emdash 0.41.0 → 0.42.0

package/dist/comments-Bi2j9IoX.mjs

@@ -0,0 +1,195 @@
+import { i as InvalidCursorError } from "./types-j6MBDjlZ.mjs";
+import { t as CommentRepository } from "./comment-Cq1UYN8_.mjs";
+
+//#region src/api/handlers/comments.ts
+async function handleCommentList(db, collection, contentId, options = {}) {
+	try {
+		const repo = new CommentRepository(db);
+		const total = await repo.countByContent(collection, contentId, "approved");
+		let publicItems;
+		let nextCursor;
+		if (options.threaded) {
+			const result = await repo.findByContent(collection, contentId, {
+				status: "approved",
+				limit: 500
+			});
+			publicItems = CommentRepository.assembleThreads(result.items).map((c) => CommentRepository.toPublicComment(c));
+		} else {
+			const result = await repo.findByContent(collection, contentId, {
+				status: "approved",
+				limit: options.limit,
+				cursor: options.cursor
+			});
+			publicItems = result.items.map((c) => CommentRepository.toPublicComment(c));
+			nextCursor = result.nextCursor;
+		}
+		return {
+			success: true,
+			data: {
+				items: publicItems,
+				nextCursor,
+				total
+			}
+		};
+	} catch (error) {
+		if (error instanceof InvalidCursorError) return {
+			success: false,
+			error: {
+				code: "INVALID_CURSOR",
+				message: error.message
+			}
+		};
+		console.error("Comment list error:", error);
+		return {
+			success: false,
+			error: {
+				code: "COMMENT_LIST_ERROR",
+				message: "Failed to list comments"
+			}
+		};
+	}
+}
+async function handleCommentInbox(db, options = {}) {
+	try {
+		const repo = new CommentRepository(db);
+		const status = options.status ?? "pending";
+		const result = await repo.findByStatus(status, {
+			collection: options.collection,
+			search: options.search,
+			limit: options.limit,
+			cursor: options.cursor
+		});
+		return {
+			success: true,
+			data: {
+				items: result.items,
+				nextCursor: result.nextCursor
+			}
+		};
+	} catch (error) {
+		if (error instanceof InvalidCursorError) return {
+			success: false,
+			error: {
+				code: "INVALID_CURSOR",
+				message: error.message
+			}
+		};
+		console.error("Comment inbox error:", error);
+		return {
+			success: false,
+			error: {
+				code: "COMMENT_INBOX_ERROR",
+				message: "Failed to list comments"
+			}
+		};
+	}
+}
+async function handleCommentCounts(db) {
+	try {
+		return {
+			success: true,
+			data: await new CommentRepository(db).countByStatus()
+		};
+	} catch (error) {
+		console.error("Comment counts error:", error);
+		return {
+			success: false,
+			error: {
+				code: "COMMENT_COUNTS_ERROR",
+				message: "Failed to get comment counts"
+			}
+		};
+	}
+}
+async function handleCommentGet(db, id) {
+	try {
+		const comment = await new CommentRepository(db).findById(id);
+		if (!comment) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Comment not found: ${id}`
+			}
+		};
+		return {
+			success: true,
+			data: comment
+		};
+	} catch (error) {
+		console.error("Comment get error:", error);
+		return {
+			success: false,
+			error: {
+				code: "COMMENT_GET_ERROR",
+				message: "Failed to get comment"
+			}
+		};
+	}
+}
+async function handleCommentDelete(db, id) {
+	try {
+		if (!await new CommentRepository(db).delete(id)) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Comment not found: ${id}`
+			}
+		};
+		return {
+			success: true,
+			data: { deleted: true }
+		};
+	} catch (error) {
+		console.error("Comment delete error:", error);
+		return {
+			success: false,
+			error: {
+				code: "COMMENT_DELETE_ERROR",
+				message: "Failed to delete comment"
+			}
+		};
+	}
+}
+async function handleCommentBulk(db, ids, action) {
+	try {
+		const repo = new CommentRepository(db);
+		let affected;
+		if (action === "delete") affected = await repo.bulkDelete(ids);
+		else affected = await repo.bulkUpdateStatus(ids, {
+			approve: "approved",
+			spam: "spam",
+			trash: "trash"
+		}[action]);
+		return {
+			success: true,
+			data: { affected }
+		};
+	} catch (error) {
+		console.error("Comment bulk error:", error);
+		return {
+			success: false,
+			error: {
+				code: "COMMENT_BULK_ERROR",
+				message: "Failed to perform bulk operation"
+			}
+		};
+	}
+}
+/**
+* Hash an IP address for storage (never store cleartext IPs).
+*
+* Uses full SHA-256 with a site-specific salt to prevent rainbow-table
+* recovery of IPs. The salt must be provided by the caller — typically
+* via `resolveSecretsCached(db).ipSalt` from `#config/secrets.js`. The
+* salt is generated and persisted on first need so it's stable across
+* requests within a deployment but unique per install.
+*/
+async function hashIp(ip, salt) {
+	const data = `ip:${salt}:${ip}`;
+	const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data));
+	return Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+//#endregion
+export { handleCommentInbox as a, handleCommentGet as i, handleCommentCounts as n, handleCommentList as o, handleCommentDelete as r, hashIp as s, handleCommentBulk as t };
+//# sourceMappingURL=comments-Bi2j9IoX.mjs.map

package/dist/comments-Bi2j9IoX.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments-Bi2j9IoX.mjs","names":[],"sources":["../src/api/handlers/comments.ts"],"sourcesContent":["/**\n * Comment handlers — business logic for comment API routes.\n *\n * Standalone functions that return ApiResult<T>. Routes are thin wrappers.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { CommentRepository } from \"../../database/repositories/comment.js\";\nimport type { Comment, CommentStatus, PublicComment } from \"../../database/repositories/comment.js\";\nimport { InvalidCursorError } from \"../../database/repositories/types.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Public: List approved comments for content\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentList(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tcontentId: string,\n\toptions: { limit?: number; cursor?: string; threaded?: boolean } = {},\n): Promise<ApiResult<{ items: PublicComment[]; nextCursor?: string; total: number }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\n\t\t// Get total approved count\n\t\tconst total = await repo.countByContent(collection, contentId, \"approved\");\n\n\t\tlet publicItems: PublicComment[];\n\t\tlet nextCursor: string | undefined;\n\n\t\tif (options.threaded) {\n\t\t\t// Threaded mode: fetch all approved comments (capped) so threading\n\t\t\t// doesn't lose children that would fall on later pages.\n\t\t\tconst MAX_THREADED = 500;\n\t\t\tconst result = await repo.findByContent(collection, contentId, {\n\t\t\t\tstatus: \"approved\",\n\t\t\t\tlimit: MAX_THREADED,\n\t\t\t});\n\t\t\tconst threaded = CommentRepository.assembleThreads(result.items);\n\t\t\tpublicItems = threaded.map((c) => CommentRepository.toPublicComment(c));\n\t\t\t// No cursor for threaded mode — all comments returned at once\n\t\t} else {\n\t\t\tconst result = await repo.findByContent(collection, contentId, {\n\t\t\t\tstatus: \"approved\",\n\t\t\t\tlimit: options.limit,\n\t\t\t\tcursor: options.cursor,\n\t\t\t});\n\t\t\tpublicItems = result.items.map((c) => CommentRepository.toPublicComment(c));\n\t\t\tnextCursor = result.nextCursor;\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\titems: publicItems,\n\t\t\t\tnextCursor,\n\t\t\t\ttotal,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Comment list error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list comments\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Moderation inbox\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentInbox(\n\tdb: Kysely<Database>,\n\toptions: {\n\t\tstatus?: CommentStatus;\n\t\tcollection?: string;\n\t\tsearch?: string;\n\t\tlimit?: number;\n\t\tcursor?: string;\n\t} = {},\n): Promise<ApiResult<{ items: Comment[]; nextCursor?: string }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst status = options.status ?? \"pending\";\n\n\t\tconst result = await repo.findByStatus(status, {\n\t\t\tcollection: options.collection,\n\t\t\tsearch: options.search,\n\t\t\tlimit: options.limit,\n\t\t\tcursor: options.cursor,\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\titems: result.items,\n\t\t\t\tnextCursor: result.nextCursor,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Comment inbox error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_INBOX_ERROR\",\n\t\t\t\tmessage: \"Failed to list comments\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Status counts for inbox badges\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentCounts(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<Record<CommentStatus, number>>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst counts = await repo.countByStatus();\n\t\treturn { success: true, data: counts };\n\t} catch (error) {\n\t\tconsole.error(\"Comment counts error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_COUNTS_ERROR\",\n\t\t\t\tmessage: \"Failed to get comment counts\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Get single comment detail\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentGet(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<Comment>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst comment = await repo.findById(id);\n\n\t\tif (!comment) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Comment not found: ${id}` },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: comment };\n\t} catch (error) {\n\t\tconsole.error(\"Comment get error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get comment\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Change comment status\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentStatusChange(\n\tdb: Kysely<Database>,\n\tid: string,\n\tstatus: CommentStatus,\n): Promise<ApiResult<Comment>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst updated = await repo.updateStatus(id, status);\n\n\t\tif (!updated) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Comment not found: ${id}` },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: updated };\n\t} catch (error) {\n\t\tconsole.error(\"Comment status change error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_STATUS_ERROR\",\n\t\t\t\tmessage: \"Failed to update comment status\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Hard delete comment\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentDelete(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<{ deleted: true }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst deleted = await repo.delete(id);\n\n\t\tif (!deleted) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Comment not found: ${id}` },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { deleted: true } };\n\t} catch (error) {\n\t\tconsole.error(\"Comment delete error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete comment\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Bulk operations\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentBulk(\n\tdb: Kysely<Database>,\n\tids: string[],\n\taction: \"approve\" | \"spam\" | \"trash\" | \"delete\",\n): Promise<ApiResult<{ affected: number }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\n\t\tlet affected: number;\n\t\tif (action === \"delete\") {\n\t\t\taffected = await repo.bulkDelete(ids);\n\t\t} else {\n\t\t\tconst statusMap: Record<string, CommentStatus> = {\n\t\t\t\tapprove: \"approved\",\n\t\t\t\tspam: \"spam\",\n\t\t\t\ttrash: \"trash\",\n\t\t\t};\n\t\t\taffected = await repo.bulkUpdateStatus(ids, statusMap[action]);\n\t\t}\n\n\t\treturn { success: true, data: { affected } };\n\t} catch (error) {\n\t\tconsole.error(\"Comment bulk error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_BULK_ERROR\",\n\t\t\t\tmessage: \"Failed to perform bulk operation\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Hash an IP address for storage (never store cleartext IPs).\n *\n * Uses full SHA-256 with a site-specific salt to prevent rainbow-table\n * recovery of IPs. The salt must be provided by the caller — typically\n * via `resolveSecretsCached(db).ipSalt` from `#config/secrets.js`. The\n * salt is generated and persisted on first need so it's stable across\n * requests within a deployment but unique per install.\n */\nexport async function hashIp(ip: string, salt: string): Promise<string> {\n\tconst data = `ip:${salt}:${ip}`;\n\tconst buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(data));\n\treturn Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n"],"mappings":";;;;AAkBA,eAAsB,kBACrB,IACA,YACA,WACA,UAAmE,EAAE,EACgB;AACrF,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EAGtC,MAAM,QAAQ,MAAM,KAAK,eAAe,YAAY,WAAW,WAAW;EAE1E,IAAI;EACJ,IAAI;AAEJ,MAAI,QAAQ,UAAU;GAIrB,MAAM,SAAS,MAAM,KAAK,cAAc,YAAY,WAAW;IAC9D,QAAQ;IACR,OAHoB;IAIpB,CAAC;AAEF,iBADiB,kBAAkB,gBAAgB,OAAO,MAAM,CACzC,KAAK,MAAM,kBAAkB,gBAAgB,EAAE,CAAC;SAEjE;GACN,MAAM,SAAS,MAAM,KAAK,cAAc,YAAY,WAAW;IAC9D,QAAQ;IACR,OAAO,QAAQ;IACf,QAAQ,QAAQ;IAChB,CAAC;AACF,iBAAc,OAAO,MAAM,KAAK,MAAM,kBAAkB,gBAAgB,EAAE,CAAC;AAC3E,gBAAa,OAAO;;AAGrB,SAAO;GACN,SAAS;GACT,MAAM;IACL,OAAO;IACP;IACA;IACA;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,UAAQ,MAAM,uBAAuB,MAAM;AAC3C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,mBACrB,IACA,UAMI,EAAE,EAC0D;AAChE,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EACtC,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;GAC9C,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB,CAAC;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IACL,OAAO,OAAO;IACd,YAAY,OAAO;IACnB;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,oBACrB,IACoD;AACpD,KAAI;AAGH,SAAO;GAAE,SAAS;GAAM,MADT,MADF,IAAI,kBAAkB,GAAG,CACZ,eAAe;GACH;UAC9B,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,iBACrB,IACA,IAC8B;AAC9B,KAAI;EAEH,MAAM,UAAU,MADH,IAAI,kBAAkB,GAAG,CACX,SAAS,GAAG;AAEvC,MAAI,CAAC,QACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,sBAAsB;IAAM;GACjE;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM;GAAS;UAC/B,OAAO;AACf,UAAQ,MAAM,sBAAsB,MAAM;AAC1C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAyCH,eAAsB,oBACrB,IACA,IACwC;AACxC,KAAI;AAIH,MAAI,CAFY,MADH,IAAI,kBAAkB,GAAG,CACX,OAAO,GAAG,CAGpC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,sBAAsB;IAAM;GACjE;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;UACzC,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,kBACrB,IACA,KACA,QAC2C;AAC3C,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EAEtC,IAAI;AACJ,MAAI,WAAW,SACd,YAAW,MAAM,KAAK,WAAW,IAAI;MAOrC,YAAW,MAAM,KAAK,iBAAiB,KALU;GAChD,SAAS;GACT,MAAM;GACN,OAAO;GACP,CACqD,QAAQ;AAG/D,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,UAAU;GAAE;UACpC,OAAO;AACf,UAAQ,MAAM,uBAAuB,MAAM;AAC3C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;AAaH,eAAsB,OAAO,IAAY,MAA+B;CACvE,MAAM,OAAO,MAAM,KAAK,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC;AACjF,QAAO,MAAM,KAAK,IAAI,WAAW,IAAI,GAAG,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG"}

package/dist/components-CQY-Sgm-.mjs

@@ -0,0 +1,108 @@
+//#region src/widgets/components.ts
+/**
+* Core widget components registry
+* These are built-in widgets that ship with EmDash
+*/
+const coreWidgetComponents = [
+	{
+		id: "core:recent-posts",
+		label: "Recent Posts",
+		description: "Display a list of recent posts",
+		props: {
+			count: {
+				type: "number",
+				label: "Number of posts",
+				default: 5
+			},
+			showThumbnails: {
+				type: "boolean",
+				label: "Show thumbnails",
+				default: false
+			},
+			showDate: {
+				type: "boolean",
+				label: "Show date",
+				default: true
+			}
+		}
+	},
+	{
+		id: "core:categories",
+		label: "Categories",
+		description: "Display category list",
+		props: {
+			showCount: {
+				type: "boolean",
+				label: "Show post count",
+				default: true
+			},
+			hierarchical: {
+				type: "boolean",
+				label: "Show hierarchy",
+				default: true
+			}
+		}
+	},
+	{
+		id: "core:tags",
+		label: "Tags",
+		description: "Display tag cloud",
+		props: {
+			showCount: {
+				type: "boolean",
+				label: "Show count",
+				default: false
+			},
+			limit: {
+				type: "number",
+				label: "Maximum tags",
+				default: 20
+			}
+		}
+	},
+	{
+		id: "core:search",
+		label: "Search",
+		description: "Search form",
+		props: { placeholder: {
+			type: "string",
+			label: "Placeholder text",
+			default: "Search..."
+		} }
+	},
+	{
+		id: "core:archives",
+		label: "Archives",
+		description: "Monthly/yearly archives",
+		props: {
+			type: {
+				type: "select",
+				label: "Group by",
+				default: "monthly",
+				options: [{
+					value: "monthly",
+					label: "Monthly"
+				}, {
+					value: "yearly",
+					label: "Yearly"
+				}]
+			},
+			limit: {
+				type: "number",
+				label: "Limit",
+				default: 12
+			}
+		}
+	}
+];
+/**
+* Get all widget component definitions (core + plugin-registered)
+* For now, only returns core components. Plugin widgets will be added later.
+*/
+function getWidgetComponents() {
+	return [...coreWidgetComponents];
+}
+
+//#endregion
+export { getWidgetComponents as t };
+//# sourceMappingURL=components-CQY-Sgm-.mjs.map

package/dist/components-CQY-Sgm-.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"components-CQY-Sgm-.mjs","names":[],"sources":["../src/widgets/components.ts"],"sourcesContent":["import type { WidgetComponentDef } from \"./types.js\";\n\n/**\n * Core widget components registry\n * These are built-in widgets that ship with EmDash\n */\nexport const coreWidgetComponents: WidgetComponentDef[] = [\n\t{\n\t\tid: \"core:recent-posts\",\n\t\tlabel: \"Recent Posts\",\n\t\tdescription: \"Display a list of recent posts\",\n\t\tprops: {\n\t\t\tcount: {\n\t\t\t\ttype: \"number\",\n\t\t\t\tlabel: \"Number of posts\",\n\t\t\t\tdefault: 5,\n\t\t\t},\n\t\t\tshowThumbnails: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show thumbnails\",\n\t\t\t\tdefault: false,\n\t\t\t},\n\t\t\tshowDate: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show date\",\n\t\t\t\tdefault: true,\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:categories\",\n\t\tlabel: \"Categories\",\n\t\tdescription: \"Display category list\",\n\t\tprops: {\n\t\t\tshowCount: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show post count\",\n\t\t\t\tdefault: true,\n\t\t\t},\n\t\t\thierarchical: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show hierarchy\",\n\t\t\t\tdefault: true,\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:tags\",\n\t\tlabel: \"Tags\",\n\t\tdescription: \"Display tag cloud\",\n\t\tprops: {\n\t\t\tshowCount: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show count\",\n\t\t\t\tdefault: false,\n\t\t\t},\n\t\t\tlimit: {\n\t\t\t\ttype: \"number\",\n\t\t\t\tlabel: \"Maximum tags\",\n\t\t\t\tdefault: 20,\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:search\",\n\t\tlabel: \"Search\",\n\t\tdescription: \"Search form\",\n\t\tprops: {\n\t\t\tplaceholder: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tlabel: \"Placeholder text\",\n\t\t\t\tdefault: \"Search...\",\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:archives\",\n\t\tlabel: \"Archives\",\n\t\tdescription: \"Monthly/yearly archives\",\n\t\tprops: {\n\t\t\ttype: {\n\t\t\t\ttype: \"select\",\n\t\t\t\tlabel: \"Group by\",\n\t\t\t\tdefault: \"monthly\",\n\t\t\t\toptions: [\n\t\t\t\t\t{ value: \"monthly\", label: \"Monthly\" },\n\t\t\t\t\t{ value: \"yearly\", label: \"Yearly\" },\n\t\t\t\t],\n\t\t\t},\n\t\t\tlimit: {\n\t\t\t\ttype: \"number\",\n\t\t\t\tlabel: \"Limit\",\n\t\t\t\tdefault: 12,\n\t\t\t},\n\t\t},\n\t},\n];\n\n/**\n * Get all widget component definitions (core + plugin-registered)\n * For now, only returns core components. Plugin widgets will be added later.\n */\nexport function getWidgetComponents(): WidgetComponentDef[] {\n\treturn [...coreWidgetComponents];\n}\n"],"mappings":";;;;;AAMA,MAAa,uBAA6C;CACzD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,OAAO;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,gBAAgB;IACf,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,UAAU;IACT,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,WAAW;IACV,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,cAAc;IACb,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,WAAW;IACV,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,OAAO;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO,EACN,aAAa;GACZ,MAAM;GACN,OAAO;GACP,SAAS;GACT,EACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,MAAM;IACL,MAAM;IACN,OAAO;IACP,SAAS;IACT,SAAS,CACR;KAAE,OAAO;KAAW,OAAO;KAAW,EACtC;KAAE,OAAO;KAAU,OAAO;KAAU,CACpC;IACD;GACD,OAAO;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD;EACD;CACD;;;;;AAMD,SAAgB,sBAA4C;AAC3D,QAAO,CAAC,GAAG,qBAAqB"}

package/dist/config-BnuORwSP.mjs

@@ -0,0 +1,242 @@
+import { isDid } from "@atcute/lexicons/syntax";
+
+//#region src/registry/config.ts
+/**
+* Helpers for normalizing the registry integration option into the shape
+* exposed on the admin manifest.
+*
+* The integration option accepts a human-friendly duration string for
+* `policy.minimumReleaseAge` (`"48h"`, `"7d"`); the manifest exposes
+* seconds so the browser doesn't need a duration parser.
+*/
+const DEFAULT_REGISTRY_AGGREGATOR_URL = "https://registry.emdashcms.com";
+function resolveRegistryConfigForSandbox(options) {
+	if (options.registry === false) return { fieldPrefix: "registry" };
+	if (options.registry !== void 0) return {
+		input: options.registry,
+		fieldPrefix: "registry"
+	};
+	if (options.experimentalRegistry !== void 0) return {
+		input: options.experimentalRegistry,
+		fieldPrefix: "experimental.registry"
+	};
+	if (options.sandboxRunner && options.sandboxEnabled !== false) return {
+		input: DEFAULT_REGISTRY_AGGREGATOR_URL,
+		fieldPrefix: "registry"
+	};
+	return { fieldPrefix: "registry" };
+}
+function getRegistryConfigInput(registry, experimentalRegistry) {
+	return resolveRegistryConfigForSandbox({
+		registry,
+		experimentalRegistry
+	}).input;
+}
+var RegistryConfigurationError = class extends Error {
+	constructor(code, field, message, options) {
+		super(`EmDash registry configuration error in ${field}: ${message}`, options);
+		this.code = code;
+		this.field = field;
+		this.name = "RegistryConfigurationError";
+	}
+};
+function registryField(options, suffix) {
+	return `${options.fieldPrefix ?? "experimental.registry"}.${suffix}`;
+}
+/**
+* Canonicalize a capabilities list for set-style comparison.
+*
+* Capabilities (the legacy declared-access shape used by the current
+* sandbox enforcer) are conceptually a *set*: order, duplicates, and
+* non-string entries don't carry meaning. The install handler's drift
+* check compares the admin's acknowledged set against the bundle
+* manifest's set; both sides pass through this canonicalizer first so
+* an aggregator-supplied array with unstable order or junk entries
+* can't cause a spurious drift rejection.
+*
+* Filters non-strings, deduplicates, and sorts lexically. Named to
+* avoid shadowing `@emdash-cms/plugin-types`'s existing
+* `normalizeCapabilities` (which dedupes + applies the deprecated →
+* current alias map but does not filter junk or sort).
+*
+* Exported so the same shape is produced by the browser before sending
+* the `acknowledgedDeclaredAccess` payload and by the server before
+* comparing against the bundle.
+*/
+function canonicalCapabilitiesForDriftCheck(value) {
+	if (!Array.isArray(value)) return [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) if (typeof entry === "string" && entry.length > 0) seen.add(entry);
+	return [...seen].toSorted();
+}
+/**
+* Returns whether a `(publisher_did, slug)` pair is on the
+* minimum-release-age exemption list. Exported so the same matcher is
+* used by the browser policy filter and the server-side install
+* enforcement.
+*
+* Matching is DID-only. Handles are aggregator-supplied envelope data
+* (mutable, controlled by an attacker who compromises the aggregator)
+* and cannot be used as a trust input -- a compromised aggregator
+* could claim any handle for any package and bypass the holdback. DIDs
+* are part of the AT URI of the package record and are independently
+* resolvable, so even a compromised aggregator can't lie about the
+* publisher DID without also breaking checksum verification downstream.
+*
+* Entries from config are already lowercased at manifest-build time.
+* Runtime values are lowercased here at compare time.
+*/
+function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
+	if (!exclude || exclude.length === 0) return false;
+	const didLower = publisherDid.toLowerCase();
+	const fullDid = `${didLower}/${slug.toLowerCase()}`;
+	for (const entry of exclude) {
+		if (entry === didLower) return true;
+		if (entry === fullDid) return true;
+	}
+	return false;
+}
+const DURATION_PATTERN = /^(\d+)(s|m|h|d|w)$/;
+/** Trailing slashes on the aggregator URL, stripped during normalization. */
+const TRAILING_SLASHES = /\/+$/;
+/** Trailing dot on a hostname, stripped before URL host comparisons. */
+const TRAILING_DOT = /\.$/;
+const REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+/**
+* Parse a duration string or raw second count into a non-negative
+* integer count of seconds. Throws on unrecognised input so config
+* mistakes fail at startup rather than silently disabling the policy.
+*/
+function parseDurationSeconds(duration) {
+	if (typeof duration === "number") {
+		if (!Number.isFinite(duration) || duration < 0) throw new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);
+		return Math.floor(duration);
+	}
+	const match = duration.match(DURATION_PATTERN);
+	if (!match) throw new Error(`Invalid duration format: "${duration}". Use a duration string like "48h", "7d", "30m", or a number of seconds.`);
+	const value = parseInt(match[1], 10);
+	const unit = match[2];
+	switch (unit) {
+		case "s": return value;
+		case "m": return value * 60;
+		case "h": return value * 60 * 60;
+		case "d": return value * 24 * 60 * 60;
+		case "w": return value * 7 * 24 * 60 * 60;
+		default: throw new Error(`Unknown duration unit: ${unit}`);
+	}
+}
+/**
+* Validate that `aggregatorUrl` is a safe outbound target for the
+* registry's XRPC calls. Same posture as artifact downloads: HTTPS
+* required in production; `http://localhost` allowed only in dev.
+*
+* The aggregator's responses are the trust source for release records,
+* checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST
+* verification lands). Allowing plain HTTP here would let a network
+* attacker swap a release record and point the artifact URL at their
+* own HTTPS bundle, defeating the checksum trust chain because the
+* attacker controls the unsigned transport that supplied the checksum.
+*/
+function validateAggregatorUrl(aggregatorUrl, options = {}) {
+	let parsed;
+	try {
+		parsed = new URL(aggregatorUrl);
+	} catch (cause) {
+		throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_INVALID", registryField(options, "aggregatorUrl"), "must be a valid URL", { cause });
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField(options, "aggregatorUrl"), "must use HTTP or HTTPS");
+	if (parsed.username || parsed.password) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField(options, "aggregatorUrl"), "must not contain embedded credentials");
+	const rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, "");
+	const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
+	const isLocalhost = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1" || hostname.startsWith("::ffff:127.") || hostname.startsWith("::ffff:7f00:");
+	if (!(options.allowLocalhost ?? import.meta.env.DEV)) {
+		if (parsed.protocol === "http:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField(options, "aggregatorUrl"), "must use HTTPS outside development");
+		if (isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField(options, "aggregatorUrl"), "must not point at localhost outside development");
+	} else if (parsed.protocol === "http:" && !isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField(options, "aggregatorUrl"), "must use HTTPS unless it points at localhost in development");
+	return parsed;
+}
+/**
+* Expand the `RegistryConfigInput` shorthand into the full
+* `RegistryConfig` object shape.
+*
+* Users can pass a bare aggregator URL string for the common case
+* (`registry: "https://registry.emdashcms.com"`); the
+* normalizer handles either form transparently.
+*
+* Returns `undefined` for `undefined` input so callers can chain with
+* optional chaining.
+*/
+function coerceRegistryConfig(input) {
+	if (input === void 0) return void 0;
+	if (typeof input === "string") return { aggregatorUrl: input };
+	return input;
+}
+/**
+* Normalize the user-supplied `RegistryConfigInput` into the shape that
+* ships to the admin browser via the manifest endpoint.
+*
+* Accepts either the shorthand string form
+* (`"https://registry.emdashcms.com"`) or the full `RegistryConfig`
+* object. Returns `null` when `input` is undefined so callers can
+* spread the result directly into the manifest object.
+*
+* Throws a field-specific configuration error if the aggregator URL is
+* malformed or forbidden, or a registry policy value cannot be normalized.
+* The Astro integration uses this to fail during config loading. Runtime
+* manifest generation uses {@link resolveManifestRegistryConfig} to expose
+* recognized failures without exposing the configured value.
+*/
+function normalizeRegistryConfig(input, options = {}) {
+	const config = coerceRegistryConfig(input);
+	if (!config) return null;
+	const aggregatorUrl = typeof config.aggregatorUrl === "string" ? config.aggregatorUrl.trim() : void 0;
+	if (!aggregatorUrl) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_REQUIRED", registryField(options, "aggregatorUrl"), "is required when the registry is configured");
+	validateAggregatorUrl(aggregatorUrl, options);
+	const out = { aggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, "") };
+	if (config.acceptLabelers) out.acceptLabelers = config.acceptLabelers;
+	const policy = {};
+	let hasPolicy = false;
+	if (config.policy?.minimumReleaseAge !== void 0) {
+		try {
+			policy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);
+		} catch (cause) {
+			throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_INVALID", registryField(options, "policy.minimumReleaseAge"), "must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds", { cause });
+		}
+		hasPolicy = true;
+	}
+	if (config.policy?.minimumReleaseAgeExclude !== void 0) {
+		if (!Array.isArray(config.policy.minimumReleaseAgeExclude)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField(options, "policy.minimumReleaseAgeExclude"), "must be an array of DIDs or <did>/<slug> entries");
+		const list = config.policy.minimumReleaseAgeExclude.map((entry) => {
+			if (typeof entry !== "string") throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField(options, "policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
+			const trimmed = entry.trim();
+			if (!trimmed) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField(options, "policy.minimumReleaseAgeExclude"), "entries cannot be empty");
+			const lower = trimmed.toLowerCase();
+			const [did, slug, ...extra] = lower.split("/");
+			if (!did || !isDid(did) || extra.length > 0 || slug !== void 0 && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField(options, "policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
+			return lower;
+		});
+		if (list.length > 0) {
+			policy.minimumReleaseAgeExclude = list;
+			hasPolicy = true;
+		}
+	}
+	if (hasPolicy) out.policy = policy;
+	return out;
+}
+/** Normalize registry config without allowing a known config error to hide the admin. */
+function resolveManifestRegistryConfig(input, options = {}) {
+	try {
+		const registry = normalizeRegistryConfig(input, options);
+		return registry ? { registry } : {};
+	} catch (error) {
+		if (!(error instanceof RegistryConfigurationError)) throw error;
+		return { error: {
+			code: error.code,
+			field: error.field
+		} };
+	}
+}
+
+//#endregion
+export { parseDurationSeconds as a, resolveRegistryConfigForSandbox as c, normalizeRegistryConfig as i, validateAggregatorUrl as l, coerceRegistryConfig as n, releaseExemptFromMinimumAge as o, getRegistryConfigInput as r, resolveManifestRegistryConfig as s, canonicalCapabilitiesForDriftCheck as t };
+//# sourceMappingURL=config-BnuORwSP.mjs.map

package/dist/config-BnuORwSP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-BnuORwSP.mjs","names":[],"sources":["../src/registry/config.ts"],"sourcesContent":["/**\n * Helpers for normalizing the registry integration option into the shape\n * exposed on the admin manifest.\n *\n * The integration option accepts a human-friendly duration string for\n * `policy.minimumReleaseAge` (`\"48h\"`, `\"7d\"`); the manifest exposes\n * seconds so the browser doesn't need a duration parser.\n */\n\nimport { isDid } from \"@atcute/lexicons/syntax\";\n\nimport type { RegistryConfig, RegistryConfigInput, RegistryConfigOption } from \"./types.js\";\n\nexport const DEFAULT_REGISTRY_AGGREGATOR_URL = \"https://registry.emdashcms.com\";\n\nexport interface ResolvedRegistryConfigInput {\n\tinput?: RegistryConfigInput;\n\tfieldPrefix: RegistryConfigurationPrefix;\n}\n\nexport function resolveRegistryConfigForSandbox(options: {\n\tregistry?: RegistryConfigOption;\n\texperimentalRegistry?: RegistryConfigInput;\n\tsandboxRunner?: string;\n\tsandboxEnabled?: boolean;\n}): ResolvedRegistryConfigInput {\n\tif (options.registry === false) return { fieldPrefix: \"registry\" };\n\tif (options.registry !== undefined) {\n\t\treturn { input: options.registry, fieldPrefix: \"registry\" };\n\t}\n\tif (options.experimentalRegistry !== undefined) {\n\t\treturn { input: options.experimentalRegistry, fieldPrefix: \"experimental.registry\" };\n\t}\n\tif (options.sandboxRunner && options.sandboxEnabled !== false) {\n\t\treturn { input: DEFAULT_REGISTRY_AGGREGATOR_URL, fieldPrefix: \"registry\" };\n\t}\n\treturn { fieldPrefix: \"registry\" };\n}\n\nexport function getRegistryConfigInput(\n\tregistry: RegistryConfigOption | undefined,\n\texperimentalRegistry: RegistryConfigInput | undefined,\n): RegistryConfigInput | undefined {\n\treturn resolveRegistryConfigForSandbox({ registry, experimentalRegistry }).input;\n}\n\n/**\n * Shape returned in the admin manifest's `registry` field. The browser\n * consumes this directly -- all duration normalization and aggregator URL\n * validation has already happened by the time it gets here.\n */\nexport interface ManifestRegistryConfig {\n\taggregatorUrl: string;\n\tacceptLabelers?: string;\n\tpolicy?: {\n\t\tminimumReleaseAgeSeconds?: number;\n\t\t/**\n\t\t * Allowlist of publishers / packages exempt from the\n\t\t * {@link minimumReleaseAgeSeconds} holdback. Each entry is either:\n\t\t *\n\t\t *   - A bare publisher DID: `\"did:plc:abc123\"`. Every package from\n\t\t *     that publisher is exempt.\n\t\t *   - A `<did>/<slug>` pair: only that specific package is exempt.\n\t\t *\n\t\t * Handles are not accepted because they are mutable\n\t\t * aggregator-supplied envelope data.\n\t\t *\n\t\t * Normalized to lowercase strings at config load time so the\n\t\t * browser does case-insensitive comparison. See\n\t\t * {@link releaseExemptFromMinimumAge}.\n\t\t */\n\t\tminimumReleaseAgeExclude?: string[];\n\t};\n}\n\nexport type RegistryConfigurationErrorCode =\n\t| \"REGISTRY_AGGREGATOR_URL_REQUIRED\"\n\t| \"REGISTRY_AGGREGATOR_URL_INVALID\"\n\t| \"REGISTRY_AGGREGATOR_URL_FORBIDDEN\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\";\n\nexport type RegistryConfigurationPrefix = \"registry\" | \"experimental.registry\";\n\ntype RegistryConfigurationFieldSuffix =\n\t| \"aggregatorUrl\"\n\t| \"policy.minimumReleaseAge\"\n\t| \"policy.minimumReleaseAgeExclude\";\n\nexport type RegistryConfigurationField =\n\t`${RegistryConfigurationPrefix}.${RegistryConfigurationFieldSuffix}`;\n\nexport interface ManifestRegistryConfigurationError {\n\tcode: RegistryConfigurationErrorCode;\n\tfield: RegistryConfigurationField;\n}\n\nclass RegistryConfigurationError extends Error {\n\tconstructor(\n\t\tpublic readonly code: RegistryConfigurationErrorCode,\n\t\tpublic readonly field: RegistryConfigurationField,\n\t\tmessage: string,\n\t\toptions?: ErrorOptions,\n\t) {\n\t\tsuper(`EmDash registry configuration error in ${field}: ${message}`, options);\n\t\tthis.name = \"RegistryConfigurationError\";\n\t}\n}\n\nexport interface RegistryConfigurationValidationOptions {\n\tallowLocalhost?: boolean;\n\tfieldPrefix?: RegistryConfigurationPrefix;\n}\n\nfunction registryField(\n\toptions: RegistryConfigurationValidationOptions,\n\tsuffix: RegistryConfigurationFieldSuffix,\n): RegistryConfigurationField {\n\treturn `${options.fieldPrefix ?? \"experimental.registry\"}.${suffix}`;\n}\n\n/**\n * Canonicalize a capabilities list for set-style comparison.\n *\n * Capabilities (the legacy declared-access shape used by the current\n * sandbox enforcer) are conceptually a *set*: order, duplicates, and\n * non-string entries don't carry meaning. The install handler's drift\n * check compares the admin's acknowledged set against the bundle\n * manifest's set; both sides pass through this canonicalizer first so\n * an aggregator-supplied array with unstable order or junk entries\n * can't cause a spurious drift rejection.\n *\n * Filters non-strings, deduplicates, and sorts lexically. Named to\n * avoid shadowing `@emdash-cms/plugin-types`'s existing\n * `normalizeCapabilities` (which dedupes + applies the deprecated →\n * current alias map but does not filter junk or sort).\n *\n * Exported so the same shape is produced by the browser before sending\n * the `acknowledgedDeclaredAccess` payload and by the server before\n * comparing against the bundle.\n */\nexport function canonicalCapabilitiesForDriftCheck(value: unknown): string[] {\n\tif (!Array.isArray(value)) return [];\n\tconst seen = new Set<string>();\n\tfor (const entry of value) {\n\t\tif (typeof entry === \"string\" && entry.length > 0) {\n\t\t\tseen.add(entry);\n\t\t}\n\t}\n\treturn [...seen].toSorted();\n}\n\n/**\n * Returns whether a `(publisher_did, slug)` pair is on the\n * minimum-release-age exemption list. Exported so the same matcher is\n * used by the browser policy filter and the server-side install\n * enforcement.\n *\n * Matching is DID-only. Handles are aggregator-supplied envelope data\n * (mutable, controlled by an attacker who compromises the aggregator)\n * and cannot be used as a trust input -- a compromised aggregator\n * could claim any handle for any package and bypass the holdback. DIDs\n * are part of the AT URI of the package record and are independently\n * resolvable, so even a compromised aggregator can't lie about the\n * publisher DID without also breaking checksum verification downstream.\n *\n * Entries from config are already lowercased at manifest-build time.\n * Runtime values are lowercased here at compare time.\n */\nexport function releaseExemptFromMinimumAge(\n\texclude: readonly string[] | undefined,\n\tpublisherDid: string,\n\tslug: string,\n): boolean {\n\tif (!exclude || exclude.length === 0) return false;\n\tconst didLower = publisherDid.toLowerCase();\n\tconst slugLower = slug.toLowerCase();\n\tconst fullDid = `${didLower}/${slugLower}`;\n\n\tfor (const entry of exclude) {\n\t\tif (entry === didLower) return true;\n\t\tif (entry === fullDid) return true;\n\t}\n\treturn false;\n}\n\nconst DURATION_PATTERN = /^(\\d+)(s|m|h|d|w)$/;\n\n/** Trailing slashes on the aggregator URL, stripped during normalization. */\nconst TRAILING_SLASHES = /\\/+$/;\n\n/** Trailing dot on a hostname, stripped before URL host comparisons. */\nconst TRAILING_DOT = /\\.$/;\n\nconst REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;\n\n/**\n * Parse a duration string or raw second count into a non-negative\n * integer count of seconds. Throws on unrecognised input so config\n * mistakes fail at startup rather than silently disabling the policy.\n */\nexport function parseDurationSeconds(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\tif (!Number.isFinite(duration) || duration < 0) {\n\t\t\tthrow new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);\n\t\t}\n\t\treturn Math.floor(duration);\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use a duration string like \"48h\", \"7d\", \"30m\", or a number of seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 24 * 60 * 60;\n\t\tcase \"w\":\n\t\t\treturn value * 7 * 24 * 60 * 60;\n\t\tdefault:\n\t\t\t// Unreachable given the regex, but keep the exhaustive arm for\n\t\t\t// future maintainers who add a unit to the pattern.\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Validate that `aggregatorUrl` is a safe outbound target for the\n * registry's XRPC calls. Same posture as artifact downloads: HTTPS\n * required in production; `http://localhost` allowed only in dev.\n *\n * The aggregator's responses are the trust source for release records,\n * checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST\n * verification lands). Allowing plain HTTP here would let a network\n * attacker swap a release record and point the artifact URL at their\n * own HTTPS bundle, defeating the checksum trust chain because the\n * attacker controls the unsigned transport that supplied the checksum.\n */\nexport function validateAggregatorUrl(\n\taggregatorUrl: string,\n\toptions: RegistryConfigurationValidationOptions = {},\n): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(aggregatorUrl);\n\t} catch (cause) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_INVALID\",\n\t\t\tregistryField(options, \"aggregatorUrl\"),\n\t\t\t\"must be a valid URL\",\n\t\t\t{ cause },\n\t\t);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(options, \"aggregatorUrl\"),\n\t\t\t\"must use HTTP or HTTPS\",\n\t\t);\n\t}\n\t// Reject embedded credentials. The normalized aggregator URL ends\n\t// up in the admin manifest and is shipped to every admin browser;\n\t// browser `fetch()` also outright rejects URLs with `user:pass@`,\n\t// so leaving them in would both leak the credentials and break the\n\t// registry UI at runtime.\n\tif (parsed.username || parsed.password) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(options, \"aggregatorUrl\"),\n\t\t\t\"must not contain embedded credentials\",\n\t\t);\n\t}\n\n\t// WHATWG URL preserves the brackets on IPv6 hostnames -- strip them\n\t// before any comparison so `https://[::1]/` is recognised as localhost\n\t// and not treated as a generic domain string.\n\tconst rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname =\n\t\trawHostname.startsWith(\"[\") && rawHostname.endsWith(\"]\")\n\t\t\t? rawHostname.slice(1, -1)\n\t\t\t: rawHostname;\n\tconst isLocalhost =\n\t\thostname === \"localhost\" ||\n\t\thostname.endsWith(\".localhost\") ||\n\t\thostname === \"127.0.0.1\" ||\n\t\thostname === \"::1\" ||\n\t\t// IPv4-mapped IPv6 forms of loopback, e.g. `::ffff:127.0.0.1` and `::ffff:7f00:1`.\n\t\thostname.startsWith(\"::ffff:127.\") ||\n\t\thostname.startsWith(\"::ffff:7f00:\");\n\n\tconst allowLocalhost = options.allowLocalhost ?? import.meta.env.DEV;\n\tif (!allowLocalhost) {\n\t\tif (parsed.protocol === \"http:\") {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(options, \"aggregatorUrl\"),\n\t\t\t\t\"must use HTTPS outside development\",\n\t\t\t);\n\t\t}\n\t\tif (isLocalhost) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(options, \"aggregatorUrl\"),\n\t\t\t\t\"must not point at localhost outside development\",\n\t\t\t);\n\t\t}\n\t} else if (parsed.protocol === \"http:\" && !isLocalhost) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(options, \"aggregatorUrl\"),\n\t\t\t\"must use HTTPS unless it points at localhost in development\",\n\t\t);\n\t}\n\n\treturn parsed;\n}\n\n/**\n * Expand the `RegistryConfigInput` shorthand into the full\n * `RegistryConfig` object shape.\n *\n * Users can pass a bare aggregator URL string for the common case\n * (`registry: \"https://registry.emdashcms.com\"`); the\n * normalizer handles either form transparently.\n *\n * Returns `undefined` for `undefined` input so callers can chain with\n * optional chaining.\n */\nexport function coerceRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n): RegistryConfig | undefined {\n\tif (input === undefined) return undefined;\n\tif (typeof input === \"string\") return { aggregatorUrl: input };\n\treturn input;\n}\n\n/**\n * Normalize the user-supplied `RegistryConfigInput` into the shape that\n * ships to the admin browser via the manifest endpoint.\n *\n * Accepts either the shorthand string form\n * (`\"https://registry.emdashcms.com\"`) or the full `RegistryConfig`\n * object. Returns `null` when `input` is undefined so callers can\n * spread the result directly into the manifest object.\n *\n * Throws a field-specific configuration error if the aggregator URL is\n * malformed or forbidden, or a registry policy value cannot be normalized.\n * The Astro integration uses this to fail during config loading. Runtime\n * manifest generation uses {@link resolveManifestRegistryConfig} to expose\n * recognized failures without exposing the configured value.\n */\nexport function normalizeRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): ManifestRegistryConfig | null {\n\tconst config = coerceRegistryConfig(input);\n\tif (!config) return null;\n\n\tconst aggregatorUrl =\n\t\ttypeof config.aggregatorUrl === \"string\" ? config.aggregatorUrl.trim() : undefined;\n\tif (!aggregatorUrl) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_REQUIRED\",\n\t\t\tregistryField(options, \"aggregatorUrl\"),\n\t\t\t\"is required when the registry is configured\",\n\t\t);\n\t}\n\n\tvalidateAggregatorUrl(aggregatorUrl, options);\n\n\tconst out: ManifestRegistryConfig = {\n\t\t// Strip any trailing slash so `${aggregatorUrl}/xrpc/...` works\n\t\t// regardless of how the user wrote it.\n\t\taggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, \"\"),\n\t};\n\n\tif (config.acceptLabelers) {\n\t\tout.acceptLabelers = config.acceptLabelers;\n\t}\n\n\tconst policy: ManifestRegistryConfig[\"policy\"] = {};\n\tlet hasPolicy = false;\n\n\tif (config.policy?.minimumReleaseAge !== undefined) {\n\t\ttry {\n\t\t\tpolicy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);\n\t\t} catch (cause) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\",\n\t\t\t\tregistryField(options, \"policy.minimumReleaseAge\"),\n\t\t\t\t'must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds',\n\t\t\t\t{ cause },\n\t\t\t);\n\t\t}\n\t\thasPolicy = true;\n\t}\n\n\tif (config.policy?.minimumReleaseAgeExclude !== undefined) {\n\t\tif (!Array.isArray(config.policy.minimumReleaseAgeExclude)) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\tregistryField(options, \"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\"must be an array of DIDs or <did>/<slug> entries\",\n\t\t\t);\n\t\t}\n\t\t// Normalize at load time so callers (browser and server) can do\n\t\t// plain string compares without each one re-implementing the\n\t\t// case-folding rule.\n\t\tconst list = config.policy.minimumReleaseAgeExclude.map((entry) => {\n\t\t\tif (typeof entry !== \"string\") {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(options, \"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst trimmed = entry.trim();\n\t\t\tif (!trimmed) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(options, \"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"entries cannot be empty\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst lower = trimmed.toLowerCase();\n\t\t\tconst [did, slug, ...extra] = lower.split(\"/\");\n\t\t\tif (\n\t\t\t\t!did ||\n\t\t\t\t!isDid(did) ||\n\t\t\t\textra.length > 0 ||\n\t\t\t\t(slug !== undefined && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug))\n\t\t\t) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(options, \"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn lower;\n\t\t});\n\t\tif (list.length > 0) {\n\t\t\tpolicy.minimumReleaseAgeExclude = list;\n\t\t\thasPolicy = true;\n\t\t}\n\t}\n\n\tif (hasPolicy) {\n\t\tout.policy = policy;\n\t}\n\n\treturn out;\n}\n\n/** Normalize registry config without allowing a known config error to hide the admin. */\nexport function resolveManifestRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): {\n\tregistry?: ManifestRegistryConfig;\n\terror?: ManifestRegistryConfigurationError;\n} {\n\ttry {\n\t\tconst registry = normalizeRegistryConfig(input, options);\n\t\treturn registry ? { registry } : {};\n\t} catch (error) {\n\t\tif (!(error instanceof RegistryConfigurationError)) throw error;\n\t\treturn { error: { code: error.code, field: error.field } };\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAaA,MAAa,kCAAkC;AAO/C,SAAgB,gCAAgC,SAKhB;AAC/B,KAAI,QAAQ,aAAa,MAAO,QAAO,EAAE,aAAa,YAAY;AAClE,KAAI,QAAQ,aAAa,OACxB,QAAO;EAAE,OAAO,QAAQ;EAAU,aAAa;EAAY;AAE5D,KAAI,QAAQ,yBAAyB,OACpC,QAAO;EAAE,OAAO,QAAQ;EAAsB,aAAa;EAAyB;AAErF,KAAI,QAAQ,iBAAiB,QAAQ,mBAAmB,MACvD,QAAO;EAAE,OAAO;EAAiC,aAAa;EAAY;AAE3E,QAAO,EAAE,aAAa,YAAY;;AAGnC,SAAgB,uBACf,UACA,sBACkC;AAClC,QAAO,gCAAgC;EAAE;EAAU;EAAsB,CAAC,CAAC;;AAsD5E,IAAM,6BAAN,cAAyC,MAAM;CAC9C,YACC,AAAgB,MAChB,AAAgB,OAChB,SACA,SACC;AACD,QAAM,0CAA0C,MAAM,IAAI,WAAW,QAAQ;EAL7D;EACA;AAKhB,OAAK,OAAO;;;AASd,SAAS,cACR,SACA,QAC6B;AAC7B,QAAO,GAAG,QAAQ,eAAe,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;AAuB7D,SAAgB,mCAAmC,OAA0B;AAC5E,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,EAAE;CACpC,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,SAAS,MACnB,KAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC/C,MAAK,IAAI,MAAM;AAGjB,QAAO,CAAC,GAAG,KAAK,CAAC,UAAU;;;;;;;;;;;;;;;;;;;AAoB5B,SAAgB,4BACf,SACA,cACA,MACU;AACV,KAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;CAC7C,MAAM,WAAW,aAAa,aAAa;CAE3C,MAAM,UAAU,GAAG,SAAS,GADV,KAAK,aAAa;AAGpC,MAAK,MAAM,SAAS,SAAS;AAC5B,MAAI,UAAU,SAAU,QAAO;AAC/B,MAAI,UAAU,QAAS,QAAO;;AAE/B,QAAO;;AAGR,MAAM,mBAAmB;;AAGzB,MAAM,mBAAmB;;AAGzB,MAAM,eAAe;AAErB,MAAM,gCAAgC;;;;;;AAOtC,SAAgB,qBAAqB,UAAmC;AACvE,KAAI,OAAO,aAAa,UAAU;AACjC,MAAI,CAAC,OAAO,SAAS,SAAS,IAAI,WAAW,EAC5C,OAAM,IAAI,MAAM,qBAAqB,SAAS,yCAAyC;AAExF,SAAO,KAAK,MAAM,SAAS;;CAG5B,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,2EACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,IAAI,KAAK,KAAK;EAC9B,QAGC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;;;;;;;;;;AAgBpD,SAAgB,sBACf,eACA,UAAkD,EAAE,EAC9C;CACN,IAAI;AACJ,KAAI;AACH,WAAS,IAAI,IAAI,cAAc;UACvB,OAAO;AACf,QAAM,IAAI,2BACT,mCACA,cAAc,SAAS,gBAAgB,EACvC,uBACA,EAAE,OAAO,CACT;;AAEF,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,IAAI,2BACT,qCACA,cAAc,SAAS,gBAAgB,EACvC,yBACA;AAOF,KAAI,OAAO,YAAY,OAAO,SAC7B,OAAM,IAAI,2BACT,qCACA,cAAc,SAAS,gBAAgB,EACvC,wCACA;CAMF,MAAM,cAAc,OAAO,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;CAC3E,MAAM,WACL,YAAY,WAAW,IAAI,IAAI,YAAY,SAAS,IAAI,GACrD,YAAY,MAAM,GAAG,GAAG,GACxB;CACJ,MAAM,cACL,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,aAAa,SAEb,SAAS,WAAW,cAAc,IAClC,SAAS,WAAW,eAAe;AAGpC,KAAI,EADmB,QAAQ,kBAAkB,OAAO,KAAK,IAAI,MAC5C;AACpB,MAAI,OAAO,aAAa,QACvB,OAAM,IAAI,2BACT,qCACA,cAAc,SAAS,gBAAgB,EACvC,qCACA;AAEF,MAAI,YACH,OAAM,IAAI,2BACT,qCACA,cAAc,SAAS,gBAAgB,EACvC,kDACA;YAEQ,OAAO,aAAa,WAAW,CAAC,YAC1C,OAAM,IAAI,2BACT,qCACA,cAAc,SAAS,gBAAgB,EACvC,8DACA;AAGF,QAAO;;;;;;;;;;;;;AAcR,SAAgB,qBACf,OAC6B;AAC7B,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,SAAU,QAAO,EAAE,eAAe,OAAO;AAC9D,QAAO;;;;;;;;;;;;;;;;;AAkBR,SAAgB,wBACf,OACA,UAAkD,EAAE,EACpB;CAChC,MAAM,SAAS,qBAAqB,MAAM;AAC1C,KAAI,CAAC,OAAQ,QAAO;CAEpB,MAAM,gBACL,OAAO,OAAO,kBAAkB,WAAW,OAAO,cAAc,MAAM,GAAG;AAC1E,KAAI,CAAC,cACJ,OAAM,IAAI,2BACT,oCACA,cAAc,SAAS,gBAAgB,EACvC,8CACA;AAGF,uBAAsB,eAAe,QAAQ;CAE7C,MAAM,MAA8B,EAGnC,eAAe,cAAc,QAAQ,kBAAkB,GAAG,EAC1D;AAED,KAAI,OAAO,eACV,KAAI,iBAAiB,OAAO;CAG7B,MAAM,SAA2C,EAAE;CACnD,IAAI,YAAY;AAEhB,KAAI,OAAO,QAAQ,sBAAsB,QAAW;AACnD,MAAI;AACH,UAAO,2BAA2B,qBAAqB,OAAO,OAAO,kBAAkB;WAC/E,OAAO;AACf,SAAM,IAAI,2BACT,wCACA,cAAc,SAAS,2BAA2B,EAClD,mFACA,EAAE,OAAO,CACT;;AAEF,cAAY;;AAGb,KAAI,OAAO,QAAQ,6BAA6B,QAAW;AAC1D,MAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,yBAAyB,CACzD,OAAM,IAAI,2BACT,gDACA,cAAc,SAAS,kCAAkC,EACzD,mDACA;EAKF,MAAM,OAAO,OAAO,OAAO,yBAAyB,KAAK,UAAU;AAClE,OAAI,OAAO,UAAU,SACpB,OAAM,IAAI,2BACT,gDACA,cAAc,SAAS,kCAAkC,EACzD,+DACA;GAEF,MAAM,UAAU,MAAM,MAAM;AAC5B,OAAI,CAAC,QACJ,OAAM,IAAI,2BACT,gDACA,cAAc,SAAS,kCAAkC,EACzD,0BACA;GAEF,MAAM,QAAQ,QAAQ,aAAa;GACnC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,MAAM,MAAM,IAAI;AAC9C,OACC,CAAC,OACD,CAAC,MAAM,IAAI,IACX,MAAM,SAAS,KACd,SAAS,UAAa,CAAC,8BAA8B,KAAK,KAAK,CAEhE,OAAM,IAAI,2BACT,gDACA,cAAc,SAAS,kCAAkC,EACzD,+DACA;AAEF,UAAO;IACN;AACF,MAAI,KAAK,SAAS,GAAG;AACpB,UAAO,2BAA2B;AAClC,eAAY;;;AAId,KAAI,UACH,KAAI,SAAS;AAGd,QAAO;;;AAIR,SAAgB,8BACf,OACA,UAAkD,EAAE,EAInD;AACD,KAAI;EACH,MAAM,WAAW,wBAAwB,OAAO,QAAQ;AACxD,SAAO,WAAW,EAAE,UAAU,GAAG,EAAE;UAC3B,OAAO;AACf,MAAI,EAAE,iBAAiB,4BAA6B,OAAM;AAC1D,SAAO,EAAE,OAAO;GAAE,MAAM,MAAM;GAAM,OAAO,MAAM;GAAO,EAAE"}