emdash 1.0.1 → 1.1.0

package/dist/search-D6-XK1Sn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-D6-XK1Sn.mjs","names":[],"sources":["../src/search/query.ts","../src/search/text-extraction.ts","../src/search/index.ts"],"sourcesContent":["/**\n * Search Query Functions\n *\n * Programmatic API for searching content using FTS5.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { sql } from \"kysely\";\n\nimport { encodeCursor, decodeCursor, InvalidCursorError } from \"../database/repositories/types.js\";\nimport type { Database } from \"../database/types.js\";\nimport { validateIdentifier } from \"../database/validate.js\";\nimport { resolveConfiguredLocale } from \"../i18n/config.js\";\nimport { getDb } from \"../loader.js\";\nimport { FTSManager } from \"./fts-manager.js\";\nimport type {\n\tSearchOptions,\n\tCollectionSearchOptions,\n\tSearchResult,\n\tSearchResponse,\n\tSuggestOptions,\n\tSuggestion,\n\tSearchStats,\n} from \"./types.js\";\n\n/**\n * Marker stored in the `id` slot of a search pagination cursor.\n *\n * Search results are merged from per-collection FTS queries and re-sorted by\n * score, so there is no single stable keyset column to encode (the way\n * `getEmDashCollection` encodes `(orderValue, id)`). We page over the merged,\n * score-sorted set by offset instead, carried as the cursor's `orderValue`.\n * Reusing `encodeCursor`/`decodeCursor` keeps the opaque base64-JSON shape and\n * the `InvalidCursorError` handling consistent with the rest of the API.\n */\nconst SEARCH_CURSOR_MARKER = \"search\";\n\n/** Encode the next-page offset into an opaque search cursor. */\nfunction encodeSearchCursor(offset: number): string {\n\treturn encodeCursor(String(offset), SEARCH_CURSOR_MARKER);\n}\n\n/**\n * Decode a search cursor back to its offset. Throws `InvalidCursorError` for a\n * malformed cursor or one that doesn't carry a non-negative integer offset, so\n * a client pagination bug surfaces immediately rather than silently restarting\n * from the first page.\n */\n/** Upper bound on a decoded search offset, to cap the per-collection row fetch a forged cursor can trigger. */\nconst MAX_SEARCH_OFFSET = 10_000;\n\nfunction decodeSearchOffset(cursor: string): number {\n\tconst { orderValue, id } = decodeCursor(cursor);\n\tif (id !== SEARCH_CURSOR_MARKER) {\n\t\tthrow new InvalidCursorError(cursor);\n\t}\n\tconst offset = Number(orderValue);\n\tif (!Number.isInteger(offset) || offset < 0 || offset > MAX_SEARCH_OFFSET) {\n\t\tthrow new InvalidCursorError(cursor);\n\t}\n\treturn offset;\n}\n\n/** Pattern to split on whitespace for query term extraction */\nconst WHITESPACE_SPLIT_PATTERN = /\\s+/;\nconst FTS_OPERATORS_PATTERN = /\\b(AND|OR|NOT|NEAR)\\b/i;\nconst DOUBLE_QUOTE_PATTERN = /\"/g;\n\n/**\n * Detect FTS5 query syntax errors. Match specifically on the SQLite FTS5\n * error fingerprints rather than a broad \"fts5\" / \"syntax error\" filter\n * (which would also swallow internal table-corruption errors). The two\n * fingerprints we care about are:\n *\n *  - \"fts5: syntax error near …\" — unbalanced quotes, stray operators,\n *    other malformed user input\n *  - \"unknown special query: …\" — bare special tokens like `^*` that\n *    parse but don't resolve to a real FTS5 directive\n */\nfunction isFts5SyntaxError(error: unknown): boolean {\n\tif (!(error instanceof Error)) return false;\n\tconst message = error.message.toLowerCase();\n\treturn message.includes(\"fts5: syntax error\") || message.includes(\"unknown special query\");\n}\n\n/**\n * Search across multiple collections\n *\n * Public API that auto-injects the database.\n *\n * @param query - Search query (FTS5 syntax supported)\n * @param options - Search options\n * @returns Search results with pagination\n *\n * @example\n * ```typescript\n * import { search } from \"emdash\";\n *\n * const results = await search(\"hello world\", {\n *   collections: [\"posts\", \"pages\"],\n *   limit: 20\n * });\n * ```\n */\nexport async function search(query: string, options: SearchOptions = {}): Promise<SearchResponse> {\n\tconst db = await getDb();\n\treturn searchWithDb(db, query, options);\n}\n\n/**\n * Search across multiple collections (with explicit db)\n *\n * @internal Use `search()` in templates. This variant is for admin routes\n * that already have a database handle.\n *\n * @param db - Kysely database instance\n * @param query - Search query (FTS5 syntax supported)\n * @param options - Search options\n * @returns Search results with pagination\n */\nexport async function searchWithDb(\n\tdb: Kysely<Database>,\n\tquery: string,\n\toptions: SearchOptions = {},\n): Promise<SearchResponse> {\n\tconst ftsManager = new FTSManager(db);\n\tconst limit = options.limit ?? 20;\n\tconst status = options.status ?? \"published\";\n\tconst offset = options.cursor ? decodeSearchOffset(options.cursor) : 0;\n\n\t// Get searchable collections\n\tlet collections = options.collections;\n\tif (!collections || collections.length === 0) {\n\t\tcollections = await getSearchableCollections(db);\n\t}\n\n\tif (collections.length === 0) {\n\t\treturn { items: [] };\n\t}\n\n\t// To rank the merged window [offset, offset + limit) correctly, each\n\t// collection must contribute its own top (offset + limit) rows — in the\n\t// worst case the entire window comes from one collection. The extra +1\n\t// row detects whether a further page exists.\n\tconst perCollectionLimit = offset + limit + 1;\n\n\t// Search each collection and merge results\n\tconst allResults: SearchResult[] = [];\n\tconst titleColumns = await ftsManager.getCollectionsWithTitleColumn(collections);\n\n\tfor (const collection of collections) {\n\t\tconst config = await ftsManager.getSearchConfig(collection);\n\t\tif (!config?.enabled) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst collectionResults = await searchSingleCollection(\n\t\t\tdb,\n\t\t\tcollection,\n\t\t\tquery,\n\t\t\t{\n\t\t\t\tstatus,\n\t\t\t\tlocale: options.locale,\n\t\t\t\tlimit: perCollectionLimit,\n\t\t\t\tscope: options.scope,\n\t\t\t},\n\t\t\tconfig.weights,\n\t\t\ttitleColumns.has(collection),\n\t\t\tconfig.titleField,\n\t\t);\n\n\t\tallResults.push(...collectionResults);\n\t}\n\n\t// Sort by score descending\n\tallResults.sort((a, b) => b.score - a.score);\n\n\t// Page the merged set by offset. A nextCursor is issued only when at least\n\t// one result exists past this page.\n\tconst items = allResults.slice(offset, offset + limit);\n\tconst hasMore = allResults.length > offset + limit;\n\tconst nextCursor = hasMore ? encodeSearchCursor(offset + limit) : undefined;\n\n\treturn { items, nextCursor };\n}\n\n/**\n * Search within a single collection\n *\n * @param db - Kysely database instance\n * @param collection - Collection slug\n * @param query - Search query (FTS5 syntax supported)\n * @param options - Search options\n * @returns Search results with pagination\n *\n * @example\n * ```typescript\n * const results = await searchCollection(db, \"posts\", \"hello world\", {\n *   limit: 10\n * });\n * ```\n */\nexport async function searchCollection(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tquery: string,\n\toptions: CollectionSearchOptions = {},\n): Promise<SearchResponse> {\n\tconst ftsManager = new FTSManager(db);\n\tconst config = await ftsManager.getSearchConfig(collection);\n\n\tif (!config?.enabled) {\n\t\treturn { items: [] };\n\t}\n\n\tconst limit = options.limit ?? 20;\n\tconst offset = options.cursor ? decodeSearchOffset(options.cursor) : 0;\n\n\t// Over-fetch the [offset, offset + limit) window plus one row to detect a\n\t// further page, then slice. Keeps the FTS SQL (LIMIT-only) unchanged and\n\t// the cursor contract identical to the cross-collection path.\n\tconst fetched = await searchSingleCollection(\n\t\tdb,\n\t\tcollection,\n\t\tquery,\n\t\t{\n\t\t\tstatus: options.status,\n\t\t\tlocale: options.locale,\n\t\t\tlimit: offset + limit + 1,\n\t\t\tscope: options.scope,\n\t\t},\n\t\tconfig.weights,\n\t\tundefined,\n\t\tconfig.titleField,\n\t);\n\n\tconst items = fetched.slice(offset, offset + limit);\n\tconst hasMore = fetched.length > offset + limit;\n\tconst nextCursor = hasMore ? encodeSearchCursor(offset + limit) : undefined;\n\n\treturn { items, nextCursor };\n}\n\n/**\n * Internal function to search a single collection\n */\nasync function searchSingleCollection(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tquery: string,\n\toptions: CollectionSearchOptions,\n\tweights?: Record<string, number>,\n\thasTitle?: boolean,\n\ttitleField?: string,\n): Promise<SearchResult[]> {\n\t// Validate before any raw SQL interpolation\n\tvalidateIdentifier(collection, \"collection slug\");\n\n\tconst ftsManager = new FTSManager(db);\n\tconst ftsTable = ftsManager.getFtsTableName(collection);\n\tconst contentTable = ftsManager.getContentTableName(collection);\n\tconst limit = options.limit ?? 20;\n\tconst status = options.status ?? \"published\";\n\tconst locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;\n\n\t// Check if FTS table exists\n\tif (!(await ftsManager.ftsTableExists(collection))) {\n\t\treturn [];\n\t}\n\n\t// Escape the query for FTS5\n\tconst escapedQuery = escapeQuery(query);\n\tif (!escapedQuery) {\n\t\treturn [];\n\t}\n\n\t// Get searchable fields for snippet generation\n\tconst searchableFields = await ftsManager.getSearchableFields(collection);\n\n\t// Title scope restricts the FTS5 match to the collection's title column.\n\t// The scoped column must be one of the indexed searchable fields; a\n\t// collection whose title is not indexed cannot match by title. Operators\n\t// are disabled so every term stays quoted inside the filter's group.\n\tlet matchQuery = escapedQuery;\n\tif (options.scope === \"title\") {\n\t\tconst titleColumn =\n\t\t\ttitleField && searchableFields.includes(titleField)\n\t\t\t\t? titleField\n\t\t\t\t: searchableFields.includes(\"title\")\n\t\t\t\t\t? \"title\"\n\t\t\t\t\t: undefined;\n\t\tif (!titleColumn) {\n\t\t\treturn [];\n\t\t}\n\t\tvalidateIdentifier(titleColumn, \"title field\");\n\t\tmatchQuery = `${titleColumn} : (${escapeQuery(query, false)})`;\n\t}\n\n\t// `title` is an optional user-defined field, not a system column. Only\n\t// select it when the collection actually has one; otherwise the query\n\t// errors with \"no such column: c.title\". Multi-collection callers\n\t// precompute this in bulk and pass it in; single-collection callers fall\n\t// back to the per-collection check.\n\t// A configured titleField drives the result title so search shows\n\t// the same value as the content list. It's a validated existing field, so\n\t// the column exists; otherwise fall back to the optional `title` column.\n\tlet titleExpr;\n\tif (titleField) {\n\t\tvalidateIdentifier(titleField, \"title field\");\n\t\ttitleExpr = sql`c.${sql.ref(titleField)}`;\n\t} else {\n\t\tconst collectionHasTitle = hasTitle ?? (await ftsManager.hasTitleColumn(collection));\n\t\ttitleExpr = collectionHasTitle ? sql`c.title` : sql`NULL`;\n\t}\n\n\t// Build weight string for bm25 if weights provided\n\t// Format: bm25(table, weight1, weight2, ...)\n\t// First two weights are for 'id' and 'locale' columns (UNINDEXED, so 0)\n\tlet bm25Args = \"\";\n\tif (weights && searchableFields.length > 0) {\n\t\tconst weightValues = [\"0\", \"0\"]; // id column, locale column\n\t\tfor (const field of searchableFields) {\n\t\t\tweightValues.push(String(weights[field] ?? 1));\n\t\t}\n\t\tbm25Args = weightValues.join(\", \");\n\t}\n\n\t// Build and execute the search query\n\t// Using raw SQL because Kysely doesn't have FTS5 support\n\tconst bm25Expr = bm25Args ? `bm25(\"${ftsTable}\", ${bm25Args})` : `bm25(\"${ftsTable}\")`;\n\n\t// Snippet column index is 2 (after id=0, locale=1, first searchable field=2)\n\tlet results;\n\ttry {\n\t\tresults = await sql<{\n\t\t\tid: string;\n\t\t\tslug: string | null;\n\t\t\tlocale: string;\n\t\t\ttitle: string | null;\n\t\t\tsnippet: string | null;\n\t\t\tscore: number;\n\t\t}>`\n\t\tSELECT\n\t\t\tc.id,\n\t\t\tc.slug,\n\t\t\tc.locale,\n\t\t\t${titleExpr} as title,\n\t\t\tsnippet(\"${sql.raw(ftsTable)}\", 2, '<mark>', '</mark>', '...', 32) as snippet,\n\t\t\t${sql.raw(bm25Expr)} as score\n\t\tFROM \"${sql.raw(ftsTable)}\" f\n\t\tJOIN \"${sql.raw(contentTable)}\" c ON f.id = c.id\n\t\tWHERE \"${sql.raw(ftsTable)}\" MATCH ${matchQuery}\n\t\tAND c.status = ${status}\n\t\tAND c.deleted_at IS NULL\n\t\t${locale ? sql`AND c.locale = ${locale}` : sql``}\n\t\tORDER BY score\n\t\tLIMIT ${limit}\n\t`.execute(db);\n\t} catch (error) {\n\t\t// FTS5 returns syntax errors for queries with unbalanced quotes,\n\t\t// stray operators, or other malformed input. Treat these as\n\t\t// \"no matches\" so the user gets an empty result rather than an\n\t\t// internals-leaking error. Other errors (table missing, IO) still\n\t\t// propagate. Intentionally not logged: any anonymous client can\n\t\t// trigger this path, and the underlying error message embeds the\n\t\t// raw query, so logging would be both noisy and a log-injection\n\t\t// vector.\n\t\tif (isFts5SyntaxError(error)) {\n\t\t\treturn [];\n\t\t}\n\t\tthrow error;\n\t}\n\n\treturn results.rows.map((row) => ({\n\t\tcollection,\n\t\tid: row.id,\n\t\tslug: row.slug,\n\t\tlocale: row.locale,\n\t\ttitle: row.title ?? undefined,\n\t\t// SQLite's snippet() returns NULL when the targeted column is\n\t\t// NULL for that row — even if the row matched via a different\n\t\t// searchable column. Skip sanitization in that case so we don't\n\t\t// throw on `null.replace`. The SearchResult.snippet field is\n\t\t// already optional, so omitting it is the documented contract.\n\t\tsnippet: row.snippet === null ? undefined : sanitizeSnippet(row.snippet),\n\t\tscore: Math.abs(row.score), // bm25 returns negative scores\n\t}));\n}\n\n// Module-scope regexes so the engine doesn't recompile per call —\n// snippet sanitization runs on every search result.\nconst SNIPPET_AMP_RE = /&/g;\nconst SNIPPET_LT_RE = /</g;\nconst SNIPPET_GT_RE = />/g;\nconst SNIPPET_QUOT_RE = /\"/g;\nconst SNIPPET_APOS_RE = /'/g;\n\n/**\n * Make an FTS5 snippet safe to render with `set:html` / `innerHTML`.\n *\n * SQLite's `snippet()` function splices literal `<mark>` and `</mark>`\n * markers around matched terms but does not escape the surrounding\n * source text. Posts that legitimately contain `<`, `>`, `&`, `\"` or\n * `'` would render as broken markup, and a `<script>` literal in a\n * title (or any other indexed field) would execute when displayed.\n *\n * The fix: HTML-escape the whole string, which turns the markers into\n * `&lt;mark&gt;` / `&lt;/mark&gt;`. Then restore those two patterns to\n * their original tag form. The result is \"the indexed text with all\n * HTML metacharacters escaped, plus a small set of literal `<mark>`\n * highlight tags around matched terms\" — which matches the API's\n * documented contract.\n */\nfunction sanitizeSnippet(snippet: string): string {\n\treturn snippet\n\t\t.replace(SNIPPET_AMP_RE, \"&amp;\")\n\t\t.replace(SNIPPET_LT_RE, \"&lt;\")\n\t\t.replace(SNIPPET_GT_RE, \"&gt;\")\n\t\t.replace(SNIPPET_QUOT_RE, \"&quot;\")\n\t\t.replace(SNIPPET_APOS_RE, \"&#39;\")\n\t\t.replaceAll(\"&lt;mark&gt;\", \"<mark>\")\n\t\t.replaceAll(\"&lt;/mark&gt;\", \"</mark>\");\n}\n\n/**\n * Get search suggestions for autocomplete\n *\n * @param db - Kysely database instance\n * @param query - Partial search query\n * @param options - Suggestion options\n * @returns Array of suggestions\n */\nexport async function getSuggestions(\n\tdb: Kysely<Database>,\n\tquery: string,\n\toptions: SuggestOptions = {},\n): Promise<Suggestion[]> {\n\tconst limit = options.limit ?? 5;\n\tconst locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;\n\n\t// Get searchable collections\n\tlet collections = options.collections;\n\tif (!collections || collections.length === 0) {\n\t\tcollections = await getSearchableCollections(db);\n\t}\n\n\tif (collections.length === 0) {\n\t\treturn [];\n\t}\n\n\tconst suggestions: Suggestion[] = [];\n\tconst ftsManager = new FTSManager(db);\n\tconst titleColumns = await ftsManager.getCollectionsWithTitleColumn(collections);\n\n\tfor (const collection of collections) {\n\t\tconst config = await ftsManager.getSearchConfig(collection);\n\t\tif (!config?.enabled) {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Suggestions are title-based (Suggestion.title is required). A configured\n\t\t// titleField supplies it -- a validated existing column -- so it\n\t\t// takes precedence and keeps autocomplete consistent with search results.\n\t\t// Otherwise fall back to the optional `title` field; collections with\n\t\t// neither can't produce a suggestion and are skipped (selecting a missing\n\t\t// column would error).\n\t\tlet titleExpr;\n\t\tif (config.titleField) {\n\t\t\tvalidateIdentifier(config.titleField, \"title field\");\n\t\t\ttitleExpr = sql`c.${sql.ref(config.titleField)}`;\n\t\t} else if (titleColumns.has(collection)) {\n\t\t\ttitleExpr = sql`c.title`;\n\t\t} else {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Validate before raw SQL interpolation\n\t\tvalidateIdentifier(collection, \"collection slug\");\n\n\t\tconst ftsTable = ftsManager.getFtsTableName(collection);\n\t\tconst contentTable = ftsManager.getContentTableName(collection);\n\n\t\t// Use prefix search for autocomplete. `escapeQuery` already appends `*`\n\t\t// to each term for prefix matching, so we must not append another one.\n\t\tconst prefixQuery = escapeQuery(query);\n\t\tif (!prefixQuery) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet results;\n\t\ttry {\n\t\t\tresults = await sql<{\n\t\t\t\tid: string;\n\t\t\t\tslug: string | null;\n\t\t\t\ttitle: string;\n\t\t\t}>`\n\t\t\t\tSELECT\n\t\t\t\t\tc.id,\n\t\t\t\t\tc.slug,\n\t\t\t\t\t${titleExpr} AS title\n\t\t\t\tFROM \"${sql.raw(ftsTable)}\" f\n\t\t\t\tJOIN \"${sql.raw(contentTable)}\" c ON f.id = c.id\n\t\t\t\tWHERE \"${sql.raw(ftsTable)}\" MATCH ${prefixQuery}\n\t\t\t\tAND c.status = 'published'\n\t\t\t\tAND c.deleted_at IS NULL\n\t\t\t\tAND ${titleExpr} IS NOT NULL\n\t\t\t\t${locale ? sql`AND c.locale = ${locale}` : sql``}\n\t\t\t\tORDER BY bm25(\"${sql.raw(ftsTable)}\")\n\t\t\t\tLIMIT ${limit}\n\t\t\t`.execute(db);\n\t\t} catch (error) {\n\t\t\t// Same swallow as searchSingleCollection: malformed prefix\n\t\t\t// queries should yield no suggestions, not surface DB errors.\n\t\t\t// Intentionally not logged (anonymous-triggerable, echoes\n\t\t\t// user input -- see searchSingleCollection for rationale).\n\t\t\tif (isFts5SyntaxError(error)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\n\t\tfor (const row of results.rows) {\n\t\t\tsuggestions.push({\n\t\t\t\tcollection,\n\t\t\t\tid: row.id,\n\t\t\t\tslug: row.slug,\n\t\t\t\ttitle: row.title,\n\t\t\t});\n\t\t}\n\t}\n\n\treturn suggestions.slice(0, limit);\n}\n\n/**\n * Get search statistics for all collections\n */\nexport async function getSearchStats(db: Kysely<Database>): Promise<SearchStats> {\n\tconst ftsManager = new FTSManager(db);\n\tconst collections = await getSearchableCollections(db);\n\tconst stats: SearchStats = { collections: {} };\n\n\tfor (const collection of collections) {\n\t\tconst collectionStats = await ftsManager.getIndexStats(collection);\n\t\tif (collectionStats) {\n\t\t\tstats.collections[collection] = collectionStats;\n\t\t}\n\t}\n\n\treturn stats;\n}\n\n/**\n * Get list of collections with search enabled\n */\nasync function getSearchableCollections(db: Kysely<Database>): Promise<string[]> {\n\tconst results = await db\n\t\t.selectFrom(\"_emdash_collections\")\n\t\t.select([\"slug\", \"search_config\"])\n\t\t.execute();\n\n\treturn results\n\t\t.filter((r) => {\n\t\t\tif (!r.search_config) return false;\n\t\t\ttry {\n\t\t\t\tconst config = JSON.parse(r.search_config);\n\t\t\t\treturn config.enabled === true;\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t})\n\t\t.map((r) => r.slug);\n}\n\n/**\n * Escape a query string for FTS5\n *\n * Handles special characters and prevents injection.\n */\nfunction escapeQuery(query: string, allowOperators = true): string {\n\tif (!query || typeof query !== \"string\") {\n\t\treturn \"\";\n\t}\n\n\t// Trim whitespace\n\tquery = query.trim();\n\n\tif (query.length === 0) {\n\t\treturn \"\";\n\t}\n\n\t// If already a quoted phrase, escape only interior quotes and preserve phrase syntax\n\tif (query.startsWith('\"') && query.endsWith('\"') && query.length >= 2) {\n\t\tconst inner = query.slice(1, -1);\n\t\treturn `\"${inner.replace(DOUBLE_QUOTE_PATTERN, '\"\"')}\"`;\n\t}\n\n\t// Escape any existing quotes\n\tconst escaped = query.replace(DOUBLE_QUOTE_PATTERN, '\"\"');\n\n\t// If the query contains FTS5 operators (AND, OR, NOT, NEAR),\n\t// pass through with quotes escaped but operators preserved. Not allowed\n\t// when the match string is embedded in a column filter: unquoted parens\n\t// would let a clause escape the filter's group.\n\tif (allowOperators && FTS_OPERATORS_PATTERN.test(query)) {\n\t\treturn escaped;\n\t}\n\n\t// For simple queries, wrap each word to handle special chars\n\tconst terms = escaped.split(WHITESPACE_SPLIT_PATTERN).filter((t) => t.length > 0);\n\tif (terms.length === 0) {\n\t\treturn \"\";\n\t}\n\n\t// Join with implicit AND, add prefix matching (*) to all terms\n\t// This allows \"hel wor\" to match \"hello world\"\n\treturn terms.map((t) => `\"${t}\"*`).join(\" \");\n}\n","/**\n * Text Extraction\n *\n * Extracts plain text from Portable Text blocks for FTS indexing.\n * Uses @portabletext/toolkit as base with extensions for custom block types.\n */\n\nimport { toPlainText } from \"@portabletext/toolkit\";\n\nimport type { PortableTextBlock } from \"../content/converters/types.js\";\n\n/**\n * Validate that a value looks like a Portable Text block array.\n * Each element must have at least a `_type` string property.\n */\nfunction isPortableTextArray(value: unknown[]): value is PortableTextBlock[] {\n\treturn value.every(\n\t\t(item) =>\n\t\t\ttypeof item === \"object\" &&\n\t\t\titem !== null &&\n\t\t\t\"_type\" in item &&\n\t\t\ttypeof item._type === \"string\",\n\t);\n}\n\n/**\n * Extract additional text from custom block types that toPlainText doesn't handle\n */\nfunction extractCustomBlockText(block: PortableTextBlock): string {\n\t// Code blocks - include the code content\n\tif (block._type === \"code\" && \"code\" in block && typeof block.code === \"string\") {\n\t\treturn block.code;\n\t}\n\n\t// Image blocks - include alt text and caption\n\tif (block._type === \"image\") {\n\t\tconst parts: string[] = [];\n\t\tif (\"alt\" in block && typeof block.alt === \"string\" && block.alt) {\n\t\t\tparts.push(block.alt);\n\t\t}\n\t\tif (\"caption\" in block && typeof block.caption === \"string\" && block.caption) {\n\t\t\tparts.push(block.caption);\n\t\t}\n\t\treturn parts.join(\" \");\n\t}\n\n\treturn \"\";\n}\n\n/**\n * Extract plain text from Portable Text blocks\n *\n * Uses @portabletext/toolkit's toPlainText for standard blocks,\n * plus extracts text from custom block types (code, images with alt/caption).\n *\n * @param blocks - Array of Portable Text blocks (or a JSON string)\n * @returns Plain text content\n *\n * @example\n * ```typescript\n * const text = extractPlainText([\n *   {\n *     _type: \"block\",\n *     _key: \"abc\",\n *     children: [{ _type: \"span\", _key: \"s1\", text: \"Hello World\" }]\n *   }\n * ]);\n * // Returns: \"Hello World\"\n * ```\n */\nexport function extractPlainText(blocks: PortableTextBlock[] | string | null | undefined): string {\n\tif (!blocks) {\n\t\treturn \"\";\n\t}\n\n\t// Handle JSON string input\n\tlet parsedBlocks: PortableTextBlock[];\n\tif (typeof blocks === \"string\") {\n\t\ttry {\n\t\t\tparsedBlocks = JSON.parse(blocks);\n\t\t} catch {\n\t\t\t// If it's not valid JSON, treat as plain text\n\t\t\treturn blocks;\n\t\t}\n\t} else {\n\t\tparsedBlocks = blocks;\n\t}\n\n\tif (!Array.isArray(parsedBlocks)) {\n\t\treturn \"\";\n\t}\n\n\t// Use official toPlainText for standard blocks.\n\t// toPlainText expects `{ _type: string; [key: string]: any }[]` but our blocks use\n\t// `unknown` index sigs. They're structurally compatible at runtime — spread each block\n\t// to satisfy the wider index signature without an unsafe cast.\n\tconst toolkitBlocks = parsedBlocks.map((b) => {\n\t\tconst obj: Record<string, unknown> & { _type: string } = { _type: b._type };\n\t\tfor (const [key, val] of Object.entries(b)) {\n\t\t\tobj[key] = val;\n\t\t}\n\t\treturn obj;\n\t});\n\tconst standardText = toPlainText(toolkitBlocks);\n\n\t// Extract text from custom block types that toPlainText doesn't handle\n\tconst customTexts = parsedBlocks.map(extractCustomBlockText).filter((text) => text.length > 0);\n\n\t// Combine both\n\tconst allTexts = [standardText, ...customTexts].filter((t) => t.length > 0);\n\treturn allTexts.join(\"\\n\");\n}\n\n/**\n * Extract searchable text from a content entry\n *\n * Extracts text from specified fields, handling both plain text and Portable Text.\n *\n * @param entry - Content entry data\n * @param fields - Field names to extract text from\n * @returns Object mapping field names to extracted text\n */\nexport function extractSearchableFields(\n\tentry: Record<string, unknown>,\n\tfields: string[],\n): Record<string, string> {\n\tconst result: Record<string, string> = {};\n\n\tfor (const field of fields) {\n\t\tconst value = entry[field];\n\n\t\tif (value === null || value === undefined) {\n\t\t\tresult[field] = \"\";\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (typeof value === \"string\") {\n\t\t\t// Could be plain text or JSON Portable Text\n\t\t\tif (value.startsWith(\"[\")) {\n\t\t\t\tresult[field] = extractPlainText(value);\n\t\t\t} else {\n\t\t\t\tresult[field] = value;\n\t\t\t}\n\t\t} else if (Array.isArray(value)) {\n\t\t\t// Validate the array looks like Portable Text before treating it as such\n\t\t\tif (isPortableTextArray(value)) {\n\t\t\t\tresult[field] = extractPlainText(value);\n\t\t\t} else {\n\t\t\t\tresult[field] = JSON.stringify(value);\n\t\t\t}\n\t\t} else if (typeof value === \"object\") {\n\t\t\t// Object — serialize to JSON for searchable text\n\t\t\tresult[field] = JSON.stringify(value);\n\t\t} else if (typeof value === \"number\" || typeof value === \"boolean\") {\n\t\t\tresult[field] = `${value}`;\n\t\t} else {\n\t\t\tresult[field] = \"\";\n\t\t}\n\t}\n\n\treturn result;\n}\n","/**\n * Search Module\n *\n * Full-text search for EmDash using SQLite FTS5.\n */\n\n// Types\nexport type {\n\tSearchConfig,\n\tSearchTokenizer,\n\tSearchOptions,\n\tCollectionSearchOptions,\n\tSearchResult,\n\tSearchResponse,\n\tSuggestOptions,\n\tSuggestion,\n\tSearchStats,\n} from \"./types.js\";\nexport { SEARCH_TOKENIZERS } from \"./types.js\";\n\n// FTS Manager\nexport { FTSManager } from \"./fts-manager.js\";\n\n// Query functions (public API uses getDb() internally)\nexport { search, searchWithDb, searchCollection, getSuggestions, getSearchStats } from \"./query.js\";\n\n// Text extraction\nexport { extractPlainText, extractSearchableFields } from \"./text-extraction.js\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmCA,MAAM,uBAAuB;;AAG7B,SAAS,mBAAmB,QAAwB;AACnD,QAAO,aAAa,OAAO,OAAO,EAAE,qBAAqB;;;;;;;;;AAU1D,MAAM,oBAAoB;AAE1B,SAAS,mBAAmB,QAAwB;CACnD,MAAM,EAAE,YAAY,OAAO,aAAa,OAAO;AAC/C,KAAI,OAAO,qBACV,OAAM,IAAI,mBAAmB,OAAO;CAErC,MAAM,SAAS,OAAO,WAAW;AACjC,KAAI,CAAC,OAAO,UAAU,OAAO,IAAI,SAAS,KAAK,SAAS,kBACvD,OAAM,IAAI,mBAAmB,OAAO;AAErC,QAAO;;;AAIR,MAAM,2BAA2B;AACjC,MAAM,wBAAwB;AAC9B,MAAM,uBAAuB;;;;;;;;;;;;AAa7B,SAAS,kBAAkB,OAAyB;AACnD,KAAI,EAAE,iBAAiB,OAAQ,QAAO;CACtC,MAAM,UAAU,MAAM,QAAQ,aAAa;AAC3C,QAAO,QAAQ,SAAS,qBAAqB,IAAI,QAAQ,SAAS,wBAAwB;;;;;;;;;;;;;;;;;;;;;AAsB3F,eAAsB,OAAO,OAAe,UAAyB,EAAE,EAA2B;AAEjG,QAAO,aADI,MAAM,OAAO,EACA,OAAO,QAAQ;;;;;;;;;;;;;AAcxC,eAAsB,aACrB,IACA,OACA,UAAyB,EAAE,EACD;CAC1B,MAAM,aAAa,IAAI,WAAW,GAAG;CACrC,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,SAAS,QAAQ,SAAS,mBAAmB,QAAQ,OAAO,GAAG;CAGrE,IAAI,cAAc,QAAQ;AAC1B,KAAI,CAAC,eAAe,YAAY,WAAW,EAC1C,eAAc,MAAM,yBAAyB,GAAG;AAGjD,KAAI,YAAY,WAAW,EAC1B,QAAO,EAAE,OAAO,EAAE,EAAE;CAOrB,MAAM,qBAAqB,SAAS,QAAQ;CAG5C,MAAM,aAA6B,EAAE;CACrC,MAAM,eAAe,MAAM,WAAW,8BAA8B,YAAY;AAEhF,MAAK,MAAM,cAAc,aAAa;EACrC,MAAM,SAAS,MAAM,WAAW,gBAAgB,WAAW;AAC3D,MAAI,CAAC,QAAQ,QACZ;EAGD,MAAM,oBAAoB,MAAM,uBAC/B,IACA,YACA,OACA;GACC;GACA,QAAQ,QAAQ;GAChB,OAAO;GACP,OAAO,QAAQ;GACf,EACD,OAAO,SACP,aAAa,IAAI,WAAW,EAC5B,OAAO,WACP;AAED,aAAW,KAAK,GAAG,kBAAkB;;AAItC,YAAW,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM;AAQ5C,QAAO;EAAE,OAJK,WAAW,MAAM,QAAQ,SAAS,MAAM;EAItC,YAHA,WAAW,SAAS,SAAS,QAChB,mBAAmB,SAAS,MAAM,GAAG;EAEtC;;;;;;;;;;;;;;;;;;AAmB7B,eAAsB,iBACrB,IACA,YACA,OACA,UAAmC,EAAE,EACX;CAE1B,MAAM,SAAS,MADI,IAAI,WAAW,GAAG,CACL,gBAAgB,WAAW;AAE3D,KAAI,CAAC,QAAQ,QACZ,QAAO,EAAE,OAAO,EAAE,EAAE;CAGrB,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,SAAS,mBAAmB,QAAQ,OAAO,GAAG;CAKrE,MAAM,UAAU,MAAM,uBACrB,IACA,YACA,OACA;EACC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ;EAChB,OAAO,SAAS,QAAQ;EACxB,OAAO,QAAQ;EACf,EACD,OAAO,SACP,QACA,OAAO,WACP;AAMD,QAAO;EAAE,OAJK,QAAQ,MAAM,QAAQ,SAAS,MAAM;EAInC,YAHA,QAAQ,SAAS,SAAS,QACb,mBAAmB,SAAS,MAAM,GAAG;EAEtC;;;;;AAM7B,eAAe,uBACd,IACA,YACA,OACA,SACA,SACA,UACA,YAC0B;AAE1B,oBAAmB,YAAY,kBAAkB;CAEjD,MAAM,aAAa,IAAI,WAAW,GAAG;CACrC,MAAM,WAAW,WAAW,gBAAgB,WAAW;CACvD,MAAM,eAAe,WAAW,oBAAoB,WAAW;CAC/D,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,SAAS,QAAQ,SAAS,wBAAwB,QAAQ,OAAO,GAAG;AAG1E,KAAI,CAAE,MAAM,WAAW,eAAe,WAAW,CAChD,QAAO,EAAE;CAIV,MAAM,eAAe,YAAY,MAAM;AACvC,KAAI,CAAC,aACJ,QAAO,EAAE;CAIV,MAAM,mBAAmB,MAAM,WAAW,oBAAoB,WAAW;CAMzE,IAAI,aAAa;AACjB,KAAI,QAAQ,UAAU,SAAS;EAC9B,MAAM,cACL,cAAc,iBAAiB,SAAS,WAAW,GAChD,aACA,iBAAiB,SAAS,QAAQ,GACjC,UACA;AACL,MAAI,CAAC,YACJ,QAAO,EAAE;AAEV,qBAAmB,aAAa,cAAc;AAC9C,eAAa,GAAG,YAAY,MAAM,YAAY,OAAO,MAAM,CAAC;;CAW7D,IAAI;AACJ,KAAI,YAAY;AACf,qBAAmB,YAAY,cAAc;AAC7C,cAAY,GAAG,KAAK,IAAI,IAAI,WAAW;OAGvC,aAD2B,YAAa,MAAM,WAAW,eAAe,WAAW,GAClD,GAAG,YAAY,GAAG;CAMpD,IAAI,WAAW;AACf,KAAI,WAAW,iBAAiB,SAAS,GAAG;EAC3C,MAAM,eAAe,CAAC,KAAK,IAAI;AAC/B,OAAK,MAAM,SAAS,iBACnB,cAAa,KAAK,OAAO,QAAQ,UAAU,EAAE,CAAC;AAE/C,aAAW,aAAa,KAAK,KAAK;;CAKnC,MAAM,WAAW,WAAW,SAAS,SAAS,KAAK,SAAS,KAAK,SAAS,SAAS;CAGnF,IAAI;AACJ,KAAI;AACH,YAAU,MAAM,GAOd;;;;;KAKC,UAAU;cACD,IAAI,IAAI,SAAS,CAAC;KAC3B,IAAI,IAAI,SAAS,CAAC;UACb,IAAI,IAAI,SAAS,CAAC;UAClB,IAAI,IAAI,aAAa,CAAC;WACrB,IAAI,IAAI,SAAS,CAAC,UAAU,WAAW;mBAC/B,OAAO;;IAEtB,SAAS,GAAG,kBAAkB,WAAW,GAAG,GAAG;;UAEzC,MAAM;GACb,QAAQ,GAAG;UACJ,OAAO;AASf,MAAI,kBAAkB,MAAM,CAC3B,QAAO,EAAE;AAEV,QAAM;;AAGP,QAAO,QAAQ,KAAK,KAAK,SAAS;EACjC;EACA,IAAI,IAAI;EACR,MAAM,IAAI;EACV,QAAQ,IAAI;EACZ,OAAO,IAAI,SAAS;EAMpB,SAAS,IAAI,YAAY,OAAO,SAAY,gBAAgB,IAAI,QAAQ;EACxE,OAAO,KAAK,IAAI,IAAI,MAAM;EAC1B,EAAE;;AAKJ,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;;;;;;;;;;;;;;;;;AAkBxB,SAAS,gBAAgB,SAAyB;AACjD,QAAO,QACL,QAAQ,gBAAgB,QAAQ,CAChC,QAAQ,eAAe,OAAO,CAC9B,QAAQ,eAAe,OAAO,CAC9B,QAAQ,iBAAiB,SAAS,CAClC,QAAQ,iBAAiB,QAAQ,CACjC,WAAW,gBAAgB,SAAS,CACpC,WAAW,iBAAiB,UAAU;;;;;;;;;;AAWzC,eAAsB,eACrB,IACA,OACA,UAA0B,EAAE,EACJ;CACxB,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,SAAS,wBAAwB,QAAQ,OAAO,GAAG;CAG1E,IAAI,cAAc,QAAQ;AAC1B,KAAI,CAAC,eAAe,YAAY,WAAW,EAC1C,eAAc,MAAM,yBAAyB,GAAG;AAGjD,KAAI,YAAY,WAAW,EAC1B,QAAO,EAAE;CAGV,MAAM,cAA4B,EAAE;CACpC,MAAM,aAAa,IAAI,WAAW,GAAG;CACrC,MAAM,eAAe,MAAM,WAAW,8BAA8B,YAAY;AAEhF,MAAK,MAAM,cAAc,aAAa;EACrC,MAAM,SAAS,MAAM,WAAW,gBAAgB,WAAW;AAC3D,MAAI,CAAC,QAAQ,QACZ;EASD,IAAI;AACJ,MAAI,OAAO,YAAY;AACtB,sBAAmB,OAAO,YAAY,cAAc;AACpD,eAAY,GAAG,KAAK,IAAI,IAAI,OAAO,WAAW;aACpC,aAAa,IAAI,WAAW,CACtC,aAAY,GAAG;MAEf;AAID,qBAAmB,YAAY,kBAAkB;EAEjD,MAAM,WAAW,WAAW,gBAAgB,WAAW;EACvD,MAAM,eAAe,WAAW,oBAAoB,WAAW;EAI/D,MAAM,cAAc,YAAY,MAAM;AACtC,MAAI,CAAC,YACJ;EAGD,IAAI;AACJ,MAAI;AACH,aAAU,MAAM,GAId;;;;OAIE,UAAU;YACL,IAAI,IAAI,SAAS,CAAC;YAClB,IAAI,IAAI,aAAa,CAAC;aACrB,IAAI,IAAI,SAAS,CAAC,UAAU,YAAY;;;UAG3C,UAAU;MACd,SAAS,GAAG,kBAAkB,WAAW,GAAG,GAAG;qBAChC,IAAI,IAAI,SAAS,CAAC;YAC3B,MAAM;KACb,QAAQ,GAAG;WACL,OAAO;AAKf,OAAI,kBAAkB,MAAM,CAC3B;AAED,SAAM;;AAGP,OAAK,MAAM,OAAO,QAAQ,KACzB,aAAY,KAAK;GAChB;GACA,IAAI,IAAI;GACR,MAAM,IAAI;GACV,OAAO,IAAI;GACX,CAAC;;AAIJ,QAAO,YAAY,MAAM,GAAG,MAAM;;;;;AAMnC,eAAsB,eAAe,IAA4C;CAChF,MAAM,aAAa,IAAI,WAAW,GAAG;CACrC,MAAM,cAAc,MAAM,yBAAyB,GAAG;CACtD,MAAM,QAAqB,EAAE,aAAa,EAAE,EAAE;AAE9C,MAAK,MAAM,cAAc,aAAa;EACrC,MAAM,kBAAkB,MAAM,WAAW,cAAc,WAAW;AAClE,MAAI,gBACH,OAAM,YAAY,cAAc;;AAIlC,QAAO;;;;;AAMR,eAAe,yBAAyB,IAAyC;AAMhF,SALgB,MAAM,GACpB,WAAW,sBAAsB,CACjC,OAAO,CAAC,QAAQ,gBAAgB,CAAC,CACjC,SAAS,EAGT,QAAQ,MAAM;AACd,MAAI,CAAC,EAAE,cAAe,QAAO;AAC7B,MAAI;AAEH,UADe,KAAK,MAAM,EAAE,cAAc,CAC5B,YAAY;UACnB;AACP,UAAO;;GAEP,CACD,KAAK,MAAM,EAAE,KAAK;;;;;;;AAQrB,SAAS,YAAY,OAAe,iBAAiB,MAAc;AAClE,KAAI,CAAC,SAAS,OAAO,UAAU,SAC9B,QAAO;AAIR,SAAQ,MAAM,MAAM;AAEpB,KAAI,MAAM,WAAW,EACpB,QAAO;AAIR,KAAI,MAAM,WAAW,KAAI,IAAI,MAAM,SAAS,KAAI,IAAI,MAAM,UAAU,EAEnE,QAAO,IADO,MAAM,MAAM,GAAG,GAAG,CACf,QAAQ,sBAAsB,OAAK,CAAC;CAItD,MAAM,UAAU,MAAM,QAAQ,sBAAsB,OAAK;AAMzD,KAAI,kBAAkB,sBAAsB,KAAK,MAAM,CACtD,QAAO;CAIR,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,CAAC,QAAQ,MAAM,EAAE,SAAS,EAAE;AACjF,KAAI,MAAM,WAAW,EACpB,QAAO;AAKR,QAAO,MAAM,KAAK,MAAM,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI;;;;;;;;;;;;;;;ACzlB7C,SAAS,oBAAoB,OAAgD;AAC5E,QAAO,MAAM,OACX,SACA,OAAO,SAAS,YAChB,SAAS,QACT,WAAW,QACX,OAAO,KAAK,UAAU,SACvB;;;;;AAMF,SAAS,uBAAuB,OAAkC;AAEjE,KAAI,MAAM,UAAU,UAAU,UAAU,SAAS,OAAO,MAAM,SAAS,SACtE,QAAO,MAAM;AAId,KAAI,MAAM,UAAU,SAAS;EAC5B,MAAM,QAAkB,EAAE;AAC1B,MAAI,SAAS,SAAS,OAAO,MAAM,QAAQ,YAAY,MAAM,IAC5D,OAAM,KAAK,MAAM,IAAI;AAEtB,MAAI,aAAa,SAAS,OAAO,MAAM,YAAY,YAAY,MAAM,QACpE,OAAM,KAAK,MAAM,QAAQ;AAE1B,SAAO,MAAM,KAAK,IAAI;;AAGvB,QAAO;;;;;;;;;;;;;;;;;;;;;;;AAwBR,SAAgB,iBAAiB,QAAiE;AACjG,KAAI,CAAC,OACJ,QAAO;CAIR,IAAI;AACJ,KAAI,OAAO,WAAW,SACrB,KAAI;AACH,iBAAe,KAAK,MAAM,OAAO;SAC1B;AAEP,SAAO;;KAGR,gBAAe;AAGhB,KAAI,CAAC,MAAM,QAAQ,aAAa,CAC/B,QAAO;AAqBR,QADiB,CANI,YAPC,aAAa,KAAK,MAAM;EAC7C,MAAM,MAAmD,EAAE,OAAO,EAAE,OAAO;AAC3E,OAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,EAAE,CACzC,KAAI,OAAO;AAEZ,SAAO;GACN,CAC6C,EAMf,GAHZ,aAAa,IAAI,uBAAuB,CAAC,QAAQ,SAAS,KAAK,SAAS,EAAE,CAG/C,CAAC,QAAQ,MAAM,EAAE,SAAS,EAAE,CAC3D,KAAK,KAAK;;;;;;;;;;;AAY3B,SAAgB,wBACf,OACA,QACyB;CACzB,MAAM,SAAiC,EAAE;AAEzC,MAAK,MAAM,SAAS,QAAQ;EAC3B,MAAM,QAAQ,MAAM;AAEpB,MAAI,UAAU,QAAQ,UAAU,QAAW;AAC1C,UAAO,SAAS;AAChB;;AAGD,MAAI,OAAO,UAAU,SAEpB,KAAI,MAAM,WAAW,IAAI,CACxB,QAAO,SAAS,iBAAiB,MAAM;MAEvC,QAAO,SAAS;WAEP,MAAM,QAAQ,MAAM,CAE9B,KAAI,oBAAoB,MAAM,CAC7B,QAAO,SAAS,iBAAiB,MAAM;MAEvC,QAAO,SAAS,KAAK,UAAU,MAAM;WAE5B,OAAO,UAAU,SAE3B,QAAO,SAAS,KAAK,UAAU,MAAM;WAC3B,OAAO,UAAU,YAAY,OAAO,UAAU,UACxD,QAAO,SAAS,GAAG;MAEnB,QAAO,SAAS;;AAIlB,QAAO"}

package/dist/secrets-Cc_O3Kp-.mjs

@@ -0,0 +1,369 @@
+import { t as after } from "./after-PcEvMY_6.mjs";
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { a as encodeBase64url, r as decodeBase64url } from "./base64-BQBZwXCx.mjs";
+import { r as singleFlightCached, t as createSingleFlightCache } from "./single-flight-cache-D0EaGbN1.mjs";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+
+//#region src/database/request-scoped.ts
+const REQUEST_SCOPED_DBS_KEY = Symbol.for("emdash:request-scoped-dbs");
+function getRegistry() {
+	const holder = globalThis;
+	let registry = holder[REQUEST_SCOPED_DBS_KEY];
+	if (!registry) {
+		registry = /* @__PURE__ */ new WeakSet();
+		holder[REQUEST_SCOPED_DBS_KEY] = registry;
+	}
+	return registry;
+}
+function markRequestScopedDb(db) {
+	getRegistry().add(db);
+}
+function isRequestScopedDb(db) {
+	return getRegistry().has(db);
+}
+
+//#endregion
+//#region src/config/secrets.ts
+/**
+* Centralized secrets module
+*
+* Single source of truth for site-level cryptographic secrets:
+*
+* - `EMDASH_ENCRYPTION_KEY` — primary key for encrypting plugin secrets at
+*   rest. A comma-separated list supports rotation: the first key encrypts
+*   new values and every listed key remains available for decryption. Format:
+*   `emdash_enc_v1_<43 base64url chars>` representing
+*   32 random bytes. **Operator-provided; never stored in the database.**
+*   Losing the key means losing every secret encrypted with it. Validated
+*   at runtime startup via `validateEncryptionKeyAtStartup` — request-time
+*   resolution does not depend on it, so a malformed key can't 500 the
+*   preview/comment hot paths for unrelated visitors.
+* - `EMDASH_IP_SALT` (optional) / DB-stored `emdash:ip_salt` — site-specific
+*   salt for hashing commenter IPs. Generated and persisted on first need
+*   if no env override is set. Replaces the previous hardcoded
+*   `"emdash-ip-salt"` constant which was correlatable across installs.
+* - `EMDASH_PREVIEW_SECRET` (optional) / DB-stored `emdash:preview_secret` —
+*   HMAC secret for signing preview URLs. Generated and persisted on first
+*   need if no env override is set. Replaces the previous empty-string
+*   fallback which silently disabled preview-token verification.
+*
+* The `EMDASH_AUTH_SECRET` env var is consulted only as a legacy fallback
+* source for the IP salt — that's the only path the prior code actually
+* read it from. New deployments don't need to set it.
+*
+* Modeled on `resolveS3Config` in `../storage/s3.ts`.
+*/
+/** v1 encryption key prefix. Bumping requires a separate KDF version. */
+const ENCRYPTION_KEY_PREFIX = "emdash_enc_v1_";
+/** 32 random bytes encoded as unpadded base64url = 43 chars. */
+const ENCRYPTION_KEY_BODY_LENGTH = 43;
+/**
+* Built from the prefix constant via interpolation. The prefix has no regex
+* metacharacters today (`emdash_enc_v1_`), but escaping is cheap defense
+* against anyone changing the prefix in a future bump without remembering.
+*/
+const ENCRYPTION_KEY_PATTERN = new RegExp(`^${ENCRYPTION_KEY_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[A-Za-z0-9_-]{${ENCRYPTION_KEY_BODY_LENGTH}}$`);
+/** Options-table key for the persisted commenter-IP salt. */
+const IP_SALT_OPTION_KEY = "emdash:ip_salt";
+/** Options-table key for the persisted preview HMAC secret. */
+const PREVIEW_SECRET_OPTION_KEY = "emdash:preview_secret";
+/** Length in bytes of generated values. 32 bytes = 256 bits. */
+const GENERATED_SECRET_BYTES = 32;
+/**
+* Class of validation failures raised by this module.
+*
+* Errors here are operator-facing config problems (malformed key, etc.).
+* They are thrown rather than soft-skipped so misconfiguration fails loudly
+* at startup instead of silently degrading at request time.
+*/
+var EmDashSecretsError = class extends Error {
+	name = "EmDashSecretsError";
+	code;
+	constructor(message, code) {
+		super(message);
+		this.code = code;
+	}
+};
+/**
+* Parse the `EMDASH_ENCRYPTION_KEY` env var.
+*
+* Accepts a single key or a comma-separated list. The first entry is the
+* primary (used for new writes); all entries are tried for decryption,
+* matched by `kid`. Whitespace around commas is tolerated. Empty entries
+* (e.g. trailing comma) are ignored.
+*
+* Returns `null` for an unset/empty input. Throws `EmDashSecretsError` on
+* any malformed entry — silent skipping would mask deployment mistakes.
+*/
+async function parseEncryptionKeys(raw) {
+	if (!raw) return null;
+	const entries = raw.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+	if (entries.length === 0) return null;
+	const parsed = [];
+	const seenKids = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (!ENCRYPTION_KEY_PATTERN.test(entry)) throw new EmDashSecretsError(`EMDASH_ENCRYPTION_KEY entry is malformed (expected "${ENCRYPTION_KEY_PREFIX}" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars). Generate one with \`emdash secrets generate\`.`, "INVALID_ENCRYPTION_KEY");
+		const body = entry.slice(14);
+		const key = decodeBase64urlStrict(body);
+		if (!key) throw new EmDashSecretsError("EMDASH_ENCRYPTION_KEY body is not valid base64url", "INVALID_ENCRYPTION_KEY");
+		if (key.length !== GENERATED_SECRET_BYTES) throw new EmDashSecretsError(`EMDASH_ENCRYPTION_KEY must decode to ${GENERATED_SECRET_BYTES} bytes, got ${key.length}`, "INVALID_ENCRYPTION_KEY");
+		if (encodeBase64url(key) !== body) throw new EmDashSecretsError("EMDASH_ENCRYPTION_KEY body is not canonical base64url. Generate one with `emdash secrets generate`.", "INVALID_ENCRYPTION_KEY");
+		const kid = fingerprintKeyBytes(key);
+		if (seenKids.has(kid)) continue;
+		seenKids.add(kid);
+		parsed.push({
+			kid,
+			key,
+			raw: entry
+		});
+	}
+	return parsed;
+}
+/**
+* Resolve the encryption keys used for plugin secret settings.
+*
+* This is deliberately separate from `resolveSecrets`: plugin settings are
+* not on the anonymous request path, and a missing or malformed key must only
+* fail operations that need encrypted plugin settings.
+*/
+function resolvePluginEncryptionKeys(env) {
+	return parseEncryptionKeys((env ?? readDefaultEnv()).EMDASH_ENCRYPTION_KEY);
+}
+/**
+* Compute the kid for a raw key string (the env-var form including the
+* `emdash_enc_v1_` prefix). Public so the CLI's `fingerprint` subcommand
+* and admin endpoints can show kids without exposing raw keys.
+*
+* The kid is derived from the decoded key **bytes**, not the raw string,
+* so admin endpoints / future rotation flows can match envelope kids
+* against bytes regardless of how the env var was originally spelled.
+*
+* Validates the same shape as `parseEncryptionKeys` — including canonical
+* base64url — so the CLI can't print a kid for a key the runtime would
+* later refuse to load.
+*
+* Throws `EmDashSecretsError` for malformed or non-canonical input.
+*/
+async function fingerprintKey(raw) {
+	if (!ENCRYPTION_KEY_PATTERN.test(raw)) throw new EmDashSecretsError(`Key must match "${ENCRYPTION_KEY_PREFIX}" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars`, "INVALID_ENCRYPTION_KEY");
+	const body = raw.slice(14);
+	const bytes = decodeBase64urlStrict(body);
+	if (!bytes || bytes.length !== GENERATED_SECRET_BYTES || encodeBase64url(bytes) !== body) throw new EmDashSecretsError(`Key body must decode to ${GENERATED_SECRET_BYTES} canonical base64url bytes`, "INVALID_ENCRYPTION_KEY");
+	return fingerprintKeyBytes(bytes);
+}
+/**
+* Internal: kid derivation from raw key bytes. The single source of truth
+* for what makes two keys "the same key" — used by both `parseEncryptionKeys`
+* and `fingerprintKey`.
+*/
+function fingerprintKeyBytes(key) {
+	return encodeHexLowerCase(sha256(key)).slice(0, 8);
+}
+/**
+* Generate a fresh `EMDASH_ENCRYPTION_KEY` value. Used by the CLI's
+* `secrets generate` subcommand and by `create-emdash` scaffolding.
+*/
+function generateEncryptionKey() {
+	const bytes = new Uint8Array(GENERATED_SECRET_BYTES);
+	crypto.getRandomValues(bytes);
+	return `${ENCRYPTION_KEY_PREFIX}${encodeBase64url(bytes)}`;
+}
+/**
+* Resolve site secrets. Reads env vars; for IP salt and preview secret,
+* falls back to a DB-stored value, generating one atomically on first need.
+*
+* Idempotent. Concurrent callers race on the atomic `setIfAbsent`; whichever
+* wins, all callers converge on the same stored value.
+*
+* Note: `EMDASH_ENCRYPTION_KEY` is **not** consumed here. It's validated
+* separately at runtime startup (see `validateEncryptionKeyAtStartup`) so a
+* malformed key can't take down preview-token verification or comment
+* submission for unrelated visitors. Plugin-secret encryption reads it
+* separately through `resolvePluginEncryptionKeys`.
+*/
+async function resolveSecrets(options) {
+	const env = options.env ?? readDefaultEnv();
+	const repo = options._repo ?? new OptionsRepository(options.db);
+	const previewEnvOverride = pickFirstNonEmpty(env.EMDASH_PREVIEW_SECRET, env.PREVIEW_SECRET);
+	const ipSaltEnvOverride = pickFirstNonEmpty(env.EMDASH_IP_SALT, env.EMDASH_AUTH_SECRET, env.AUTH_SECRET);
+	const [previewSecret, ipSalt] = await Promise.all([previewEnvOverride !== null ? Promise.resolve({
+		value: previewEnvOverride,
+		source: "env"
+	}) : ensureGeneratedOption(repo, PREVIEW_SECRET_OPTION_KEY), ipSaltEnvOverride !== null ? Promise.resolve({
+		value: ipSaltEnvOverride,
+		source: "env"
+	}) : ensureGeneratedOption(repo, IP_SALT_OPTION_KEY)]);
+	return {
+		previewSecret: previewSecret.value,
+		previewSecretSource: previewSecret.source,
+		ipSalt: ipSalt.value,
+		ipSaltSource: ipSalt.source
+	};
+}
+/**
+* Validate `EMDASH_ENCRYPTION_KEY` once at runtime startup. Logs an
+* operator-facing error if the value is malformed but does **not** throw —
+* plugin secret-setting operations fail closed at their own boundary when
+* the key is invalid. This way, deployment mistakes surface immediately in
+* startup logs without wedging unrelated request paths such as preview-token
+* verification or comment submission.
+*
+* Returns `true` if the key is unset or valid, `false` if it was malformed.
+*/
+async function validateEncryptionKeyAtStartup(env) {
+	const resolved = env ?? readDefaultEnv();
+	try {
+		await parseEncryptionKeys(resolved.EMDASH_ENCRYPTION_KEY);
+		return true;
+	} catch (error) {
+		if (error instanceof EmDashSecretsError) {
+			console.error(`[emdash] EMDASH_ENCRYPTION_KEY is invalid: ${error.message} Plugin secret settings are unavailable until this is fixed. Generate a fresh key with \`emdash secrets generate\`.`);
+			return false;
+		}
+		throw error;
+	}
+}
+/**
+* Per-DB cache of resolved secrets. Request-scoped views of the configured
+* database (see `database/request-scoped.ts`) share one entry; any other
+* Kysely instance is keyed by its identity.
+*
+* The resolved values are stable for the lifetime of the deployment (env
+* vars don't change without a restart, and DB-stored values are written
+* once via `setIfAbsent`). Caching avoids one options-table read per
+* request on the hot paths (preview verification, comment hashing). A
+* deleted row is regenerated only by a process or isolate that has not
+* cached the old value, so rotating a DB-stored secret needs a restart or
+* redeploy.
+*
+* Lives on `globalThis` so module-duplication during SSR bundling can't
+* fragment the cache. See `request-context.ts` for the same pattern.
+*
+* Each entry is a poison-immune single-flight cache (see
+* `utils/single-flight-cache.ts`): the resolved *value* is cached, never an
+* in-flight promise, so a request cancelled mid-resolve can't strand later
+* preview/comment requests on the isolate.
+*/
+const SECRETS_CACHE_KEY = Symbol.for("@emdash-cms/core/secrets-cache@2");
+function getSecretsCache(db) {
+	const holder = globalThis;
+	let entry = holder[SECRETS_CACHE_KEY];
+	if (!entry) {
+		entry = { cache: /* @__PURE__ */ new WeakMap() };
+		holder[SECRETS_CACHE_KEY] = entry;
+	}
+	if (isRequestScopedDb(db)) {
+		entry.requestScoped ??= createSingleFlightCache();
+		return entry.requestScoped;
+	}
+	let cache = entry.cache.get(db);
+	if (!cache) {
+		cache = createSingleFlightCache();
+		entry.cache.set(db, cache);
+	}
+	return cache;
+}
+/**
+* Memoized wrapper around `resolveSecrets`. Use this from request-time hot
+* paths (preview verification, comment IP hashing) so they don't reread
+* env / re-query options on every request.
+*
+* Request-scoped views of the configured database share one resolution;
+* playground / DO preview / per-test databases each get their own.
+* Concurrent cold callers coalesce onto one resolution via the single-flight
+* lock; a failed resolution propagates to the caller and releases the lock so
+* the next caller retries.
+*/
+function resolveSecretsCached(db) {
+	return singleFlightCached(getSecretsCache(db), () => resolveSecrets({ db }), {
+		anchor: (promise) => after(() => promise),
+		ownerTimeoutMs: 3e4
+	});
+}
+/**
+* Read or generate-and-persist a random base64url secret stored in the
+* options table.
+*
+* Concurrency: `setIfAbsent` is an atomic INSERT...ON CONFLICT DO NOTHING.
+* On race, the loser re-reads to converge on the winner's value.
+*/
+async function ensureGeneratedOption(repo, optionKey) {
+	const existing = await repo.get(optionKey);
+	if (typeof existing === "string" && existing.length > 0) return {
+		value: existing,
+		source: "db"
+	};
+	const generated = generateRandomSecret();
+	if (await repo.setIfAbsent(optionKey, generated)) return {
+		value: generated,
+		source: "db"
+	};
+	const winner = await repo.get(optionKey);
+	if (typeof winner !== "string" || winner.length === 0) throw new EmDashSecretsError(`Failed to persist generated secret for "${optionKey}"`, "SECRET_PERSIST_FAILED");
+	return {
+		value: winner,
+		source: "db"
+	};
+}
+/** Generate 32 random bytes encoded as unpadded base64url. */
+function generateRandomSecret() {
+	const bytes = new Uint8Array(GENERATED_SECRET_BYTES);
+	crypto.getRandomValues(bytes);
+	return encodeBase64url(bytes);
+}
+/** Return the first non-empty string from `values`, or `null` if all are empty. */
+function pickFirstNonEmpty(...values) {
+	for (const value of values) if (typeof value === "string" && value.length > 0) return value;
+	return null;
+}
+const BASE64URL_CHARSET_PATTERN = /^[A-Za-z0-9_-]+$/;
+/**
+* Validate base64url shape and decode. Returns `null` on malformed input
+* (rather than throwing) so the caller can produce a config-specific error.
+*/
+function decodeBase64urlStrict(input) {
+	if (!BASE64URL_CHARSET_PATTERN.test(input)) return null;
+	try {
+		return decodeBase64url(input);
+	} catch {
+		return null;
+	}
+}
+/**
+* Default env reader.
+*
+* Reads **only** `process.env`. This module must never reference
+* `import.meta.env`: in an Astro/Vite production build the bare
+* `import.meta.env` expression is statically replaced with an object
+* literal built from the env loaded at build time, which (a) embeds any
+* secret present in `.env` on the build machine into the shipped server
+* bundle, and (b) makes that stale build-time value silently shadow the
+* real runtime secret configured on the deployment platform (e.g. via
+* `wrangler secret put`). See #2139.
+*
+* `process.env` is the runtime source on Node/container deployments and
+* on Cloudflare Workers with Node compatibility (the same source
+* `resolveS3Config` in `../storage/s3.ts` uses). The CLI surface
+* (`cli/commands/secrets.ts`) runs outside the bundle where
+* `process.env` is native.
+*
+* The convention documented in AGENTS.md ("import.meta.env.EMDASH_X ||
+* import.meta.env.X") is for public, build-time config in route
+* handlers; secrets are deliberately excluded from it.
+*/
+function readDefaultEnv() {
+	const proc = typeof process !== "undefined" && process.env ? process.env : {};
+	return {
+		EMDASH_ENCRYPTION_KEY: proc.EMDASH_ENCRYPTION_KEY,
+		EMDASH_PREVIEW_SECRET: proc.EMDASH_PREVIEW_SECRET,
+		PREVIEW_SECRET: proc.PREVIEW_SECRET,
+		EMDASH_IP_SALT: proc.EMDASH_IP_SALT,
+		EMDASH_AUTH_SECRET: proc.EMDASH_AUTH_SECRET,
+		AUTH_SECRET: proc.AUTH_SECRET
+	};
+}
+
+//#endregion
+export { resolveSecretsCached as a, resolvePluginEncryptionKeys as i, fingerprintKey as n, validateEncryptionKeyAtStartup as o, generateEncryptionKey as r, markRequestScopedDb as s, EmDashSecretsError as t };
+//# sourceMappingURL=secrets-Cc_O3Kp-.mjs.map

package/dist/secrets-Cc_O3Kp-.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-Cc_O3Kp-.mjs","names":[],"sources":["../src/database/request-scoped.ts","../src/config/secrets.ts"],"sourcesContent":["/**\n * Handles returned by the adapter's `createRequestScopedDb`. Some adapters\n * (D1 with sessions, Hyperdrive, Durable Object SQL with sessions or on\n * writes) build a new Kysely instance for each request or event, and every\n * one addresses the configured database, so a cache keyed by instance uses\n * `isRequestScopedDb` to treat them as one database. A database that other\n * code puts in the request context (playground, Durable Object preview) is\n * not registered.\n */\n\nimport type { Kysely } from \"kysely\";\n\n// On globalThis so Vite SSR chunk duplication cannot split the registry\n// between the middleware that registers handles and the caches that read it.\nconst REQUEST_SCOPED_DBS_KEY = Symbol.for(\"emdash:request-scoped-dbs\");\n\nfunction getRegistry(): WeakSet<object> {\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern\n\tconst holder = globalThis as Record<symbol, WeakSet<object> | undefined>;\n\tlet registry = holder[REQUEST_SCOPED_DBS_KEY];\n\tif (!registry) {\n\t\tregistry = new WeakSet();\n\t\tholder[REQUEST_SCOPED_DBS_KEY] = registry;\n\t}\n\treturn registry;\n}\n\nexport function markRequestScopedDb<DB>(db: Kysely<DB>): void {\n\tgetRegistry().add(db);\n}\n\nexport function isRequestScopedDb<DB>(db: Kysely<DB>): boolean {\n\treturn getRegistry().has(db);\n}\n","/**\n * Centralized secrets module\n *\n * Single source of truth for site-level cryptographic secrets:\n *\n * - `EMDASH_ENCRYPTION_KEY` — primary key for encrypting plugin secrets at\n *   rest. A comma-separated list supports rotation: the first key encrypts\n *   new values and every listed key remains available for decryption. Format:\n *   `emdash_enc_v1_<43 base64url chars>` representing\n *   32 random bytes. **Operator-provided; never stored in the database.**\n *   Losing the key means losing every secret encrypted with it. Validated\n *   at runtime startup via `validateEncryptionKeyAtStartup` — request-time\n *   resolution does not depend on it, so a malformed key can't 500 the\n *   preview/comment hot paths for unrelated visitors.\n * - `EMDASH_IP_SALT` (optional) / DB-stored `emdash:ip_salt` — site-specific\n *   salt for hashing commenter IPs. Generated and persisted on first need\n *   if no env override is set. Replaces the previous hardcoded\n *   `\"emdash-ip-salt\"` constant which was correlatable across installs.\n * - `EMDASH_PREVIEW_SECRET` (optional) / DB-stored `emdash:preview_secret` —\n *   HMAC secret for signing preview URLs. Generated and persisted on first\n *   need if no env override is set. Replaces the previous empty-string\n *   fallback which silently disabled preview-token verification.\n *\n * The `EMDASH_AUTH_SECRET` env var is consulted only as a legacy fallback\n * source for the IP salt — that's the only path the prior code actually\n * read it from. New deployments don't need to set it.\n *\n * Modeled on `resolveS3Config` in `../storage/s3.ts`.\n */\n\nimport { sha256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\nimport type { Kysely } from \"kysely\";\n\nimport { after } from \"../after.js\";\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport { isRequestScopedDb } from \"../database/request-scoped.js\";\nimport type { Database } from \"../database/types.js\";\nimport { decodeBase64url, encodeBase64url } from \"../utils/base64.js\";\nimport {\n\tcreateSingleFlightCache,\n\ttype SingleFlightCache,\n\tsingleFlightCached,\n} from \"../utils/single-flight-cache.js\";\n\n/** v1 encryption key prefix. Bumping requires a separate KDF version. */\nexport const ENCRYPTION_KEY_PREFIX = \"emdash_enc_v1_\";\n\n/** 32 random bytes encoded as unpadded base64url = 43 chars. */\nconst ENCRYPTION_KEY_BODY_LENGTH = 43;\n\nconst REGEX_META_PATTERN = /[.*+?^${}()|[\\]\\\\]/g;\n\n/**\n * Built from the prefix constant via interpolation. The prefix has no regex\n * metacharacters today (`emdash_enc_v1_`), but escaping is cheap defense\n * against anyone changing the prefix in a future bump without remembering.\n */\nconst ENCRYPTION_KEY_PATTERN = new RegExp(\n\t`^${ENCRYPTION_KEY_PREFIX.replace(REGEX_META_PATTERN, \"\\\\$&\")}[A-Za-z0-9_-]{${ENCRYPTION_KEY_BODY_LENGTH}}$`,\n);\n\n/** Options-table key for the persisted commenter-IP salt. */\nexport const IP_SALT_OPTION_KEY = \"emdash:ip_salt\";\n\n/** Options-table key for the persisted preview HMAC secret. */\nexport const PREVIEW_SECRET_OPTION_KEY = \"emdash:preview_secret\";\n\n/** Length in bytes of generated values. 32 bytes = 256 bits. */\nconst GENERATED_SECRET_BYTES = 32;\n\n/**\n * A parsed encryption key with its kid (key id) fingerprint.\n *\n * `kid` is the first 8 chars of the SHA-256 hash of the decoded key bytes\n * (lowercase hex), used to tag envelopes so the decryptor can pick the right\n * key during rotation.\n */\nexport interface ParsedEncryptionKey {\n\t/** 8-char lowercase hex fingerprint derived from the decoded key bytes. */\n\tkid: string;\n\t/** The 32 raw key bytes, ready for `crypto.subtle.importKey`. */\n\tkey: Uint8Array;\n\t/** The original env-var-formatted string (kept for re-emit; never log). */\n\traw: string;\n}\n\n/** Resolved site secrets. */\nexport interface ResolvedSecrets {\n\t/** HMAC secret for preview URLs. Always non-empty after resolution. */\n\tpreviewSecret: string;\n\t/**\n\t * Source of `previewSecret`. Useful for diagnostics; never expose the\n\t * value itself, only the source.\n\t */\n\tpreviewSecretSource: \"env\" | \"db\";\n\t/** Salt for hashing commenter IPs. Always non-empty after resolution. */\n\tipSalt: string;\n\t/** Source of `ipSalt`. */\n\tipSaltSource: \"env\" | \"db\";\n}\n\n/** Inputs for `resolveSecrets`. */\nexport interface ResolveSecretsOptions {\n\t/**\n\t * The Kysely DB used to persist (and read back) generated salt/preview\n\t * secret values. Required — these values must be stable across requests\n\t * within a deployment.\n\t */\n\tdb: Kysely<Database>;\n\t/**\n\t * Optional explicit env override map. When omitted, falls back to\n\t * `process.env` via `readDefaultEnv` below (never `import.meta.env` —\n\t * see that function's docstring). Tests pass an explicit map to avoid\n\t * leaking process state.\n\t */\n\tenv?: SecretsEnv;\n\t/**\n\t * @internal Test seam: inject a custom OptionsRepository to exercise\n\t * the lost-race re-read branch. Production callers never set this.\n\t */\n\t_repo?: OptionsRepository;\n}\n\n/** Environment-variable shape consulted by the resolver. */\nexport interface SecretsEnv {\n\t/**\n\t * Read by `validateEncryptionKeyAtStartup` and the plugin-secret encryption\n\t * layer. **Not** consulted by `resolveSecrets`,\n\t * so a malformed value can't 500 the preview/comment hot paths.\n\t */\n\tEMDASH_ENCRYPTION_KEY?: string;\n\tEMDASH_PREVIEW_SECRET?: string;\n\t/** Legacy alias; new docs point at EMDASH_PREVIEW_SECRET. */\n\tPREVIEW_SECRET?: string;\n\tEMDASH_IP_SALT?: string;\n\t/**\n\t * Legacy fallback. Prior code derived the IP salt from\n\t * `EMDASH_AUTH_SECRET || AUTH_SECRET || \"emdash-ip-salt\"`. We preserve\n\t * the env-var fallback (so existing installs keep their stable salt)\n\t * but no longer read it from `import.meta.env` in route handlers.\n\t */\n\tEMDASH_AUTH_SECRET?: string;\n\t/** Legacy alias. */\n\tAUTH_SECRET?: string;\n}\n\n/**\n * Class of validation failures raised by this module.\n *\n * Errors here are operator-facing config problems (malformed key, etc.).\n * They are thrown rather than soft-skipped so misconfiguration fails loudly\n * at startup instead of silently degrading at request time.\n */\nexport class EmDashSecretsError extends Error {\n\toverride readonly name = \"EmDashSecretsError\";\n\treadonly code: string;\n\n\tconstructor(message: string, code: string) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Encryption key parsing\n// ---------------------------------------------------------------------------\n\n/**\n * Parse the `EMDASH_ENCRYPTION_KEY` env var.\n *\n * Accepts a single key or a comma-separated list. The first entry is the\n * primary (used for new writes); all entries are tried for decryption,\n * matched by `kid`. Whitespace around commas is tolerated. Empty entries\n * (e.g. trailing comma) are ignored.\n *\n * Returns `null` for an unset/empty input. Throws `EmDashSecretsError` on\n * any malformed entry — silent skipping would mask deployment mistakes.\n */\nexport async function parseEncryptionKeys(\n\traw: string | undefined,\n): Promise<ParsedEncryptionKey[] | null> {\n\tif (!raw) return null;\n\n\tconst entries = raw\n\t\t.split(\",\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n\n\tif (entries.length === 0) return null;\n\n\tconst parsed: ParsedEncryptionKey[] = [];\n\tconst seenKids = new Set<string>();\n\n\tfor (const entry of entries) {\n\t\tif (!ENCRYPTION_KEY_PATTERN.test(entry)) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t`EMDASH_ENCRYPTION_KEY entry is malformed (expected \"${ENCRYPTION_KEY_PREFIX}\" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars). Generate one with \\`emdash secrets generate\\`.`,\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\n\t\tconst body = entry.slice(ENCRYPTION_KEY_PREFIX.length);\n\t\tconst key = decodeBase64urlStrict(body);\n\t\tif (!key) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t\"EMDASH_ENCRYPTION_KEY body is not valid base64url\",\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\t\tif (key.length !== GENERATED_SECRET_BYTES) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t`EMDASH_ENCRYPTION_KEY must decode to ${GENERATED_SECRET_BYTES} bytes, got ${key.length}`,\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\n\t\t// Reject non-canonical base64url. 43 chars decode to 32 bytes but\n\t\t// the last char only carries 2 information bits — multiple raw\n\t\t// strings can decode to the same bytes. Forcing canonical form\n\t\t// guarantees `kid` (derived from bytes) is stable per key\n\t\t// material, regardless of how the operator pasted it.\n\t\tconst canonical = encodeBase64url(key);\n\t\tif (canonical !== body) {\n\t\t\tthrow new EmDashSecretsError(\n\t\t\t\t\"EMDASH_ENCRYPTION_KEY body is not canonical base64url. Generate one with `emdash secrets generate`.\",\n\t\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t\t);\n\t\t}\n\n\t\tconst kid = fingerprintKeyBytes(key);\n\t\tif (seenKids.has(kid)) {\n\t\t\t// Duplicate keys are user error (paste mistake during rotation).\n\t\t\t// We dedupe rather than throw — the rotation flow is forgiving.\n\t\t\tcontinue;\n\t\t}\n\t\tseenKids.add(kid);\n\t\tparsed.push({ kid, key, raw: entry });\n\t}\n\n\t// `parsed` always has at least one entry here: `entries` was non-empty\n\t// after filtering, the loop runs at least once, the first iteration\n\t// always passes the empty-`seenKids` check.\n\treturn parsed;\n}\n\n/**\n * Resolve the encryption keys used for plugin secret settings.\n *\n * This is deliberately separate from `resolveSecrets`: plugin settings are\n * not on the anonymous request path, and a missing or malformed key must only\n * fail operations that need encrypted plugin settings.\n */\nexport function resolvePluginEncryptionKeys(\n\tenv?: SecretsEnv,\n): Promise<ParsedEncryptionKey[] | null> {\n\treturn parseEncryptionKeys((env ?? readDefaultEnv()).EMDASH_ENCRYPTION_KEY);\n}\n\n/**\n * Compute the kid for a raw key string (the env-var form including the\n * `emdash_enc_v1_` prefix). Public so the CLI's `fingerprint` subcommand\n * and admin endpoints can show kids without exposing raw keys.\n *\n * The kid is derived from the decoded key **bytes**, not the raw string,\n * so admin endpoints / future rotation flows can match envelope kids\n * against bytes regardless of how the env var was originally spelled.\n *\n * Validates the same shape as `parseEncryptionKeys` — including canonical\n * base64url — so the CLI can't print a kid for a key the runtime would\n * later refuse to load.\n *\n * Throws `EmDashSecretsError` for malformed or non-canonical input.\n */\nexport async function fingerprintKey(raw: string): Promise<string> {\n\tif (!ENCRYPTION_KEY_PATTERN.test(raw)) {\n\t\tthrow new EmDashSecretsError(\n\t\t\t`Key must match \"${ENCRYPTION_KEY_PREFIX}\" followed by ${ENCRYPTION_KEY_BODY_LENGTH} base64url chars`,\n\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t);\n\t}\n\tconst body = raw.slice(ENCRYPTION_KEY_PREFIX.length);\n\tconst bytes = decodeBase64urlStrict(body);\n\tif (!bytes || bytes.length !== GENERATED_SECRET_BYTES || encodeBase64url(bytes) !== body) {\n\t\tthrow new EmDashSecretsError(\n\t\t\t`Key body must decode to ${GENERATED_SECRET_BYTES} canonical base64url bytes`,\n\t\t\t\"INVALID_ENCRYPTION_KEY\",\n\t\t);\n\t}\n\treturn fingerprintKeyBytes(bytes);\n}\n\n/**\n * Internal: kid derivation from raw key bytes. The single source of truth\n * for what makes two keys \"the same key\" — used by both `parseEncryptionKeys`\n * and `fingerprintKey`.\n */\nfunction fingerprintKeyBytes(key: Uint8Array): string {\n\treturn encodeHexLowerCase(sha256(key)).slice(0, 8);\n}\n\n/**\n * Generate a fresh `EMDASH_ENCRYPTION_KEY` value. Used by the CLI's\n * `secrets generate` subcommand and by `create-emdash` scaffolding.\n */\nexport function generateEncryptionKey(): string {\n\tconst bytes = new Uint8Array(GENERATED_SECRET_BYTES);\n\tcrypto.getRandomValues(bytes);\n\treturn `${ENCRYPTION_KEY_PREFIX}${encodeBase64url(bytes)}`;\n}\n\n// ---------------------------------------------------------------------------\n// Site-secret resolution (DB-backed with env override)\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve site secrets. Reads env vars; for IP salt and preview secret,\n * falls back to a DB-stored value, generating one atomically on first need.\n *\n * Idempotent. Concurrent callers race on the atomic `setIfAbsent`; whichever\n * wins, all callers converge on the same stored value.\n *\n * Note: `EMDASH_ENCRYPTION_KEY` is **not** consumed here. It's validated\n * separately at runtime startup (see `validateEncryptionKeyAtStartup`) so a\n * malformed key can't take down preview-token verification or comment\n * submission for unrelated visitors. Plugin-secret encryption reads it\n * separately through `resolvePluginEncryptionKeys`.\n */\nexport async function resolveSecrets(options: ResolveSecretsOptions): Promise<ResolvedSecrets> {\n\tconst env = options.env ?? readDefaultEnv();\n\tconst repo = options._repo ?? new OptionsRepository(options.db);\n\n\tconst previewEnvOverride = pickFirstNonEmpty(env.EMDASH_PREVIEW_SECRET, env.PREVIEW_SECRET);\n\tconst ipSaltEnvOverride = pickFirstNonEmpty(\n\t\tenv.EMDASH_IP_SALT,\n\t\tenv.EMDASH_AUTH_SECRET,\n\t\tenv.AUTH_SECRET,\n\t);\n\n\tconst [previewSecret, ipSalt] = await Promise.all([\n\t\tpreviewEnvOverride !== null\n\t\t\t? Promise.resolve({ value: previewEnvOverride, source: \"env\" as const })\n\t\t\t: ensureGeneratedOption(repo, PREVIEW_SECRET_OPTION_KEY),\n\t\tipSaltEnvOverride !== null\n\t\t\t? Promise.resolve({ value: ipSaltEnvOverride, source: \"env\" as const })\n\t\t\t: ensureGeneratedOption(repo, IP_SALT_OPTION_KEY),\n\t]);\n\n\treturn {\n\t\tpreviewSecret: previewSecret.value,\n\t\tpreviewSecretSource: previewSecret.source,\n\t\tipSalt: ipSalt.value,\n\t\tipSaltSource: ipSalt.source,\n\t};\n}\n\n/**\n * Validate `EMDASH_ENCRYPTION_KEY` once at runtime startup. Logs an\n * operator-facing error if the value is malformed but does **not** throw —\n * plugin secret-setting operations fail closed at their own boundary when\n * the key is invalid. This way, deployment mistakes surface immediately in\n * startup logs without wedging unrelated request paths such as preview-token\n * verification or comment submission.\n *\n * Returns `true` if the key is unset or valid, `false` if it was malformed.\n */\nexport async function validateEncryptionKeyAtStartup(env?: SecretsEnv): Promise<boolean> {\n\tconst resolved = env ?? readDefaultEnv();\n\ttry {\n\t\tawait parseEncryptionKeys(resolved.EMDASH_ENCRYPTION_KEY);\n\t\treturn true;\n\t} catch (error) {\n\t\tif (error instanceof EmDashSecretsError) {\n\t\t\tconsole.error(\n\t\t\t\t`[emdash] EMDASH_ENCRYPTION_KEY is invalid: ${error.message} ` +\n\t\t\t\t\t\"Plugin secret settings are unavailable until this is fixed. \" +\n\t\t\t\t\t\"Generate a fresh key with `emdash secrets generate`.\",\n\t\t\t);\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Per-DB cache of resolved secrets. Request-scoped views of the configured\n * database (see `database/request-scoped.ts`) share one entry; any other\n * Kysely instance is keyed by its identity.\n *\n * The resolved values are stable for the lifetime of the deployment (env\n * vars don't change without a restart, and DB-stored values are written\n * once via `setIfAbsent`). Caching avoids one options-table read per\n * request on the hot paths (preview verification, comment hashing). A\n * deleted row is regenerated only by a process or isolate that has not\n * cached the old value, so rotating a DB-stored secret needs a restart or\n * redeploy.\n *\n * Lives on `globalThis` so module-duplication during SSR bundling can't\n * fragment the cache. See `request-context.ts` for the same pattern.\n *\n * Each entry is a poison-immune single-flight cache (see\n * `utils/single-flight-cache.ts`): the resolved *value* is cached, never an\n * in-flight promise, so a request cancelled mid-resolve can't strand later\n * preview/comment requests on the isolate.\n */\n// Versioned to prevent cache fragmentation if `ResolvedSecrets`'s shape\n// ever changes. Bump the suffix on incompatible changes so a co-resident\n// older build doesn't read a newer-shape value. Bumped to @2 when the cached\n// value changed from a bare promise to a single-flight cache.\nconst SECRETS_CACHE_KEY = Symbol.for(\"@emdash-cms/core/secrets-cache@2\");\n\ninterface SecretsCacheHolder {\n\tcache: WeakMap<Kysely<Database>, SingleFlightCache<ResolvedSecrets>>;\n\trequestScoped?: SingleFlightCache<ResolvedSecrets>;\n}\n\nfunction getSecretsCache(db: Kysely<Database>): SingleFlightCache<ResolvedSecrets> {\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern\n\tconst holder = globalThis as Record<symbol, SecretsCacheHolder | undefined>;\n\tlet entry = holder[SECRETS_CACHE_KEY];\n\tif (!entry) {\n\t\tentry = { cache: new WeakMap() };\n\t\tholder[SECRETS_CACHE_KEY] = entry;\n\t}\n\tif (isRequestScopedDb(db)) {\n\t\tentry.requestScoped ??= createSingleFlightCache<ResolvedSecrets>();\n\t\treturn entry.requestScoped;\n\t}\n\tlet cache = entry.cache.get(db);\n\tif (!cache) {\n\t\tcache = createSingleFlightCache<ResolvedSecrets>();\n\t\tentry.cache.set(db, cache);\n\t}\n\treturn cache;\n}\n\n/**\n * Memoized wrapper around `resolveSecrets`. Use this from request-time hot\n * paths (preview verification, comment IP hashing) so they don't reread\n * env / re-query options on every request.\n *\n * Request-scoped views of the configured database share one resolution;\n * playground / DO preview / per-test databases each get their own.\n * Concurrent cold callers coalesce onto one resolution via the single-flight\n * lock; a failed resolution propagates to the caller and releases the lock so\n * the next caller retries.\n */\nexport function resolveSecretsCached(db: Kysely<Database>): Promise<ResolvedSecrets> {\n\tconst cache = getSecretsCache(db);\n\treturn singleFlightCached(cache, () => resolveSecrets({ db }), {\n\t\tanchor: (promise) => after(() => promise),\n\t\townerTimeoutMs: 30_000,\n\t});\n}\n\n/**\n * Test-only helper: clear the secrets cache. Tests that mutate env between\n * cases need this so a stale resolution doesn't leak across cases.\n *\n * @internal\n */\nexport function _clearSecretsCacheForTesting(): void {\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern\n\tconst holder = globalThis as Record<symbol, SecretsCacheHolder | undefined>;\n\tholder[SECRETS_CACHE_KEY] = undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Internals\n// ---------------------------------------------------------------------------\n\n/**\n * Read or generate-and-persist a random base64url secret stored in the\n * options table.\n *\n * Concurrency: `setIfAbsent` is an atomic INSERT...ON CONFLICT DO NOTHING.\n * On race, the loser re-reads to converge on the winner's value.\n */\nasync function ensureGeneratedOption(\n\trepo: OptionsRepository,\n\toptionKey: string,\n): Promise<{ value: string; source: \"db\" }> {\n\tconst existing = await repo.get<string>(optionKey);\n\tif (typeof existing === \"string\" && existing.length > 0) {\n\t\treturn { value: existing, source: \"db\" };\n\t}\n\n\tconst generated = generateRandomSecret();\n\tconst inserted = await repo.setIfAbsent(optionKey, generated);\n\tif (inserted) {\n\t\treturn { value: generated, source: \"db\" };\n\t}\n\n\t// Lost the race — another process inserted first. Re-read to pick up\n\t// the winner. If the row is somehow still missing or empty, treat that\n\t// as a real error rather than looping.\n\tconst winner = await repo.get<string>(optionKey);\n\tif (typeof winner !== \"string\" || winner.length === 0) {\n\t\tthrow new EmDashSecretsError(\n\t\t\t`Failed to persist generated secret for \"${optionKey}\"`,\n\t\t\t\"SECRET_PERSIST_FAILED\",\n\t\t);\n\t}\n\treturn { value: winner, source: \"db\" };\n}\n\n/** Generate 32 random bytes encoded as unpadded base64url. */\nfunction generateRandomSecret(): string {\n\tconst bytes = new Uint8Array(GENERATED_SECRET_BYTES);\n\tcrypto.getRandomValues(bytes);\n\treturn encodeBase64url(bytes);\n}\n\n/** Return the first non-empty string from `values`, or `null` if all are empty. */\nfunction pickFirstNonEmpty(...values: (string | undefined)[]): string | null {\n\tfor (const value of values) {\n\t\tif (typeof value === \"string\" && value.length > 0) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn null;\n}\n\nconst BASE64URL_CHARSET_PATTERN = /^[A-Za-z0-9_-]+$/;\n\n/**\n * Validate base64url shape and decode. Returns `null` on malformed input\n * (rather than throwing) so the caller can produce a config-specific error.\n */\nfunction decodeBase64urlStrict(input: string): Uint8Array | null {\n\t// `decodeBase64url` accepts padded input too; the env-var format is\n\t// strictly unpadded base64url, so we do a charset check first.\n\tif (!BASE64URL_CHARSET_PATTERN.test(input)) return null;\n\ttry {\n\t\treturn decodeBase64url(input);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Default env reader.\n *\n * Reads **only** `process.env`. This module must never reference\n * `import.meta.env`: in an Astro/Vite production build the bare\n * `import.meta.env` expression is statically replaced with an object\n * literal built from the env loaded at build time, which (a) embeds any\n * secret present in `.env` on the build machine into the shipped server\n * bundle, and (b) makes that stale build-time value silently shadow the\n * real runtime secret configured on the deployment platform (e.g. via\n * `wrangler secret put`). See #2139.\n *\n * `process.env` is the runtime source on Node/container deployments and\n * on Cloudflare Workers with Node compatibility (the same source\n * `resolveS3Config` in `../storage/s3.ts` uses). The CLI surface\n * (`cli/commands/secrets.ts`) runs outside the bundle where\n * `process.env` is native.\n *\n * The convention documented in AGENTS.md (\"import.meta.env.EMDASH_X ||\n * import.meta.env.X\") is for public, build-time config in route\n * handlers; secrets are deliberately excluded from it.\n */\nfunction readDefaultEnv(): SecretsEnv {\n\tconst proc = typeof process !== \"undefined\" && process.env ? process.env : {};\n\n\treturn {\n\t\tEMDASH_ENCRYPTION_KEY: proc.EMDASH_ENCRYPTION_KEY,\n\t\tEMDASH_PREVIEW_SECRET: proc.EMDASH_PREVIEW_SECRET,\n\t\tPREVIEW_SECRET: proc.PREVIEW_SECRET,\n\t\tEMDASH_IP_SALT: proc.EMDASH_IP_SALT,\n\t\tEMDASH_AUTH_SECRET: proc.EMDASH_AUTH_SECRET,\n\t\tAUTH_SECRET: proc.AUTH_SECRET,\n\t};\n}\n"],"mappings":";;;;;;;;AAcA,MAAM,yBAAyB,OAAO,IAAI,4BAA4B;AAEtE,SAAS,cAA+B;CAEvC,MAAM,SAAS;CACf,IAAI,WAAW,OAAO;AACtB,KAAI,CAAC,UAAU;AACd,6BAAW,IAAI,SAAS;AACxB,SAAO,0BAA0B;;AAElC,QAAO;;AAGR,SAAgB,oBAAwB,IAAsB;AAC7D,cAAa,CAAC,IAAI,GAAG;;AAGtB,SAAgB,kBAAsB,IAAyB;AAC9D,QAAO,aAAa,CAAC,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACc7B,MAAa,wBAAwB;;AAGrC,MAAM,6BAA6B;;;;;;AASnC,MAAM,yBAAyB,IAAI,OAClC,IAAI,sBAAsB,QARA,uBAQ4B,OAAO,CAAC,gBAAgB,2BAA2B,IACzG;;AAGD,MAAa,qBAAqB;;AAGlC,MAAa,4BAA4B;;AAGzC,MAAM,yBAAyB;;;;;;;;AAqF/B,IAAa,qBAAb,cAAwC,MAAM;CAC7C,AAAkB,OAAO;CACzB,AAAS;CAET,YAAY,SAAiB,MAAc;AAC1C,QAAM,QAAQ;AACd,OAAK,OAAO;;;;;;;;;;;;;;AAmBd,eAAsB,oBACrB,KACwC;AACxC,KAAI,CAAC,IAAK,QAAO;CAEjB,MAAM,UAAU,IACd,MAAM,IAAI,CACV,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,EAAE;AAErC,KAAI,QAAQ,WAAW,EAAG,QAAO;CAEjC,MAAM,SAAgC,EAAE;CACxC,MAAM,2BAAW,IAAI,KAAa;AAElC,MAAK,MAAM,SAAS,SAAS;AAC5B,MAAI,CAAC,uBAAuB,KAAK,MAAM,CACtC,OAAM,IAAI,mBACT,uDAAuD,sBAAsB,gBAAgB,2BAA2B,oEACxH,yBACA;EAGF,MAAM,OAAO,MAAM,MAAM,GAA6B;EACtD,MAAM,MAAM,sBAAsB,KAAK;AACvC,MAAI,CAAC,IACJ,OAAM,IAAI,mBACT,qDACA,yBACA;AAEF,MAAI,IAAI,WAAW,uBAClB,OAAM,IAAI,mBACT,wCAAwC,uBAAuB,cAAc,IAAI,UACjF,yBACA;AASF,MADkB,gBAAgB,IAAI,KACpB,KACjB,OAAM,IAAI,mBACT,uGACA,yBACA;EAGF,MAAM,MAAM,oBAAoB,IAAI;AACpC,MAAI,SAAS,IAAI,IAAI,CAGpB;AAED,WAAS,IAAI,IAAI;AACjB,SAAO,KAAK;GAAE;GAAK;GAAK,KAAK;GAAO,CAAC;;AAMtC,QAAO;;;;;;;;;AAUR,SAAgB,4BACf,KACwC;AACxC,QAAO,qBAAqB,OAAO,gBAAgB,EAAE,sBAAsB;;;;;;;;;;;;;;;;;AAkB5E,eAAsB,eAAe,KAA8B;AAClE,KAAI,CAAC,uBAAuB,KAAK,IAAI,CACpC,OAAM,IAAI,mBACT,mBAAmB,sBAAsB,gBAAgB,2BAA2B,mBACpF,yBACA;CAEF,MAAM,OAAO,IAAI,MAAM,GAA6B;CACpD,MAAM,QAAQ,sBAAsB,KAAK;AACzC,KAAI,CAAC,SAAS,MAAM,WAAW,0BAA0B,gBAAgB,MAAM,KAAK,KACnF,OAAM,IAAI,mBACT,2BAA2B,uBAAuB,6BAClD,yBACA;AAEF,QAAO,oBAAoB,MAAM;;;;;;;AAQlC,SAAS,oBAAoB,KAAyB;AACrD,QAAO,mBAAmB,OAAO,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;;;;;;AAOnD,SAAgB,wBAAgC;CAC/C,MAAM,QAAQ,IAAI,WAAW,uBAAuB;AACpD,QAAO,gBAAgB,MAAM;AAC7B,QAAO,GAAG,wBAAwB,gBAAgB,MAAM;;;;;;;;;;;;;;;AAoBzD,eAAsB,eAAe,SAA0D;CAC9F,MAAM,MAAM,QAAQ,OAAO,gBAAgB;CAC3C,MAAM,OAAO,QAAQ,SAAS,IAAI,kBAAkB,QAAQ,GAAG;CAE/D,MAAM,qBAAqB,kBAAkB,IAAI,uBAAuB,IAAI,eAAe;CAC3F,MAAM,oBAAoB,kBACzB,IAAI,gBACJ,IAAI,oBACJ,IAAI,YACJ;CAED,MAAM,CAAC,eAAe,UAAU,MAAM,QAAQ,IAAI,CACjD,uBAAuB,OACpB,QAAQ,QAAQ;EAAE,OAAO;EAAoB,QAAQ;EAAgB,CAAC,GACtE,sBAAsB,MAAM,0BAA0B,EACzD,sBAAsB,OACnB,QAAQ,QAAQ;EAAE,OAAO;EAAmB,QAAQ;EAAgB,CAAC,GACrE,sBAAsB,MAAM,mBAAmB,CAClD,CAAC;AAEF,QAAO;EACN,eAAe,cAAc;EAC7B,qBAAqB,cAAc;EACnC,QAAQ,OAAO;EACf,cAAc,OAAO;EACrB;;;;;;;;;;;;AAaF,eAAsB,+BAA+B,KAAoC;CACxF,MAAM,WAAW,OAAO,gBAAgB;AACxC,KAAI;AACH,QAAM,oBAAoB,SAAS,sBAAsB;AACzD,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,oBAAoB;AACxC,WAAQ,MACP,8CAA8C,MAAM,QAAQ,qHAG5D;AACD,UAAO;;AAER,QAAM;;;;;;;;;;;;;;;;;;;;;;;;AA6BR,MAAM,oBAAoB,OAAO,IAAI,mCAAmC;AAOxE,SAAS,gBAAgB,IAA0D;CAElF,MAAM,SAAS;CACf,IAAI,QAAQ,OAAO;AACnB,KAAI,CAAC,OAAO;AACX,UAAQ,EAAE,uBAAO,IAAI,SAAS,EAAE;AAChC,SAAO,qBAAqB;;AAE7B,KAAI,kBAAkB,GAAG,EAAE;AAC1B,QAAM,kBAAkB,yBAA0C;AAClE,SAAO,MAAM;;CAEd,IAAI,QAAQ,MAAM,MAAM,IAAI,GAAG;AAC/B,KAAI,CAAC,OAAO;AACX,UAAQ,yBAA0C;AAClD,QAAM,MAAM,IAAI,IAAI,MAAM;;AAE3B,QAAO;;;;;;;;;;;;;AAcR,SAAgB,qBAAqB,IAAgD;AAEpF,QAAO,mBADO,gBAAgB,GAAG,QACM,eAAe,EAAE,IAAI,CAAC,EAAE;EAC9D,SAAS,YAAY,YAAY,QAAQ;EACzC,gBAAgB;EAChB,CAAC;;;;;;;;;AA0BH,eAAe,sBACd,MACA,WAC2C;CAC3C,MAAM,WAAW,MAAM,KAAK,IAAY,UAAU;AAClD,KAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EACrD,QAAO;EAAE,OAAO;EAAU,QAAQ;EAAM;CAGzC,MAAM,YAAY,sBAAsB;AAExC,KADiB,MAAM,KAAK,YAAY,WAAW,UAAU,CAE5D,QAAO;EAAE,OAAO;EAAW,QAAQ;EAAM;CAM1C,MAAM,SAAS,MAAM,KAAK,IAAY,UAAU;AAChD,KAAI,OAAO,WAAW,YAAY,OAAO,WAAW,EACnD,OAAM,IAAI,mBACT,2CAA2C,UAAU,IACrD,wBACA;AAEF,QAAO;EAAE,OAAO;EAAQ,QAAQ;EAAM;;;AAIvC,SAAS,uBAA+B;CACvC,MAAM,QAAQ,IAAI,WAAW,uBAAuB;AACpD,QAAO,gBAAgB,MAAM;AAC7B,QAAO,gBAAgB,MAAM;;;AAI9B,SAAS,kBAAkB,GAAG,QAA+C;AAC5E,MAAK,MAAM,SAAS,OACnB,KAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC/C,QAAO;AAGT,QAAO;;AAGR,MAAM,4BAA4B;;;;;AAMlC,SAAS,sBAAsB,OAAkC;AAGhE,KAAI,CAAC,0BAA0B,KAAK,MAAM,CAAE,QAAO;AACnD,KAAI;AACH,SAAO,gBAAgB,MAAM;SACtB;AACP,SAAO;;;;;;;;;;;;;;;;;;;;;;;;;AA0BT,SAAS,iBAA6B;CACrC,MAAM,OAAO,OAAO,YAAY,eAAe,QAAQ,MAAM,QAAQ,MAAM,EAAE;AAE7E,QAAO;EACN,uBAAuB,KAAK;EAC5B,uBAAuB,KAAK;EAC5B,gBAAgB,KAAK;EACrB,gBAAgB,KAAK;EACrB,oBAAoB,KAAK;EACzB,aAAa,KAAK;EAClB"}