emdash 0.39.0 → 0.40.0

package/dist/manifest-schema-Bkh8SeHd.mjs

@@ -1,491 +0,0 @@
-import { z } from "zod";
-import { Permissions } from "@emdash-cms/auth";
-import { capabilitiesToDeclaredAccess, declaredAccessToCapabilities, isJsonPostRouteContract, manifestRouteEntrySchema, normalizeManifestRoute, routeNameSchema } from "@emdash-cms/plugin-types";
-
-//#region src/plugins/manifest-schema.ts
-/**
-* Zod schema for PluginManifest validation
-*
-* Used to validate manifest.json from plugin bundles at every parse site:
-* - Client-side download (marketplace.ts extractBundle)
-* - R2 load (api/handlers/marketplace.ts loadBundleFromR2)
-* - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)
-* - Marketplace ingest extends this with publishing-specific fields
-*/
-/**
-* Current capability names — the ones authors should use going forward.
-* See `PluginCapability` in `types.ts` for documentation of each.
-*/
-const CURRENT_PLUGIN_CAPABILITIES = [
-	"network:request",
-	"network:request:unrestricted",
-	"content:read",
-	"content:revisions:read",
-	"content:write",
-	"content:publish",
-	"content:restore",
-	"comments:read",
-	"comments:moderate",
-	"schema:read",
-	"admin.editor-draft:read",
-	"admin.editor-draft:patch",
-	"hooks.content-policy:register",
-	"taxonomies:read",
-	"taxonomies:write",
-	"redirects:read",
-	"redirects:write",
-	"media:read",
-	"media:bytes:read",
-	"media:metadata:write",
-	"media:write",
-	"users:read",
-	"email:send",
-	"hooks.email-transport:register",
-	"hooks.email-events:register",
-	"hooks.page-fragments:register"
-];
-/**
-* Legacy capability names accepted during the deprecation window.
-* Normalized to current names via `normalizeCapability()` in types.ts
-* before reaching the runtime. Plugin authors are warned at bundle/validate
-* and hard-failed at publish.
-*/
-const DEPRECATED_PLUGIN_CAPABILITIES = [
-	"network:fetch",
-	"network:fetch:any",
-	"read:content",
-	"write:content",
-	"read:media",
-	"write:media",
-	"read:users",
-	"email:provide",
-	"email:intercept",
-	"page:inject"
-];
-/**
-* Full set of accepted capability strings — current + deprecated.
-*
-* The manifest schema accepts both during the transition. The runtime only
-* ever sees current names because `normalizeCapability()` rewrites legacy
-* names at every external boundary (definePlugin, adaptSandboxEntry).
-*/
-const PLUGIN_CAPABILITIES$1 = [...CURRENT_PLUGIN_CAPABILITIES, ...DEPRECATED_PLUGIN_CAPABILITIES];
-/** Must stay in sync with FieldType in schema/types.ts */
-const FIELD_TYPES = [
-	"string",
-	"text",
-	"number",
-	"integer",
-	"boolean",
-	"datetime",
-	"select",
-	"multiSelect",
-	"portableText",
-	"image",
-	"file",
-	"reference",
-	"json",
-	"slug",
-	"repeater"
-];
-const HOOK_NAMES = [
-	"plugin:install",
-	"plugin:activate",
-	"plugin:deactivate",
-	"plugin:uninstall",
-	"content:beforeSave",
-	"content:afterSave",
-	"content:beforeDelete",
-	"content:afterDelete",
-	"content:beforePublish",
-	"content:beforeSchedule",
-	"content:beforeUnpublish",
-	"content:afterPublish",
-	"content:afterUnpublish",
-	"content:afterRestore",
-	"content:afterSchedule",
-	"content:afterUnschedule",
-	"media:beforeUpload",
-	"media:afterUpload",
-	"cron",
-	"email:beforeSend",
-	"email:deliver",
-	"email:afterSend",
-	"comment:beforeCreate",
-	"comment:moderate",
-	"comment:afterCreate",
-	"comment:afterModerate",
-	"page:metadata",
-	"page:fragments"
-];
-/**
-* Structured hook entry for manifest — name plus optional metadata.
-* During a transition period, both plain strings and objects are accepted.
-*/
-const manifestHookEntrySchema = z.object({
-	name: z.enum(HOOK_NAMES),
-	exclusive: z.boolean().optional(),
-	priority: z.number().int().optional(),
-	timeout: z.number().int().positive().optional(),
-	dependencies: z.array(z.string().min(1)).optional(),
-	errorPolicy: z.enum(["continue", "abort"]).optional()
-});
-/**
-* Structured route entry for manifest — name plus optional metadata.
-* Both plain strings and objects are accepted; strings are normalized
-* to `{ name }` objects via `normalizeManifestRoute()`.
-*/
-const manifestRouteEntrySchema$1 = manifestRouteEntrySchema.safeExtend({ permission: z.string().refine((permission) => Object.hasOwn(Permissions, permission)).optional() });
-const pluginJsonSchema = z.record(z.string(), z.unknown());
-const pluginMcpConfigSchema = z.object({ tools: z.array(z.object({
-	name: z.string().min(1).max(64).regex(/^[a-zA-Z0-9_-]+$/, "Invalid MCP tool name"),
-	description: z.string().min(1),
-	route: routeNameSchema,
-	permission: z.string().refine((permission) => Object.hasOwn(Permissions, permission)),
-	destructive: z.boolean(),
-	inputSchema: pluginJsonSchema,
-	outputSchema: pluginJsonSchema.optional()
-})) });
-/** Index field names must be valid identifiers to prevent SQL injection via JSON path expressions */
-const indexFieldName = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/);
-const storageCollectionSchema = z.object({
-	indexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])),
-	uniqueIndexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])).optional()
-});
-const baseSettingFields = {
-	label: z.string(),
-	description: z.string().optional()
-};
-const settingFieldSchema = z.discriminatedUnion("type", [
-	z.object({
-		...baseSettingFields,
-		type: z.literal("string"),
-		default: z.string().optional(),
-		multiline: z.boolean().optional()
-	}),
-	z.object({
-		...baseSettingFields,
-		type: z.literal("number"),
-		default: z.number().optional(),
-		min: z.number().optional(),
-		max: z.number().optional()
-	}),
-	z.object({
-		...baseSettingFields,
-		type: z.literal("boolean"),
-		default: z.boolean().optional()
-	}),
-	z.object({
-		...baseSettingFields,
-		type: z.literal("select"),
-		options: z.array(z.object({
-			value: z.string(),
-			label: z.string()
-		})),
-		default: z.string().optional()
-	}),
-	z.object({
-		...baseSettingFields,
-		type: z.literal("secret")
-	}),
-	z.object({
-		...baseSettingFields,
-		type: z.literal("url"),
-		default: z.string().optional(),
-		placeholder: z.string().optional()
-	}),
-	z.object({
-		...baseSettingFields,
-		type: z.literal("email"),
-		default: z.string().optional(),
-		placeholder: z.string().optional()
-	})
-]);
-const adminPageSchema = z.object({
-	path: z.string(),
-	label: z.string(),
-	icon: z.string().optional()
-});
-const dashboardWidgetSchema = z.object({
-	id: z.string(),
-	size: z.enum([
-		"full",
-		"half",
-		"third"
-	]).optional(),
-	title: z.string().optional()
-});
-const editorExtensionIdPattern = /^[a-z][a-z0-9_-]*$/;
-const collectionSlugPattern = /^[a-z][a-z0-9_]*$/;
-const editorCollectionsSchema = z.array(z.string().max(63).regex(collectionSlugPattern, "Invalid collection slug")).max(64).refine((collections) => new Set(collections).size === collections.length, { message: "Editor extension collections must be unique" });
-const editorDraftFieldSelectorSchema = z.object({
-	fields: z.array(z.string().max(63).regex(collectionSlugPattern, "Invalid field slug")).max(32).refine((fields) => new Set(fields).size === fields.length, { message: "Editor draft fields must be unique" }).optional(),
-	translatable: z.literal(true).optional()
-}).refine((selector) => (selector.fields?.length ?? 0) > 0 || selector.translatable === true, { message: "Editor draft selector must include fields or translatable" });
-const editorDraftAccessSchema = z.object({
-	read: editorDraftFieldSelectorSchema.optional(),
-	patch: editorDraftFieldSelectorSchema.optional()
-}).refine((access) => access.read !== void 0 || access.patch !== void 0, { message: "Editor draft access must include read or patch" });
-const editorPanelSchema = z.object({
-	id: z.string().min(1).max(64).regex(editorExtensionIdPattern, "Invalid editor panel id"),
-	title: z.string().min(1).max(128),
-	route: routeNameSchema.max(128),
-	collections: editorCollectionsSchema.optional(),
-	order: z.number().int().min(-1e3).max(1e3).optional(),
-	draft: editorDraftAccessSchema.optional()
-}).refine((extension) => extension.draft === void 0 || (extension.collections?.length ?? 0) > 0, {
-	message: "Editor draft access requires explicit collection scope",
-	path: ["collections"]
-});
-const editorActionConfirmSchema = z.object({
-	title: z.string().min(1).max(128),
-	text: z.string().min(1).max(1024),
-	confirm: z.string().min(1).max(64),
-	deny: z.string().min(1).max(64),
-	style: z.literal("danger").optional()
-});
-const editorActionSchema = z.object({
-	id: z.string().min(1).max(64).regex(editorExtensionIdPattern, "Invalid editor action id"),
-	label: z.string().min(1).max(128),
-	route: routeNameSchema.max(128),
-	placement: z.enum(["toolbar", "overflow"]),
-	collections: editorCollectionsSchema.optional(),
-	style: z.enum(["default", "danger"]).optional(),
-	confirm: editorActionConfirmSchema.optional(),
-	draft: editorDraftAccessSchema.optional()
-}).refine((action) => action.style !== "danger" || action.confirm !== void 0, {
-	message: "Danger editor actions require confirmation",
-	path: ["confirm"]
-}).refine((extension) => extension.draft === void 0 || (extension.collections?.length ?? 0) > 0, {
-	message: "Editor draft access requires explicit collection scope",
-	path: ["collections"]
-});
-function uniqueExtensionIds(items, ctx, path) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const [index, item] of (items ?? []).entries()) {
-		if (seen.has(item.id)) ctx.addIssue({
-			code: "custom",
-			message: `Duplicate ${path} id`,
-			path: [
-				path,
-				index,
-				"id"
-			]
-		});
-		seen.add(item.id);
-	}
-}
-const pluginAdminConfigSchema = z.object({
-	entry: z.string().optional(),
-	settingsSchema: z.record(z.string(), settingFieldSchema).optional(),
-	pages: z.array(adminPageSchema).optional(),
-	widgets: z.array(dashboardWidgetSchema).optional(),
-	editorPanels: z.array(editorPanelSchema).max(32).optional(),
-	editorActions: z.array(editorActionSchema).max(32).optional(),
-	fieldWidgets: z.array(z.object({
-		name: z.string().min(1),
-		label: z.string().min(1),
-		fieldTypes: z.array(z.enum(FIELD_TYPES)),
-		elements: z.array(z.object({
-			type: z.string(),
-			action_id: z.string(),
-			label: z.string().optional()
-		}).loose()).optional()
-	})).optional()
-}).superRefine((admin, ctx) => {
-	uniqueExtensionIds(admin.editorPanels, ctx, "editorPanels");
-	uniqueExtensionIds(admin.editorActions, ctx, "editorActions");
-});
-/**
-* An operation's constraint object. Open vocabulary: keys the runtime
-* recognises are enforced, others are advisory. The bundler emits `{}` for a
-* granted operation; presence (not value) signals the grant.
-*/
-const accessConstraints = z.record(z.string(), z.unknown());
-/**
-* Structured trust contract embedded in the bundle manifest. Mirrors
-* `DeclaredAccess` in `@emdash-cms/plugin-types`. Categories are host
-* subsystems; operations are modes of participation.
-*/
-const declaredAccessSchema = z.object({
-	content: z.object({
-		read: accessConstraints.optional(),
-		revisionsRead: accessConstraints.optional(),
-		write: accessConstraints.optional(),
-		publish: accessConstraints.optional(),
-		restore: accessConstraints.optional(),
-		policy: accessConstraints.optional()
-	}).optional(),
-	schema: z.object({ read: accessConstraints.optional() }).optional(),
-	admin: z.object({
-		editorDraftRead: accessConstraints.optional(),
-		editorDraftPatch: accessConstraints.optional()
-	}).optional(),
-	taxonomies: z.object({
-		read: accessConstraints.optional(),
-		write: accessConstraints.optional()
-	}).optional(),
-	redirects: z.object({
-		read: accessConstraints.optional(),
-		write: accessConstraints.optional()
-	}).optional(),
-	comments: z.object({
-		read: accessConstraints.optional(),
-		moderate: accessConstraints.optional()
-	}).optional(),
-	media: z.object({
-		read: accessConstraints.optional(),
-		bytesRead: accessConstraints.optional(),
-		metadataWrite: accessConstraints.optional(),
-		write: accessConstraints.optional()
-	}).optional(),
-	network: z.object({ request: z.object({ allowedHosts: z.array(z.string()).min(1).optional() }).optional() }).optional(),
-	email: z.object({
-		send: accessConstraints.optional(),
-		events: accessConstraints.optional(),
-		transport: accessConstraints.optional()
-	}).optional(),
-	page: z.object({ fragments: accessConstraints.optional() }).optional(),
-	users: z.object({ read: accessConstraints.optional() }).optional()
-});
-/**
-* Zod schema matching the PluginManifest interface from types.ts.
-*
-* Every JSON.parse of a manifest.json should validate through this.
-*
-* `declaredAccess` is the trust contract; `capabilities`/`allowedHosts` are the
-* runtime's enforcement currency. Apply `reconcileManifestAccess` after parsing
-* to make them consistent (declaredAccess authoritative when present). Kept a
-* plain object (no `.transform`) because callers `.pick()`/`.extend()` it.
-*/
-const pluginManifestBaseSchema = z.object({
-	id: z.string().min(1),
-	version: z.string().min(1),
-	declaredAccess: declaredAccessSchema.optional(),
-	capabilities: z.array(z.enum(PLUGIN_CAPABILITIES$1)),
-	allowedHosts: z.array(z.string()),
-	storage: z.record(z.string(), storageCollectionSchema),
-	hooks: z.array(z.union([z.enum(HOOK_NAMES), manifestHookEntrySchema])),
-	routes: z.array(z.union([routeNameSchema, manifestRouteEntrySchema$1])),
-	mcp: pluginMcpConfigSchema.optional(),
-	admin: pluginAdminConfigSchema
-});
-function validateEditorExtensionRoutes(manifest, ctx) {
-	for (const [kind, extensions] of [["editorPanels", manifest.admin.editorPanels], ["editorActions", manifest.admin.editorActions]]) for (const [index, extension] of (extensions ?? []).entries()) {
-		const matches = manifest.routes.filter((route) => (typeof route === "string" ? route : route.name) === extension.route);
-		if (matches.length !== 1) {
-			ctx.addIssue({
-				code: "custom",
-				message: matches.length === 0 ? "Editor extension route is not declared" : "Editor extension route must be declared exactly once",
-				path: [
-					"admin",
-					kind,
-					index,
-					"route"
-				]
-			});
-			continue;
-		}
-		const route = matches[0];
-		if (!route) continue;
-		if (typeof route !== "string" && route.public === true) ctx.addIssue({
-			code: "custom",
-			message: "Editor extension routes must be private",
-			path: [
-				"admin",
-				kind,
-				index,
-				"route"
-			]
-		});
-		if (typeof route !== "string" && !isJsonPostRouteContract(route)) ctx.addIssue({
-			code: "custom",
-			message: "Editor extension routes must accept POST JSON requests and return JSON",
-			path: [
-				"admin",
-				kind,
-				index,
-				"route"
-			]
-		});
-	}
-}
-function validateUniqueRoutes(manifest, ctx) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const [index, route] of manifest.routes.entries()) {
-		const name = typeof route === "string" ? route : route.name;
-		if (seen.has(name)) ctx.addIssue({
-			code: "custom",
-			message: `Route "${name}" must be declared exactly once`,
-			path: ["routes", index]
-		});
-		seen.add(name);
-	}
-}
-function validateMcpToolRoutes(manifest, ctx) {
-	for (const [index, tool] of (manifest.mcp?.tools ?? []).entries()) {
-		const route = manifest.routes.find((candidate) => (typeof candidate === "string" ? candidate : candidate.name) === tool.route);
-		if (typeof route === "string" || route === void 0 || route.public === true || route.permission !== tool.permission || !isJsonPostRouteContract(route)) ctx.addIssue({
-			code: "custom",
-			message: "MCP tools must reference a private POST-compatible JSON route",
-			path: [
-				"mcp",
-				"tools",
-				index,
-				"route"
-			]
-		});
-	}
-}
-function validateBlockKitAdminRoute(manifest, ctx) {
-	if ((manifest.admin.pages?.length ?? 0) === 0 && (manifest.admin.widgets?.length ?? 0) === 0) return;
-	const routeIndex = manifest.routes.findIndex((route) => (typeof route === "string" ? route : route.name) === "admin");
-	if (routeIndex < 0) return;
-	const route = manifest.routes[routeIndex];
-	if (!route) return;
-	if (typeof route !== "string" && (route.public === true || !isJsonPostRouteContract(route))) ctx.addIssue({
-		code: "custom",
-		message: "Block Kit admin routes must be private POST-compatible JSON routes",
-		path: ["routes", routeIndex]
-	});
-}
-const pluginManifestSchema$1 = pluginManifestBaseSchema.superRefine((manifest, ctx) => {
-	validateUniqueRoutes(manifest, ctx);
-	validateEditorExtensionRoutes(manifest, ctx);
-	validateMcpToolRoutes(manifest, ctx);
-	validateBlockKitAdminRoute(manifest, ctx);
-});
-/**
-* Reconcile a parsed manifest's trust contract with its enforcement currency.
-* `declaredAccess` is authoritative: when present, `capabilities`/`allowedHosts`
-* are re-derived from it so what the runtime enforces always matches what was
-* recorded and consented to. A pre-migration bundle without `declaredAccess`
-* has it derived from the legacy capability list instead. The result always
-* carries both, mutually consistent. Apply this at every bundle-parse site.
-*/
-function reconcileManifestAccess$1(manifest) {
-	return manifest.declaredAccess ? {
-		...manifest,
-		...declaredAccessToCapabilities(manifest.declaredAccess)
-	} : {
-		...manifest,
-		declaredAccess: capabilitiesToDeclaredAccess(manifest.capabilities, manifest.allowedHosts)
-	};
-}
-/**
-* Normalize a manifest hook entry — plain strings become `{ name }` objects.
-*/
-function normalizeManifestHook(entry) {
-	if (typeof entry === "string") return { name: entry };
-	return entry;
-}
-/**
-* Normalize a manifest route entry — plain strings become `{ name }` objects.
-*/
-function normalizeManifestRoute$1(entry) {
-	return normalizeManifestRoute(entry);
-}
-
-//#endregion
-export { pluginManifestBaseSchema as a, normalizeManifestRoute$1 as i, PLUGIN_CAPABILITIES$1 as n, pluginManifestSchema$1 as o, normalizeManifestHook as r, reconcileManifestAccess$1 as s, HOOK_NAMES as t };
-//# sourceMappingURL=manifest-schema-Bkh8SeHd.mjs.map

package/dist/manifest-schema-Bkh8SeHd.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-schema-Bkh8SeHd.mjs","names":["PLUGIN_CAPABILITIES","manifestRouteEntrySchema","sharedManifestRouteEntrySchema","pluginManifestSchema","reconcileManifestAccess","normalizeManifestRoute","normalizeSharedManifestRoute"],"sources":["../src/plugins/manifest-schema.ts"],"sourcesContent":["/**\n * Zod schema for PluginManifest validation\n *\n * Used to validate manifest.json from plugin bundles at every parse site:\n * - Client-side download (marketplace.ts extractBundle)\n * - R2 load (api/handlers/marketplace.ts loadBundleFromR2)\n * - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)\n * - Marketplace ingest extends this with publishing-specific fields\n */\n\nimport { Permissions } from \"@emdash-cms/auth\";\nimport {\n\tcapabilitiesToDeclaredAccess,\n\tdeclaredAccessToCapabilities,\n\tisJsonPostRouteContract,\n\tmanifestRouteEntrySchema as sharedManifestRouteEntrySchema,\n\tnormalizeManifestRoute as normalizeSharedManifestRoute,\n\trouteNameSchema,\n} from \"@emdash-cms/plugin-types\";\nimport { z } from \"zod\";\n\nimport type { PluginManifest } from \"./types.js\";\n\n// ── Enum values (must stay in sync with types.ts) ───────────────\n\n/**\n * Current capability names — the ones authors should use going forward.\n * See `PluginCapability` in `types.ts` for documentation of each.\n */\nexport const CURRENT_PLUGIN_CAPABILITIES = [\n\t\"network:request\",\n\t\"network:request:unrestricted\",\n\t\"content:read\",\n\t\"content:revisions:read\",\n\t\"content:write\",\n\t\"content:publish\",\n\t\"content:restore\",\n\t\"comments:read\",\n\t\"comments:moderate\",\n\t\"schema:read\",\n\t\"admin.editor-draft:read\",\n\t\"admin.editor-draft:patch\",\n\t\"hooks.content-policy:register\",\n\t\"taxonomies:read\",\n\t\"taxonomies:write\",\n\t\"redirects:read\",\n\t\"redirects:write\",\n\t\"media:read\",\n\t\"media:bytes:read\",\n\t\"media:metadata:write\",\n\t\"media:write\",\n\t\"users:read\",\n\t\"email:send\",\n\t\"hooks.email-transport:register\",\n\t\"hooks.email-events:register\",\n\t\"hooks.page-fragments:register\",\n] as const;\n\n/**\n * Legacy capability names accepted during the deprecation window.\n * Normalized to current names via `normalizeCapability()` in types.ts\n * before reaching the runtime. Plugin authors are warned at bundle/validate\n * and hard-failed at publish.\n */\nexport const DEPRECATED_PLUGIN_CAPABILITIES = [\n\t\"network:fetch\",\n\t\"network:fetch:any\",\n\t\"read:content\",\n\t\"write:content\",\n\t\"read:media\",\n\t\"write:media\",\n\t\"read:users\",\n\t\"email:provide\",\n\t\"email:intercept\",\n\t\"page:inject\",\n] as const;\n\n/**\n * Full set of accepted capability strings — current + deprecated.\n *\n * The manifest schema accepts both during the transition. The runtime only\n * ever sees current names because `normalizeCapability()` rewrites legacy\n * names at every external boundary (definePlugin, adaptSandboxEntry).\n */\nexport const PLUGIN_CAPABILITIES = [\n\t...CURRENT_PLUGIN_CAPABILITIES,\n\t...DEPRECATED_PLUGIN_CAPABILITIES,\n] as const;\n\n/** Must stay in sync with FieldType in schema/types.ts */\nconst FIELD_TYPES = [\n\t\"string\",\n\t\"text\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"multiSelect\",\n\t\"portableText\",\n\t\"image\",\n\t\"file\",\n\t\"reference\",\n\t\"json\",\n\t\"slug\",\n\t\"repeater\",\n] as const;\n\nexport const HOOK_NAMES = [\n\t\"plugin:install\",\n\t\"plugin:activate\",\n\t\"plugin:deactivate\",\n\t\"plugin:uninstall\",\n\t\"content:beforeSave\",\n\t\"content:afterSave\",\n\t\"content:beforeDelete\",\n\t\"content:afterDelete\",\n\t\"content:beforePublish\",\n\t\"content:beforeSchedule\",\n\t\"content:beforeUnpublish\",\n\t\"content:afterPublish\",\n\t\"content:afterUnpublish\",\n\t\"content:afterRestore\",\n\t\"content:afterSchedule\",\n\t\"content:afterUnschedule\",\n\t\"media:beforeUpload\",\n\t\"media:afterUpload\",\n\t\"cron\",\n\t\"email:beforeSend\",\n\t\"email:deliver\",\n\t\"email:afterSend\",\n\t\"comment:beforeCreate\",\n\t\"comment:moderate\",\n\t\"comment:afterCreate\",\n\t\"comment:afterModerate\",\n\t\"page:metadata\",\n\t\"page:fragments\",\n] as const;\n\n/**\n * Structured hook entry for manifest — name plus optional metadata.\n * During a transition period, both plain strings and objects are accepted.\n */\nconst manifestHookEntrySchema = z.object({\n\tname: z.enum(HOOK_NAMES),\n\texclusive: z.boolean().optional(),\n\tpriority: z.number().int().optional(),\n\ttimeout: z.number().int().positive().optional(),\n\tdependencies: z.array(z.string().min(1)).optional(),\n\terrorPolicy: z.enum([\"continue\", \"abort\"]).optional(),\n});\n\n/**\n * Structured route entry for manifest — name plus optional metadata.\n * Both plain strings and objects are accepted; strings are normalized\n * to `{ name }` objects via `normalizeManifestRoute()`.\n */\nconst manifestRouteEntrySchema = sharedManifestRouteEntrySchema.safeExtend({\n\tpermission: z\n\t\t.string()\n\t\t.refine((permission) => Object.hasOwn(Permissions, permission))\n\t\t.optional(),\n});\n\nconst pluginJsonSchema = z.record(z.string(), z.unknown());\nconst mcpToolNamePattern = /^[a-zA-Z0-9_-]+$/;\nconst pluginMcpConfigSchema = z.object({\n\ttools: z.array(\n\t\tz.object({\n\t\t\tname: z.string().min(1).max(64).regex(mcpToolNamePattern, \"Invalid MCP tool name\"),\n\t\t\tdescription: z.string().min(1),\n\t\t\troute: routeNameSchema,\n\t\t\tpermission: z.string().refine((permission) => Object.hasOwn(Permissions, permission)),\n\t\t\tdestructive: z.boolean(),\n\t\t\tinputSchema: pluginJsonSchema,\n\t\t\toutputSchema: pluginJsonSchema.optional(),\n\t\t}),\n\t),\n});\n\n// ── Sub-schemas ─────────────────────────────────────────────────\n\n/** Index field names must be valid identifiers to prevent SQL injection via JSON path expressions */\nconst indexFieldName = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/);\n\nconst storageCollectionSchema = z.object({\n\tindexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])),\n\tuniqueIndexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])).optional(),\n});\n\nconst baseSettingFields = {\n\tlabel: z.string(),\n\tdescription: z.string().optional(),\n};\n\nconst settingFieldSchema = z.discriminatedUnion(\"type\", [\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"string\"),\n\t\tdefault: z.string().optional(),\n\t\tmultiline: z.boolean().optional(),\n\t}),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"number\"),\n\t\tdefault: z.number().optional(),\n\t\tmin: z.number().optional(),\n\t\tmax: z.number().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"boolean\"), default: z.boolean().optional() }),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"select\"),\n\t\toptions: z.array(z.object({ value: z.string(), label: z.string() })),\n\t\tdefault: z.string().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"secret\") }),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"url\"),\n\t\tdefault: z.string().optional(),\n\t\tplaceholder: z.string().optional(),\n\t}),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"email\"),\n\t\tdefault: z.string().optional(),\n\t\tplaceholder: z.string().optional(),\n\t}),\n]);\n\nconst adminPageSchema = z.object({\n\tpath: z.string(),\n\tlabel: z.string(),\n\ticon: z.string().optional(),\n});\n\nconst dashboardWidgetSchema = z.object({\n\tid: z.string(),\n\tsize: z.enum([\"full\", \"half\", \"third\"]).optional(),\n\ttitle: z.string().optional(),\n});\n\nconst editorExtensionIdPattern = /^[a-z][a-z0-9_-]*$/;\nconst collectionSlugPattern = /^[a-z][a-z0-9_]*$/;\nconst editorCollectionsSchema = z\n\t.array(z.string().max(63).regex(collectionSlugPattern, \"Invalid collection slug\"))\n\t.max(64)\n\t.refine((collections) => new Set(collections).size === collections.length, {\n\t\tmessage: \"Editor extension collections must be unique\",\n\t});\nconst editorDraftFieldSelectorSchema = z\n\t.object({\n\t\tfields: z\n\t\t\t.array(z.string().max(63).regex(collectionSlugPattern, \"Invalid field slug\"))\n\t\t\t.max(32)\n\t\t\t.refine((fields) => new Set(fields).size === fields.length, {\n\t\t\t\tmessage: \"Editor draft fields must be unique\",\n\t\t\t})\n\t\t\t.optional(),\n\t\ttranslatable: z.literal(true).optional(),\n\t})\n\t.refine((selector) => (selector.fields?.length ?? 0) > 0 || selector.translatable === true, {\n\t\tmessage: \"Editor draft selector must include fields or translatable\",\n\t});\nconst editorDraftAccessSchema = z\n\t.object({\n\t\tread: editorDraftFieldSelectorSchema.optional(),\n\t\tpatch: editorDraftFieldSelectorSchema.optional(),\n\t})\n\t.refine((access) => access.read !== undefined || access.patch !== undefined, {\n\t\tmessage: \"Editor draft access must include read or patch\",\n\t});\nconst editorPanelSchema = z\n\t.object({\n\t\tid: z.string().min(1).max(64).regex(editorExtensionIdPattern, \"Invalid editor panel id\"),\n\t\ttitle: z.string().min(1).max(128),\n\t\troute: routeNameSchema.max(128),\n\t\tcollections: editorCollectionsSchema.optional(),\n\t\torder: z.number().int().min(-1_000).max(1_000).optional(),\n\t\tdraft: editorDraftAccessSchema.optional(),\n\t})\n\t.refine(\n\t\t(extension) => extension.draft === undefined || (extension.collections?.length ?? 0) > 0,\n\t\t{\n\t\t\tmessage: \"Editor draft access requires explicit collection scope\",\n\t\t\tpath: [\"collections\"],\n\t\t},\n\t);\nconst editorActionConfirmSchema = z.object({\n\ttitle: z.string().min(1).max(128),\n\ttext: z.string().min(1).max(1_024),\n\tconfirm: z.string().min(1).max(64),\n\tdeny: z.string().min(1).max(64),\n\tstyle: z.literal(\"danger\").optional(),\n});\nconst editorActionSchema = z\n\t.object({\n\t\tid: z.string().min(1).max(64).regex(editorExtensionIdPattern, \"Invalid editor action id\"),\n\t\tlabel: z.string().min(1).max(128),\n\t\troute: routeNameSchema.max(128),\n\t\tplacement: z.enum([\"toolbar\", \"overflow\"]),\n\t\tcollections: editorCollectionsSchema.optional(),\n\t\tstyle: z.enum([\"default\", \"danger\"]).optional(),\n\t\tconfirm: editorActionConfirmSchema.optional(),\n\t\tdraft: editorDraftAccessSchema.optional(),\n\t})\n\t.refine((action) => action.style !== \"danger\" || action.confirm !== undefined, {\n\t\tmessage: \"Danger editor actions require confirmation\",\n\t\tpath: [\"confirm\"],\n\t})\n\t.refine(\n\t\t(extension) => extension.draft === undefined || (extension.collections?.length ?? 0) > 0,\n\t\t{\n\t\t\tmessage: \"Editor draft access requires explicit collection scope\",\n\t\t\tpath: [\"collections\"],\n\t\t},\n\t);\n\nfunction uniqueExtensionIds(\n\titems: readonly { id: string }[] | undefined,\n\tctx: z.RefinementCtx,\n\tpath: \"editorPanels\" | \"editorActions\",\n): void {\n\tconst seen = new Set<string>();\n\tfor (const [index, item] of (items ?? []).entries()) {\n\t\tif (seen.has(item.id)) {\n\t\t\tctx.addIssue({ code: \"custom\", message: `Duplicate ${path} id`, path: [path, index, \"id\"] });\n\t\t}\n\t\tseen.add(item.id);\n\t}\n}\n\nconst pluginAdminConfigSchema = z\n\t.object({\n\t\tentry: z.string().optional(),\n\t\tsettingsSchema: z.record(z.string(), settingFieldSchema).optional(),\n\t\tpages: z.array(adminPageSchema).optional(),\n\t\twidgets: z.array(dashboardWidgetSchema).optional(),\n\t\teditorPanels: z.array(editorPanelSchema).max(32).optional(),\n\t\teditorActions: z.array(editorActionSchema).max(32).optional(),\n\t\tfieldWidgets: z\n\t\t\t.array(\n\t\t\t\tz.object({\n\t\t\t\t\tname: z.string().min(1),\n\t\t\t\t\tlabel: z.string().min(1),\n\t\t\t\t\tfieldTypes: z.array(z.enum(FIELD_TYPES)),\n\t\t\t\t\telements: z\n\t\t\t\t\t\t.array(\n\t\t\t\t\t\t\tz\n\t\t\t\t\t\t\t\t.object({\n\t\t\t\t\t\t\t\t\ttype: z.string(),\n\t\t\t\t\t\t\t\t\taction_id: z.string(),\n\t\t\t\t\t\t\t\t\tlabel: z.string().optional(),\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t\t.loose(),\n\t\t\t\t\t\t)\n\t\t\t\t\t\t.optional(),\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.optional(),\n\t})\n\t.superRefine((admin, ctx) => {\n\t\tuniqueExtensionIds(admin.editorPanels, ctx, \"editorPanels\");\n\t\tuniqueExtensionIds(admin.editorActions, ctx, \"editorActions\");\n\t});\n\n// ── declaredAccess ──────────────────────────────────────────────\n\n/**\n * An operation's constraint object. Open vocabulary: keys the runtime\n * recognises are enforced, others are advisory. The bundler emits `{}` for a\n * granted operation; presence (not value) signals the grant.\n */\nconst accessConstraints = z.record(z.string(), z.unknown());\n\n/**\n * Structured trust contract embedded in the bundle manifest. Mirrors\n * `DeclaredAccess` in `@emdash-cms/plugin-types`. Categories are host\n * subsystems; operations are modes of participation.\n */\nconst declaredAccessSchema = z.object({\n\tcontent: z\n\t\t.object({\n\t\t\tread: accessConstraints.optional(),\n\t\t\trevisionsRead: accessConstraints.optional(),\n\t\t\twrite: accessConstraints.optional(),\n\t\t\tpublish: accessConstraints.optional(),\n\t\t\trestore: accessConstraints.optional(),\n\t\t\tpolicy: accessConstraints.optional(),\n\t\t})\n\t\t.optional(),\n\tschema: z.object({ read: accessConstraints.optional() }).optional(),\n\tadmin: z\n\t\t.object({\n\t\t\teditorDraftRead: accessConstraints.optional(),\n\t\t\teditorDraftPatch: accessConstraints.optional(),\n\t\t})\n\t\t.optional(),\n\ttaxonomies: z\n\t\t.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })\n\t\t.optional(),\n\tredirects: z\n\t\t.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })\n\t\t.optional(),\n\tcomments: z\n\t\t.object({ read: accessConstraints.optional(), moderate: accessConstraints.optional() })\n\t\t.optional(),\n\tmedia: z\n\t\t.object({\n\t\t\tread: accessConstraints.optional(),\n\t\t\tbytesRead: accessConstraints.optional(),\n\t\t\tmetadataWrite: accessConstraints.optional(),\n\t\t\twrite: accessConstraints.optional(),\n\t\t})\n\t\t.optional(),\n\tnetwork: z\n\t\t.object({\n\t\t\t// allowedHosts: absent = unrestricted; present = host-restricted. Reject\n\t\t\t// an empty array (which the decoder would otherwise have to treat as\n\t\t\t// deny-all) to match the record lexicon's `minLength: 1` and keep the\n\t\t\t// \"absent vs empty\" distinction from ever reaching enforcement ambiguous.\n\t\t\trequest: z.object({ allowedHosts: z.array(z.string()).min(1).optional() }).optional(),\n\t\t})\n\t\t.optional(),\n\temail: z\n\t\t.object({\n\t\t\tsend: accessConstraints.optional(),\n\t\t\tevents: accessConstraints.optional(),\n\t\t\ttransport: accessConstraints.optional(),\n\t\t})\n\t\t.optional(),\n\tpage: z.object({ fragments: accessConstraints.optional() }).optional(),\n\tusers: z.object({ read: accessConstraints.optional() }).optional(),\n});\n\n// ── Main schema ─────────────────────────────────────────────────\n\n/**\n * Zod schema matching the PluginManifest interface from types.ts.\n *\n * Every JSON.parse of a manifest.json should validate through this.\n *\n * `declaredAccess` is the trust contract; `capabilities`/`allowedHosts` are the\n * runtime's enforcement currency. Apply `reconcileManifestAccess` after parsing\n * to make them consistent (declaredAccess authoritative when present). Kept a\n * plain object (no `.transform`) because callers `.pick()`/`.extend()` it.\n */\nexport const pluginManifestBaseSchema = z.object({\n\tid: z.string().min(1),\n\tversion: z.string().min(1),\n\tdeclaredAccess: declaredAccessSchema.optional(),\n\tcapabilities: z.array(z.enum(PLUGIN_CAPABILITIES)),\n\tallowedHosts: z.array(z.string()),\n\tstorage: z.record(z.string(), storageCollectionSchema),\n\t/**\n\t * Hook declarations — accepts both plain name strings (legacy) and\n\t * structured objects with exclusive/priority/timeout metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\thooks: z.array(z.union([z.enum(HOOK_NAMES), manifestHookEntrySchema])),\n\t/**\n\t * Route declarations — accepts both plain name strings and\n\t * structured objects with public metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\troutes: z.array(z.union([routeNameSchema, manifestRouteEntrySchema])),\n\tmcp: pluginMcpConfigSchema.optional(),\n\tadmin: pluginAdminConfigSchema,\n});\n\nfunction validateEditorExtensionRoutes(\n\tmanifest: z.infer<typeof pluginManifestBaseSchema>,\n\tctx: z.RefinementCtx,\n): void {\n\tfor (const [kind, extensions] of [\n\t\t[\"editorPanels\", manifest.admin.editorPanels],\n\t\t[\"editorActions\", manifest.admin.editorActions],\n\t] as const) {\n\t\tfor (const [index, extension] of (extensions ?? []).entries()) {\n\t\t\tconst matches = manifest.routes.filter(\n\t\t\t\t(route) => (typeof route === \"string\" ? route : route.name) === extension.route,\n\t\t\t);\n\t\t\tif (matches.length !== 1) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tmatches.length === 0\n\t\t\t\t\t\t\t? \"Editor extension route is not declared\"\n\t\t\t\t\t\t\t: \"Editor extension route must be declared exactly once\",\n\t\t\t\t\tpath: [\"admin\", kind, index, \"route\"],\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst route = matches[0];\n\t\t\tif (!route) continue;\n\t\t\tif (typeof route !== \"string\" && route.public === true) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tmessage: \"Editor extension routes must be private\",\n\t\t\t\t\tpath: [\"admin\", kind, index, \"route\"],\n\t\t\t\t});\n\t\t\t}\n\t\t\tif (typeof route !== \"string\" && !isJsonPostRouteContract(route)) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tmessage: \"Editor extension routes must accept POST JSON requests and return JSON\",\n\t\t\t\t\tpath: [\"admin\", kind, index, \"route\"],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunction validateUniqueRoutes(\n\tmanifest: z.infer<typeof pluginManifestBaseSchema>,\n\tctx: z.RefinementCtx,\n): void {\n\tconst seen = new Set<string>();\n\tfor (const [index, route] of manifest.routes.entries()) {\n\t\tconst name = typeof route === \"string\" ? route : route.name;\n\t\tif (seen.has(name)) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tmessage: `Route \"${name}\" must be declared exactly once`,\n\t\t\t\tpath: [\"routes\", index],\n\t\t\t});\n\t\t}\n\t\tseen.add(name);\n\t}\n}\n\nfunction validateMcpToolRoutes(\n\tmanifest: z.infer<typeof pluginManifestBaseSchema>,\n\tctx: z.RefinementCtx,\n): void {\n\tfor (const [index, tool] of (manifest.mcp?.tools ?? []).entries()) {\n\t\tconst route = manifest.routes.find(\n\t\t\t(candidate) => (typeof candidate === \"string\" ? candidate : candidate.name) === tool.route,\n\t\t);\n\t\tif (\n\t\t\ttypeof route === \"string\" ||\n\t\t\troute === undefined ||\n\t\t\troute.public === true ||\n\t\t\troute.permission !== tool.permission ||\n\t\t\t!isJsonPostRouteContract(route)\n\t\t) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tmessage: \"MCP tools must reference a private POST-compatible JSON route\",\n\t\t\t\tpath: [\"mcp\", \"tools\", index, \"route\"],\n\t\t\t});\n\t\t}\n\t}\n}\n\nfunction validateBlockKitAdminRoute(\n\tmanifest: z.infer<typeof pluginManifestBaseSchema>,\n\tctx: z.RefinementCtx,\n): void {\n\tif ((manifest.admin.pages?.length ?? 0) === 0 && (manifest.admin.widgets?.length ?? 0) === 0) {\n\t\treturn;\n\t}\n\tconst routeIndex = manifest.routes.findIndex(\n\t\t(route) => (typeof route === \"string\" ? route : route.name) === \"admin\",\n\t);\n\tif (routeIndex < 0) return;\n\tconst route = manifest.routes[routeIndex];\n\tif (!route) return;\n\tif (typeof route !== \"string\" && (route.public === true || !isJsonPostRouteContract(route))) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"Block Kit admin routes must be private POST-compatible JSON routes\",\n\t\t\tpath: [\"routes\", routeIndex],\n\t\t});\n\t}\n}\n\nexport const pluginManifestSchema = pluginManifestBaseSchema.superRefine((manifest, ctx) => {\n\tvalidateUniqueRoutes(manifest, ctx);\n\tvalidateEditorExtensionRoutes(manifest, ctx);\n\tvalidateMcpToolRoutes(manifest, ctx);\n\tvalidateBlockKitAdminRoute(manifest, ctx);\n});\n\nexport type ValidatedPluginManifest = z.infer<typeof pluginManifestSchema>;\n\n/**\n * Reconcile a parsed manifest's trust contract with its enforcement currency.\n * `declaredAccess` is authoritative: when present, `capabilities`/`allowedHosts`\n * are re-derived from it so what the runtime enforces always matches what was\n * recorded and consented to. A pre-migration bundle without `declaredAccess`\n * has it derived from the legacy capability list instead. The result always\n * carries both, mutually consistent. Apply this at every bundle-parse site.\n */\nexport function reconcileManifestAccess(manifest: ValidatedPluginManifest): PluginManifest {\n\tconst reconciled: ValidatedPluginManifest = manifest.declaredAccess\n\t\t? { ...manifest, ...declaredAccessToCapabilities(manifest.declaredAccess) }\n\t\t: {\n\t\t\t\t...manifest,\n\t\t\t\tdeclaredAccess: capabilitiesToDeclaredAccess(manifest.capabilities, manifest.allowedHosts),\n\t\t\t};\n\t// Block Kit admin elements are typed as `unknown` by the Zod schema (their\n\t// Element shape is validated at render time), so the validated manifest\n\t// needs a structural cast up to the runtime PluginManifest.\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- admin elements are unknown[] in Zod; Element type checked at render time\n\treturn reconciled as unknown as PluginManifest;\n}\n\n/**\n * Normalize a manifest hook entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestHook(\n\tentry:\n\t\t| string\n\t\t| {\n\t\t\t\tname: string;\n\t\t\t\texclusive?: boolean;\n\t\t\t\tpriority?: number;\n\t\t\t\ttimeout?: number;\n\t\t\t\tdependencies?: string[];\n\t\t\t\terrorPolicy?: \"continue\" | \"abort\";\n\t\t  },\n): {\n\tname: string;\n\texclusive?: boolean;\n\tpriority?: number;\n\ttimeout?: number;\n\tdependencies?: string[];\n\terrorPolicy?: \"continue\" | \"abort\";\n} {\n\tif (typeof entry === \"string\") {\n\t\treturn { name: entry };\n\t}\n\treturn entry;\n}\n\n/**\n * Normalize a manifest route entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestRoute(entry: PluginManifest[\"routes\"][number]) {\n\treturn normalizeSharedManifestRoute(entry);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA6BA,MAAa,8BAA8B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;AAQD,MAAa,iCAAiC;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;AASD,MAAaA,wBAAsB,CAClC,GAAG,6BACH,GAAG,+BACH;;AAGD,MAAM,cAAc;CACnB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAa,aAAa;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;AAMD,MAAM,0BAA0B,EAAE,OAAO;CACxC,MAAM,EAAE,KAAK,WAAW;CACxB,WAAW,EAAE,SAAS,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACrC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;CAC/C,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;CACnD,aAAa,EAAE,KAAK,CAAC,YAAY,QAAQ,CAAC,CAAC,UAAU;CACrD,CAAC;;;;;;AAOF,MAAMC,6BAA2BC,yBAA+B,WAAW,EAC1E,YAAY,EACV,QAAQ,CACR,QAAQ,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC,CAC9D,UAAU,EACZ,CAAC;AAEF,MAAM,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;AAE1D,MAAM,wBAAwB,EAAE,OAAO,EACtC,OAAO,EAAE,MACR,EAAE,OAAO;CACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAJR,oBAIkC,wBAAwB;CAClF,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC9B,OAAO;CACP,YAAY,EAAE,QAAQ,CAAC,QAAQ,eAAe,OAAO,OAAO,aAAa,WAAW,CAAC;CACrF,aAAa,EAAE,SAAS;CACxB,aAAa;CACb,cAAc,iBAAiB,UAAU;CACzC,CAAC,CACF,EACD,CAAC;;AAKF,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,0BAA0B;AAElE,MAAM,0BAA0B,EAAE,OAAO;CACxC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC;CACpE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU;CACrF,CAAC;AAEF,MAAM,oBAAoB;CACzB,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACvD,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,WAAW,EAAE,SAAS,CAAC,UAAU;EACjC,CAAC;CACF,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,UAAU;EAAE,SAAS,EAAE,SAAS,CAAC,UAAU;EAAE,CAAC;CAC/F,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,MAAM,EAAE,OAAO;GAAE,OAAO,EAAE,QAAQ;GAAE,OAAO,EAAE,QAAQ;GAAE,CAAC,CAAC;EACpE,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,SAAS;EAAE,CAAC;CAC7D,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,MAAM;EACtB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;CACF,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;CACF,CAAC;AAEF,MAAM,kBAAkB,EAAE,OAAO;CAChC,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC;AAEF,MAAM,wBAAwB,EAAE,OAAO;CACtC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAQ;EAAQ,CAAC,CAAC,UAAU;CAClD,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAM,2BAA2B;AACjC,MAAM,wBAAwB;AAC9B,MAAM,0BAA0B,EAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,uBAAuB,0BAA0B,CAAC,CACjF,IAAI,GAAG,CACP,QAAQ,gBAAgB,IAAI,IAAI,YAAY,CAAC,SAAS,YAAY,QAAQ,EAC1E,SAAS,+CACT,CAAC;AACH,MAAM,iCAAiC,EACrC,OAAO;CACP,QAAQ,EACN,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,uBAAuB,qBAAqB,CAAC,CAC5E,IAAI,GAAG,CACP,QAAQ,WAAW,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,QAAQ,EAC3D,SAAS,sCACT,CAAC,CACD,UAAU;CACZ,cAAc,EAAE,QAAQ,KAAK,CAAC,UAAU;CACxC,CAAC,CACD,QAAQ,cAAc,SAAS,QAAQ,UAAU,KAAK,KAAK,SAAS,iBAAiB,MAAM,EAC3F,SAAS,6DACT,CAAC;AACH,MAAM,0BAA0B,EAC9B,OAAO;CACP,MAAM,+BAA+B,UAAU;CAC/C,OAAO,+BAA+B,UAAU;CAChD,CAAC,CACD,QAAQ,WAAW,OAAO,SAAS,UAAa,OAAO,UAAU,QAAW,EAC5E,SAAS,kDACT,CAAC;AACH,MAAM,oBAAoB,EACxB,OAAO;CACP,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,0BAA0B,0BAA0B;CACxF,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;CACjC,OAAO,gBAAgB,IAAI,IAAI;CAC/B,aAAa,wBAAwB,UAAU;CAC/C,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAO,CAAC,IAAI,IAAM,CAAC,UAAU;CACzD,OAAO,wBAAwB,UAAU;CACzC,CAAC,CACD,QACC,cAAc,UAAU,UAAU,WAAc,UAAU,aAAa,UAAU,KAAK,GACvF;CACC,SAAS;CACT,MAAM,CAAC,cAAc;CACrB,CACD;AACF,MAAM,4BAA4B,EAAE,OAAO;CAC1C,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;CACjC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,KAAM;CAClC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG;CAClC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG;CAC/B,OAAO,EAAE,QAAQ,SAAS,CAAC,UAAU;CACrC,CAAC;AACF,MAAM,qBAAqB,EACzB,OAAO;CACP,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,0BAA0B,2BAA2B;CACzF,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;CACjC,OAAO,gBAAgB,IAAI,IAAI;CAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,WAAW,CAAC;CAC1C,aAAa,wBAAwB,UAAU;CAC/C,OAAO,EAAE,KAAK,CAAC,WAAW,SAAS,CAAC,CAAC,UAAU;CAC/C,SAAS,0BAA0B,UAAU;CAC7C,OAAO,wBAAwB,UAAU;CACzC,CAAC,CACD,QAAQ,WAAW,OAAO,UAAU,YAAY,OAAO,YAAY,QAAW;CAC9E,SAAS;CACT,MAAM,CAAC,UAAU;CACjB,CAAC,CACD,QACC,cAAc,UAAU,UAAU,WAAc,UAAU,aAAa,UAAU,KAAK,GACvF;CACC,SAAS;CACT,MAAM,CAAC,cAAc;CACrB,CACD;AAEF,SAAS,mBACR,OACA,KACA,MACO;CACP,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,CAAC,OAAO,UAAU,SAAS,EAAE,EAAE,SAAS,EAAE;AACpD,MAAI,KAAK,IAAI,KAAK,GAAG,CACpB,KAAI,SAAS;GAAE,MAAM;GAAU,SAAS,aAAa,KAAK;GAAM,MAAM;IAAC;IAAM;IAAO;IAAK;GAAE,CAAC;AAE7F,OAAK,IAAI,KAAK,GAAG;;;AAInB,MAAM,0BAA0B,EAC9B,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,UAAU;CACnE,OAAO,EAAE,MAAM,gBAAgB,CAAC,UAAU;CAC1C,SAAS,EAAE,MAAM,sBAAsB,CAAC,UAAU;CAClD,cAAc,EAAE,MAAM,kBAAkB,CAAC,IAAI,GAAG,CAAC,UAAU;CAC3D,eAAe,EAAE,MAAM,mBAAmB,CAAC,IAAI,GAAG,CAAC,UAAU;CAC7D,cAAc,EACZ,MACA,EAAE,OAAO;EACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;EACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;EACxB,YAAY,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC;EACxC,UAAU,EACR,MACA,EACE,OAAO;GACP,MAAM,EAAE,QAAQ;GAChB,WAAW,EAAE,QAAQ;GACrB,OAAO,EAAE,QAAQ,CAAC,UAAU;GAC5B,CAAC,CACD,OAAO,CACT,CACA,UAAU;EACZ,CAAC,CACF,CACA,UAAU;CACZ,CAAC,CACD,aAAa,OAAO,QAAQ;AAC5B,oBAAmB,MAAM,cAAc,KAAK,eAAe;AAC3D,oBAAmB,MAAM,eAAe,KAAK,gBAAgB;EAC5D;;;;;;AASH,MAAM,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;;;;;;AAO3D,MAAM,uBAAuB,EAAE,OAAO;CACrC,SAAS,EACP,OAAO;EACP,MAAM,kBAAkB,UAAU;EAClC,eAAe,kBAAkB,UAAU;EAC3C,OAAO,kBAAkB,UAAU;EACnC,SAAS,kBAAkB,UAAU;EACrC,SAAS,kBAAkB,UAAU;EACrC,QAAQ,kBAAkB,UAAU;EACpC,CAAC,CACD,UAAU;CACZ,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CACnE,OAAO,EACL,OAAO;EACP,iBAAiB,kBAAkB,UAAU;EAC7C,kBAAkB,kBAAkB,UAAU;EAC9C,CAAC,CACD,UAAU;CACZ,YAAY,EACV,OAAO;EAAE,MAAM,kBAAkB,UAAU;EAAE,OAAO,kBAAkB,UAAU;EAAE,CAAC,CACnF,UAAU;CACZ,WAAW,EACT,OAAO;EAAE,MAAM,kBAAkB,UAAU;EAAE,OAAO,kBAAkB,UAAU;EAAE,CAAC,CACnF,UAAU;CACZ,UAAU,EACR,OAAO;EAAE,MAAM,kBAAkB,UAAU;EAAE,UAAU,kBAAkB,UAAU;EAAE,CAAC,CACtF,UAAU;CACZ,OAAO,EACL,OAAO;EACP,MAAM,kBAAkB,UAAU;EAClC,WAAW,kBAAkB,UAAU;EACvC,eAAe,kBAAkB,UAAU;EAC3C,OAAO,kBAAkB,UAAU;EACnC,CAAC,CACD,UAAU;CACZ,SAAS,EACP,OAAO,EAKP,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EACrF,CAAC,CACD,UAAU;CACZ,OAAO,EACL,OAAO;EACP,MAAM,kBAAkB,UAAU;EAClC,QAAQ,kBAAkB,UAAU;EACpC,WAAW,kBAAkB,UAAU;EACvC,CAAC,CACD,UAAU;CACZ,MAAM,EAAE,OAAO,EAAE,WAAW,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CACtE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CAClE,CAAC;;;;;;;;;;;AAcF,MAAa,2BAA2B,EAAE,OAAO;CAChD,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;CACrB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,gBAAgB,qBAAqB,UAAU;CAC/C,cAAc,EAAE,MAAM,EAAE,KAAKF,sBAAoB,CAAC;CAClD,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC;CACjC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB;CAMtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,WAAW,EAAE,wBAAwB,CAAC,CAAC;CAMtE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,iBAAiBC,2BAAyB,CAAC,CAAC;CACrE,KAAK,sBAAsB,UAAU;CACrC,OAAO;CACP,CAAC;AAEF,SAAS,8BACR,UACA,KACO;AACP,MAAK,MAAM,CAAC,MAAM,eAAe,CAChC,CAAC,gBAAgB,SAAS,MAAM,aAAa,EAC7C,CAAC,iBAAiB,SAAS,MAAM,cAAc,CAC/C,CACA,MAAK,MAAM,CAAC,OAAO,eAAe,cAAc,EAAE,EAAE,SAAS,EAAE;EAC9D,MAAM,UAAU,SAAS,OAAO,QAC9B,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM,UAAU,UAAU,MAC1E;AACD,MAAI,QAAQ,WAAW,GAAG;AACzB,OAAI,SAAS;IACZ,MAAM;IACN,SACC,QAAQ,WAAW,IAChB,2CACA;IACJ,MAAM;KAAC;KAAS;KAAM;KAAO;KAAQ;IACrC,CAAC;AACF;;EAED,MAAM,QAAQ,QAAQ;AACtB,MAAI,CAAC,MAAO;AACZ,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KACjD,KAAI,SAAS;GACZ,MAAM;GACN,SAAS;GACT,MAAM;IAAC;IAAS;IAAM;IAAO;IAAQ;GACrC,CAAC;AAEH,MAAI,OAAO,UAAU,YAAY,CAAC,wBAAwB,MAAM,CAC/D,KAAI,SAAS;GACZ,MAAM;GACN,SAAS;GACT,MAAM;IAAC;IAAS;IAAM;IAAO;IAAQ;GACrC,CAAC;;;AAMN,SAAS,qBACR,UACA,KACO;CACP,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,CAAC,OAAO,UAAU,SAAS,OAAO,SAAS,EAAE;EACvD,MAAM,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;AACvD,MAAI,KAAK,IAAI,KAAK,CACjB,KAAI,SAAS;GACZ,MAAM;GACN,SAAS,UAAU,KAAK;GACxB,MAAM,CAAC,UAAU,MAAM;GACvB,CAAC;AAEH,OAAK,IAAI,KAAK;;;AAIhB,SAAS,sBACR,UACA,KACO;AACP,MAAK,MAAM,CAAC,OAAO,UAAU,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,EAAE;EAClE,MAAM,QAAQ,SAAS,OAAO,MAC5B,eAAe,OAAO,cAAc,WAAW,YAAY,UAAU,UAAU,KAAK,MACrF;AACD,MACC,OAAO,UAAU,YACjB,UAAU,UACV,MAAM,WAAW,QACjB,MAAM,eAAe,KAAK,cAC1B,CAAC,wBAAwB,MAAM,CAE/B,KAAI,SAAS;GACZ,MAAM;GACN,SAAS;GACT,MAAM;IAAC;IAAO;IAAS;IAAO;IAAQ;GACtC,CAAC;;;AAKL,SAAS,2BACR,UACA,KACO;AACP,MAAK,SAAS,MAAM,OAAO,UAAU,OAAO,MAAM,SAAS,MAAM,SAAS,UAAU,OAAO,EAC1F;CAED,MAAM,aAAa,SAAS,OAAO,WACjC,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM,UAAU,QAChE;AACD,KAAI,aAAa,EAAG;CACpB,MAAM,QAAQ,SAAS,OAAO;AAC9B,KAAI,CAAC,MAAO;AACZ,KAAI,OAAO,UAAU,aAAa,MAAM,WAAW,QAAQ,CAAC,wBAAwB,MAAM,EACzF,KAAI,SAAS;EACZ,MAAM;EACN,SAAS;EACT,MAAM,CAAC,UAAU,WAAW;EAC5B,CAAC;;AAIJ,MAAaE,yBAAuB,yBAAyB,aAAa,UAAU,QAAQ;AAC3F,sBAAqB,UAAU,IAAI;AACnC,+BAA8B,UAAU,IAAI;AAC5C,uBAAsB,UAAU,IAAI;AACpC,4BAA2B,UAAU,IAAI;EACxC;;;;;;;;;AAYF,SAAgBC,0BAAwB,UAAmD;AAW1F,QAV4C,SAAS,iBAClD;EAAE,GAAG;EAAU,GAAG,6BAA6B,SAAS,eAAe;EAAE,GACzE;EACA,GAAG;EACH,gBAAgB,6BAA6B,SAAS,cAAc,SAAS,aAAa;EAC1F;;;;;AAWJ,SAAgB,sBACf,OAiBC;AACD,KAAI,OAAO,UAAU,SACpB,QAAO,EAAE,MAAM,OAAO;AAEvB,QAAO;;;;;AAMR,SAAgBC,yBAAuB,OAAyC;AAC/E,QAAOC,uBAA6B,MAAM"}