emdash 0.39.1 → 0.40.0

package/dist/dialect-helpers-7_IqPdh9.mjs

@@ -0,0 +1,307 @@
+import { n as validateJsonFieldName, t as validateIdentifier } from "./validate-DANX1-Qi.mjs";
+import { PostgresAdapter, sql } from "kysely";
+
+//#region src/database/dialect-helpers.ts
+/**
+* Detect dialect type from a Kysely instance via the adapter class.
+*/
+function detectDialect(db) {
+	if (db.getExecutor().adapter instanceof PostgresAdapter) return "postgres";
+	return "sqlite";
+}
+function isSqlite(db) {
+	return detectDialect(db) === "sqlite";
+}
+function isPostgres(db) {
+	return detectDialect(db) === "postgres";
+}
+/**
+* Execute a fixed statement list atomically when the active adapter supports
+* it. Returns `null` for adapters that should use an ordinary transaction.
+*/
+async function executeAtomicBatchIfSupported(db, queries) {
+	const adapter = db.getExecutor().adapter;
+	if (!("executeAtomicBatch" in adapter) || typeof adapter.executeAtomicBatch !== "function") return null;
+	return adapter.executeAtomicBatch(queries.map((query) => "isRawBuilder" in query ? query.compile(db) : query.compile()));
+}
+/**
+* The backend's compound-SELECT ceiling, or null when it has none worth
+* splitting statements for. Only the adapter knows: the limit is a property of
+* the SQLite build behind the dialect, not of the SQL flavour, so two "sqlite"
+* dialects can answer differently.
+*
+* A declared ceiling must be a positive integer — callers batch by it, and
+* every other value silently misbehaves rather than failing: 0 and negatives
+* never advance the batch cursor, fractions overlap batches and double-count,
+* NaN yields an empty batch. A malformed declaration throws here, where the
+* message can name the adapter.
+*/
+function compoundSelectLimit(db) {
+	const adapter = db.getExecutor().adapter;
+	if (!("compoundSelectLimit" in adapter)) return null;
+	const limit = adapter.compoundSelectLimit;
+	if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1) throw new Error(`${adapter.constructor.name} declares compoundSelectLimit ${String(limit)}; it must be a positive integer.`);
+	return limit;
+}
+/**
+* Default timestamp expression for column defaults.
+* Wrapped in parens for use in CREATE TABLE ... DEFAULT (...).
+*
+* sqlite:   (datetime('now'))
+* postgres: CURRENT_TIMESTAMP
+*/
+function currentTimestamp(db) {
+	if (isPostgres(db)) return sql`CURRENT_TIMESTAMP`;
+	return sql`(datetime('now'))`;
+}
+/**
+* Timestamp expression for use in WHERE clauses and SET expressions.
+* No wrapping parens.
+*
+* sqlite:   datetime('now')
+* postgres: CURRENT_TIMESTAMP
+*/
+function currentTimestampValue(db) {
+	if (isPostgres(db)) return sql`CURRENT_TIMESTAMP`;
+	return sql`datetime('now')`;
+}
+/**
+* Build WHERE clause for status filtering on a content table.
+* Scheduled content becomes public only after the publication sweep commits
+* the row with a literal `published` status.
+*/
+function buildStatusCondition(_db, status, tablePrefix) {
+	const statusField = tablePrefix ? `${tablePrefix}.status` : "status";
+	return sql`${sql.ref(statusField)} = ${status}`;
+}
+/**
+* Check if a table exists in the database.
+*/
+async function tableExists(db, tableName) {
+	if (isPostgres(db)) return (await sql`
+			SELECT EXISTS(
+				SELECT 1 FROM information_schema.tables
+				WHERE table_schema = current_schema() AND table_name = ${tableName}
+			) as exists
+		`.execute(db)).rows[0]?.exists === true;
+	return (await sql`
+		SELECT name FROM sqlite_master
+		WHERE type = 'table' AND name = ${tableName}
+	`.execute(db)).rows.length > 0;
+}
+/**
+* Check if an index exists in the database.
+*/
+async function indexExists(db, indexName) {
+	if (isPostgres(db)) return (await sql`
+			SELECT EXISTS(
+				SELECT 1 FROM pg_indexes
+				WHERE schemaname = current_schema() AND indexname = ${indexName}
+			) as exists
+		`.execute(db)).rows[0]?.exists === true;
+	return (await sql`
+		SELECT name FROM sqlite_master
+		WHERE type = 'index' AND name = ${indexName}
+	`.execute(db)).rows.length > 0;
+}
+/**
+* Check if a column exists in the database.
+*/
+async function columnExists(db, tableName, columnName) {
+	if (isPostgres(db)) return (await sql`
+			SELECT EXISTS(
+				SELECT 1 FROM information_schema.columns
+				WHERE table_schema = current_schema()
+					AND table_name = ${tableName}
+					AND column_name = ${columnName}
+			) as exists
+		`.execute(db)).rows[0]?.exists === true;
+	return (await sql`
+		SELECT name FROM pragma_table_info(${tableName})
+		WHERE name = ${columnName}
+	`.execute(db)).rows.length > 0;
+}
+/**
+* List tables matching a LIKE pattern.
+*/
+async function listTablesLike(db, pattern) {
+	if (isPostgres(db)) return (await sql`
+			SELECT table_name FROM information_schema.tables
+			WHERE table_schema = current_schema() AND table_name LIKE ${pattern}
+			ORDER BY table_name
+		`.execute(db)).rows.map((r) => r.table_name);
+	return (await sql`
+		SELECT name FROM sqlite_master
+		WHERE type = 'table' AND name LIKE ${pattern}
+		ORDER BY name
+	`.execute(db)).rows.map((r) => r.name);
+}
+/**
+* List a table's columns in declaration order.
+*/
+async function listTableColumns(db, tableName) {
+	if (isPostgres(db)) return (await sql`
+			SELECT column_name, data_type
+			FROM information_schema.columns
+			WHERE table_schema = current_schema() AND table_name = ${tableName}
+			ORDER BY ordinal_position
+		`.execute(db)).rows.map((column) => ({
+		name: column.column_name,
+		type: column.data_type
+	}));
+	return (await sql`
+		SELECT name, type
+		FROM pragma_table_info(${tableName})
+		ORDER BY cid
+	`.execute(db)).rows;
+}
+/**
+* Column type for binary data.
+*
+* sqlite:   blob
+* postgres: bytea
+*/
+function binaryType(db) {
+	if (isPostgres(db)) return "bytea";
+	return "blob";
+}
+/**
+* SQL expression for extracting a field from a JSON column stored as text.
+*
+* sqlite:   json_extract(column, '$.path')
+* postgres: (column)::jsonb->>'path'
+*
+* The Postgres cast is required because JSON columns (e.g.
+* `_plugin_storage.data`) are `text`, and `text ->> unknown` is not an
+* operator. The cast is immutable, so the same expression works in
+* expression indexes — queries and indexes must build it through this
+* helper so the planner can match them.
+*/
+function jsonExtractExpr(db, column, path) {
+	validateIdentifier(column, "JSON column name");
+	validateJsonFieldName(path, "JSON path");
+	if (isPostgres(db)) return `(${column})::jsonb->>'${path}'`;
+	return `json_extract(${column}, '$.${path}')`;
+}
+/**
+* SQL expression for extracting a queryable field from the plugin-storage
+* `data` column.
+*
+* `_plugin_storage.data` is `text`, so Postgres extraction goes through the
+* `(data)::jsonb->>'field'` cast (#1898) — otherwise `text ->> unknown` is not
+* an operator. But the extracted value is still `text`, so a numeric comparison
+* (`stock >= 10`) compares lexically (`'9' >= '10'` is TRUE) and silently
+* over-counts / oversells; pass `{ numeric: true }` for a numeric comparison.
+*
+* The numeric form is a **type-guarded** cast, not a bare `::numeric`. A bare
+* cast throws `invalid input syntax for type numeric` the moment a single
+* scanned row stores a non-number in that field (documents are schemaless),
+* aborting the whole query — and it would diverge from SQLite, which silently
+* coerces. Guarding with `jsonb_typeof`/`json_type` makes the comparison total
+* and parity-correct on both dialects: a non-number stored value yields `NULL`
+* (no match) instead of an error.
+*
+* The field name is validated before interpolation, so the casts wrap only a
+* safe identifier and add no injection surface.
+*
+* sqlite text:      json_extract(data, '$.field')
+* sqlite numeric:   CASE WHEN json_type(data, '$.field') IN ('integer', 'real')
+*                     THEN json_extract(data, '$.field') END
+* postgres text:    (data)::jsonb->>'field'
+* postgres numeric: CASE WHEN jsonb_typeof((data)::jsonb->'field') = 'number'
+*                     THEN ((data)::jsonb->>'field')::numeric END
+*/
+function pluginDataExtractExpr(db, field, options) {
+	validateJsonFieldName(field, "plugin storage field name");
+	if (isPostgres(db)) {
+		const text = `(data)::jsonb->>'${field}'`;
+		if (!options?.numeric) return text;
+		return `CASE WHEN jsonb_typeof((data)::jsonb->'${field}') = 'number' THEN (${text})::numeric END`;
+	}
+	const extract = `json_extract(data, '$.${field}')`;
+	if (!options?.numeric) return extract;
+	return `CASE WHEN json_type(data, '$.${field}') IN ('integer', 'real') THEN ${extract} END`;
+}
+/**
+* Build the new value of the `_plugin_storage.data` (text-JSON) column for a
+* guarded `updateIf`, composing wholesale `set` fields and integer `delta`
+* fields into a SINGLE dialect-correct expression.
+*
+* Both branches go through `json_set` / `jsonb_set` so the write never rewrites
+* the whole column from JS (which would require a read-then-write and break the
+* single-statement atomicity that makes no-oversell hold):
+*
+* - **set** field → the value is stored via `json(?)` (SQLite) / `?::jsonb`
+*   (Postgres) with `JSON.stringify(value)`, uniformly handling scalars,
+*   objects, arrays, and `null` (stored as JSON `null`, never SQL `NULL` — a
+*   SQL `NULL` in `jsonb_set` would null the entire `data` column and hit the
+*   `NOT NULL` constraint).
+* - **delta** field → `COALESCE(<numeric extract>, 0) + n`, where the extract
+*   is the type-guarded numeric form from {@link pluginDataExtractExpr} so a
+*   missing or null stored value coalesces to `0` on both dialects. The update
+*   guard rejects invalid counters and unsafe results. Integer arithmetic stays
+*   integer (Postgres `to_jsonb(numeric)` and SQLite integer `+` both round-trip
+*   without a spurious `.0`).
+*
+* Field names are validated (`validateJsonFieldName` / `pluginDataExtractExpr`)
+* before interpolation, so the JSON path is a safe identifier and values are
+* bound parameters — no injection surface.
+*
+* SQLite:   json_set(json_set(data, '$.f1', json(?)), '$.f2', COALESCE(json_extract(...), 0) + ?)
+* Postgres: (jsonb_set(jsonb_set(data::jsonb, '{f1}', ?::jsonb), '{f2}', to_jsonb(COALESCE(..., 0) + ?)))::text
+*/
+function pluginDataWriteExpr(db, setEntries, deltaEntries) {
+	const pg = isPostgres(db);
+	let expr = pg ? sql`data::jsonb` : sql`data`;
+	for (const [field, value] of setEntries) {
+		validateJsonFieldName(field, "plugin storage set field name");
+		const json = JSON.stringify(value ?? null);
+		if (pg) expr = sql`jsonb_set(${expr}, ${sql.lit(`{${field}}`)}, ${json}::jsonb)`;
+		else expr = sql`json_set(${expr}, ${sql.lit(`$.${field}`)}, json(${json}))`;
+	}
+	for (const [field, n] of deltaEntries) {
+		const numericExtract = pluginDataExtractExpr(db, field, { numeric: true });
+		if (pg) expr = sql`jsonb_set(${expr}, ${sql.lit(`{${field}}`)}, to_jsonb(COALESCE(${sql.raw(numericExtract)}, 0) + ${n}))`;
+		else expr = sql`json_set(${expr}, ${sql.lit(`$.${field}`)}, cast(COALESCE(${sql.raw(numericExtract)}, 0) as integer) + cast(${n} as integer))`;
+	}
+	if (pg) return sql`(${expr})::text`;
+	return sql`${expr}`;
+}
+function pluginDataUpdateGuard(db, deltaEntries) {
+	const pg = isPostgres(db);
+	const conditions = [pg ? sql`jsonb_typeof(data::jsonb) = 'object'` : sql`json_type(data) = 'object'`];
+	for (const [field, amount] of deltaEntries) {
+		const numeric = sql.raw(pluginDataExtractExpr(db, field, { numeric: true }));
+		const type = pg ? sql`jsonb_typeof(data::jsonb -> ${sql.lit(field)})` : sql`json_type(data, ${sql.lit(`$.${field}`)})`;
+		const base = sql`coalesce(${numeric}, 0)`;
+		const integral = pg ? sql`${base} = trunc(${base})` : sql`${base} = cast(${base} as integer)`;
+		const lower = Math.max(Number.MIN_SAFE_INTEGER, Number.MIN_SAFE_INTEGER - amount);
+		const upper = Math.min(Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER - amount);
+		conditions.push(sql`((${type} is null or ${type} = 'null' or ${numeric} is not null)
+			and ${integral} and ${base} >= ${lower} and ${base} <= ${upper})`);
+	}
+	return sql`(${sql.join(conditions, sql` and `)})`;
+}
+/**
+* SQL expression for ordering plugin-storage rows by a `data` field.
+*
+* `ORDER BY` has no bound operand to infer numeric-vs-text from, so extracting
+* as text (`->>'field'`) would sort a numeric field lexically on Postgres
+* (`[10, 100, 9]`) while SQLite's `json_extract` sorts it numerically — a
+* cross-dialect divergence. Ordering over the jsonb-native value (`->'field'`,
+* single arrow) fixes this: jsonb btree ordering is numeric among numbers,
+* lexical among strings, and total across heterogeneous values (never throws).
+* SQLite's `json_extract` already orders numerically, so it is unchanged.
+*
+* sqlite:   json_extract(data, '$.field')
+* postgres: (data)::jsonb->'field'
+*/
+function pluginDataOrderExpr(db, field) {
+	validateJsonFieldName(field, "plugin storage order field name");
+	if (isPostgres(db)) return `(data)::jsonb->'${field}'`;
+	return `json_extract(data, '$.${field}')`;
+}
+
+//#endregion
+export { pluginDataUpdateGuard as _, currentTimestamp as a, executeAtomicBatchIfSupported as c, isSqlite as d, jsonExtractExpr as f, pluginDataOrderExpr as g, pluginDataExtractExpr as h, compoundSelectLimit as i, indexExists as l, listTablesLike as m, buildStatusCondition as n, currentTimestampValue as o, listTableColumns as p, columnExists as r, detectDialect as s, binaryType as t, isPostgres as u, pluginDataWriteExpr as v, tableExists as y };
+//# sourceMappingURL=dialect-helpers-7_IqPdh9.mjs.map

package/dist/dialect-helpers-7_IqPdh9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialect-helpers-7_IqPdh9.mjs","names":[],"sources":["../src/database/dialect-helpers.ts"],"sourcesContent":["/**\n * Dialect-specific SQL helpers\n *\n * Every function takes a Kysely `db` instance and detects the dialect from\n * the adapter class. No module-level state, no globals, no heuristics —\n * the adapter is the source of truth.\n *\n * This is NOT an ORM abstraction — just targeted helpers for the ~15 places\n * that use raw dialect-specific SQL. Most Kysely schema builder code already\n * works cross-dialect.\n */\n\nimport type {\n\tColumnDataType,\n\tCompilable,\n\tCompiledQuery,\n\tKysely,\n\tQueryResult,\n\tRawBuilder,\n} from \"kysely\";\nimport { PostgresAdapter, sql } from \"kysely\";\n\nimport type { DatabaseDialectType } from \"../db/adapters.js\";\nimport type { Database } from \"./types.js\";\nimport { validateIdentifier, validateJsonFieldName } from \"./validate.js\";\n\nexport type { DatabaseDialectType };\n\n/**\n * Detect dialect type from a Kysely instance via the adapter class.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function detectDialect(db: Kysely<any>): DatabaseDialectType {\n\tif (db.getExecutor().adapter instanceof PostgresAdapter) return \"postgres\";\n\treturn \"sqlite\";\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function isSqlite(db: Kysely<any>): boolean {\n\treturn detectDialect(db) === \"sqlite\";\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function isPostgres(db: Kysely<any>): boolean {\n\treturn detectDialect(db) === \"postgres\";\n}\n\n/**\n * Declared by an adapter whose backend caps the number of terms in a compound\n * SELECT (`UNION ALL`, `INTERSECT`, `EXCEPT`). SQLite's own\n * SQLITE_LIMIT_COMPOUND_SELECT default is 500 — high enough that no query\n * EmDash builds approaches it — but Cloudflare D1 sets it to 5 and rejects\n * anything larger with \"too many terms in compound SELECT\".\n */\nexport interface CompoundSelectLimitedAdapter {\n\t/** Maximum terms per compound SELECT. Must be a positive integer. */\n\treadonly compoundSelectLimit: number;\n}\n\n/**\n * Declared by an adapter that can execute independent compiled statements as\n * one atomic batch. The statements run in order and either all commit or none\n * do. D1 exposes this through `D1Database.batch()` even though it does not\n * support Kysely's interactive transaction API.\n */\nexport interface AtomicBatchAdapter {\n\texecuteAtomicBatch(queries: readonly CompiledQuery[]): Promise<readonly QueryResult<unknown>[]>;\n}\n\n/**\n * Execute a fixed statement list atomically when the active adapter supports\n * it. Returns `null` for adapters that should use an ordinary transaction.\n */\nexport async function executeAtomicBatchIfSupported<DB>(\n\tdb: Kysely<DB>,\n\tqueries: readonly (Compilable | RawBuilder<unknown>)[],\n): Promise<readonly QueryResult<unknown>[] | null> {\n\tconst adapter: object = db.getExecutor().adapter;\n\tif (!(\"executeAtomicBatch\" in adapter) || typeof adapter.executeAtomicBatch !== \"function\") {\n\t\treturn null;\n\t}\n\n\treturn adapter.executeAtomicBatch(\n\t\tqueries.map((query) => (\"isRawBuilder\" in query ? query.compile(db) : query.compile())),\n\t);\n}\n\n/**\n * The backend's compound-SELECT ceiling, or null when it has none worth\n * splitting statements for. Only the adapter knows: the limit is a property of\n * the SQLite build behind the dialect, not of the SQL flavour, so two \"sqlite\"\n * dialects can answer differently.\n *\n * A declared ceiling must be a positive integer — callers batch by it, and\n * every other value silently misbehaves rather than failing: 0 and negatives\n * never advance the batch cursor, fractions overlap batches and double-count,\n * NaN yields an empty batch. A malformed declaration throws here, where the\n * message can name the adapter.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function compoundSelectLimit(db: Kysely<any>): number | null {\n\tconst adapter: object = db.getExecutor().adapter;\n\tif (!(\"compoundSelectLimit\" in adapter)) return null;\n\n\tconst limit: unknown = adapter.compoundSelectLimit;\n\tif (typeof limit !== \"number\" || !Number.isInteger(limit) || limit < 1) {\n\t\tthrow new Error(\n\t\t\t`${adapter.constructor.name} declares compoundSelectLimit ${String(limit)}; it must be a positive integer.`,\n\t\t);\n\t}\n\treturn limit;\n}\n\n/**\n * Default timestamp expression for column defaults.\n * Wrapped in parens for use in CREATE TABLE ... DEFAULT (...).\n *\n * sqlite:   (datetime('now'))\n * postgres: CURRENT_TIMESTAMP\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function currentTimestamp(db: Kysely<any>): RawBuilder<string> {\n\tif (isPostgres(db)) {\n\t\treturn sql`CURRENT_TIMESTAMP`;\n\t}\n\treturn sql`(datetime('now'))`;\n}\n\n/**\n * Timestamp expression for use in WHERE clauses and SET expressions.\n * No wrapping parens.\n *\n * sqlite:   datetime('now')\n * postgres: CURRENT_TIMESTAMP\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function currentTimestampValue(db: Kysely<any>): RawBuilder<string> {\n\tif (isPostgres(db)) {\n\t\treturn sql`CURRENT_TIMESTAMP`;\n\t}\n\treturn sql`datetime('now')`;\n}\n\n/**\n * Build WHERE clause for status filtering on a content table.\n * Scheduled content becomes public only after the publication sweep commits\n * the row with a literal `published` status.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function buildStatusCondition(\n\t_db: Kysely<any>,\n\tstatus: string,\n\ttablePrefix?: string,\n): ReturnType<typeof sql> {\n\tconst statusField = tablePrefix ? `${tablePrefix}.status` : \"status\";\n\treturn sql`${sql.ref(statusField)} = ${status}`;\n}\n\n/**\n * Check if a table exists in the database.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function tableExists(db: Kysely<any>, tableName: string): Promise<boolean> {\n\tif (isPostgres(db)) {\n\t\t// Scope to the active schema (matches indexExists/columnExists below).\n\t\t// Hardcoding 'public' breaks non-public-schema Postgres deployments.\n\t\tconst result = await sql<{ exists: boolean }>`\n\t\t\tSELECT EXISTS(\n\t\t\t\tSELECT 1 FROM information_schema.tables\n\t\t\t\tWHERE table_schema = current_schema() AND table_name = ${tableName}\n\t\t\t) as exists\n\t\t`.execute(db);\n\t\treturn result.rows[0]?.exists === true;\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM sqlite_master\n\t\tWHERE type = 'table' AND name = ${tableName}\n\t`.execute(db);\n\treturn result.rows.length > 0;\n}\n\n/**\n * Check if an index exists in the database.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function indexExists(db: Kysely<any>, indexName: string): Promise<boolean> {\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{ exists: boolean }>`\n\t\t\tSELECT EXISTS(\n\t\t\t\tSELECT 1 FROM pg_indexes\n\t\t\t\tWHERE schemaname = current_schema() AND indexname = ${indexName}\n\t\t\t) as exists\n\t\t`.execute(db);\n\t\treturn result.rows[0]?.exists === true;\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM sqlite_master\n\t\tWHERE type = 'index' AND name = ${indexName}\n\t`.execute(db);\n\treturn result.rows.length > 0;\n}\n\n/**\n * Check if a column exists in the database.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function columnExists(\n\tdb: Kysely<any>,\n\ttableName: string,\n\tcolumnName: string,\n): Promise<boolean> {\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{ exists: boolean }>`\n\t\t\tSELECT EXISTS(\n\t\t\t\tSELECT 1 FROM information_schema.columns\n\t\t\t\tWHERE table_schema = current_schema()\n\t\t\t\t\tAND table_name = ${tableName}\n\t\t\t\t\tAND column_name = ${columnName}\n\t\t\t) as exists\n\t\t`.execute(db);\n\t\treturn result.rows[0]?.exists === true;\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM pragma_table_info(${tableName})\n\t\tWHERE name = ${columnName}\n\t`.execute(db);\n\treturn result.rows.length > 0;\n}\n\n/**\n * List tables matching a LIKE pattern.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function listTablesLike(db: Kysely<any>, pattern: string): Promise<string[]> {\n\tif (isPostgres(db)) {\n\t\t// Scope to the connection's active schema rather than hardcoding\n\t\t// 'public'. A Postgres deployment using a non-public schema (per-tenant\n\t\t// or shared-cluster setups), or per-test schemas, otherwise sees tables\n\t\t// from the wrong schema — or none at all. Mirrors migration 038.\n\t\tconst result = await sql<{ table_name: string }>`\n\t\t\tSELECT table_name FROM information_schema.tables\n\t\t\tWHERE table_schema = current_schema() AND table_name LIKE ${pattern}\n\t\t\tORDER BY table_name\n\t\t`.execute(db);\n\t\treturn result.rows.map((r) => r.table_name);\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM sqlite_master\n\t\tWHERE type = 'table' AND name LIKE ${pattern}\n\t\tORDER BY name\n\t`.execute(db);\n\treturn result.rows.map((r) => r.name);\n}\n\nexport interface TableColumnInfo {\n\tname: string;\n\ttype: string;\n}\n\n/**\n * List a table's columns in declaration order.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function listTableColumns(\n\tdb: Kysely<any>,\n\ttableName: string,\n): Promise<TableColumnInfo[]> {\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{\n\t\t\tcolumn_name: string;\n\t\t\tdata_type: string;\n\t\t}>`\n\t\t\tSELECT column_name, data_type\n\t\t\tFROM information_schema.columns\n\t\t\tWHERE table_schema = current_schema() AND table_name = ${tableName}\n\t\t\tORDER BY ordinal_position\n\t\t`.execute(db);\n\t\treturn result.rows.map((column) => ({\n\t\t\tname: column.column_name,\n\t\t\ttype: column.data_type,\n\t\t}));\n\t}\n\n\tconst result = await sql<{ name: string; type: string }>`\n\t\tSELECT name, type\n\t\tFROM pragma_table_info(${tableName})\n\t\tORDER BY cid\n\t`.execute(db);\n\treturn result.rows;\n}\n\n/**\n * Column type for binary data.\n *\n * sqlite:   blob\n * postgres: bytea\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function binaryType(db: Kysely<any>): ColumnDataType {\n\tif (isPostgres(db)) {\n\t\treturn \"bytea\";\n\t}\n\treturn \"blob\";\n}\n\n/**\n * SQL expression for extracting a field from a JSON column stored as text.\n *\n * sqlite:   json_extract(column, '$.path')\n * postgres: (column)::jsonb->>'path'\n *\n * The Postgres cast is required because JSON columns (e.g.\n * `_plugin_storage.data`) are `text`, and `text ->> unknown` is not an\n * operator. The cast is immutable, so the same expression works in\n * expression indexes — queries and indexes must build it through this\n * helper so the planner can match them.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function jsonExtractExpr(db: Kysely<any>, column: string, path: string): string {\n\tvalidateIdentifier(column, \"JSON column name\");\n\tvalidateJsonFieldName(path, \"JSON path\");\n\tif (isPostgres(db)) {\n\t\treturn `(${column})::jsonb->>'${path}'`;\n\t}\n\treturn `json_extract(${column}, '$.${path}')`;\n}\n\n/**\n * SQL expression for extracting a queryable field from the plugin-storage\n * `data` column.\n *\n * `_plugin_storage.data` is `text`, so Postgres extraction goes through the\n * `(data)::jsonb->>'field'` cast (#1898) — otherwise `text ->> unknown` is not\n * an operator. But the extracted value is still `text`, so a numeric comparison\n * (`stock >= 10`) compares lexically (`'9' >= '10'` is TRUE) and silently\n * over-counts / oversells; pass `{ numeric: true }` for a numeric comparison.\n *\n * The numeric form is a **type-guarded** cast, not a bare `::numeric`. A bare\n * cast throws `invalid input syntax for type numeric` the moment a single\n * scanned row stores a non-number in that field (documents are schemaless),\n * aborting the whole query — and it would diverge from SQLite, which silently\n * coerces. Guarding with `jsonb_typeof`/`json_type` makes the comparison total\n * and parity-correct on both dialects: a non-number stored value yields `NULL`\n * (no match) instead of an error.\n *\n * The field name is validated before interpolation, so the casts wrap only a\n * safe identifier and add no injection surface.\n *\n * sqlite text:      json_extract(data, '$.field')\n * sqlite numeric:   CASE WHEN json_type(data, '$.field') IN ('integer', 'real')\n *                     THEN json_extract(data, '$.field') END\n * postgres text:    (data)::jsonb->>'field'\n * postgres numeric: CASE WHEN jsonb_typeof((data)::jsonb->'field') = 'number'\n *                     THEN ((data)::jsonb->>'field')::numeric END\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function pluginDataExtractExpr(\n\tdb: Kysely<any>,\n\tfield: string,\n\toptions?: { numeric?: boolean },\n): string {\n\tvalidateJsonFieldName(field, \"plugin storage field name\");\n\tif (isPostgres(db)) {\n\t\tconst text = `(data)::jsonb->>'${field}'`;\n\t\tif (!options?.numeric) return text;\n\t\treturn `CASE WHEN jsonb_typeof((data)::jsonb->'${field}') = 'number' THEN (${text})::numeric END`;\n\t}\n\tconst extract = `json_extract(data, '$.${field}')`;\n\tif (!options?.numeric) return extract;\n\treturn `CASE WHEN json_type(data, '$.${field}') IN ('integer', 'real') THEN ${extract} END`;\n}\n\n/**\n * Build the new value of the `_plugin_storage.data` (text-JSON) column for a\n * guarded `updateIf`, composing wholesale `set` fields and integer `delta`\n * fields into a SINGLE dialect-correct expression.\n *\n * Both branches go through `json_set` / `jsonb_set` so the write never rewrites\n * the whole column from JS (which would require a read-then-write and break the\n * single-statement atomicity that makes no-oversell hold):\n *\n * - **set** field → the value is stored via `json(?)` (SQLite) / `?::jsonb`\n *   (Postgres) with `JSON.stringify(value)`, uniformly handling scalars,\n *   objects, arrays, and `null` (stored as JSON `null`, never SQL `NULL` — a\n *   SQL `NULL` in `jsonb_set` would null the entire `data` column and hit the\n *   `NOT NULL` constraint).\n * - **delta** field → `COALESCE(<numeric extract>, 0) + n`, where the extract\n *   is the type-guarded numeric form from {@link pluginDataExtractExpr} so a\n *   missing or null stored value coalesces to `0` on both dialects. The update\n *   guard rejects invalid counters and unsafe results. Integer arithmetic stays\n *   integer (Postgres `to_jsonb(numeric)` and SQLite integer `+` both round-trip\n *   without a spurious `.0`).\n *\n * Field names are validated (`validateJsonFieldName` / `pluginDataExtractExpr`)\n * before interpolation, so the JSON path is a safe identifier and values are\n * bound parameters — no injection surface.\n *\n * SQLite:   json_set(json_set(data, '$.f1', json(?)), '$.f2', COALESCE(json_extract(...), 0) + ?)\n * Postgres: (jsonb_set(jsonb_set(data::jsonb, '{f1}', ?::jsonb), '{f2}', to_jsonb(COALESCE(..., 0) + ?)))::text\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function pluginDataWriteExpr(\n\tdb: Kysely<any>,\n\tsetEntries: Array<[string, unknown]>,\n\tdeltaEntries: Array<[string, number]>,\n): RawBuilder<string> {\n\tconst pg = isPostgres(db);\n\tlet expr: RawBuilder<unknown> = pg ? sql`data::jsonb` : sql`data`;\n\n\tfor (const [field, value] of setEntries) {\n\t\tvalidateJsonFieldName(field, \"plugin storage set field name\");\n\t\tconst json = JSON.stringify(value ?? null);\n\t\tif (pg) {\n\t\t\texpr = sql`jsonb_set(${expr}, ${sql.lit(`{${field}}`)}, ${json}::jsonb)`;\n\t\t} else {\n\t\t\texpr = sql`json_set(${expr}, ${sql.lit(`$.${field}`)}, json(${json}))`;\n\t\t}\n\t}\n\n\tfor (const [field, n] of deltaEntries) {\n\t\tconst numericExtract = pluginDataExtractExpr(db, field, { numeric: true });\n\t\tif (pg) {\n\t\t\texpr = sql`jsonb_set(${expr}, ${sql.lit(`{${field}}`)}, to_jsonb(COALESCE(${sql.raw(numericExtract)}, 0) + ${n}))`;\n\t\t} else {\n\t\t\texpr = sql`json_set(${expr}, ${sql.lit(`$.${field}`)}, cast(COALESCE(${sql.raw(numericExtract)}, 0) as integer) + cast(${n} as integer))`;\n\t\t}\n\t}\n\n\tif (pg) {\n\t\treturn sql<string>`(${expr})::text`;\n\t}\n\treturn sql<string>`${expr}`;\n}\n\nexport function pluginDataUpdateGuard(\n\tdb: Kysely<Database>,\n\tdeltaEntries: Array<[string, number]>,\n): RawBuilder<boolean> {\n\tconst pg = isPostgres(db);\n\tconst conditions: RawBuilder<boolean>[] = [\n\t\tpg ? sql`jsonb_typeof(data::jsonb) = 'object'` : sql`json_type(data) = 'object'`,\n\t];\n\tfor (const [field, amount] of deltaEntries) {\n\t\tconst numeric = sql.raw(pluginDataExtractExpr(db, field, { numeric: true }));\n\t\tconst type = pg\n\t\t\t? sql`jsonb_typeof(data::jsonb -> ${sql.lit(field)})`\n\t\t\t: sql`json_type(data, ${sql.lit(`$.${field}`)})`;\n\t\tconst base = sql`coalesce(${numeric}, 0)`;\n\t\tconst integral = pg ? sql`${base} = trunc(${base})` : sql`${base} = cast(${base} as integer)`;\n\t\tconst lower = Math.max(Number.MIN_SAFE_INTEGER, Number.MIN_SAFE_INTEGER - amount);\n\t\tconst upper = Math.min(Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER - amount);\n\t\tconditions.push(sql`((${type} is null or ${type} = 'null' or ${numeric} is not null)\n\t\t\tand ${integral} and ${base} >= ${lower} and ${base} <= ${upper})`);\n\t}\n\treturn sql`(${sql.join(conditions, sql` and `)})`;\n}\n\n/**\n * SQL expression for ordering plugin-storage rows by a `data` field.\n *\n * `ORDER BY` has no bound operand to infer numeric-vs-text from, so extracting\n * as text (`->>'field'`) would sort a numeric field lexically on Postgres\n * (`[10, 100, 9]`) while SQLite's `json_extract` sorts it numerically — a\n * cross-dialect divergence. Ordering over the jsonb-native value (`->'field'`,\n * single arrow) fixes this: jsonb btree ordering is numeric among numbers,\n * lexical among strings, and total across heterogeneous values (never throws).\n * SQLite's `json_extract` already orders numerically, so it is unchanged.\n *\n * sqlite:   json_extract(data, '$.field')\n * postgres: (data)::jsonb->'field'\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function pluginDataOrderExpr(db: Kysely<any>, field: string): string {\n\tvalidateJsonFieldName(field, \"plugin storage order field name\");\n\tif (isPostgres(db)) {\n\t\treturn `(data)::jsonb->'${field}'`;\n\t}\n\treturn `json_extract(data, '$.${field}')`;\n}\n"],"mappings":";;;;;;;AAgCA,SAAgB,cAAc,IAAsC;AACnE,KAAI,GAAG,aAAa,CAAC,mBAAmB,gBAAiB,QAAO;AAChE,QAAO;;AAIR,SAAgB,SAAS,IAA0B;AAClD,QAAO,cAAc,GAAG,KAAK;;AAI9B,SAAgB,WAAW,IAA0B;AACpD,QAAO,cAAc,GAAG,KAAK;;;;;;AA6B9B,eAAsB,8BACrB,IACA,SACkD;CAClD,MAAM,UAAkB,GAAG,aAAa,CAAC;AACzC,KAAI,EAAE,wBAAwB,YAAY,OAAO,QAAQ,uBAAuB,WAC/E,QAAO;AAGR,QAAO,QAAQ,mBACd,QAAQ,KAAK,UAAW,kBAAkB,QAAQ,MAAM,QAAQ,GAAG,GAAG,MAAM,SAAS,CAAE,CACvF;;;;;;;;;;;;;;AAgBF,SAAgB,oBAAoB,IAAgC;CACnE,MAAM,UAAkB,GAAG,aAAa,CAAC;AACzC,KAAI,EAAE,yBAAyB,SAAU,QAAO;CAEhD,MAAM,QAAiB,QAAQ;AAC/B,KAAI,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,MAAM,IAAI,QAAQ,EACpE,OAAM,IAAI,MACT,GAAG,QAAQ,YAAY,KAAK,gCAAgC,OAAO,MAAM,CAAC,kCAC1E;AAEF,QAAO;;;;;;;;;AAWR,SAAgB,iBAAiB,IAAqC;AACrE,KAAI,WAAW,GAAG,CACjB,QAAO,GAAG;AAEX,QAAO,GAAG;;;;;;;;;AAWX,SAAgB,sBAAsB,IAAqC;AAC1E,KAAI,WAAW,GAAG,CACjB,QAAO,GAAG;AAEX,QAAO,GAAG;;;;;;;AASX,SAAgB,qBACf,KACA,QACA,aACyB;CACzB,MAAM,cAAc,cAAc,GAAG,YAAY,WAAW;AAC5D,QAAO,GAAG,GAAG,IAAI,IAAI,YAAY,CAAC,KAAK;;;;;AAOxC,eAAsB,YAAY,IAAiB,WAAqC;AACvF,KAAI,WAAW,GAAG,CASjB,SANe,MAAM,GAAwB;;;6DAGc,UAAU;;IAEnE,QAAQ,GAAG,EACC,KAAK,IAAI,WAAW;AAOnC,SAJe,MAAM,GAAqB;;oCAEP,UAAU;GAC3C,QAAQ,GAAG,EACC,KAAK,SAAS;;;;;AAO7B,eAAsB,YAAY,IAAiB,WAAqC;AACvF,KAAI,WAAW,GAAG,CAOjB,SANe,MAAM,GAAwB;;;0DAGW,UAAU;;IAEhE,QAAQ,GAAG,EACC,KAAK,IAAI,WAAW;AAOnC,SAJe,MAAM,GAAqB;;oCAEP,UAAU;GAC3C,QAAQ,GAAG,EACC,KAAK,SAAS;;;;;AAO7B,eAAsB,aACrB,IACA,WACA,YACmB;AACnB,KAAI,WAAW,GAAG,CASjB,SARe,MAAM,GAAwB;;;;wBAIvB,UAAU;yBACT,WAAW;;IAEhC,QAAQ,GAAG,EACC,KAAK,IAAI,WAAW;AAOnC,SAJe,MAAM,GAAqB;uCACJ,UAAU;iBAChC,WAAW;GACzB,QAAQ,GAAG,EACC,KAAK,SAAS;;;;;AAO7B,eAAsB,eAAe,IAAiB,SAAoC;AACzF,KAAI,WAAW,GAAG,CAUjB,SALe,MAAM,GAA2B;;+DAEa,QAAQ;;IAEnE,QAAQ,GAAG,EACC,KAAK,KAAK,MAAM,EAAE,WAAW;AAQ5C,SALe,MAAM,GAAqB;;uCAEJ,QAAQ;;GAE5C,QAAQ,GAAG,EACC,KAAK,KAAK,MAAM,EAAE,KAAK;;;;;AAYtC,eAAsB,iBACrB,IACA,WAC6B;AAC7B,KAAI,WAAW,GAAG,CAUjB,SATe,MAAM,GAGnB;;;4DAGwD,UAAU;;IAElE,QAAQ,GAAG,EACC,KAAK,KAAK,YAAY;EACnC,MAAM,OAAO;EACb,MAAM,OAAO;EACb,EAAE;AAQJ,SALe,MAAM,GAAmC;;2BAE9B,UAAU;;GAElC,QAAQ,GAAG,EACC;;;;;;;;AAUf,SAAgB,WAAW,IAAiC;AAC3D,KAAI,WAAW,GAAG,CACjB,QAAO;AAER,QAAO;;;;;;;;;;;;;;AAgBR,SAAgB,gBAAgB,IAAiB,QAAgB,MAAsB;AACtF,oBAAmB,QAAQ,mBAAmB;AAC9C,uBAAsB,MAAM,YAAY;AACxC,KAAI,WAAW,GAAG,CACjB,QAAO,IAAI,OAAO,cAAc,KAAK;AAEtC,QAAO,gBAAgB,OAAO,OAAO,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgC3C,SAAgB,sBACf,IACA,OACA,SACS;AACT,uBAAsB,OAAO,4BAA4B;AACzD,KAAI,WAAW,GAAG,EAAE;EACnB,MAAM,OAAO,oBAAoB,MAAM;AACvC,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,SAAO,0CAA0C,MAAM,sBAAsB,KAAK;;CAEnF,MAAM,UAAU,yBAAyB,MAAM;AAC/C,KAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,QAAO,gCAAgC,MAAM,iCAAiC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCvF,SAAgB,oBACf,IACA,YACA,cACqB;CACrB,MAAM,KAAK,WAAW,GAAG;CACzB,IAAI,OAA4B,KAAK,GAAG,gBAAgB,GAAG;AAE3D,MAAK,MAAM,CAAC,OAAO,UAAU,YAAY;AACxC,wBAAsB,OAAO,gCAAgC;EAC7D,MAAM,OAAO,KAAK,UAAU,SAAS,KAAK;AAC1C,MAAI,GACH,QAAO,GAAG,aAAa,KAAK,IAAI,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,IAAI,KAAK;MAE/D,QAAO,GAAG,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC,SAAS,KAAK;;AAIrE,MAAK,MAAM,CAAC,OAAO,MAAM,cAAc;EACtC,MAAM,iBAAiB,sBAAsB,IAAI,OAAO,EAAE,SAAS,MAAM,CAAC;AAC1E,MAAI,GACH,QAAO,GAAG,aAAa,KAAK,IAAI,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC,sBAAsB,IAAI,IAAI,eAAe,CAAC,SAAS,EAAE;MAE/G,QAAO,GAAG,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC,kBAAkB,IAAI,IAAI,eAAe,CAAC,0BAA0B,EAAE;;AAI7H,KAAI,GACH,QAAO,GAAW,IAAI,KAAK;AAE5B,QAAO,GAAW,GAAG;;AAGtB,SAAgB,sBACf,IACA,cACsB;CACtB,MAAM,KAAK,WAAW,GAAG;CACzB,MAAM,aAAoC,CACzC,KAAK,GAAG,yCAAyC,GAAG,6BACpD;AACD,MAAK,MAAM,CAAC,OAAO,WAAW,cAAc;EAC3C,MAAM,UAAU,IAAI,IAAI,sBAAsB,IAAI,OAAO,EAAE,SAAS,MAAM,CAAC,CAAC;EAC5E,MAAM,OAAO,KACV,GAAG,+BAA+B,IAAI,IAAI,MAAM,CAAC,KACjD,GAAG,mBAAmB,IAAI,IAAI,KAAK,QAAQ,CAAC;EAC/C,MAAM,OAAO,GAAG,YAAY,QAAQ;EACpC,MAAM,WAAW,KAAK,GAAG,GAAG,KAAK,WAAW,KAAK,KAAK,GAAG,GAAG,KAAK,UAAU,KAAK;EAChF,MAAM,QAAQ,KAAK,IAAI,OAAO,kBAAkB,OAAO,mBAAmB,OAAO;EACjF,MAAM,QAAQ,KAAK,IAAI,OAAO,kBAAkB,OAAO,mBAAmB,OAAO;AACjF,aAAW,KAAK,GAAG,KAAK,KAAK,cAAc,KAAK,eAAe,QAAQ;SAChE,SAAS,OAAO,KAAK,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,GAAG;;AAEpE,QAAO,GAAG,IAAI,IAAI,KAAK,YAAY,GAAG,QAAQ,CAAC;;;;;;;;;;;;;;;;AAkBhD,SAAgB,oBAAoB,IAAiB,OAAuB;AAC3E,uBAAsB,OAAO,kCAAkC;AAC/D,KAAI,WAAW,GAAG,CACjB,QAAO,mBAAmB,MAAM;AAEjC,QAAO,yBAAyB,MAAM"}

package/dist/digest-BarSh-pN.mjs

@@ -0,0 +1,194 @@
+import { n as canonicalJson } from "./canonical-YhEQezjg.mjs";
+import { SHA256 } from "@oslojs/crypto/sha2";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+
+//#region src/transfer/format/digest.ts
+/**
+* SHA-256 hashing and the digests that identify packages, plans, receipts,
+* and verified target state.
+*
+* Digest rules (formatVersion "1"):
+* - `packageDigest = "sha256:" + hex(sha256(utf8(canonicalJson(manifest))))`
+* - `planDigest = "sha256:" + hex(sha256(utf8(canonicalJson(plan))))` over the
+*   complete {@link SiteImportPlan} including its `decisions`, `packageDigest`
+*   and `target.siteId`, so a plan cannot be replayed against another package
+*   or target.
+* - `receiptDigest` covers the receipt with its `receiptDigest` property
+*   removed.
+* - A record's hash is the hex SHA-256 of its canonical JSON (the NDJSON line
+*   without its newline).
+* - A chunk's logical hash is
+*   `hex(sha256(utf8(canonicalJson([[id, recordSha256], …]))))` over the
+*   records of one package record chunk, in chunk order, each record in its
+*   predicted target form (after declared transformations).
+* - `logicalDigest = "sha256:" + hex(sha256(utf8(canonicalJson(chunks))))`
+*   where `chunks` is `[[kind, seq, chunkLogicalSha256], …]` for every record
+*   chunk in package order (kinds in `RECORD_KINDS` order, then `seq`).
+*   `principal` chunks are excluded because principals are never written to
+*   a target. The two-level shape lets verification run in bounded steps and
+*   persist one hash per chunk instead of an in-progress hash state.
+*/
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+function isSha256Hex(value) {
+	return typeof value === "string" && SHA256_HEX_PATTERN.test(value);
+}
+function isSha256Digest(value) {
+	return typeof value === "string" && SHA256_DIGEST_PATTERN.test(value);
+}
+function toSha256Digest(hex) {
+	if (!isSha256Hex(hex)) throw new TypeError("Expected a lowercase hex SHA-256");
+	return `sha256:${hex}`;
+}
+function isDigestStreamConstructor(value) {
+	return typeof value === "function";
+}
+function isNodeCreateHash(value) {
+	return typeof value === "function";
+}
+function getDigestStream() {
+	const candidate = typeof globalThis.crypto === "object" ? Reflect.get(globalThis.crypto, "DigestStream") : void 0;
+	return isDigestStreamConstructor(candidate) ? candidate : void 0;
+}
+function isNodeRuntime() {
+	const processLike = Reflect.get(globalThis, "process");
+	if (typeof processLike !== "object" || processLike === null) return false;
+	const versions = Reflect.get(processLike, "versions");
+	return typeof versions === "object" && versions !== null && typeof Reflect.get(versions, "node") === "string";
+}
+let nodeCreateHash;
+function loadNodeCreateHash() {
+	nodeCreateHash ??= (async () => {
+		if (!isNodeRuntime()) return null;
+		try {
+			const nodeCrypto = await import("node:crypto");
+			return isNodeCreateHash(nodeCrypto.createHash) ? nodeCrypto.createHash : null;
+		} catch {
+			return null;
+		}
+	})();
+	return nodeCreateHash;
+}
+async function preferredBackend() {
+	if (getDigestStream()) return "digest-stream";
+	if (await loadNodeCreateHash()) return "node";
+	return "oslo";
+}
+var DigestStreamHasher = class {
+	backend = "digest-stream";
+	#stream;
+	#writer;
+	#failure;
+	constructor(DigestStream) {
+		this.#stream = new DigestStream("SHA-256");
+		this.#writer = this.#stream.getWriter();
+	}
+	update(chunk) {
+		this.#writer.write(chunk.slice()).catch((error) => {
+			this.#failure ??= error;
+		});
+	}
+	async digest() {
+		await this.#writer.close();
+		if (this.#failure !== void 0) throw this.#failure;
+		return encodeHexLowerCase(new Uint8Array(await this.#stream.digest));
+	}
+};
+var NodeHasher = class {
+	backend = "node";
+	#hash;
+	constructor(createHash) {
+		this.#hash = createHash("sha256");
+	}
+	update(chunk) {
+		this.#hash.update(chunk);
+	}
+	async digest() {
+		return this.#hash.digest("hex");
+	}
+};
+var OsloHasher = class {
+	backend = "oslo";
+	#hash = new SHA256();
+	update(chunk) {
+		this.#hash.update(chunk);
+	}
+	async digest() {
+		return encodeHexLowerCase(this.#hash.digest());
+	}
+};
+async function createSha256(options = {}) {
+	switch (options.backend ?? await preferredBackend()) {
+		case "digest-stream": {
+			const DigestStream = getDigestStream();
+			if (!DigestStream) throw new Error("crypto.DigestStream is not available");
+			return new DigestStreamHasher(DigestStream);
+		}
+		case "node": {
+			const createHash = await loadNodeCreateHash();
+			if (!createHash) throw new Error("node:crypto is not available");
+			return new NodeHasher(createHash);
+		}
+		case "oslo": return new OsloHasher();
+	}
+}
+const encoder = new TextEncoder();
+async function sha256Hex(data) {
+	const bytes = typeof data === "string" ? encoder.encode(data) : data;
+	const hasher = await createSha256();
+	hasher.update(bytes);
+	return hasher.digest();
+}
+/** `"sha256:" + hex(sha256(utf8(canonicalJson(value))))`. */
+async function canonicalDigest(value) {
+	return toSha256Digest(await sha256Hex(canonicalJson(value)));
+}
+/** Hex SHA-256 of a record's canonical JSON (its NDJSON line without the newline). */
+async function recordSha256(record) {
+	return sha256Hex(canonicalJson(record));
+}
+function packageDigest(manifest) {
+	return canonicalDigest(manifest);
+}
+function planDigest(plan) {
+	return canonicalDigest(plan);
+}
+/** Digest over a receipt without its own `receiptDigest` property. */
+function receiptDigest(receipt) {
+	const { receiptDigest: _ignored, ...rest } = receipt;
+	return canonicalDigest(rest);
+}
+/** Hex logical hash of one record chunk from its `[id, recordSha256]` pairs in chunk order. */
+async function chunkLogicalSha256(records) {
+	for (const [, sha] of records) if (!isSha256Hex(sha)) throw new TypeError("Expected a lowercase hex SHA-256");
+	return sha256Hex(canonicalJson(records.map(([id, sha]) => [id, sha])));
+}
+/** `logicalDigest` from `[kind, seq, chunkLogicalSha256]` tuples in package order. */
+async function logicalDigest(chunks) {
+	for (const [, , sha] of chunks) if (!isSha256Hex(sha)) throw new TypeError("Expected a lowercase hex SHA-256");
+	return canonicalDigest(chunks.map(([kind, seq, sha]) => [
+		kind,
+		seq,
+		sha
+	]));
+}
+/**
+* Pass-through stream that feeds every chunk to `hasher` and counts bytes.
+* Throws inside the stream as soon as more than `maxBytes` flow through.
+*/
+function createHashingStream(hasher, options = {}) {
+	let total = 0;
+	return {
+		stream: new TransformStream({ transform(chunk, controller) {
+			total += chunk.byteLength;
+			if (options.maxBytes !== void 0 && total > options.maxBytes) throw options.onLimitExceeded?.() ?? /* @__PURE__ */ new RangeError("Stream exceeded its declared size");
+			hasher.update(chunk);
+			controller.enqueue(chunk);
+		} }),
+		bytes: () => total
+	};
+}
+
+//#endregion
+export { isSha256Digest as a, planDigest as c, sha256Hex as d, toSha256Digest as f, createSha256 as i, receiptDigest as l, chunkLogicalSha256 as n, logicalDigest as o, createHashingStream as r, packageDigest as s, canonicalDigest as t, recordSha256 as u };
+//# sourceMappingURL=digest-BarSh-pN.mjs.map

package/dist/digest-BarSh-pN.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest-BarSh-pN.mjs","names":["#stream","#writer","#failure","#hash"],"sources":["../src/transfer/format/digest.ts"],"sourcesContent":["/**\n * SHA-256 hashing and the digests that identify packages, plans, receipts,\n * and verified target state.\n *\n * Digest rules (formatVersion \"1\"):\n * - `packageDigest = \"sha256:\" + hex(sha256(utf8(canonicalJson(manifest))))`\n * - `planDigest = \"sha256:\" + hex(sha256(utf8(canonicalJson(plan))))` over the\n *   complete {@link SiteImportPlan} including its `decisions`, `packageDigest`\n *   and `target.siteId`, so a plan cannot be replayed against another package\n *   or target.\n * - `receiptDigest` covers the receipt with its `receiptDigest` property\n *   removed.\n * - A record's hash is the hex SHA-256 of its canonical JSON (the NDJSON line\n *   without its newline).\n * - A chunk's logical hash is\n *   `hex(sha256(utf8(canonicalJson([[id, recordSha256], …]))))` over the\n *   records of one package record chunk, in chunk order, each record in its\n *   predicted target form (after declared transformations).\n * - `logicalDigest = \"sha256:\" + hex(sha256(utf8(canonicalJson(chunks))))`\n *   where `chunks` is `[[kind, seq, chunkLogicalSha256], …]` for every record\n *   chunk in package order (kinds in `RECORD_KINDS` order, then `seq`).\n *   `principal` chunks are excluded because principals are never written to\n *   a target. The two-level shape lets verification run in bounded steps and\n *   persist one hash per chunk instead of an in-progress hash state.\n */\n\nimport { SHA256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\n\nimport { canonicalJson } from \"./canonical.js\";\n\nexport type Sha256Digest = `sha256:${string}`;\n\nconst SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;\nconst SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;\n\nexport function isSha256Hex(value: unknown): value is string {\n\treturn typeof value === \"string\" && SHA256_HEX_PATTERN.test(value);\n}\n\nexport function isSha256Digest(value: unknown): value is Sha256Digest {\n\treturn typeof value === \"string\" && SHA256_DIGEST_PATTERN.test(value);\n}\n\nexport function toSha256Digest(hex: string): Sha256Digest {\n\tif (!isSha256Hex(hex)) throw new TypeError(\"Expected a lowercase hex SHA-256\");\n\treturn `sha256:${hex}`;\n}\n\nexport function sha256HexOf(digest: Sha256Digest): string {\n\tif (!isSha256Digest(digest)) throw new TypeError(\"Expected a sha256: digest\");\n\treturn digest.slice(\"sha256:\".length);\n}\n\n/** Incremental SHA-256. `update` never retains the chunk after it returns. */\nexport interface Sha256Hasher {\n\treadonly backend: Sha256Backend;\n\tupdate(chunk: Uint8Array): void;\n\t/** Lowercase hex digest. The hasher must not be used afterwards. */\n\tdigest(): Promise<string>;\n}\n\nexport type Sha256Backend = \"digest-stream\" | \"node\" | \"oslo\";\n\ninterface DigestStreamLike extends WritableStream<ArrayBufferView | ArrayBuffer> {\n\treadonly digest: Promise<ArrayBuffer>;\n}\n\ntype DigestStreamConstructor = new (algorithm: string) => DigestStreamLike;\n\ninterface NodeHash {\n\tupdate(data: Uint8Array): unknown;\n\tdigest(encoding: \"hex\"): string;\n}\n\ntype NodeCreateHash = (algorithm: string) => NodeHash;\n\nfunction isDigestStreamConstructor(value: unknown): value is DigestStreamConstructor {\n\treturn typeof value === \"function\";\n}\n\nfunction isNodeCreateHash(value: unknown): value is NodeCreateHash {\n\treturn typeof value === \"function\";\n}\n\nfunction getDigestStream(): DigestStreamConstructor | undefined {\n\tconst candidate: unknown =\n\t\ttypeof globalThis.crypto === \"object\"\n\t\t\t? Reflect.get(globalThis.crypto, \"DigestStream\")\n\t\t\t: undefined;\n\treturn isDigestStreamConstructor(candidate) ? candidate : undefined;\n}\n\nfunction isNodeRuntime(): boolean {\n\tconst processLike: unknown = Reflect.get(globalThis, \"process\");\n\tif (typeof processLike !== \"object\" || processLike === null) return false;\n\tconst versions: unknown = Reflect.get(processLike, \"versions\");\n\treturn (\n\t\ttypeof versions === \"object\" &&\n\t\tversions !== null &&\n\t\ttypeof Reflect.get(versions, \"node\") === \"string\"\n\t);\n}\n\nlet nodeCreateHash: Promise<NodeCreateHash | null> | undefined;\n\nfunction loadNodeCreateHash(): Promise<NodeCreateHash | null> {\n\tnodeCreateHash ??= (async () => {\n\t\tif (!isNodeRuntime()) return null;\n\t\ttry {\n\t\t\tconst nodeCrypto: { createHash?: unknown } = await import(\"node:crypto\");\n\t\t\treturn isNodeCreateHash(nodeCrypto.createHash) ? nodeCrypto.createHash : null;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t})();\n\treturn nodeCreateHash;\n}\n\nasync function preferredBackend(): Promise<Sha256Backend> {\n\tif (getDigestStream()) return \"digest-stream\";\n\tif (await loadNodeCreateHash()) return \"node\";\n\treturn \"oslo\";\n}\n\nclass DigestStreamHasher implements Sha256Hasher {\n\treadonly backend = \"digest-stream\";\n\treadonly #stream: DigestStreamLike;\n\treadonly #writer: WritableStreamDefaultWriter<ArrayBufferView | ArrayBuffer>;\n\t#failure: unknown;\n\n\tconstructor(DigestStream: DigestStreamConstructor) {\n\t\tthis.#stream = new DigestStream(\"SHA-256\");\n\t\tthis.#writer = this.#stream.getWriter();\n\t}\n\n\tupdate(chunk: Uint8Array): void {\n\t\t// DigestStream consumes its input asynchronously; copy so the caller\n\t\t// may reuse its buffer as soon as update() returns.\n\t\tthis.#writer.write(chunk.slice()).catch((error: unknown) => {\n\t\t\tthis.#failure ??= error;\n\t\t});\n\t}\n\n\tasync digest(): Promise<string> {\n\t\tawait this.#writer.close();\n\t\tif (this.#failure !== undefined) throw this.#failure;\n\t\treturn encodeHexLowerCase(new Uint8Array(await this.#stream.digest));\n\t}\n}\n\nclass NodeHasher implements Sha256Hasher {\n\treadonly backend = \"node\";\n\treadonly #hash: NodeHash;\n\n\tconstructor(createHash: NodeCreateHash) {\n\t\tthis.#hash = createHash(\"sha256\");\n\t}\n\n\tupdate(chunk: Uint8Array): void {\n\t\tthis.#hash.update(chunk);\n\t}\n\n\tasync digest(): Promise<string> {\n\t\treturn this.#hash.digest(\"hex\");\n\t}\n}\n\nclass OsloHasher implements Sha256Hasher {\n\treadonly backend = \"oslo\";\n\treadonly #hash = new SHA256();\n\n\tupdate(chunk: Uint8Array): void {\n\t\tthis.#hash.update(chunk);\n\t}\n\n\tasync digest(): Promise<string> {\n\t\treturn encodeHexLowerCase(this.#hash.digest());\n\t}\n}\n\n/**\n * Backends usable in this runtime, most preferred first: `crypto.DigestStream`\n * (workerd), `node:crypto`, then the pure-JS oslo implementation.\n */\nexport async function availableSha256Backends(): Promise<Sha256Backend[]> {\n\tconst backends: Sha256Backend[] = [];\n\tif (getDigestStream()) backends.push(\"digest-stream\");\n\tif (await loadNodeCreateHash()) backends.push(\"node\");\n\tbackends.push(\"oslo\");\n\treturn backends;\n}\n\nexport async function createSha256(\n\toptions: { backend?: Sha256Backend } = {},\n): Promise<Sha256Hasher> {\n\tconst backend = options.backend ?? (await preferredBackend());\n\tswitch (backend) {\n\t\tcase \"digest-stream\": {\n\t\t\tconst DigestStream = getDigestStream();\n\t\t\tif (!DigestStream) throw new Error(\"crypto.DigestStream is not available\");\n\t\t\treturn new DigestStreamHasher(DigestStream);\n\t\t}\n\t\tcase \"node\": {\n\t\t\tconst createHash = await loadNodeCreateHash();\n\t\t\tif (!createHash) throw new Error(\"node:crypto is not available\");\n\t\t\treturn new NodeHasher(createHash);\n\t\t}\n\t\tcase \"oslo\":\n\t\t\treturn new OsloHasher();\n\t}\n}\n\nconst encoder = new TextEncoder();\n\nexport async function sha256Hex(data: Uint8Array | string): Promise<string> {\n\tconst bytes = typeof data === \"string\" ? encoder.encode(data) : data;\n\tconst hasher = await createSha256();\n\thasher.update(bytes);\n\treturn hasher.digest();\n}\n\n/** `\"sha256:\" + hex(sha256(utf8(canonicalJson(value))))`. */\nexport async function canonicalDigest(value: unknown): Promise<Sha256Digest> {\n\treturn toSha256Digest(await sha256Hex(canonicalJson(value)));\n}\n\n/** Hex SHA-256 of a record's canonical JSON (its NDJSON line without the newline). */\nexport async function recordSha256(record: unknown): Promise<string> {\n\treturn sha256Hex(canonicalJson(record));\n}\n\nexport function packageDigest(manifest: unknown): Promise<Sha256Digest> {\n\treturn canonicalDigest(manifest);\n}\n\nexport function planDigest(plan: unknown): Promise<Sha256Digest> {\n\treturn canonicalDigest(plan);\n}\n\n/** Digest over a receipt without its own `receiptDigest` property. */\nexport function receiptDigest(receipt: Record<string, unknown>): Promise<Sha256Digest> {\n\tconst { receiptDigest: _ignored, ...rest } = receipt;\n\treturn canonicalDigest(rest);\n}\n\n/** Hex logical hash of one record chunk from its `[id, recordSha256]` pairs in chunk order. */\nexport async function chunkLogicalSha256(\n\trecords: ReadonlyArray<readonly [id: string, recordSha256: string]>,\n): Promise<string> {\n\tfor (const [, sha] of records) {\n\t\tif (!isSha256Hex(sha)) throw new TypeError(\"Expected a lowercase hex SHA-256\");\n\t}\n\treturn sha256Hex(canonicalJson(records.map(([id, sha]) => [id, sha])));\n}\n\n/** `logicalDigest` from `[kind, seq, chunkLogicalSha256]` tuples in package order. */\nexport async function logicalDigest(\n\tchunks: ReadonlyArray<readonly [kind: string, seq: number, chunkLogicalSha256: string]>,\n): Promise<Sha256Digest> {\n\tfor (const [, , sha] of chunks) {\n\t\tif (!isSha256Hex(sha)) throw new TypeError(\"Expected a lowercase hex SHA-256\");\n\t}\n\treturn canonicalDigest(chunks.map(([kind, seq, sha]) => [kind, seq, sha]));\n}\n\n/**\n * Pass-through stream that feeds every chunk to `hasher` and counts bytes.\n * Throws inside the stream as soon as more than `maxBytes` flow through.\n */\nexport function createHashingStream(\n\thasher: Sha256Hasher,\n\toptions: { maxBytes?: number; onLimitExceeded?: () => unknown } = {},\n): { stream: TransformStream<Uint8Array, Uint8Array>; bytes: () => number } {\n\tlet total = 0;\n\tconst stream = new TransformStream<Uint8Array, Uint8Array>({\n\t\ttransform(chunk, controller) {\n\t\t\ttotal += chunk.byteLength;\n\t\t\tif (options.maxBytes !== undefined && total > options.maxBytes) {\n\t\t\t\tthrow options.onLimitExceeded?.() ?? new RangeError(\"Stream exceeded its declared size\");\n\t\t\t}\n\t\t\thasher.update(chunk);\n\t\t\tcontroller.enqueue(chunk);\n\t\t},\n\t});\n\treturn { stream, bytes: () => total };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAE9B,SAAgB,YAAY,OAAiC;AAC5D,QAAO,OAAO,UAAU,YAAY,mBAAmB,KAAK,MAAM;;AAGnE,SAAgB,eAAe,OAAuC;AACrE,QAAO,OAAO,UAAU,YAAY,sBAAsB,KAAK,MAAM;;AAGtE,SAAgB,eAAe,KAA2B;AACzD,KAAI,CAAC,YAAY,IAAI,CAAE,OAAM,IAAI,UAAU,mCAAmC;AAC9E,QAAO,UAAU;;AA+BlB,SAAS,0BAA0B,OAAkD;AACpF,QAAO,OAAO,UAAU;;AAGzB,SAAS,iBAAiB,OAAyC;AAClE,QAAO,OAAO,UAAU;;AAGzB,SAAS,kBAAuD;CAC/D,MAAM,YACL,OAAO,WAAW,WAAW,WAC1B,QAAQ,IAAI,WAAW,QAAQ,eAAe,GAC9C;AACJ,QAAO,0BAA0B,UAAU,GAAG,YAAY;;AAG3D,SAAS,gBAAyB;CACjC,MAAM,cAAuB,QAAQ,IAAI,YAAY,UAAU;AAC/D,KAAI,OAAO,gBAAgB,YAAY,gBAAgB,KAAM,QAAO;CACpE,MAAM,WAAoB,QAAQ,IAAI,aAAa,WAAW;AAC9D,QACC,OAAO,aAAa,YACpB,aAAa,QACb,OAAO,QAAQ,IAAI,UAAU,OAAO,KAAK;;AAI3C,IAAI;AAEJ,SAAS,qBAAqD;AAC7D,qBAAoB,YAAY;AAC/B,MAAI,CAAC,eAAe,CAAE,QAAO;AAC7B,MAAI;GACH,MAAM,aAAuC,MAAM,OAAO;AAC1D,UAAO,iBAAiB,WAAW,WAAW,GAAG,WAAW,aAAa;UAClE;AACP,UAAO;;KAEL;AACJ,QAAO;;AAGR,eAAe,mBAA2C;AACzD,KAAI,iBAAiB,CAAE,QAAO;AAC9B,KAAI,MAAM,oBAAoB,CAAE,QAAO;AACvC,QAAO;;AAGR,IAAM,qBAAN,MAAiD;CAChD,AAAS,UAAU;CACnB,CAASA;CACT,CAASC;CACT;CAEA,YAAY,cAAuC;AAClD,QAAKD,SAAU,IAAI,aAAa,UAAU;AAC1C,QAAKC,SAAU,MAAKD,OAAQ,WAAW;;CAGxC,OAAO,OAAyB;AAG/B,QAAKC,OAAQ,MAAM,MAAM,OAAO,CAAC,CAAC,OAAO,UAAmB;AAC3D,SAAKC,YAAa;IACjB;;CAGH,MAAM,SAA0B;AAC/B,QAAM,MAAKD,OAAQ,OAAO;AAC1B,MAAI,MAAKC,YAAa,OAAW,OAAM,MAAKA;AAC5C,SAAO,mBAAmB,IAAI,WAAW,MAAM,MAAKF,OAAQ,OAAO,CAAC;;;AAItE,IAAM,aAAN,MAAyC;CACxC,AAAS,UAAU;CACnB,CAASG;CAET,YAAY,YAA4B;AACvC,QAAKA,OAAQ,WAAW,SAAS;;CAGlC,OAAO,OAAyB;AAC/B,QAAKA,KAAM,OAAO,MAAM;;CAGzB,MAAM,SAA0B;AAC/B,SAAO,MAAKA,KAAM,OAAO,MAAM;;;AAIjC,IAAM,aAAN,MAAyC;CACxC,AAAS,UAAU;CACnB,CAASA,OAAQ,IAAI,QAAQ;CAE7B,OAAO,OAAyB;AAC/B,QAAKA,KAAM,OAAO,MAAM;;CAGzB,MAAM,SAA0B;AAC/B,SAAO,mBAAmB,MAAKA,KAAM,QAAQ,CAAC;;;AAgBhD,eAAsB,aACrB,UAAuC,EAAE,EACjB;AAExB,SADgB,QAAQ,WAAY,MAAM,kBAAkB,EAC5D;EACC,KAAK,iBAAiB;GACrB,MAAM,eAAe,iBAAiB;AACtC,OAAI,CAAC,aAAc,OAAM,IAAI,MAAM,uCAAuC;AAC1E,UAAO,IAAI,mBAAmB,aAAa;;EAE5C,KAAK,QAAQ;GACZ,MAAM,aAAa,MAAM,oBAAoB;AAC7C,OAAI,CAAC,WAAY,OAAM,IAAI,MAAM,+BAA+B;AAChE,UAAO,IAAI,WAAW,WAAW;;EAElC,KAAK,OACJ,QAAO,IAAI,YAAY;;;AAI1B,MAAM,UAAU,IAAI,aAAa;AAEjC,eAAsB,UAAU,MAA4C;CAC3E,MAAM,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,KAAK,GAAG;CAChE,MAAM,SAAS,MAAM,cAAc;AACnC,QAAO,OAAO,MAAM;AACpB,QAAO,OAAO,QAAQ;;;AAIvB,eAAsB,gBAAgB,OAAuC;AAC5E,QAAO,eAAe,MAAM,UAAU,cAAc,MAAM,CAAC,CAAC;;;AAI7D,eAAsB,aAAa,QAAkC;AACpE,QAAO,UAAU,cAAc,OAAO,CAAC;;AAGxC,SAAgB,cAAc,UAA0C;AACvE,QAAO,gBAAgB,SAAS;;AAGjC,SAAgB,WAAW,MAAsC;AAChE,QAAO,gBAAgB,KAAK;;;AAI7B,SAAgB,cAAc,SAAyD;CACtF,MAAM,EAAE,eAAe,UAAU,GAAG,SAAS;AAC7C,QAAO,gBAAgB,KAAK;;;AAI7B,eAAsB,mBACrB,SACkB;AAClB,MAAK,MAAM,GAAG,QAAQ,QACrB,KAAI,CAAC,YAAY,IAAI,CAAE,OAAM,IAAI,UAAU,mCAAmC;AAE/E,QAAO,UAAU,cAAc,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;;;AAIvE,eAAsB,cACrB,QACwB;AACxB,MAAK,MAAM,KAAK,QAAQ,OACvB,KAAI,CAAC,YAAY,IAAI,CAAE,OAAM,IAAI,UAAU,mCAAmC;AAE/E,QAAO,gBAAgB,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;EAAC;EAAM;EAAK;EAAI,CAAC,CAAC;;;;;;AAO3E,SAAgB,oBACf,QACA,UAAkE,EAAE,EACO;CAC3E,IAAI,QAAQ;AAWZ,QAAO;EAAE,QAVM,IAAI,gBAAwC,EAC1D,UAAU,OAAO,YAAY;AAC5B,YAAS,MAAM;AACf,OAAI,QAAQ,aAAa,UAAa,QAAQ,QAAQ,SACrD,OAAM,QAAQ,mBAAmB,oBAAI,IAAI,WAAW,oCAAoC;AAEzF,UAAO,OAAO,MAAM;AACpB,cAAW,QAAQ,MAAM;KAE1B,CAAC;EACe,aAAa;EAAO"}