8Array): string {\n\treturn encodeHexLowerCase(sha256(key)).slice(0, 8);\n}\n\n/**\n * Generate a fresh `EMDASH_ENCRYPTION_KEY` value. Used by the CLI's\n * `secrets generate` subcommand and by `create-emdash` scaffolding.\n */\nexport function generateEncryptionKey(): string {\n\tconst bytes = new Uint8Array(GENERATED_SECRET_BYTES);\n\tcrypto.getRandomValues(bytes);\n\treturn `${ENCRYPTION_KEY_PREFIX}${encodeBase64url(bytes)}`;\n}\n\n// ---------------------------------------------------------------------------\n// Site-secret resolution (DB-backed with env override)\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve site secrets. Reads env vars; for IP salt and preview secret,\n * falls back to a DB-stored value, generating one atomically on first need.\n *\n * Idempotent. Concurrent callers race on the atomic `setIfAbsent`; whichever\n * wins, all callers converge on the same stored value.\n *\n * Note: `EMDASH_ENCRYPTION_KEY` is **not** consumed here. It's validated\n * separately at runtime startup (see `validateEncryptionKeyAtStartup`) so a\n * malformed key can't take down preview-token verification or comment\n * submission for unrelated visitors. Plugin-secret encryption reads it\n * separately through `resolvePluginEncryptionKeys`.\n */\nexport async function resolveSecrets(options: ResolveSecretsOptions): Promise<ResolvedSecrets> {\n\tconst env = options.env ?? readDefaultEnv();\n\tconst repo = options._repo ?? new OptionsRepository(options.db);\n\n\tconst previewEnvOverride = pickFirstNonEmpty(env.EMDASH_PREVIEW_SECRET, env.PREVIEW_SECRET);\n\tconst ipSaltEnvOverride = pickFirstNonEmpty(\n\t\tenv.EMDASH_IP_SALT,\n\t\tenv.EMDASH_AUTH_SECRET,\n\t\tenv.AUTH_SECRET,\n\t);\n\n\tconst [previewSecret, ipSalt] = await Promise.all([\n\t\tpreviewEnvOverride !== null\n\t\t\t? Promise.resolve({ value: previewEnvOverride, source: \"env\" as const })\n\t\t\t: ensureGeneratedOption(repo, PREVIEW_SECRET_OPTION_KEY),\n\t\tipSaltEnvOverride !== null\n\t\t\t? Promise.resolve({ value: ipSaltEnvOverride, source: \"env\" as const })\n\t\t\t: ensureGeneratedOption(repo, IP_SALT_OPTION_KEY),\n\t]);\n\n\treturn {\n\t\tpreviewSecret: previewSecret.value,\n\t\tpreviewSecretSource: previewSecret.source,\n\t\tipSalt: ipSalt.value,\n\t\tipSaltSource: ipSalt.source,\n\t};\n}\n\n/**\n * Validate `EMDASH_ENCRYPTION_KEY` once at runtime startup. Logs an\n * operator-facing error if the value is malformed but does **not** throw —\n * plugin secret-setting operations fail closed at their own boundary when\n * the key is invalid. This way, deployment mistakes surface immediately in\n * startup logs without wedging unrelated request paths such as preview-token\n * verification or comment submission.\n *\n * Returns `true` if the key is unset or valid, `false` if it was malformed.\n */\nexport async function validateEncryptionKeyAtStartup(env?: SecretsEnv): Promise<boolean> {\n\tconst resolved = env ?? readDefaultEnv();\n\ttry {\n\t\tawait parseEncryptionKeys(resolved.EMDASH_ENCRYPTION_KEY);\n\t\treturn true;\n\t} catch (error) {\n\t\tif (error instanceof EmDashSecretsError) {\n\t\t\tconsole.error(\n\t\t\t\t`[emdash] EMDASH_ENCRYPTION_KEY is invalid: ${error.message} ` +\n\t\t\t\t\t\"Plugin secret settings are unavailable until this is fixed. \" +\n\t\t\t\t\t\"Generate a fresh key with `emdash secrets generate`.\",\n\t\t\t);\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Per-DB cache of resolved secrets, keyed by Kysely instance identity.\n *\n * The resolved values are stable for the lifetime of the deployment (env\n * vars don't change without a restart, and DB-stored values are written\n * once via `setIfAbsent`). Caching avoids one options-table read per\n * request on the hot paths (preview verification, comment hashing).\n *\n * Lives on `globalThis` so module-duplication during SSR bundling can't\n * fragment the cache. See `request-context.ts` for the same pattern.\n *\n * Each db gets its own poison-immune single-flight cache (see\n * `utils/single-flight-cache.ts`): the resolved *value* is cached, never an\n * in-flight promise, so a request cancelled mid-resolve can't strand later\n * preview/comment requests on the isolate.\n */\n// Versioned to prevent cache fragmentation if `ResolvedSecrets`'s shape\n// ever changes. Bump the suffix on incompatible changes so a co-resident\n// older build doesn't read a newer-shape value. Bumped to @2 when the cached\n// value changed from a bare promise to a single-flight cache.\nconst SECRETS_CACHE_KEY = Symbol.for(\"@emdash-cms/core/secrets-cache@2\");\n\ninterface SecretsCacheHolder {\n\tcache: WeakMap<Kysely<Database>, SingleFlightCache<ResolvedSecrets>>;\n}\n\nfunction getSecretsCache(): WeakMap<Kysely<Database>, SingleFlightCache<ResolvedSecrets>> {\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern\n\tconst holder = globalThis as Record<symbol, SecretsCacheHolder | undefined>;\n\tlet entry = holder[SECRETS_CACHE_KEY];\n\tif (!entry) {\n\t\tentry = { cache: new WeakMap() };\n\t\tholder[SECRETS_CACHE_KEY] = entry;\n\t}\n\treturn entry.cache;\n}\n\n/**\n * Memoized wrapper around `resolveSecrets`. Use this from request-time hot\n * paths (preview verification, comment IP hashing) so they don't reread\n * env / re-query options on every request.\n *\n * The cache is keyed by `Kysely` instance, so playground / per-DO / per-test\n * databases each get their own resolution. Concurrent cold callers coalesce\n * onto one resolution via the single-flight lock; a failed resolution\n * propagates to the caller and releases the lock so the next caller retries.\n */\nexport function resolveSecretsCached(db: Kysely<Database>): Promise<ResolvedSecrets> {\n\tconst caches = getSecretsCache();\n\tlet cache = caches.get(db);\n\tif (!cache) {\n\t\tcache = createSingleFlightCache<ResolvedSecrets>();\n\t\tcaches.set(db, cache);\n\t}\n\treturn singleFlightCached(cache, () => resolveSecrets({ db }), {\n\t\tanchor: (promise) => after(() => promise),\n\t\townerTimeoutMs: 30_000,\n\t});\n}\n\n/**\n * Test-only helper: clear the secrets cache. Tests that mutate env between\n * cases need this so a stale resolution doesn't leak across cases.\n *\n * @internal\n */\nexport function _clearSecretsCacheForTesting(): void {\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern\n\tconst holder = globalThis as Record<symbol, SecretsCacheHolder | undefined>;\n\tholder[SECRETS_CACHE_KEY] = undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Internals\n// ---------------------------------------------------------------------------\n\n/**\n * Read or generate-and-persist a random base64url secret stored in the\n * options table.\n *\n * Concurrency: `setIfAbsent` is an atomic INSERT...ON CONFLICT DO NOTHING.\n * On race, the loser re-reads to converge on the winner's value.\n */\nasync function ensureGeneratedOption(\n\trepo: OptionsRepository,\n\toptionKey: string,\n): Promise<{ value: string; source: \"db\" }> {\n\tconst existing = await repo.get<string>(optionKey);\n\tif (typeof existing === \"string\" && existing.length > 0) {\n\t\treturn { value: existing, source: \"db\" };\n\t}\n\n\tconst generated = generateRandomSecret();\n\tconst inserted = await repo.setIfAbsent(optionKey, generated);\n\tif (inserted) {\n\t\treturn { value: generated, source: \"db\" };\n\t}\n\n\t// Lost the race — another process inserted first. Re-read to pick up\n\t// the winner. If the row is somehow still missing or empty, treat that\n\t// as a real error rather than looping.\n\tconst winner = await repo.get<string>(optionKey);\n\tif (typeof winner !== \"string\" || winner.length === 0) {\n\t\tthrow new EmDashSecretsError(\n\t\t\t`Failed to persist generated secret for \"${optionKey}\"`,\n\t\t\t\"SECRET_PERSIST_FAILED\",\n\t\t);\n\t}\n\treturn { value: winner, source: \"db\" };\n}\n\n/** Generate 32 random bytes encoded as unpadded base64url. */\nfunction generateRandomSecret(): string {\n\tconst bytes = new Uint8Array(GENERATED_SECRET_BYTES);\n\tcrypto.getRandomValues(bytes);\n\treturn encodeBase64url(bytes);\n}\n\n/** Return the first non-empty string from `values`, or `null` if all are empty. */\nfunction pickFirstNonEmpty(...values: (string | undefined)[]): string | null {\n\tfor (const value of values) {\n\t\tif (typeof value === \"string\" && value.length > 0) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn null;\n}\n\nconst BASE64URL_CHARSET_PATTERN = /^[A-Za-z0-9_-]+$/;\n\n/**\n * Validate base64url shape and decode. Returns `null` on malformed input\n * (rather than throwing) so the caller can produce a config-specific error.\n */\nfunction decodeBase64urlStrict(input: string): Uint8Array | null {\n\t// `decodeBase64url` accepts padded input too; the env-var format is\n\t// strictly unpadded base64url, so we do a charset check first.\n\tif (!BASE64URL_CHARSET_PATTERN.test(input)) return null;\n\ttry {\n\t\treturn decodeBase64url(input);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Default env reader.\n *\n * Reads **only** `process.env`. This module must never reference\n * `import.meta.env`: in an Astro/Vite production build the bare\n * `import.meta.env` expression is statically replaced with an object\n * literal built from the env loaded at build time, which (a) embeds any\n * secret present in `.env` on the build machine into the shipped server\n * bundle, and (b) makes that stale build-time value silently shadow the\n * real runtime secret configured on the deployment platform (e.g. via\n * `wrangler secret put`). See #2139.\n *\n * `process.env` is the runtime source on Node/container deployments and\n * on Cloudflare Workers with Node compatibility (the same source\n * `resolveS3Config` in `../storage/s3.ts` uses). The CLI surface\n * (`cli/commands/secrets.ts`) runs outside the bundle where\n * `process.env` is native.\n *\n * The convention documented in AGENTS.md (\"import.meta.env.EMDASH_X ||\n * import.meta.env.X\") is for public, build-time config in route\n * handlers; secrets are deliberately excluded from it.\n */\nfunction readDefaultEnv(): SecretsEnv {\n\tconst proc = typeof process !== \"undefined\" && process.env ? process.env : {};\n\n\treturn {\n\t\tEMDASH_ENCRYPTION_KEY: proc.EMDASH_ENCRYPTION_KEY,\n\t\tEMDASH_PREVIEW_SECRET: proc.EMDASH_PREVIEW_SECRET,\n\t\tPREVIEW_SECRET: proc.PREVIEW_SECRET,\n\t\tEMDASH_IP_SALT: proc.EMDASH_IP_SALT,\n\t\tEMDASH_AUTH_SECRET: proc.EMDASH_AUTH_SECRET,\n\t\tAUTH_SECRET: proc.AUTH_SECRET,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,wBAAwB;;AAGrC,MAAM,6BAA6B;;;;;;AASnC,MAAM,yBAAyB,IAAI,OAClC,IAAI,sBAAsB,QARA,uBAQ4B,OAAO,CAAC,gBAAgB,2BAA2B,IACzG;;AAGD,MAAa,qBAAqB;;AAGlC,MAAa,4BAA4B;;AAGzC,MAAM,yBAAyB;;;;;;;;AAqF/B,IAAa,qBAAb,cAAwC,MAAM;CAC7C,AAAkB,OAAO;CACzB,AAAS;CAET,YAAY,SAAiB,MAAc;AAC1C,QAAM,QAAQ;AACd,OAAK,OAAO;;;;;;;;;;;;;;AAmBd,eAAsB,oBACrB,KACwC;AACxC,KAAI,CAAC,IAAK,QAAO;CAEjB,MAAM,UAAU,IACd,MAAM,IAAI,CACV,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,EAAE;AAErC,KAAI,QAAQ,WAAW,EAAG,QAAO;CAEjC,MAAM,SAAgC,EAAE;CACxC,MAAM,2BAAW,IAAI,KAAa;AAElC,MAAK,MAAM,SAAS,SAAS;AAC5B,MAAI,CAAC,uBAAuB,KAAK,MAAM,CACtC,OAAM,IAAI,mBACT,uDAAuD,sBAAsB,gBAAgB,2BAA2B,oEACxH,yBACA;EAGF,MAAM,OAAO,MAAM,MAAM,GAA6B;EACtD,MAAM,MAAM,sBAAsB,KAAK;AACvC,MAAI,CAAC,IACJ,OAAM,IAAI,mBACT,qDACA,yBACA;AAEF,MAAI,IAAI,WAAW,uBAClB,OAAM,IAAI,mBACT,wCAAwC,uBAAuB,cAAc,IAAI,UACjF,yBACA;AASF,MADkB,gBAAgB,IAAI,KACpB,KACjB,OAAM,IAAI,mBACT,uGACA,yBACA;EAGF,MAAM,MAAM,oBAAoB,IAAI;AACpC,MAAI,SAAS,IAAI,IAAI,CAGpB;AAED,WAAS,IAAI,IAAI;AACjB,SAAO,KAAK;GAAE;GAAK;GAAK,KAAK;GAAO,CAAC;;AAMtC,QAAO;;;;;;;;;AAUR,SAAgB,4BACf,KACwC;AACxC,QAAO,qBAAqB,OAAO,gBAAgB,EAAE,sBAAsB;;;;;;;;;;;;;;;;;AAkB5E,eAAsB,eAAe,KAA8B;AAClE,KAAI,CAAC,uBAAuB,KAAK,IAAI,CACpC,OAAM,IAAI,mBACT,mBAAmB,sBAAsB,gBAAgB,2BAA2B,mBACpF,yBACA;CAEF,MAAM,OAAO,IAAI,MAAM,GAA6B;CACpD,MAAM,QAAQ,sBAAsB,KAAK;AACzC,KAAI,CAAC,SAAS,MAAM,WAAW,0BAA0B,gBAAgB,MAAM,KAAK,KACnF,OAAM,IAAI,mBACT,2BAA2B,uBAAuB,6BAClD,yBACA;AAEF,QAAO,oBAAoB,MAAM;;;;;;;AAQlC,SAAS,oBAAoB,KAAyB;AACrD,QAAO,mBAAmB,OAAO,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;;;;;;AAOnD,SAAgB,wBAAgC;CAC/C,MAAM,QAAQ,IAAI,WAAW,uBAAuB;AACpD,QAAO,gBAAgB,MAAM;AAC7B,QAAO,GAAG,wBAAwB,gBAAgB,MAAM;;;;;;;;;;;;;;;AAoBzD,eAAsB,eAAe,SAA0D;CAC9F,MAAM,MAAM,QAAQ,OAAO,gBAAgB;CAC3C,MAAM,OAAO,QAAQ,SAAS,IAAI,kBAAkB,QAAQ,GAAG;CAE/D,MAAM,qBAAqB,kBAAkB,IAAI,uBAAuB,IAAI,eAAe;CAC3F,MAAM,oBAAoB,kBACzB,IAAI,gBACJ,IAAI,oBACJ,IAAI,YACJ;CAED,MAAM,CAAC,eAAe,UAAU,MAAM,QAAQ,IAAI,CACjD,uBAAuB,OACpB,QAAQ,QAAQ;EAAE,OAAO;EAAoB,QAAQ;EAAgB,CAAC,GACtE,sBAAsB,MAAM,0BAA0B,EACzD,sBAAsB,OACnB,QAAQ,QAAQ;EAAE,OAAO;EAAmB,QAAQ;EAAgB,CAAC,GACrE,sBAAsB,MAAM,mBAAmB,CAClD,CAAC;AAEF,QAAO;EACN,eAAe,cAAc;EAC7B,qBAAqB,cAAc;EACnC,QAAQ,OAAO;EACf,cAAc,OAAO;EACrB;;;;;;;;;;;;AAaF,eAAsB,+BAA+B,KAAoC;CACxF,MAAM,WAAW,OAAO,gBAAgB;AACxC,KAAI;AACH,QAAM,oBAAoB,SAAS,sBAAsB;AACzD,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,oBAAoB;AACxC,WAAQ,MACP,8CAA8C,MAAM,QAAQ,qHAG5D;AACD,UAAO;;AAER,QAAM;;;;;;;;;;;;;;;;;;;AAwBR,MAAM,oBAAoB,OAAO,IAAI,mCAAmC;AAMxE,SAAS,kBAAiF;CAEzF,MAAM,SAAS;CACf,IAAI,QAAQ,OAAO;AACnB,KAAI,CAAC,OAAO;AACX,UAAQ,EAAE,uBAAO,IAAI,SAAS,EAAE;AAChC,SAAO,qBAAqB;;AAE7B,QAAO,MAAM;;;;;;;;;;;;AAad,SAAgB,qBAAqB,IAAgD;CACpF,MAAM,SAAS,iBAAiB;CAChC,IAAI,QAAQ,OAAO,IAAI,GAAG;AAC1B,KAAI,CAAC,OAAO;AACX,UAAQ,yBAA0C;AAClD,SAAO,IAAI,IAAI,MAAM;;AAEtB,QAAO,mBAAmB,aAAa,eAAe,EAAE,IAAI,CAAC,EAAE;EAC9D,SAAS,YAAY,YAAY,QAAQ;EACzC,gBAAgB;EAChB,CAAC;;;;;;;;;AA0BH,eAAe,sBACd,MACA,WAC2C;CAC3C,MAAM,WAAW,MAAM,KAAK,IAAY,UAAU;AAClD,KAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EACrD,QAAO;EAAE,OAAO;EAAU,QAAQ;EAAM;CAGzC,MAAM,YAAY,sBAAsB;AAExC,KADiB,MAAM,KAAK,YAAY,WAAW,UAAU,CAE5D,QAAO;EAAE,OAAO;EAAW,QAAQ;EAAM;CAM1C,MAAM,SAAS,MAAM,KAAK,IAAY,UAAU;AAChD,KAAI,OAAO,WAAW,YAAY,OAAO,WAAW,EACnD,OAAM,IAAI,mBACT,2CAA2C,UAAU,IACrD,wBACA;AAEF,QAAO;EAAE,OAAO;EAAQ,QAAQ;EAAM;;;AAIvC,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,uBAAuB;AACpD,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;;AAI9B,SAAS,kBAAkB,GAAG,QAA+C;AAC5E,MAAK,MAAM,SAAS,OACnB,KAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC/C,QAAO;AAGT,QAAO;;AAGR,MAAM,4BAA4B;;;;;AAMlC,SAAS,sBAAsB,OAAkC;AAGhE,KAAI,CAAC,0BAA0B,KAAK,MAAM,CAAE,QAAO;AACnD,KAAI;AACH,SAAO,gBAAgB,MAAM;SACtB;AACP,SAAO;;;;;;;;;;;;;;;;;;;;;;;;;AA0BT,SAAS,iBAA6B;CACrC,MAAM,OAAO,OAAO,YAAY,eAAe,QAAQ,MAAM,QAAQ,MAAM,EAAE;AAE7E,QAAO;EACN,uBAAuB,KAAK;EAC5B,uBAAuB,KAAK;EAC5B,gBAAgB,KAAK;EACrB,gBAAgB,KAAK;EACrB,oBAAoB,KAAK;EACzB,aAAa,KAAK;EAClB"}