emdash 1.1.0 → 1.2.0

package/dist/artifact-fetch-DsRczRGG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-fetch-DsRczRGG.mjs","names":["TRAILING_DOT"],"sources":["../../registry-verification/dist/fetch-B66dZAfm.js","../../registry-verification/dist/artifact.js","../src/registry/artifact-fetch.ts"],"sourcesContent":["import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/fetch.ts\nconst DIGITS = /^\\d+$/;\nconst IPV4_LITERAL = /^\\d{1,3}(?:\\.\\d{1,3}){3}$/;\nconst IPV4_PART = /^\\d{1,3}$/;\nconst IPV6_PART = /^[0-9a-f]{1,4}$/i;\nconst TRAILING_DOT = /\\.+$/;\nconst DEFAULT_FETCH_LIMITS = {\n\theaderTimeoutMs: 1e4,\n\ttotalTimeoutMs: 3e4,\n\tmaxBytes: 25 * 1024 * 1024,\n\tmaxRedirects: 3\n};\nasync function fetchVerifiedResource(value, options) {\n\tconst limits = {\n\t\theaderTimeoutMs: options.headerTimeoutMs ?? DEFAULT_FETCH_LIMITS.headerTimeoutMs,\n\t\ttotalTimeoutMs: options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs,\n\t\tmaxBytes: options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes,\n\t\tmaxRedirects: options.maxRedirects ?? DEFAULT_FETCH_LIMITS.maxRedirects\n\t};\n\tif (!areValidLimits(limits)) return verificationError(\"INVALID_URL\", \"Fetch limits must be positive integers.\");\n\tconst startedAt = Date.now();\n\tlet currentUrl = parseAndValidateUrl(value, void 0, options.allowHttpLocalhost === true);\n\tif (!currentUrl.success) return currentUrl;\n\tfor (let redirects = 0;; redirects += 1) {\n\t\tconst remaining = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remaining <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst host = isAllowedLoopback(currentUrl.value, options.allowHttpLocalhost === true) ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t} : await validateHost(currentUrl.value, options.resolveHostname, remaining);\n\t\tif (!host.success) return host;\n\t\tconst remainingAfterResolution = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remainingAfterResolution <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst response = await fetchResponse(options.fetch, currentUrl.value, Math.min(remainingAfterResolution, limits.headerTimeoutMs));\n\t\tif (!response.success) return response;\n\t\tif (isRedirect(response.value.status)) {\n\t\t\tif (redirects >= limits.maxRedirects) return verificationError(\"REDIRECT_LIMIT_EXCEEDED\", \"The resource exceeded the redirect limit.\");\n\t\t\tconst location = response.value.headers.get(\"location\");\n\t\t\tif (location === null) return verificationError(\"REDIRECT_LOCATION_MISSING\", \"The redirect response has no location header.\");\n\t\t\tcurrentUrl = parseAndValidateUrl(location, currentUrl.value, options.allowHttpLocalhost === true);\n\t\t\tif (!currentUrl.success) return currentUrl;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!response.value.ok && !options.allowedStatuses?.includes(response.value.status)) return verificationError(\"RESOURCE_STATUS_ERROR\", `The resource returned HTTP ${response.value.status}.`);\n\t\tconst contentLength = response.value.headers.get(\"content-length\");\n\t\tif (contentLength !== null && (!DIGITS.test(contentLength) || Number(contentLength) > limits.maxBytes)) return verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\tconst bytes = await readResponse(response.value, limits.maxBytes, startedAt, limits.totalTimeoutMs);\n\t\tif (!bytes.success) return bytes;\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: {\n\t\t\t\tbytes: bytes.value,\n\t\t\t\turl: currentUrl.value,\n\t\t\t\tstatus: response.value.status,\n\t\t\t\theaders: response.value.headers\n\t\t\t}\n\t\t};\n\t}\n}\nfunction parseAndValidateUrl(value, base, allowHttpLocalhost = false) {\n\tlet url;\n\ttry {\n\t\turl = new URL(value, base);\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The resource URL is invalid.\");\n\t}\n\tif (url.protocol !== \"https:\" && !isAllowedLoopback(url, allowHttpLocalhost) || url.username !== \"\" || url.password !== \"\") return verificationError(\"INVALID_URL\", \"Resource URLs must use HTTPS and cannot include credentials.\");\n\tif (!isAllowedLoopback(url, allowHttpLocalhost) && (isIpLiteral(url.hostname) || isLocalHostname(url.hostname))) return verificationError(\"HOST_REJECTED\", \"The resource host is not permitted.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nfunction isAllowedLoopback(url, enabled) {\n\tif (!enabled || url.protocol !== \"http:\" && url.protocol !== \"https:\") return false;\n\tconst hostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn hostname === \"localhost\" || hostname.endsWith(\".localhost\") || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\nasync function validateHost(url, resolver, timeoutMs) {\n\ttry {\n\t\tconst addresses = await withTimeout(Promise.resolve().then(() => resolver(url.hostname)), timeoutMs);\n\t\tif (addresses.length === 0 || addresses.some(isForbiddenAddress)) return verificationError(\"HOST_REJECTED\", \"The resource host resolved to a forbidden address.\");\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"HOST_REJECTED\", \"The resource host could not be validated.\");\n\t}\n}\nasync function fetchResponse(fetchImplementation, url, timeoutMs) {\n\tconst controller = new AbortController();\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => fetchImplementation(url, {\n\t\t\t\tmethod: \"GET\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: controller.signal\n\t\t\t})), timeoutMs, () => controller.abort())\n\t\t};\n\t} catch (error) {\n\t\tif (controller.signal.aborted || isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource response headers timed out.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource request failed.\");\n\t}\n}\nasync function readResponse(response, maximumBytes, startedAt, totalTimeoutMs) {\n\tif (response.body === null) return {\n\t\tsuccess: true,\n\t\tvalue: new Uint8Array()\n\t};\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet length = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst remaining = totalTimeoutMs - (Date.now() - startedAt);\n\t\t\tif (remaining <= 0) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\t\t}\n\t\t\tconst chunk = await readWithTimeout(reader, remaining);\n\t\t\tif (!chunk.success) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn chunk;\n\t\t\t}\n\t\t\tif (chunk.value.done) break;\n\t\t\tconst value = chunk.value.value;\n\t\t\tlength += value.length;\n\t\t\tif (length > maximumBytes) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch {\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst output = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\toutput.set(chunk, offset);\n\t\toffset += chunk.length;\n\t}\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: output\n\t};\n}\nasync function readWithTimeout(reader, timeoutMs) {\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => reader.read()), timeoutMs)\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t}\n}\n/**\n* Every operation has both fulfillment and rejection handlers, so an operation\n* that loses the timeout race cannot later become an unhandled rejection.\n*/\nfunction withTimeout(operation, timeoutMs, onTimeout) {\n\treturn new Promise((resolve, reject) => {\n\t\tlet settled = false;\n\t\tconst timeout = setTimeout(() => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tonTimeout?.();\n\t\t\treject(new DOMException(\"Timed out\", \"AbortError\"));\n\t\t}, timeoutMs);\n\t\toperation.then((value) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\tresolve(value);\n\t\t}, (error) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\treject(error);\n\t\t});\n\t});\n}\nfunction areValidLimits(limits) {\n\treturn Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);\n}\nfunction isRedirect(status) {\n\treturn status === 301 || status === 302 || status === 303 || status === 307 || status === 308;\n}\nfunction isAbortError(error) {\n\treturn error instanceof DOMException && error.name === \"AbortError\";\n}\nfunction isIpLiteral(hostname) {\n\treturn IPV4_LITERAL.test(hostname) || hostname.includes(\":\");\n}\nfunction isLocalHostname(hostname) {\n\tconst normalized = hostname.toLowerCase();\n\treturn normalized === \"localhost\" || normalized.endsWith(\".localhost\") || normalized.endsWith(\".local\") || normalized.endsWith(\".internal\");\n}\nfunction isForbiddenAddress(address) {\n\tconst ipv4 = parseIpv4(address);\n\tif (ipv4 !== null) {\n\t\tconst [a, b] = ipv4;\n\t\treturn a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;\n\t}\n\tconst ipv6 = parseIpv6(address);\n\tif (ipv6 === null) return true;\n\tconst first = ipv6[0];\n\tconst isUnspecified = ipv6.every((part) => part === 0);\n\tconst isLoopback = ipv6.slice(0, 7).every((part) => part === 0) && ipv6[7] === 1;\n\tconst isPrivate = (first & 65024) === 64512;\n\tconst isLinkLocal = (first & 65472) === 65152;\n\tconst isMulticast = (first & 65280) === 65280;\n\tif (ipv6.slice(0, 5).every((part) => part === 0) && ipv6[5] === 65535) return isForbiddenAddress(`${ipv6[6] >>> 8}.${ipv6[6] & 255}.${ipv6[7] >>> 8}.${ipv6[7] & 255}`);\n\treturn isUnspecified || isLoopback || isPrivate || isLinkLocal || isMulticast;\n}\nfunction parseIpv4(value) {\n\tconst parts = value.split(\".\");\n\tif (parts.length !== 4) return null;\n\tconst numbers = parts.map((part) => IPV4_PART.test(part) ? Number(part) : NaN);\n\tif (numbers.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;\n\treturn [\n\t\tnumbers[0],\n\t\tnumbers[1],\n\t\tnumbers[2],\n\t\tnumbers[3]\n\t];\n}\nfunction parseIpv6(value) {\n\tif (value.includes(\":::\") || value.split(\"::\").length > 2) return null;\n\tconst [before = \"\", after = \"\"] = value.split(\"::\");\n\tconst head = before === \"\" ? [] : before.split(\":\");\n\tconst tail = after === \"\" ? [] : after.split(\":\");\n\tconst parts = [...head, ...tail];\n\tif (parts.some((part) => !IPV6_PART.test(part)) || parts.length > 8) return null;\n\tif (!value.includes(\"::\") && parts.length !== 8) return null;\n\tconst zeroes = value.includes(\"::\") ? 8 - parts.length : 0;\n\treturn [\n\t\t...head,\n\t\t...Array.from({ length: zeroes }).fill(\"0\"),\n\t\t...tail\n\t].map((part) => Number.parseInt(part, 16));\n}\n\n//#endregion\nexport { fetchVerifiedResource as n, DEFAULT_FETCH_LIMITS as t };\n//# sourceMappingURL=fetch-B66dZAfm.js.map","import { n as unsupportedAuthDetails, t as UNSUPPORTED_AUTH_MESSAGE } from \"./auth-B730dpJ4.js\";\nimport { n as verificationError } from \"./errors-D3_zxvwe.js\";\nimport { multihashFromBlobCid, verifyMultihash } from \"./checksum.js\";\nimport { n as fetchVerifiedResource, t as DEFAULT_FETCH_LIMITS } from \"./fetch-B66dZAfm.js\";\nimport { RECORD_SCOPED_BLOB_CACHE_TYPE } from \"@emdash-cms/registry-lexicons\";\n\n//#region src/artifact.ts\nconst DID_DOCUMENT_MAX_BYTES = 256 * 1024;\nconst PLC_DID_PATTERN = /^did:plc:[a-z2-7]{24}$/;\nconst CID_PATTERN = /^b[a-z2-7]+$/;\nconst UNSAFE_PATH_SEGMENT = /[/\\\\?#]/;\nasync function fetchReleaseArtifact(input, options) {\n\tconst deadline = Date.now() + (options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs);\n\tconst { artifact } = input;\n\tif (!artifact.blob && !artifact.url) return verificationError(\"RELEASE_ARTIFACT_SOURCE_MISSING\", \"The release artifact must provide a blob or URL.\");\n\tif (artifact.requiresAuth === true || input.auth !== void 0) return unsupportedAuth(input.auth);\n\tconst blobCid = modernBlobCid(artifact.blob);\n\tconst blobMetadata = blobCid && artifact.blob && \"ref\" in artifact.blob ? artifact.blob : void 0;\n\tif (artifact.blob && !blobCid) return verificationError(\"BLOB_REF_INVALID\", \"Legacy blob references are not supported.\");\n\tif (blobCid) {\n\t\tconst expected = multihashFromBlobCid(blobCid);\n\t\tif (!expected.success) return expected;\n\t\tif (expected.value !== artifact.checksum) return verificationError(\"CHECKSUM_MISMATCH\", \"The artifact checksum does not match its blob reference CID.\");\n\t}\n\tlet lastError;\n\tfor (const cache of input.artifactCaches ?? []) {\n\t\tconst serviceEndpoint = recordScopedCacheEndpoint(cache);\n\t\tif (!serviceEndpoint || !blobCid) continue;\n\t\tconst cacheUrl = recordScopedBlobCacheUrl(serviceEndpoint, input.record, blobCid);\n\t\tif (!cacheUrl.success) {\n\t\t\tlastError = cacheUrl.error;\n\t\t\tcontinue;\n\t\t}\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"artifact-cache\", cacheUrl.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\tif (blobCid) {\n\t\tconst resolutionOptions = withinDeadline(options, deadline);\n\t\tif (!resolutionOptions) return timedOut();\n\t\tconst pds = input.pdsEndpoint ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: input.pdsEndpoint\n\t\t} : await resolvePublisherPdsEndpoint(input.record.did, resolutionOptions);\n\t\tif (pds.success) {\n\t\t\tconst url = blobUrl(pds.value, input.record.did, blobCid);\n\t\t\tif (url.success) {\n\t\t\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\t\t\tif (!attemptOptions) return timedOut();\n\t\t\t\tconst result = await fetchAndVerify(\"blob\", url.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\t\t\tif (result.success) return result;\n\t\t\t\tlastError = result.error;\n\t\t\t} else lastError = url.error;\n\t\t} else lastError = pds.error;\n\t}\n\tif (artifact.url) {\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"url\", artifact.url, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\treturn lastError ? {\n\t\tsuccess: false,\n\t\terror: lastError\n\t} : verificationError(\"FETCH_FAILED\", \"The release artifact could not be fetched.\");\n}\nfunction recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid) {\n\ttry {\n\t\tconst endpoint = new URL(serviceEndpoint);\n\t\tif (endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password || endpoint.pathname !== \"/\" || endpoint.search || endpoint.hash) throw new Error();\n\t\tconst segments = [\n\t\t\t\"r\",\n\t\t\trecord.did,\n\t\t\trecord.collection,\n\t\t\trecord.rkey,\n\t\t\trecord.cid,\n\t\t\tblobCid\n\t\t];\n\t\tif (!CID_PATTERN.test(record.cid) || !CID_PATTERN.test(blobCid) || segments.some((segment) => !isSafePathSegment(segment))) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new URL(segments.join(\"/\"), endpoint)\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The record-scoped blob cache endpoint is invalid.\");\n\t}\n}\nfunction recordScopedImageCacheUrl(serviceEndpoint, preset, record, blobCid) {\n\tconst raw = recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid);\n\tif (!raw.success) return raw;\n\tconst url = new URL(raw.value);\n\turl.pathname = `/img/${preset}${url.pathname}`;\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nasync function resolvePublisherPdsEndpoint(publisherDid, options) {\n\tconst documentUrl = didDocumentUrl(publisherDid);\n\tif (!documentUrl) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID is not supported.\");\n\tconst fetched = await fetchVerifiedResource(documentUrl, {\n\t\t...options,\n\t\tmaxBytes: DID_DOCUMENT_MAX_BYTES\n\t});\n\tif (!fetched.success) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document could not be fetched.\");\n\tlet document;\n\ttry {\n\t\tdocument = JSON.parse(new TextDecoder().decode(fetched.value.bytes));\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document is malformed.\");\n\t}\n\tif (!isRecord(document) || document.id !== publisherDid || !Array.isArray(document.service)) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\tconst service = document.service.find((value) => isRecord(value) && (value.id === `${publisherDid}#atproto_pds` || value.id === \"#atproto_pds\") && value.type === \"AtprotoPersonalDataServer\" && typeof value.serviceEndpoint === \"string\");\n\tif (!isRecord(service) || typeof service.serviceEndpoint !== \"string\") return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\ttry {\n\t\tconst endpoint = new URL(service.serviceEndpoint);\n\t\tif (!(options.allowHttpLocalhost === true && endpoint.protocol === \"http:\" && (endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\")) && endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: endpoint.href\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\t}\n}\nasync function fetchAndVerify(source, url, checksum, options, blobMetadata) {\n\tconst fetched = await fetchVerifiedResource(url, options);\n\tif (!fetched.success) return blobMetadata && fetched.error.code === \"RESOURCE_SIZE_EXCEEDED\" ? verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact size does not match its signed blob metadata.\") : fetched;\n\tconst verified = await verifyMultihash(fetched.value.bytes, checksum);\n\tif (!verified.success) return verified;\n\tconst contentType = fetched.value.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim();\n\tif (blobMetadata && (fetched.value.bytes.byteLength !== blobMetadata.size || contentType !== void 0 && contentType !== blobMetadata.mimeType)) return verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact does not match its signed blob metadata.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\tbytes: fetched.value.bytes,\n\t\t\tsource,\n\t\t\turl: fetched.value.url\n\t\t}\n\t};\n}\nfunction withBlobSizeLimit(options, blobMetadata) {\n\tif (!blobMetadata) return options;\n\treturn {\n\t\t...options,\n\t\tmaxBytes: Math.min(options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes, blobMetadata.size)\n\t};\n}\nfunction blobUrl(pdsEndpoint, publisherDid, cid) {\n\ttry {\n\t\tconst url = new URL(\"/xrpc/com.atproto.sync.getBlob\", pdsEndpoint);\n\t\turl.searchParams.set(\"did\", publisherDid);\n\t\turl.searchParams.set(\"cid\", cid);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: url\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher PDS endpoint is invalid.\");\n\t}\n}\nfunction didDocumentUrl(did) {\n\tif (PLC_DID_PATTERN.test(did)) return `https://plc.directory/${encodeURIComponent(did)}`;\n\tif (!did.startsWith(\"did:web:\")) return null;\n\ttry {\n\t\tconst parts = did.slice(8).split(\":\").map(decodeURIComponent);\n\t\tconst host = parts.shift();\n\t\tif (!host || parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) return null;\n\t\tconst path = parts.length === 0 ? \"/.well-known/did.json\" : `/${parts.join(\"/\")}/did.json`;\n\t\treturn new URL(path, `https://${host}`).href;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction unsupportedAuth(auth) {\n\treturn verificationError(\"AUTH_METHOD_UNSUPPORTED\", UNSUPPORTED_AUTH_MESSAGE, unsupportedAuthDetails(auth));\n}\nfunction withinDeadline(options, deadline) {\n\tconst remaining = deadline - Date.now();\n\tif (remaining <= 0) return null;\n\treturn {\n\t\t...options,\n\t\ttotalTimeoutMs: remaining\n\t};\n}\nfunction timedOut() {\n\treturn verificationError(\"RESOURCE_TIMEOUT\", \"Artifact retrieval exceeded its total timeout.\");\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction modernBlobCid(blob) {\n\tif (!blob || !(\"ref\" in blob) || typeof blob.ref?.$link !== \"string\") return null;\n\treturn blob.ref.$link;\n}\nfunction recordScopedCacheEndpoint(value) {\n\tif (!isRecord(value) || value.$type !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;\n\treturn typeof value.serviceEndpoint === \"string\" ? value.serviceEndpoint : null;\n}\nfunction isSafePathSegment(value) {\n\tif (value.length === 0 || UNSAFE_PATH_SEGMENT.test(value)) return false;\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return false;\n\t}\n\treturn true;\n}\n\n//#endregion\nexport { fetchReleaseArtifact, recordScopedBlobCacheUrl, recordScopedImageCacheUrl, resolvePublisherPdsEndpoint };\n//# sourceMappingURL=artifact.js.map","import type { ClientRequest, IncomingMessage } from \"node:http\";\nimport type { RequestOptions } from \"node:https\";\n\nimport { resolveAndValidateExternalUrlTarget, SsrfError } from \"../security/ssrf.js\";\n\nconst TRAILING_DOT = /\\.+$/;\nconst LOCALHOST_HOSTNAMES = new Set([\n\t\"localhost\",\n\t\"localhost.localdomain\",\n\t\"ip6-localhost\",\n\t\"ip6-loopback\",\n]);\n\nexport interface RegistryArtifactTransportInput {\n\turl: URL;\n\tallowedAddresses: readonly string[];\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nexport interface RegistryArtifactTransport {\n\tfetch(input: RegistryArtifactTransportInput): Promise<{\n\t\tresponse: Response;\n\t\t/** Workers Fetch does not expose its connected peer; DNS validation still runs before dispatch. */\n\t\tconnectedAddress: string | null;\n\t}>;\n}\n\nexport interface RegistryArtifactFetchOptions {\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nlet defaultTransport: RegistryArtifactTransport | null = null;\n\nexport function setDefaultRegistryArtifactTransport(\n\ttransport: RegistryArtifactTransport | null,\n): RegistryArtifactTransport | null {\n\tconst previous = defaultTransport;\n\tdefaultTransport = transport;\n\treturn previous;\n}\n\nfunction isLocalhostHostname(hostname: string): boolean {\n\tconst normalized = hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn (\n\t\tLOCALHOST_HOSTNAMES.has(normalized) ||\n\t\tnormalized.endsWith(\".localhost\") ||\n\t\tnormalized === \"127.0.0.1\" ||\n\t\tnormalized === \"::1\" ||\n\t\tnormalized === \"[::1]\" ||\n\t\tnormalized.startsWith(\"::ffff:127.\") ||\n\t\tnormalized.startsWith(\"::ffff:7f00:\")\n\t);\n}\n\nasync function resolveSafeArtifactTarget(urlString: string): Promise<{\n\turl: URL;\n\taddresses: readonly string[];\n}> {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(urlString);\n\t} catch {\n\t\tthrow new Error(`Invalid artifact URL: ${urlString}`);\n\t}\n\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n\t\tthrow new Error(`Artifact URL protocol not allowed: ${url.protocol}`);\n\t}\n\tif (url.username || url.password) {\n\t\tthrow new Error(\"Artifact URL must not contain embedded credentials\");\n\t}\n\n\tconst rawHostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname = stripIpv6Brackets(rawHostname);\n\tconst localhost = isLocalhostHostname(hostname);\n\n\tif (!import.meta.env.DEV) {\n\t\tif (url.protocol === \"http:\") {\n\t\t\tthrow new Error(\"Artifact URL must use https\");\n\t\t}\n\t\tif (localhost) {\n\t\t\tthrow new Error(`Artifact URL points to localhost: ${hostname}`);\n\t\t}\n\t} else if (url.protocol === \"http:\" && !localhost) {\n\t\tthrow new Error(\"Artifact URL must use https (http allowed only for localhost in dev)\");\n\t}\n\n\tif (localhost) {\n\t\treturn { url, addresses: [] };\n\t}\n\n\ttry {\n\t\treturn await resolveAndValidateExternalUrlTarget(url.href);\n\t} catch (error) {\n\t\tif (error instanceof SsrfError) {\n\t\t\tthrow new Error(`Artifact URL rejected: ${error.message}`, { cause: error });\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport async function assertSafeArtifactUrl(urlString: string): Promise<URL> {\n\treturn (await resolveSafeArtifactTarget(urlString)).url;\n}\n\nexport async function fetchRegistryArtifactUrl(\n\turlString: string,\n\toptions: RegistryArtifactFetchOptions,\n): Promise<Response> {\n\tif (!Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 0) {\n\t\tthrow new TypeError(\"Registry artifact response limit is invalid\");\n\t}\n\tconst target = await resolveSafeArtifactTarget(urlString);\n\tif (target.addresses.length === 0) {\n\t\treturn globalThis.fetch(target.url, { redirect: \"manual\", signal: options.signal });\n\t}\n\n\tconst transport = defaultTransport ?? (await createRuntimeRegistryArtifactTransport());\n\tconst result = await transport.fetch({\n\t\turl: target.url,\n\t\tallowedAddresses: target.addresses,\n\t\tsignal: options.signal,\n\t\tmaxResponseBytes: options.maxResponseBytes,\n\t});\n\tif (result.connectedAddress !== null && !target.addresses.includes(result.connectedAddress)) {\n\t\tawait result.response.body?.cancel().catch(() => undefined);\n\t\tthrow new Error(\"Registry artifact transport connected outside the validated address set\");\n\t}\n\treturn result.response;\n}\n\nasync function createRuntimeRegistryArtifactTransport(): Promise<RegistryArtifactTransport> {\n\treturn isCloudflareWorkersRuntime()\n\t\t? createWorkersRegistryArtifactTransport()\n\t\t: createNodeRegistryArtifactTransport();\n}\n\nexport function createWorkersRegistryArtifactTransport(\n\tworkerFetch: typeof globalThis.fetch = globalThis.fetch,\n): RegistryArtifactTransport {\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tconst response = await workerFetch(input.url, {\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: input.signal,\n\t\t\t\theaders: { \"Accept-Encoding\": \"identity\" },\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tresponse: limitResponseBody(response, input.maxResponseBytes),\n\t\t\t\tconnectedAddress: null,\n\t\t\t};\n\t\t},\n\t};\n}\n\nfunction isCloudflareWorkersRuntime(): boolean {\n\treturn (\n\t\ttypeof navigator !== \"undefined\" &&\n\t\ttypeof navigator.userAgent === \"string\" &&\n\t\tnavigator.userAgent.includes(\"Cloudflare-Workers\")\n\t);\n}\n\nfunction limitResponseBody(response: Response, maxBytes: number): Response {\n\tif (!response.body) return response;\n\tlet received = 0;\n\tconst body = response.body.pipeThrough(\n\t\tnew TransformStream<Uint8Array, Uint8Array>({\n\t\t\ttransform(chunk, controller) {\n\t\t\t\treceived += chunk.byteLength;\n\t\t\t\tif (received > maxBytes) {\n\t\t\t\t\tcontroller.error(new RangeError(\"Registry artifact response exceeds its byte limit\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tcontroller.enqueue(chunk);\n\t\t\t},\n\t\t}),\n\t);\n\treturn new Response(body, {\n\t\tstatus: response.status,\n\t\tstatusText: response.statusText,\n\t\theaders: response.headers,\n\t});\n}\n\nexport type RegistryArtifactNodeRequest = (\n\toptions: RequestOptions,\n\tcallback: (response: IncomingMessage) => void,\n) => ClientRequest;\n\nexport async function createNodeRegistryArtifactTransport(\n\tnodeRequest?: RegistryArtifactNodeRequest,\n): Promise<RegistryArtifactTransport> {\n\tconst request = nodeRequest ?? (await import(\"node:https\")).request;\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tlet lastError: unknown;\n\t\t\tfor (const address of input.allowedAddresses) {\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await new Promise<Response>((resolve, reject) => {\n\t\t\t\t\t\tconst chunks: Uint8Array[] = [];\n\t\t\t\t\t\tlet total = 0;\n\t\t\t\t\t\tconst req = request(\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tprotocol: \"https:\",\n\t\t\t\t\t\t\t\thostname: stripIpv6Brackets(input.url.hostname),\n\t\t\t\t\t\t\t\tport: parseHttpsPort(input.url),\n\t\t\t\t\t\t\t\tpath: `${input.url.pathname}${input.url.search}`,\n\t\t\t\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\t\t\t\t// A pooled socket may have been opened for the same hostname\n\t\t\t\t\t\t\t\t// before this address set was resolved.\n\t\t\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\t\tHost: input.url.host,\n\t\t\t\t\t\t\t\t\tConnection: \"close\",\n\t\t\t\t\t\t\t\t\t\"Accept-Encoding\": \"identity\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tlookup: (_hostname, options, callback) => {\n\t\t\t\t\t\t\t\t\tconst family = address.includes(\":\") ? 6 : 4;\n\t\t\t\t\t\t\t\t\t// Node's default autoSelectFamily asks with `all: true` and expects a list.\n\t\t\t\t\t\t\t\t\tif (options.all) callback(null, [{ address, family }]);\n\t\t\t\t\t\t\t\t\telse callback(null, address, family);\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tsignal: input.signal,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t(upstream) => {\n\t\t\t\t\t\t\t\tconst contentEncoding = upstream.headers[\"content-encoding\"];\n\t\t\t\t\t\t\t\tif (contentEncoding && contentEncoding.toLowerCase() !== \"identity\") {\n\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\tnew Error(\"Registry artifact response content encoding is unsupported\"),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tupstream.on(\"data\", (chunk: Uint8Array) => {\n\t\t\t\t\t\t\t\t\ttotal += chunk.byteLength;\n\t\t\t\t\t\t\t\t\tif (total > input.maxResponseBytes) {\n\t\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\t\tnew RangeError(\"Registry artifact response exceeds its byte limit\"),\n\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tchunks.push(new Uint8Array(chunk));\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\tupstream.once(\"error\", reject);\n\t\t\t\t\t\t\t\tupstream.once(\"end\", () => {\n\t\t\t\t\t\t\t\t\tconst bytes = concatBytes(chunks, total);\n\t\t\t\t\t\t\t\t\tconst headers = new Headers();\n\t\t\t\t\t\t\t\t\tfor (let index = 0; index < upstream.rawHeaders.length; index += 2) {\n\t\t\t\t\t\t\t\t\t\theaders.append(upstream.rawHeaders[index], upstream.rawHeaders[index + 1]);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tresolve(\n\t\t\t\t\t\t\t\t\t\tparsedResponseToWebResponse({\n\t\t\t\t\t\t\t\t\t\t\tstatus: upstream.statusCode ?? 502,\n\t\t\t\t\t\t\t\t\t\t\theaders,\n\t\t\t\t\t\t\t\t\t\t\tbody: bytes,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t\treq.once(\"error\", reject);\n\t\t\t\t\t\treq.end();\n\t\t\t\t\t});\n\t\t\t\t\treturn { response, connectedAddress: address };\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (input.signal.aborted) throw error;\n\t\t\t\t\tlastError = error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow new Error(\"Registry artifact transport could not connect to an approved address\", {\n\t\t\t\tcause: lastError,\n\t\t\t});\n\t\t},\n\t};\n}\n\ninterface ParsedHttpResponse {\n\tstatus: number;\n\theaders: Headers;\n\tbody: Uint8Array;\n}\n\nfunction parsedResponseToWebResponse(parsed: ParsedHttpResponse): Response {\n\tconst bodyAllowed = ![204, 205, 304].includes(parsed.status);\n\tlet body: ArrayBuffer | null = null;\n\tif (bodyAllowed) {\n\t\tbody = new ArrayBuffer(parsed.body.byteLength);\n\t\tnew Uint8Array(body).set(parsed.body);\n\t}\n\treturn new Response(body, {\n\t\tstatus: parsed.status,\n\t\theaders: parsed.headers,\n\t});\n}\n\nfunction concatBytes(chunks: readonly Uint8Array[], total: number): Uint8Array {\n\tconst bytes = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn bytes;\n}\n\nfunction parseHttpsPort(url: URL): number {\n\tconst port = url.port === \"\" ? 443 : Number(url.port);\n\tif (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {\n\t\tthrow new TypeError(\"Registry artifact HTTPS port is invalid\");\n\t}\n\treturn port;\n}\n\nfunction stripIpv6Brackets(hostname: string): string {\n\treturn hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n}\n"],"mappings":";;;;;AAGA,MAAM,SAAS;AACf,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAMA,iBAAe;AACrB,MAAM,uBAAuB;CAC5B,iBAAiB;CACjB,gBAAgB;CAChB,UAAU,KAAK,OAAO;CACtB,cAAc;CACd;AACD,eAAe,sBAAsB,OAAO,SAAS;CACpD,MAAM,SAAS;EACd,iBAAiB,QAAQ,mBAAmB,qBAAqB;EACjE,gBAAgB,QAAQ,kBAAkB,qBAAqB;EAC/D,UAAU,QAAQ,YAAY,qBAAqB;EACnD,cAAc,QAAQ,gBAAgB,qBAAqB;EAC3D;AACD,KAAI,CAAC,eAAe,OAAO,CAAE,QAAO,kBAAkB,eAAe,0CAA0C;CAC/G,MAAM,YAAY,KAAK,KAAK;CAC5B,IAAI,aAAa,oBAAoB,OAAO,KAAK,GAAG,QAAQ,uBAAuB,KAAK;AACxF,KAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAK,IAAI,YAAY,IAAI,aAAa,GAAG;EACxC,MAAM,YAAY,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACxD,MAAI,aAAa,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EAClH,MAAM,OAAO,kBAAkB,WAAW,OAAO,QAAQ,uBAAuB,KAAK,GAAG;GACvF,SAAS;GACT,OAAO;GACP,GAAG,MAAM,aAAa,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AAC5E,MAAI,CAAC,KAAK,QAAS,QAAO;EAC1B,MAAM,2BAA2B,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACvE,MAAI,4BAA4B,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EACjI,MAAM,WAAW,MAAM,cAAc,QAAQ,OAAO,WAAW,OAAO,KAAK,IAAI,0BAA0B,OAAO,gBAAgB,CAAC;AACjI,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,WAAW,SAAS,MAAM,OAAO,EAAE;AACtC,OAAI,aAAa,OAAO,aAAc,QAAO,kBAAkB,2BAA2B,4CAA4C;GACtI,MAAM,WAAW,SAAS,MAAM,QAAQ,IAAI,WAAW;AACvD,OAAI,aAAa,KAAM,QAAO,kBAAkB,6BAA6B,gDAAgD;AAC7H,gBAAa,oBAAoB,UAAU,WAAW,OAAO,QAAQ,uBAAuB,KAAK;AACjG,OAAI,CAAC,WAAW,QAAS,QAAO;AAChC;;AAED,MAAI,CAAC,SAAS,MAAM,MAAM,CAAC,QAAQ,iBAAiB,SAAS,SAAS,MAAM,OAAO,CAAE,QAAO,kBAAkB,yBAAyB,8BAA8B,SAAS,MAAM,OAAO,GAAG;EAC9L,MAAM,gBAAgB,SAAS,MAAM,QAAQ,IAAI,iBAAiB;AAClE,MAAI,kBAAkB,SAAS,CAAC,OAAO,KAAK,cAAc,IAAI,OAAO,cAAc,GAAG,OAAO,UAAW,QAAO,kBAAkB,0BAA0B,uCAAuC;EAClM,MAAM,QAAQ,MAAM,aAAa,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,eAAe;AACnG,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,SAAO;GACN,SAAS;GACT,OAAO;IACN,OAAO,MAAM;IACb,KAAK,WAAW;IAChB,QAAQ,SAAS,MAAM;IACvB,SAAS,SAAS,MAAM;IACxB;GACD;;;AAGH,SAAS,oBAAoB,OAAO,MAAM,qBAAqB,OAAO;CACrE,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,OAAO,KAAK;SACnB;AACP,SAAO,kBAAkB,eAAe,+BAA+B;;AAExE,KAAI,IAAI,aAAa,YAAY,CAAC,kBAAkB,KAAK,mBAAmB,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,QAAO,kBAAkB,eAAe,+DAA+D;AACnO,KAAI,CAAC,kBAAkB,KAAK,mBAAmB,KAAK,YAAY,IAAI,SAAS,IAAI,gBAAgB,IAAI,SAAS,EAAG,QAAO,kBAAkB,iBAAiB,sCAAsC;AACjM,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,SAAS,kBAAkB,KAAK,SAAS;AACxC,KAAI,CAAC,WAAW,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;CAC9E,MAAM,WAAW,IAAI,SAAS,aAAa,CAAC,QAAQA,gBAAc,GAAG;AACrE,QAAO,aAAa,eAAe,SAAS,SAAS,aAAa,IAAI,aAAa,eAAe,aAAa,WAAW,aAAa;;AAExI,eAAe,aAAa,KAAK,UAAU,WAAW;AACrD,KAAI;EACH,MAAM,YAAY,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,SAAS,IAAI,SAAS,CAAC,EAAE,UAAU;AACpG,MAAI,UAAU,WAAW,KAAK,UAAU,KAAK,mBAAmB,CAAE,QAAO,kBAAkB,iBAAiB,qDAAqD;AACjK,SAAO;GACN,SAAS;GACT,OAAO;GACP;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,iBAAiB,4CAA4C;;;AAGxF,eAAe,cAAc,qBAAqB,KAAK,WAAW;CACjE,MAAM,aAAa,IAAI,iBAAiB;AACxC,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,oBAAoB,KAAK;IAC9E,QAAQ;IACR,UAAU;IACV,QAAQ,WAAW;IACnB,CAAC,CAAC,EAAE,iBAAiB,WAAW,OAAO,CAAC;GACzC;UACO,OAAO;AACf,MAAI,WAAW,OAAO,WAAW,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,2CAA2C;AAC9I,SAAO,kBAAkB,gBAAgB,+BAA+B;;;AAG1E,eAAe,aAAa,UAAU,cAAc,WAAW,gBAAgB;AAC9E,KAAI,SAAS,SAAS,KAAM,QAAO;EAClC,SAAS;EACT,OAAO,IAAI,YAAY;EACvB;CACD,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,MAAM,SAAS,EAAE;CACjB,IAAI,SAAS;AACb,KAAI;AACH,WAAS;GACR,MAAM,YAAY,kBAAkB,KAAK,KAAK,GAAG;AACjD,OAAI,aAAa,GAAG;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,oBAAoB,iDAAiD;;GAE/F,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,OAAI,CAAC,MAAM,SAAS;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO;;AAER,OAAI,MAAM,MAAM,KAAM;GACtB,MAAM,QAAQ,MAAM,MAAM;AAC1B,aAAU,MAAM;AAChB,OAAI,SAAS,cAAc;AAC1B,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,0BAA0B,uCAAuC;;AAE3F,UAAO,KAAK,MAAM;;SAEZ;AACP,SAAO,kBAAkB,gBAAgB,2CAA2C;WAC3E;AACT,SAAO,aAAa;;CAErB,MAAM,SAAS,IAAI,WAAW,OAAO;CACrC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,SAAO,IAAI,OAAO,OAAO;AACzB,YAAU,MAAM;;AAEjB,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,gBAAgB,QAAQ,WAAW;AACjD,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,OAAO,MAAM,CAAC,EAAE,UAAU;GAChF;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,gBAAgB,2CAA2C;;;;;;;AAOtF,SAAS,YAAY,WAAW,WAAW,WAAW;AACrD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI,UAAU;EACd,MAAM,UAAU,iBAAiB;AAChC,OAAI,QAAS;AACb,aAAU;AACV,gBAAa;AACb,UAAO,IAAI,aAAa,aAAa,aAAa,CAAC;KACjD,UAAU;AACb,YAAU,MAAM,UAAU;AACzB,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,WAAQ,MAAM;MACX,UAAU;AACb,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,UAAO,MAAM;IACZ;GACD;;AAEH,SAAS,eAAe,QAAQ;AAC/B,QAAO,OAAO,OAAO,OAAO,CAAC,OAAO,UAAU,OAAO,cAAc,MAAM,IAAI,QAAQ,EAAE;;AAExF,SAAS,WAAW,QAAQ;AAC3B,QAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW;;AAE3F,SAAS,aAAa,OAAO;AAC5B,QAAO,iBAAiB,gBAAgB,MAAM,SAAS;;AAExD,SAAS,YAAY,UAAU;AAC9B,QAAO,aAAa,KAAK,SAAS,IAAI,SAAS,SAAS,IAAI;;AAE7D,SAAS,gBAAgB,UAAU;CAClC,MAAM,aAAa,SAAS,aAAa;AACzC,QAAO,eAAe,eAAe,WAAW,SAAS,aAAa,IAAI,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,YAAY;;AAE5I,SAAS,mBAAmB,SAAS;CACpC,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,MAAM;EAClB,MAAM,CAAC,GAAG,KAAK;AACf,SAAO,MAAM,KAAK,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,MAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,MAAM,OAAO,KAAK;;CAEhO,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,KAAM,QAAO;CAC1B,MAAM,QAAQ,KAAK;CACnB,MAAM,gBAAgB,KAAK,OAAO,SAAS,SAAS,EAAE;CACtD,MAAM,aAAa,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO;CAC/E,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,eAAe,QAAQ,WAAW;CACxC,MAAM,eAAe,QAAQ,WAAW;AACxC,KAAI,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO,MAAO,QAAO,mBAAmB,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM;AACvK,QAAO,iBAAiB,cAAc,aAAa,eAAe;;AAEnE,SAAS,UAAU,OAAO;CACzB,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,UAAU,MAAM,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IAAI;AAC9E,KAAI,QAAQ,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAAE,QAAO;AACtF,QAAO;EACN,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR;;AAEF,SAAS,UAAU,OAAO;AACzB,KAAI,MAAM,SAAS,MAAM,IAAI,MAAM,MAAM,KAAK,CAAC,SAAS,EAAG,QAAO;CAClE,MAAM,CAAC,SAAS,IAAI,QAAQ,MAAM,MAAM,MAAM,KAAK;CACnD,MAAM,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,MAAM,IAAI;CACnD,MAAM,OAAO,UAAU,KAAK,EAAE,GAAG,MAAM,MAAM,IAAI;CACjD,MAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK;AAChC,KAAI,MAAM,MAAM,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,MAAM,SAAS,EAAG,QAAO;AAC5E,KAAI,CAAC,MAAM,SAAS,KAAK,IAAI,MAAM,WAAW,EAAG,QAAO;CACxD,MAAM,SAAS,MAAM,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS;AACzD,QAAO;EACN,GAAG;EACH,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,CAAC,CAAC,KAAK,IAAI;EAC3C,GAAG;EACH,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,GAAG,CAAC;;;;;AClP3C,MAAM,yBAAyB,MAAM;AACrC,MAAM,kBAAkB;AACxB,MAAM,cAAc;AACpB,MAAM,sBAAsB;AAC5B,eAAe,qBAAqB,OAAO,SAAS;CACnD,MAAM,WAAW,KAAK,KAAK,IAAI,QAAQ,kBAAkB,qBAAqB;CAC9E,MAAM,EAAE,aAAa;AACrB,KAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,IAAK,QAAO,kBAAkB,mCAAmC,mDAAmD;AACpJ,KAAI,SAAS,iBAAiB,QAAQ,MAAM,SAAS,KAAK,EAAG,QAAO,gBAAgB,MAAM,KAAK;CAC/F,MAAM,UAAU,cAAc,SAAS,KAAK;CAC5C,MAAM,eAAe,WAAW,SAAS,QAAQ,SAAS,SAAS,OAAO,SAAS,OAAO,KAAK;AAC/F,KAAI,SAAS,QAAQ,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,4CAA4C;AACxH,KAAI,SAAS;EACZ,MAAM,WAAW,qBAAqB,QAAQ;AAC9C,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,SAAS,UAAU,SAAS,SAAU,QAAO,kBAAkB,qBAAqB,+DAA+D;;CAExJ,IAAI;AACJ,MAAK,MAAM,SAAS,MAAM,kBAAkB,EAAE,EAAE;EAC/C,MAAM,kBAAkB,0BAA0B,MAAM;AACxD,MAAI,CAAC,mBAAmB,CAAC,QAAS;EAClC,MAAM,WAAW,yBAAyB,iBAAiB,MAAM,QAAQ,QAAQ;AACjF,MAAI,CAAC,SAAS,SAAS;AACtB,eAAY,SAAS;AACrB;;EAED,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,kBAAkB,SAAS,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACvJ,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,KAAI,SAAS;EACZ,MAAM,oBAAoB,eAAe,SAAS,SAAS;AAC3D,MAAI,CAAC,kBAAmB,QAAO,UAAU;EACzC,MAAM,MAAM,MAAM,cAAc;GAC/B,SAAS;GACT,OAAO,MAAM;GACb,GAAG,MAAM,4BAA4B,MAAM,OAAO,KAAK,kBAAkB;AAC1E,MAAI,IAAI,SAAS;GAChB,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,OAAO,KAAK,QAAQ;AACzD,OAAI,IAAI,SAAS;IAChB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,QAAI,CAAC,eAAgB,QAAO,UAAU;IACtC,MAAM,SAAS,MAAM,eAAe,QAAQ,IAAI,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACxI,QAAI,OAAO,QAAS,QAAO;AAC3B,gBAAY,OAAO;SACb,aAAY,IAAI;QACjB,aAAY,IAAI;;AAExB,KAAI,SAAS,KAAK;EACjB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,OAAO,SAAS,KAAK,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AAC1I,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,QAAO,YAAY;EAClB,SAAS;EACT,OAAO;EACP,GAAG,kBAAkB,gBAAgB,6CAA6C;;AAEpF,SAAS,yBAAyB,iBAAiB,QAAQ,SAAS;AACnE,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,gBAAgB;AACzC,MAAI,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,YAAY,SAAS,aAAa,OAAO,SAAS,UAAU,SAAS,KAAM,OAAM,IAAI,OAAO;EAChK,MAAM,WAAW;GAChB;GACA,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP;GACA;AACD,MAAI,CAAC,YAAY,KAAK,OAAO,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,MAAM,YAAY,CAAC,kBAAkB,QAAQ,CAAC,CAAE,OAAM,IAAI,OAAO;AAC7I,SAAO;GACN,SAAS;GACT,OAAO,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,SAAS;GAC5C;SACM;AACP,SAAO,kBAAkB,eAAe,oDAAoD;;;AAG9F,SAAS,0BAA0B,iBAAiB,QAAQ,QAAQ,SAAS;CAC5E,MAAM,MAAM,yBAAyB,iBAAiB,QAAQ,QAAQ;AACtE,KAAI,CAAC,IAAI,QAAS,QAAO;CACzB,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM;AAC9B,KAAI,WAAW,QAAQ,SAAS,IAAI;AACpC,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,4BAA4B,cAAc,SAAS;CACjE,MAAM,cAAc,eAAe,aAAa;AAChD,KAAI,CAAC,YAAa,QAAO,kBAAkB,yBAAyB,sCAAsC;CAC1G,MAAM,UAAU,MAAM,sBAAsB,aAAa;EACxD,GAAG;EACH,UAAU;EACV,CAAC;AACF,KAAI,CAAC,QAAQ,QAAS,QAAO,kBAAkB,yBAAyB,mDAAmD;CAC3H,IAAI;AACJ,KAAI;AACH,aAAW,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,QAAQ,MAAM,MAAM,CAAC;SAC7D;AACP,SAAO,kBAAkB,yBAAyB,2CAA2C;;AAE9F,KAAI,CAAC,SAAS,SAAS,IAAI,SAAS,OAAO,gBAAgB,CAAC,MAAM,QAAQ,SAAS,QAAQ,CAAE,QAAO,kBAAkB,yBAAyB,uDAAuD;CACtM,MAAM,UAAU,SAAS,QAAQ,MAAM,UAAU,SAAS,MAAM,KAAK,MAAM,OAAO,GAAG,aAAa,iBAAiB,MAAM,OAAO,mBAAmB,MAAM,SAAS,+BAA+B,OAAO,MAAM,oBAAoB,SAAS;AAC3O,KAAI,CAAC,SAAS,QAAQ,IAAI,OAAO,QAAQ,oBAAoB,SAAU,QAAO,kBAAkB,yBAAyB,uDAAuD;AAChL,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,QAAQ,gBAAgB;AACjD,MAAI,EAAE,QAAQ,uBAAuB,QAAQ,SAAS,aAAa,YAAY,SAAS,aAAa,eAAe,SAAS,aAAa,iBAAiB,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,SAAU,OAAM,IAAI,OAAO;AACtP,SAAO;GACN,SAAS;GACT,OAAO,SAAS;GAChB;SACM;AACP,SAAO,kBAAkB,yBAAyB,uDAAuD;;;AAG3G,eAAe,eAAe,QAAQ,KAAK,UAAU,SAAS,cAAc;CAC3E,MAAM,UAAU,MAAM,sBAAsB,KAAK,QAAQ;AACzD,KAAI,CAAC,QAAQ,QAAS,QAAO,gBAAgB,QAAQ,MAAM,SAAS,2BAA2B,kBAAkB,0BAA0B,qEAAqE,GAAG;CACnN,MAAM,WAAW,MAAM,gBAAgB,QAAQ,MAAM,OAAO,SAAS;AACrE,KAAI,CAAC,SAAS,QAAS,QAAO;CAC9B,MAAM,cAAc,QAAQ,MAAM,QAAQ,IAAI,eAAe,EAAE,MAAM,KAAK,EAAE,CAAC,IAAI,MAAM;AACvF,KAAI,iBAAiB,QAAQ,MAAM,MAAM,eAAe,aAAa,QAAQ,gBAAgB,KAAK,KAAK,gBAAgB,aAAa,UAAW,QAAO,kBAAkB,0BAA0B,gEAAgE;AAClQ,QAAO;EACN,SAAS;EACT,OAAO;GACN,OAAO,QAAQ,MAAM;GACrB;GACA,KAAK,QAAQ,MAAM;GACnB;EACD;;AAEF,SAAS,kBAAkB,SAAS,cAAc;AACjD,KAAI,CAAC,aAAc,QAAO;AAC1B,QAAO;EACN,GAAG;EACH,UAAU,KAAK,IAAI,QAAQ,YAAY,qBAAqB,UAAU,aAAa,KAAK;EACxF;;AAEF,SAAS,QAAQ,aAAa,cAAc,KAAK;AAChD,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,kCAAkC,YAAY;AAClE,MAAI,aAAa,IAAI,OAAO,aAAa;AACzC,MAAI,aAAa,IAAI,OAAO,IAAI;AAChC,SAAO;GACN,SAAS;GACT,OAAO;GACP;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,eAAe,KAAK;AAC5B,KAAI,gBAAgB,KAAK,IAAI,CAAE,QAAO,yBAAyB,mBAAmB,IAAI;AACtF,KAAI,CAAC,IAAI,WAAW,WAAW,CAAE,QAAO;AACxC,KAAI;EACH,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,mBAAmB;EAC7D,MAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,QAAQ,MAAM,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,KAAK,CAAE,QAAO;EACxF,MAAM,OAAO,MAAM,WAAW,IAAI,0BAA0B,IAAI,MAAM,KAAK,IAAI,CAAC;AAChF,SAAO,IAAI,IAAI,MAAM,WAAW,OAAO,CAAC;SACjC;AACP,SAAO;;;AAGT,SAAS,gBAAgB,MAAM;AAC9B,QAAO,kBAAkB,2BAA2B,0BAA0B,uBAAuB,KAAK,CAAC;;AAE5G,SAAS,eAAe,SAAS,UAAU;CAC1C,MAAM,YAAY,WAAW,KAAK,KAAK;AACvC,KAAI,aAAa,EAAG,QAAO;AAC3B,QAAO;EACN,GAAG;EACH,gBAAgB;EAChB;;AAEF,SAAS,WAAW;AACnB,QAAO,kBAAkB,oBAAoB,iDAAiD;;AAE/F,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAE5E,SAAS,cAAc,MAAM;AAC5B,KAAI,CAAC,QAAQ,EAAE,SAAS,SAAS,OAAO,KAAK,KAAK,UAAU,SAAU,QAAO;AAC7E,QAAO,KAAK,IAAI;;AAEjB,SAAS,0BAA0B,OAAO;AACzC,KAAI,CAAC,SAAS,MAAM,IAAI,MAAM,UAAU,8BAA+B,QAAO;AAC9E,QAAO,OAAO,MAAM,oBAAoB,WAAW,MAAM,kBAAkB;;AAE5E,SAAS,kBAAkB,OAAO;AACjC,KAAI,MAAM,WAAW,KAAK,oBAAoB,KAAK,MAAM,CAAE,QAAO;AAClE,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,YAAY,UAAU,YAAY,EAAE;AAC1C,MAAI,cAAc,KAAK,MAAM,aAAa,MAAM,cAAc,KAAM,QAAO;;AAE5E,QAAO;;;;;AC3MR,MAAM,eAAe;AACrB,MAAM,sBAAsB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA,CAAC;AAsBF,IAAI,mBAAqD;AAUzD,SAAS,oBAAoB,UAA2B;CACvD,MAAM,aAAa,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;AACnE,QACC,oBAAoB,IAAI,WAAW,IACnC,WAAW,SAAS,aAAa,IACjC,eAAe,eACf,eAAe,SACf,eAAe,WACf,WAAW,WAAW,cAAc,IACpC,WAAW,WAAW,eAAe;;AAIvC,eAAe,0BAA0B,WAGtC;CACF,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,UAAU;SACjB;AACP,QAAM,IAAI,MAAM,yBAAyB,YAAY;;AAEtD,KAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QACjD,OAAM,IAAI,MAAM,sCAAsC,IAAI,WAAW;AAEtE,KAAI,IAAI,YAAY,IAAI,SACvB,OAAM,IAAI,MAAM,qDAAqD;CAItE,MAAM,WAAW,kBADG,IAAI,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG,CACzB;CAC/C,MAAM,YAAY,oBAAoB,SAAS;AAE/C,KAAI,CAAC,OAAO,KAAK,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,QACpB,OAAM,IAAI,MAAM,8BAA8B;AAE/C,MAAI,UACH,OAAM,IAAI,MAAM,qCAAqC,WAAW;YAEvD,IAAI,aAAa,WAAW,CAAC,UACvC,OAAM,IAAI,MAAM,uEAAuE;AAGxF,KAAI,UACH,QAAO;EAAE;EAAK,WAAW,EAAE;EAAE;AAG9B,KAAI;AACH,SAAO,MAAM,oCAAoC,IAAI,KAAK;UAClD,OAAO;AACf,MAAI,iBAAiB,UACpB,OAAM,IAAI,MAAM,0BAA0B,MAAM,WAAW,EAAE,OAAO,OAAO,CAAC;AAE7E,QAAM;;;AAQR,eAAsB,yBACrB,WACA,SACoB;AACpB,KAAI,CAAC,OAAO,cAAc,QAAQ,iBAAiB,IAAI,QAAQ,mBAAmB,EACjF,OAAM,IAAI,UAAU,8CAA8C;CAEnE,MAAM,SAAS,MAAM,0BAA0B,UAAU;AACzD,KAAI,OAAO,UAAU,WAAW,EAC/B,QAAO,WAAW,MAAM,OAAO,KAAK;EAAE,UAAU;EAAU,QAAQ,QAAQ;EAAQ,CAAC;CAIpF,MAAM,SAAS,OADG,oBAAqB,MAAM,wCAAwC,EACtD,MAAM;EACpC,KAAK,OAAO;EACZ,kBAAkB,OAAO;EACzB,QAAQ,QAAQ;EAChB,kBAAkB,QAAQ;EAC1B,CAAC;AACF,KAAI,OAAO,qBAAqB,QAAQ,CAAC,OAAO,UAAU,SAAS,OAAO,iBAAiB,EAAE;AAC5F,QAAM,OAAO,SAAS,MAAM,QAAQ,CAAC,YAAY,OAAU;AAC3D,QAAM,IAAI,MAAM,0EAA0E;;AAE3F,QAAO,OAAO;;AAGf,eAAe,yCAA6E;AAC3F,QAAO,4BAA4B,GAChC,wCAAwC,GACxC,qCAAqC;;AAGzC,SAAgB,uCACf,cAAuC,WAAW,OACtB;AAC5B,QAAO,EACN,MAAM,MAAM,OAAO;AAMlB,SAAO;GACN,UAAU,kBANM,MAAM,YAAY,MAAM,KAAK;IAC7C,UAAU;IACV,QAAQ,MAAM;IACd,SAAS,EAAE,mBAAmB,YAAY;IAC1C,CAAC,EAEqC,MAAM,iBAAiB;GAC7D,kBAAkB;GAClB;IAEF;;AAGF,SAAS,6BAAsC;AAC9C,QACC,OAAO,cAAc,eACrB,OAAO,UAAU,cAAc,YAC/B,UAAU,UAAU,SAAS,qBAAqB;;AAIpD,SAAS,kBAAkB,UAAoB,UAA4B;AAC1E,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,IAAI,WAAW;CACf,MAAM,OAAO,SAAS,KAAK,YAC1B,IAAI,gBAAwC,EAC3C,UAAU,OAAO,YAAY;AAC5B,cAAY,MAAM;AAClB,MAAI,WAAW,UAAU;AACxB,cAAW,sBAAM,IAAI,WAAW,oDAAoD,CAAC;AACrF;;AAED,aAAW,QAAQ,MAAM;IAE1B,CAAC,CACF;AACD,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ,SAAS;EACjB,YAAY,SAAS;EACrB,SAAS,SAAS;EAClB,CAAC;;AAQH,eAAsB,oCACrB,aACqC;CACrC,MAAM,UAAU,gBAAgB,MAAM,OAAO,eAAe;AAC5D,QAAO,EACN,MAAM,MAAM,OAAO;EAClB,IAAI;AACJ,OAAK,MAAM,WAAW,MAAM,iBAC3B,KAAI;AAiEH,UAAO;IAAE,UAhEQ,MAAM,IAAI,SAAmB,SAAS,WAAW;KACjE,MAAM,SAAuB,EAAE;KAC/B,IAAI,QAAQ;KACZ,MAAM,MAAM,QACX;MACC,UAAU;MACV,UAAU,kBAAkB,MAAM,IAAI,SAAS;MAC/C,MAAM,eAAe,MAAM,IAAI;MAC/B,MAAM,GAAG,MAAM,IAAI,WAAW,MAAM,IAAI;MACxC,QAAQ;MAGR,OAAO;MACP,SAAS;OACR,MAAM,MAAM,IAAI;OAChB,YAAY;OACZ,mBAAmB;OACnB;MACD,SAAS,WAAW,SAAS,aAAa;OACzC,MAAM,SAAS,QAAQ,SAAS,IAAI,GAAG,IAAI;AAE3C,WAAI,QAAQ,IAAK,UAAS,MAAM,CAAC;QAAE;QAAS;QAAQ,CAAC,CAAC;WACjD,UAAS,MAAM,SAAS,OAAO;;MAErC,QAAQ,MAAM;MACd,GACA,aAAa;MACb,MAAM,kBAAkB,SAAS,QAAQ;AACzC,UAAI,mBAAmB,gBAAgB,aAAa,KAAK,YAAY;AACpE,gBAAS,wBACR,IAAI,MAAM,6DAA6D,CACvE;AACD;;AAED,eAAS,GAAG,SAAS,UAAsB;AAC1C,gBAAS,MAAM;AACf,WAAI,QAAQ,MAAM,kBAAkB;AACnC,iBAAS,wBACR,IAAI,WAAW,oDAAoD,CACnE;AACD;;AAED,cAAO,KAAK,IAAI,WAAW,MAAM,CAAC;QACjC;AACF,eAAS,KAAK,SAAS,OAAO;AAC9B,eAAS,KAAK,aAAa;OAC1B,MAAM,QAAQ,YAAY,QAAQ,MAAM;OACxC,MAAM,UAAU,IAAI,SAAS;AAC7B,YAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,WAAW,QAAQ,SAAS,EAChE,SAAQ,OAAO,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,GAAG;AAE3E,eACC,4BAA4B;QAC3B,QAAQ,SAAS,cAAc;QAC/B;QACA,MAAM;QACN,CAAC,CACF;QACA;OAEH;AACD,SAAI,KAAK,SAAS,OAAO;AACzB,SAAI,KAAK;MACR;IACiB,kBAAkB;IAAS;WACtC,OAAO;AACf,OAAI,MAAM,OAAO,QAAS,OAAM;AAChC,eAAY;;AAGd,QAAM,IAAI,MAAM,wEAAwE,EACvF,OAAO,WACP,CAAC;IAEH;;AASF,SAAS,4BAA4B,QAAsC;CAC1E,MAAM,cAAc,CAAC;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,OAAO,OAAO;CAC5D,IAAI,OAA2B;AAC/B,KAAI,aAAa;AAChB,SAAO,IAAI,YAAY,OAAO,KAAK,WAAW;AAC9C,MAAI,WAAW,KAAK,CAAC,IAAI,OAAO,KAAK;;AAEtC,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,CAAC;;AAGH,SAAS,YAAY,QAA+B,OAA2B;CAC9E,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,QAAM,IAAI,OAAO,OAAO;AACxB,YAAU,MAAM;;AAEjB,QAAO;;AAGR,SAAS,eAAe,KAAkB;CACzC,MAAM,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO,IAAI,KAAK;AACrD,KAAI,CAAC,OAAO,cAAc,KAAK,IAAI,OAAO,KAAK,OAAO,MACrD,OAAM,IAAI,UAAU,0CAA0C;AAE/D,QAAO;;AAGR,SAAS,kBAAkB,UAA0B;AACpD,QAAO,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG"}

package/dist/artifacts-D-O-qj9C.mjs

@@ -0,0 +1,307 @@
+import { d as __exportAll } from "./runner-wqt4BrIW.mjs";
+import { n as isMissingTableError } from "./db-errors-CBD5yMro.mjs";
+import { t as after } from "./after-PcEvMY_6.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-Dr5Vr0zA.mjs";
+import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
+import { t as RedirectRepository } from "./redirect-B39kTQ_0.mjs";
+import { n as invalidateRedirectCache } from "./cache-x0z8t_m9.mjs";
+
+//#region src/redirects/artifacts.ts
+var artifacts_exports = /* @__PURE__ */ __exportAll({
+	createRedirectSource: () => createRedirectSource,
+	publishRedirectArtifacts: () => publishRedirectArtifacts,
+	publishRedirectChanges: () => publishRedirectChanges
+});
+const ARTIFACT_TARGET_BYTES = 64 * 1024;
+const GENERATION_PREFIX = "emdash-redirects-v1";
+const REPAIR_LEASE_MS = 6e4;
+/** Three bound parameters per link row keeps each insert within D1's limit. */
+const LINK_BATCH_SIZE = 30;
+const encoder = new TextEncoder();
+async function sha256Hex(value) {
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(value));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function fnv1a(value) {
+	let hash = 2166136261;
+	for (let i = 0; i < value.length; i++) {
+		hash ^= value.charCodeAt(i);
+		hash = Math.imul(hash, 16777619);
+	}
+	return hash >>> 0;
+}
+function toEntry(rule) {
+	return [
+		rule.id,
+		rule.source,
+		rule.destination,
+		rule.type
+	];
+}
+function entryBytes(entry) {
+	return encoder.encode(JSON.stringify(entry)).byteLength + 1;
+}
+async function createArtifact(kind, entries) {
+	const payload = JSON.stringify(entries);
+	return {
+		digest: await sha256Hex(`${kind}\n${payload}`),
+		kind,
+		payload
+	};
+}
+function generationId(digests) {
+	return sha256Hex([GENERATION_PREFIX, ...digests].join("\n"));
+}
+/** Splits enabled rows, in precedence order, into exact and pattern rules. */
+function toRuleSet(rows, version) {
+	const exact = [];
+	const patterns = [];
+	for (const { isPattern, ...rule } of rows) (isPattern ? patterns : exact).push(rule);
+	return {
+		version,
+		exact,
+		patterns
+	};
+}
+/**
+* Builds the artifacts for a rule set. Exact rules keep the last rule per
+* source, matching lookup semantics, and are sorted so the shards are
+* deterministic. Pattern rules keep precedence order across chunks.
+*/
+async function buildArtifacts(rules) {
+	const bySource = /* @__PURE__ */ new Map();
+	for (const rule of rules.exact) bySource.set(rule.source, toEntry(rule));
+	const exact = [...bySource.values()].toSorted((a, b) => a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
+	const exactBytes = exact.reduce((total, entry) => total + entryBytes(entry), 0);
+	const shardCount = Math.max(1, Math.ceil(exactBytes / ARTIFACT_TARGET_BYTES));
+	const shards = Array.from({ length: shardCount }, () => []);
+	for (const entry of exact) shards[fnv1a(entry[1]) % shardCount].push(entry);
+	const artifacts = [];
+	for (const shard of shards) if (shard.length > 0) artifacts.push(await createArtifact("exact", shard));
+	let chunk = [];
+	let chunkBytes = 0;
+	for (const rule of rules.patterns) {
+		const entry = toEntry(rule);
+		const bytes = entryBytes(entry);
+		if (chunk.length > 0 && chunkBytes + bytes > ARTIFACT_TARGET_BYTES) {
+			artifacts.push(await createArtifact("pattern", chunk));
+			chunk = [];
+			chunkBytes = 0;
+		}
+		chunk.push(entry);
+		chunkBytes += bytes;
+	}
+	if (chunk.length > 0) artifacts.push(await createArtifact("pattern", chunk));
+	return {
+		generation: await generationId(artifacts.map((artifact) => artifact.digest)),
+		artifacts
+	};
+}
+/**
+* Publishes the enabled redirect rules as the active generation.
+*
+* The revision is read before the rules, so the published generation holds
+* at least the changes up to the revision it is labelled with. A publish at
+* the active revision replaces the active generation, which repairs a damaged
+* one; losing the compare-and-set to a newer revision leaves that publish
+* active.
+*/
+async function publishRedirectArtifacts(db) {
+	const state = await db.selectFrom("_emdash_redirect_state").select("revision").where("id", "=", 1).executeTakeFirst();
+	if (!state) throw new Error("Redirect state row is missing");
+	const revision = Number(state.revision);
+	const { generation, artifacts } = await buildArtifacts(toRuleSet((await db.selectFrom("_emdash_redirects").select([
+		"id",
+		"source",
+		"destination",
+		"type",
+		"is_pattern"
+	]).where("enabled", "=", 1).orderBy("created_at", (order) => order.asc().nullsFirst()).orderBy("id", "asc").execute()).map((row) => ({
+		id: row.id,
+		source: row.source,
+		destination: row.destination,
+		type: Number(row.type),
+		isPattern: Number(row.is_pattern) === 1
+	})), null));
+	await withTransaction(db, async (trx) => {
+		const digests = [...new Set(artifacts.map((artifact) => artifact.digest))];
+		const stored = /* @__PURE__ */ new Map();
+		for (const batch of chunks(digests, SQL_BATCH_SIZE)) {
+			const found = await trx.selectFrom("_emdash_redirect_artifacts").select([
+				"digest",
+				"kind",
+				"payload"
+			]).where("digest", "in", batch).execute();
+			for (const row of found) stored.set(row.digest, `${row.kind}\n${row.payload}`);
+		}
+		for (const artifact of artifacts) {
+			const content = `${artifact.kind}\n${artifact.payload}`;
+			if (stored.get(artifact.digest) === content) continue;
+			stored.set(artifact.digest, content);
+			await trx.insertInto("_emdash_redirect_artifacts").values(artifact).onConflict((conflict) => conflict.column("digest").doUpdateSet({
+				kind: artifact.kind,
+				payload: artifact.payload
+			})).execute();
+		}
+		const links = artifacts.map((artifact, position) => ({
+			generation,
+			position,
+			digest: artifact.digest
+		}));
+		for (const batch of chunks(links, LINK_BATCH_SIZE)) await trx.insertInto("_emdash_redirect_generation_artifacts").values(batch).onConflict((conflict) => conflict.columns(["generation", "position"]).doUpdateSet((eb) => ({ digest: eb.ref("excluded.digest") }))).execute();
+		await trx.deleteFrom("_emdash_redirect_generation_artifacts").where("generation", "=", generation).where("position", ">=", links.length).execute();
+		const activated = await trx.updateTable("_emdash_redirect_state").set({
+			generation,
+			generation_revision: revision
+		}).where("id", "=", 1).where("generation_revision", "<=", revision).executeTakeFirst();
+		if (BigInt(activated.numUpdatedRows) === 0n) return;
+		await trx.deleteFrom("_emdash_redirect_generation_artifacts").where((eb) => eb("generation", "<>", eb.selectFrom("_emdash_redirect_state").select("generation").where("id", "=", 1))).execute();
+		await trx.deleteFrom("_emdash_redirect_artifacts").where(({ exists, not, selectFrom }) => not(exists(selectFrom("_emdash_redirect_generation_artifacts").select("_emdash_redirect_generation_artifacts.digest").whereRef("_emdash_redirect_generation_artifacts.digest", "=", "_emdash_redirect_artifacts.digest")))).execute();
+	});
+}
+/**
+* Publishes after a redirect write, then invalidates this isolate's cache. A
+* failed publish is logged rather than failing the write: readers fall back
+* to the rules table and repair the stale generation.
+*/
+async function publishRedirectChanges(db) {
+	try {
+		await publishRedirectArtifacts(db);
+	} catch (error) {
+		console.error("[emdash:redirects] publishing redirect artifacts failed:", error);
+	}
+	invalidateRedirectCache();
+}
+function isArtifactEntry(value) {
+	return Array.isArray(value) && value.length === 4 && typeof value[0] === "string" && typeof value[1] === "string" && typeof value[2] === "string" && typeof value[3] === "number";
+}
+function parseEntries(payload) {
+	try {
+		const parsed = JSON.parse(payload);
+		return Array.isArray(parsed) && parsed.every(isArtifactEntry) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Loads and verifies the active generation. Returns null when nothing is
+* published, the generation is stale, or any artifact is missing, altered, or
+* out of place.
+*/
+async function loadPublishedRedirects(db) {
+	const rows = await db.selectFrom("_emdash_redirect_state as state").leftJoin("_emdash_redirect_generation_artifacts as link", "link.generation", "state.generation").leftJoin("_emdash_redirect_artifacts as artifact", "artifact.digest", "link.digest").select([
+		"state.revision",
+		"state.generation",
+		"state.generation_revision",
+		"link.position",
+		"link.digest",
+		"artifact.kind",
+		"artifact.payload"
+	]).where("state.id", "=", 1).orderBy("link.position", "asc").execute();
+	const state = rows[0];
+	if (!state?.generation) return null;
+	if (Number(state.revision) > Number(state.generation_revision)) return null;
+	const exact = [];
+	const patterns = [];
+	const digests = [];
+	const links = rows.filter((row) => row.position !== null);
+	for (const [index, link] of links.entries()) {
+		if (Number(link.position) !== index || !link.digest || link.payload === null || link.kind !== "exact" && link.kind !== "pattern") return null;
+		if (await sha256Hex(`${link.kind}\n${link.payload}`) !== link.digest) return null;
+		const entries = parseEntries(link.payload);
+		if (!entries) return null;
+		const target = link.kind === "exact" ? exact : patterns;
+		for (const [id, source, destination, type] of entries) target.push({
+			id,
+			source,
+			destination,
+			type
+		});
+		digests.push(link.digest);
+	}
+	if (await generationId(digests) !== state.generation) return null;
+	return {
+		version: state.generation,
+		exact,
+		patterns
+	};
+}
+async function loadRulesTable(db) {
+	return toRuleSet((await new RedirectRepository(db).findAllEnabled()).map(({ id, source, destination, type, isPattern }) => ({
+		id,
+		source,
+		destination,
+		type,
+		isPattern
+	})), null);
+}
+const REPAIR_STATE_KEY = Symbol.for("emdash:redirect-artifact-repair");
+const g = globalThis;
+const repairState = g[REPAIR_STATE_KEY] ?? (() => {
+	const state = { runningUntil: 0 };
+	g[REPAIR_STATE_KEY] = state;
+	return state;
+})();
+/**
+* Republishes the artifacts under a database lease so one isolate repairs a
+* stale or damaged generation while the others keep serving.
+*/
+async function repairRedirectArtifacts(db) {
+	const now = Date.now();
+	const expiresAt = now + REPAIR_LEASE_MS;
+	const lease = await db.updateTable("_emdash_redirect_state").set({ repair_expires_at: expiresAt }).where("id", "=", 1).where("repair_expires_at", "<", now).executeTakeFirst();
+	if (BigInt(lease.numUpdatedRows) === 0n) return;
+	try {
+		await publishRedirectArtifacts(db);
+	} finally {
+		await db.updateTable("_emdash_redirect_state").set({ repair_expires_at: 0 }).where("id", "=", 1).where("repair_expires_at", "=", expiresAt).execute();
+	}
+}
+function scheduleRedirectRepair(db) {
+	const now = Date.now();
+	if (repairState.runningUntil > now) return;
+	const runningUntil = now + REPAIR_LEASE_MS;
+	repairState.runningUntil = runningUntil;
+	after(async () => {
+		try {
+			await repairRedirectArtifacts(db);
+		} catch (error) {
+			console.error("[emdash:redirects] repairing redirect artifacts failed:", error);
+		} finally {
+			if (repairState.runningUntil === runningUntil) repairState.runningUntil = 0;
+		}
+	});
+}
+/**
+* The rule source the middleware caches: the published generation when it is
+* current and verifies, otherwise the rules table. Before the artifact tables exist the
+* rules table is read directly.
+*/
+function createRedirectSource(db) {
+	return {
+		async load() {
+			let published;
+			try {
+				published = await loadPublishedRedirects(db);
+			} catch (error) {
+				if (isMissingTableError(error)) return loadRulesTable(db);
+				throw error;
+			}
+			if (published) return published;
+			scheduleRedirectRepair(db);
+			return loadRulesTable(db);
+		},
+		async isCurrent(version) {
+			const state = await db.selectFrom("_emdash_redirect_state").select([
+				"revision",
+				"generation",
+				"generation_revision"
+			]).where("id", "=", 1).executeTakeFirst();
+			return state?.generation === version && Number(state.revision) <= Number(state.generation_revision);
+		}
+	};
+}
+
+//#endregion
+export { createRedirectSource as n, publishRedirectChanges as r, artifacts_exports as t };
+//# sourceMappingURL=artifacts-D-O-qj9C.mjs.map

package/dist/artifacts-D-O-qj9C.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts-D-O-qj9C.mjs","names":[],"sources":["../src/redirects/artifacts.ts"],"sourcesContent":["/**\n * Published redirect artifacts.\n *\n * Enabled redirect rules are published as compact, content-addressed JSON\n * artifacts grouped into a generation. The middleware loads the active\n * generation in one query and afterwards only polls the small state row, so a\n * site with many redirects never rescans `_emdash_redirects` on the read path.\n *\n * Exact rules are sharded by a hash of their source and pattern rules are\n * chunked in precedence order, so a single rule change usually rewrites one\n * artifact. Writers bump `_emdash_redirect_state.revision` through triggers.\n * A generation that is stale or fails verification is never served: readers\n * fall back to the rules table and schedule a repair.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { after } from \"../after.js\";\nimport { RedirectRepository } from \"../database/repositories/redirect.js\";\nimport { withTransaction } from \"../database/transaction.js\";\nimport type { Database } from \"../database/types.js\";\nimport { chunks, SQL_BATCH_SIZE } from \"../utils/chunks.js\";\nimport { isMissingTableError } from \"../utils/db-errors.js\";\nimport {\n\tinvalidateRedirectCache,\n\ttype RedirectRule,\n\ttype RedirectRuleSet,\n\ttype RedirectSource,\n} from \"./cache.js\";\n\ntype ArtifactKind = \"exact\" | \"pattern\";\ntype ArtifactEntry = [id: string, source: string, destination: string, type: number];\n\ninterface RedirectArtifact {\n\tdigest: string;\n\tkind: ArtifactKind;\n\tpayload: string;\n}\n\ninterface RuleRow {\n\tid: string;\n\tsource: string;\n\tdestination: string;\n\ttype: number;\n\tis_pattern: number;\n}\n\nconst ARTIFACT_TARGET_BYTES = 64 * 1024;\nconst GENERATION_PREFIX = \"emdash-redirects-v1\";\nconst REPAIR_LEASE_MS = 60_000;\n/** Three bound parameters per link row keeps each insert within D1's limit. */\nconst LINK_BATCH_SIZE = 30;\n\nconst encoder = new TextEncoder();\n\nasync function sha256Hex(value: string): Promise<string> {\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n\treturn Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction fnv1a(value: string): number {\n\tlet hash = 0x811c9dc5;\n\tfor (let i = 0; i < value.length; i++) {\n\t\thash ^= value.charCodeAt(i);\n\t\thash = Math.imul(hash, 0x01000193);\n\t}\n\treturn hash >>> 0;\n}\n\nfunction toEntry(rule: RedirectRule): ArtifactEntry {\n\treturn [rule.id, rule.source, rule.destination, rule.type];\n}\n\nfunction entryBytes(entry: ArtifactEntry): number {\n\treturn encoder.encode(JSON.stringify(entry)).byteLength + 1;\n}\n\nasync function createArtifact(kind: ArtifactKind, entries: ArtifactEntry[]) {\n\tconst payload = JSON.stringify(entries);\n\treturn { digest: await sha256Hex(`${kind}\\n${payload}`), kind, payload };\n}\n\nfunction generationId(digests: string[]): Promise<string> {\n\treturn sha256Hex([GENERATION_PREFIX, ...digests].join(\"\\n\"));\n}\n\n/** Splits enabled rows, in precedence order, into exact and pattern rules. */\nfunction toRuleSet(\n\trows: Array<RedirectRule & { isPattern: boolean }>,\n\tversion: string | null,\n): RedirectRuleSet {\n\tconst exact: RedirectRule[] = [];\n\tconst patterns: RedirectRule[] = [];\n\tfor (const { isPattern, ...rule } of rows) {\n\t\t(isPattern ? patterns : exact).push(rule);\n\t}\n\treturn { version, exact, patterns };\n}\n\n/**\n * Builds the artifacts for a rule set. Exact rules keep the last rule per\n * source, matching lookup semantics, and are sorted so the shards are\n * deterministic. Pattern rules keep precedence order across chunks.\n */\nasync function buildArtifacts(\n\trules: RedirectRuleSet,\n): Promise<{ generation: string; artifacts: RedirectArtifact[] }> {\n\tconst bySource = new Map<string, ArtifactEntry>();\n\tfor (const rule of rules.exact) bySource.set(rule.source, toEntry(rule));\n\tconst exact = [...bySource.values()].toSorted((a, b) => (a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0));\n\tconst exactBytes = exact.reduce((total, entry) => total + entryBytes(entry), 0);\n\tconst shardCount = Math.max(1, Math.ceil(exactBytes / ARTIFACT_TARGET_BYTES));\n\tconst shards: ArtifactEntry[][] = Array.from({ length: shardCount }, () => []);\n\tfor (const entry of exact) shards[fnv1a(entry[1]) % shardCount].push(entry);\n\n\tconst artifacts: RedirectArtifact[] = [];\n\tfor (const shard of shards) {\n\t\tif (shard.length > 0) artifacts.push(await createArtifact(\"exact\", shard));\n\t}\n\n\tlet chunk: ArtifactEntry[] = [];\n\tlet chunkBytes = 0;\n\tfor (const rule of rules.patterns) {\n\t\tconst entry = toEntry(rule);\n\t\tconst bytes = entryBytes(entry);\n\t\tif (chunk.length > 0 && chunkBytes + bytes > ARTIFACT_TARGET_BYTES) {\n\t\t\tartifacts.push(await createArtifact(\"pattern\", chunk));\n\t\t\tchunk = [];\n\t\t\tchunkBytes = 0;\n\t\t}\n\t\tchunk.push(entry);\n\t\tchunkBytes += bytes;\n\t}\n\tif (chunk.length > 0) artifacts.push(await createArtifact(\"pattern\", chunk));\n\n\treturn {\n\t\tgeneration: await generationId(artifacts.map((artifact) => artifact.digest)),\n\t\tartifacts,\n\t};\n}\n\n/**\n * Publishes the enabled redirect rules as the active generation.\n *\n * The revision is read before the rules, so the published generation holds\n * at least the changes up to the revision it is labelled with. A publish at\n * the active revision replaces the active generation, which repairs a damaged\n * one; losing the compare-and-set to a newer revision leaves that publish\n * active.\n */\nexport async function publishRedirectArtifacts(db: Kysely<Database>): Promise<void> {\n\tconst state = await db\n\t\t.selectFrom(\"_emdash_redirect_state\")\n\t\t.select(\"revision\")\n\t\t.where(\"id\", \"=\", 1)\n\t\t.executeTakeFirst();\n\tif (!state) throw new Error(\"Redirect state row is missing\");\n\tconst revision = Number(state.revision);\n\n\tconst rows: RuleRow[] = await db\n\t\t.selectFrom(\"_emdash_redirects\")\n\t\t.select([\"id\", \"source\", \"destination\", \"type\", \"is_pattern\"])\n\t\t.where(\"enabled\", \"=\", 1)\n\t\t.orderBy(\"created_at\", (order) => order.asc().nullsFirst())\n\t\t.orderBy(\"id\", \"asc\")\n\t\t.execute();\n\tconst { generation, artifacts } = await buildArtifacts(\n\t\ttoRuleSet(\n\t\t\trows.map((row) => ({\n\t\t\t\tid: row.id,\n\t\t\t\tsource: row.source,\n\t\t\t\tdestination: row.destination,\n\t\t\t\ttype: Number(row.type),\n\t\t\t\tisPattern: Number(row.is_pattern) === 1,\n\t\t\t})),\n\t\t\tnull,\n\t\t),\n\t);\n\n\tawait withTransaction(db, async (trx) => {\n\t\tconst digests = [...new Set(artifacts.map((artifact) => artifact.digest))];\n\t\tconst stored = new Map<string, string>();\n\t\tfor (const batch of chunks(digests, SQL_BATCH_SIZE)) {\n\t\t\tconst found = await trx\n\t\t\t\t.selectFrom(\"_emdash_redirect_artifacts\")\n\t\t\t\t.select([\"digest\", \"kind\", \"payload\"])\n\t\t\t\t.where(\"digest\", \"in\", batch)\n\t\t\t\t.execute();\n\t\t\tfor (const row of found) stored.set(row.digest, `${row.kind}\\n${row.payload}`);\n\t\t}\n\t\tfor (const artifact of artifacts) {\n\t\t\tconst content = `${artifact.kind}\\n${artifact.payload}`;\n\t\t\tif (stored.get(artifact.digest) === content) continue;\n\t\t\tstored.set(artifact.digest, content);\n\t\t\t// A stored row that does not match its digest was damaged; rewrite it.\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_redirect_artifacts\")\n\t\t\t\t.values(artifact)\n\t\t\t\t.onConflict((conflict) =>\n\t\t\t\t\tconflict.column(\"digest\").doUpdateSet({ kind: artifact.kind, payload: artifact.payload }),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t}\n\n\t\tconst links = artifacts.map((artifact, position) => ({\n\t\t\tgeneration,\n\t\t\tposition,\n\t\t\tdigest: artifact.digest,\n\t\t}));\n\t\tfor (const batch of chunks(links, LINK_BATCH_SIZE)) {\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_redirect_generation_artifacts\")\n\t\t\t\t.values(batch)\n\t\t\t\t.onConflict((conflict) =>\n\t\t\t\t\tconflict\n\t\t\t\t\t\t.columns([\"generation\", \"position\"])\n\t\t\t\t\t\t.doUpdateSet((eb) => ({ digest: eb.ref(\"excluded.digest\") })),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t}\n\t\tawait trx\n\t\t\t.deleteFrom(\"_emdash_redirect_generation_artifacts\")\n\t\t\t.where(\"generation\", \"=\", generation)\n\t\t\t.where(\"position\", \">=\", links.length)\n\t\t\t.execute();\n\n\t\tconst activated = await trx\n\t\t\t.updateTable(\"_emdash_redirect_state\")\n\t\t\t.set({ generation, generation_revision: revision })\n\t\t\t.where(\"id\", \"=\", 1)\n\t\t\t.where(\"generation_revision\", \"<=\", revision)\n\t\t\t.executeTakeFirst();\n\t\tif (BigInt(activated.numUpdatedRows) === 0n) return;\n\n\t\t// Another publish may have activated since this one; keep the active generation.\n\t\tawait trx\n\t\t\t.deleteFrom(\"_emdash_redirect_generation_artifacts\")\n\t\t\t.where((eb) =>\n\t\t\t\teb(\n\t\t\t\t\t\"generation\",\n\t\t\t\t\t\"<>\",\n\t\t\t\t\teb.selectFrom(\"_emdash_redirect_state\").select(\"generation\").where(\"id\", \"=\", 1),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.execute();\n\t\tawait trx\n\t\t\t.deleteFrom(\"_emdash_redirect_artifacts\")\n\t\t\t.where(({ exists, not, selectFrom }) =>\n\t\t\t\tnot(\n\t\t\t\t\texists(\n\t\t\t\t\t\tselectFrom(\"_emdash_redirect_generation_artifacts\")\n\t\t\t\t\t\t\t.select(\"_emdash_redirect_generation_artifacts.digest\")\n\t\t\t\t\t\t\t.whereRef(\n\t\t\t\t\t\t\t\t\"_emdash_redirect_generation_artifacts.digest\",\n\t\t\t\t\t\t\t\t\"=\",\n\t\t\t\t\t\t\t\t\"_emdash_redirect_artifacts.digest\",\n\t\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.execute();\n\t});\n}\n\n/**\n * Publishes after a redirect write, then invalidates this isolate's cache. A\n * failed publish is logged rather than failing the write: readers fall back\n * to the rules table and repair the stale generation.\n */\nexport async function publishRedirectChanges(db: Kysely<Database>): Promise<void> {\n\ttry {\n\t\tawait publishRedirectArtifacts(db);\n\t} catch (error) {\n\t\tconsole.error(\"[emdash:redirects] publishing redirect artifacts failed:\", error);\n\t}\n\tinvalidateRedirectCache();\n}\n\nfunction isArtifactEntry(value: unknown): value is ArtifactEntry {\n\treturn (\n\t\tArray.isArray(value) &&\n\t\tvalue.length === 4 &&\n\t\ttypeof value[0] === \"string\" &&\n\t\ttypeof value[1] === \"string\" &&\n\t\ttypeof value[2] === \"string\" &&\n\t\ttypeof value[3] === \"number\"\n\t);\n}\n\nfunction parseEntries(payload: string): ArtifactEntry[] | null {\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(payload);\n\t\treturn Array.isArray(parsed) && parsed.every(isArtifactEntry) ? parsed : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Loads and verifies the active generation. Returns null when nothing is\n * published, the generation is stale, or any artifact is missing, altered, or\n * out of place.\n */\nasync function loadPublishedRedirects(db: Kysely<Database>): Promise<RedirectRuleSet | null> {\n\tconst rows = await db\n\t\t.selectFrom(\"_emdash_redirect_state as state\")\n\t\t.leftJoin(\n\t\t\t\"_emdash_redirect_generation_artifacts as link\",\n\t\t\t\"link.generation\",\n\t\t\t\"state.generation\",\n\t\t)\n\t\t.leftJoin(\"_emdash_redirect_artifacts as artifact\", \"artifact.digest\", \"link.digest\")\n\t\t.select([\n\t\t\t\"state.revision\",\n\t\t\t\"state.generation\",\n\t\t\t\"state.generation_revision\",\n\t\t\t\"link.position\",\n\t\t\t\"link.digest\",\n\t\t\t\"artifact.kind\",\n\t\t\t\"artifact.payload\",\n\t\t])\n\t\t.where(\"state.id\", \"=\", 1)\n\t\t.orderBy(\"link.position\", \"asc\")\n\t\t.execute();\n\n\tconst state = rows[0];\n\tif (!state?.generation) return null;\n\tif (Number(state.revision) > Number(state.generation_revision)) return null;\n\n\tconst exact: RedirectRule[] = [];\n\tconst patterns: RedirectRule[] = [];\n\tconst digests: string[] = [];\n\tconst links = rows.filter((row) => row.position !== null);\n\tfor (const [index, link] of links.entries()) {\n\t\tif (\n\t\t\tNumber(link.position) !== index ||\n\t\t\t!link.digest ||\n\t\t\tlink.payload === null ||\n\t\t\t(link.kind !== \"exact\" && link.kind !== \"pattern\")\n\t\t) {\n\t\t\treturn null;\n\t\t}\n\t\tif ((await sha256Hex(`${link.kind}\\n${link.payload}`)) !== link.digest) {\n\t\t\treturn null;\n\t\t}\n\t\tconst entries = parseEntries(link.payload);\n\t\tif (!entries) return null;\n\t\tconst target = link.kind === \"exact\" ? exact : patterns;\n\t\tfor (const [id, source, destination, type] of entries) {\n\t\t\ttarget.push({ id, source, destination, type });\n\t\t}\n\t\tdigests.push(link.digest);\n\t}\n\tif ((await generationId(digests)) !== state.generation) return null;\n\n\treturn { version: state.generation, exact, patterns };\n}\n\nasync function loadRulesTable(db: Kysely<Database>): Promise<RedirectRuleSet> {\n\tconst redirects = await new RedirectRepository(db).findAllEnabled();\n\treturn toRuleSet(\n\t\tredirects.map(({ id, source, destination, type, isPattern }) => ({\n\t\t\tid,\n\t\t\tsource,\n\t\t\tdestination,\n\t\t\ttype,\n\t\t\tisPattern,\n\t\t})),\n\t\tnull,\n\t);\n}\n\ninterface RepairState {\n\trunningUntil: number;\n}\n\nconst REPAIR_STATE_KEY = Symbol.for(\"emdash:redirect-artifact-repair\");\nconst g = globalThis as Record<symbol, unknown>;\nconst repairState: RepairState =\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)\n\t(g[REPAIR_STATE_KEY] as RepairState | undefined) ??\n\t(() => {\n\t\tconst state: RepairState = { runningUntil: 0 };\n\t\tg[REPAIR_STATE_KEY] = state;\n\t\treturn state;\n\t})();\n\n/**\n * Republishes the artifacts under a database lease so one isolate repairs a\n * stale or damaged generation while the others keep serving.\n */\nasync function repairRedirectArtifacts(db: Kysely<Database>): Promise<void> {\n\tconst now = Date.now();\n\tconst expiresAt = now + REPAIR_LEASE_MS;\n\tconst lease = await db\n\t\t.updateTable(\"_emdash_redirect_state\")\n\t\t.set({ repair_expires_at: expiresAt })\n\t\t.where(\"id\", \"=\", 1)\n\t\t.where(\"repair_expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\tif (BigInt(lease.numUpdatedRows) === 0n) return;\n\ttry {\n\t\tawait publishRedirectArtifacts(db);\n\t} finally {\n\t\tawait db\n\t\t\t.updateTable(\"_emdash_redirect_state\")\n\t\t\t.set({ repair_expires_at: 0 })\n\t\t\t.where(\"id\", \"=\", 1)\n\t\t\t.where(\"repair_expires_at\", \"=\", expiresAt)\n\t\t\t.execute();\n\t}\n}\n\nfunction scheduleRedirectRepair(db: Kysely<Database>): void {\n\tconst now = Date.now();\n\tif (repairState.runningUntil > now) return;\n\tconst runningUntil = now + REPAIR_LEASE_MS;\n\trepairState.runningUntil = runningUntil;\n\tafter(async () => {\n\t\ttry {\n\t\t\tawait repairRedirectArtifacts(db);\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[emdash:redirects] repairing redirect artifacts failed:\", error);\n\t\t} finally {\n\t\t\tif (repairState.runningUntil === runningUntil) repairState.runningUntil = 0;\n\t\t}\n\t});\n}\n\n/**\n * The rule source the middleware caches: the published generation when it is\n * current and verifies, otherwise the rules table. Before the artifact tables exist the\n * rules table is read directly.\n */\nexport function createRedirectSource(db: Kysely<Database>): RedirectSource {\n\treturn {\n\t\tasync load() {\n\t\t\tlet published: RedirectRuleSet | null;\n\t\t\ttry {\n\t\t\t\tpublished = await loadPublishedRedirects(db);\n\t\t\t} catch (error) {\n\t\t\t\tif (isMissingTableError(error)) return loadRulesTable(db);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (published) return published;\n\t\t\tscheduleRedirectRepair(db);\n\t\t\treturn loadRulesTable(db);\n\t\t},\n\t\tasync isCurrent(version) {\n\t\t\tconst state = await db\n\t\t\t\t.selectFrom(\"_emdash_redirect_state\")\n\t\t\t\t.select([\"revision\", \"generation\", \"generation_revision\"])\n\t\t\t\t.where(\"id\", \"=\", 1)\n\t\t\t\t.executeTakeFirst();\n\t\t\treturn (\n\t\t\t\tstate?.generation === version && Number(state.revision) <= Number(state.generation_revision)\n\t\t\t);\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;AA+CA,MAAM,wBAAwB,KAAK;AACnC,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;;AAExB,MAAM,kBAAkB;AAExB,MAAM,UAAU,IAAI,aAAa;AAEjC,eAAe,UAAU,OAAgC;CACxD,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,MAAM,CAAC;AAC3E,QAAO,MAAM,KAAK,IAAI,WAAW,OAAO,GAAG,SAAS,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;AAGjG,SAAS,MAAM,OAAuB;CACrC,IAAI,OAAO;AACX,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,UAAQ,MAAM,WAAW,EAAE;AAC3B,SAAO,KAAK,KAAK,MAAM,SAAW;;AAEnC,QAAO,SAAS;;AAGjB,SAAS,QAAQ,MAAmC;AACnD,QAAO;EAAC,KAAK;EAAI,KAAK;EAAQ,KAAK;EAAa,KAAK;EAAK;;AAG3D,SAAS,WAAW,OAA8B;AACjD,QAAO,QAAQ,OAAO,KAAK,UAAU,MAAM,CAAC,CAAC,aAAa;;AAG3D,eAAe,eAAe,MAAoB,SAA0B;CAC3E,MAAM,UAAU,KAAK,UAAU,QAAQ;AACvC,QAAO;EAAE,QAAQ,MAAM,UAAU,GAAG,KAAK,IAAI,UAAU;EAAE;EAAM;EAAS;;AAGzE,SAAS,aAAa,SAAoC;AACzD,QAAO,UAAU,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,KAAK,CAAC;;;AAI7D,SAAS,UACR,MACA,SACkB;CAClB,MAAM,QAAwB,EAAE;CAChC,MAAM,WAA2B,EAAE;AACnC,MAAK,MAAM,EAAE,WAAW,GAAG,UAAU,KACpC,EAAC,YAAY,WAAW,OAAO,KAAK,KAAK;AAE1C,QAAO;EAAE;EAAS;EAAO;EAAU;;;;;;;AAQpC,eAAe,eACd,OACiE;CACjE,MAAM,2BAAW,IAAI,KAA4B;AACjD,MAAK,MAAM,QAAQ,MAAM,MAAO,UAAS,IAAI,KAAK,QAAQ,QAAQ,KAAK,CAAC;CACxE,MAAM,QAAQ,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,UAAU,GAAG,MAAO,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAG;CACjG,MAAM,aAAa,MAAM,QAAQ,OAAO,UAAU,QAAQ,WAAW,MAAM,EAAE,EAAE;CAC/E,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,aAAa,sBAAsB,CAAC;CAC7E,MAAM,SAA4B,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,EAAE,CAAC;AAC9E,MAAK,MAAM,SAAS,MAAO,QAAO,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,MAAM;CAE3E,MAAM,YAAgC,EAAE;AACxC,MAAK,MAAM,SAAS,OACnB,KAAI,MAAM,SAAS,EAAG,WAAU,KAAK,MAAM,eAAe,SAAS,MAAM,CAAC;CAG3E,IAAI,QAAyB,EAAE;CAC/B,IAAI,aAAa;AACjB,MAAK,MAAM,QAAQ,MAAM,UAAU;EAClC,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,WAAW,MAAM;AAC/B,MAAI,MAAM,SAAS,KAAK,aAAa,QAAQ,uBAAuB;AACnE,aAAU,KAAK,MAAM,eAAe,WAAW,MAAM,CAAC;AACtD,WAAQ,EAAE;AACV,gBAAa;;AAEd,QAAM,KAAK,MAAM;AACjB,gBAAc;;AAEf,KAAI,MAAM,SAAS,EAAG,WAAU,KAAK,MAAM,eAAe,WAAW,MAAM,CAAC;AAE5E,QAAO;EACN,YAAY,MAAM,aAAa,UAAU,KAAK,aAAa,SAAS,OAAO,CAAC;EAC5E;EACA;;;;;;;;;;;AAYF,eAAsB,yBAAyB,IAAqC;CACnF,MAAM,QAAQ,MAAM,GAClB,WAAW,yBAAyB,CACpC,OAAO,WAAW,CAClB,MAAM,MAAM,KAAK,EAAE,CACnB,kBAAkB;AACpB,KAAI,CAAC,MAAO,OAAM,IAAI,MAAM,gCAAgC;CAC5D,MAAM,WAAW,OAAO,MAAM,SAAS;CASvC,MAAM,EAAE,YAAY,cAAc,MAAM,eACvC,WARuB,MAAM,GAC5B,WAAW,oBAAoB,CAC/B,OAAO;EAAC;EAAM;EAAU;EAAe;EAAQ;EAAa,CAAC,CAC7D,MAAM,WAAW,KAAK,EAAE,CACxB,QAAQ,eAAe,UAAU,MAAM,KAAK,CAAC,YAAY,CAAC,CAC1D,QAAQ,MAAM,MAAM,CACpB,SAAS,EAGJ,KAAK,SAAS;EAClB,IAAI,IAAI;EACR,QAAQ,IAAI;EACZ,aAAa,IAAI;EACjB,MAAM,OAAO,IAAI,KAAK;EACtB,WAAW,OAAO,IAAI,WAAW,KAAK;EACtC,EAAE,EACH,KACA,CACD;AAED,OAAM,gBAAgB,IAAI,OAAO,QAAQ;EACxC,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,UAAU,KAAK,aAAa,SAAS,OAAO,CAAC,CAAC;EAC1E,MAAM,yBAAS,IAAI,KAAqB;AACxC,OAAK,MAAM,SAAS,OAAO,SAAS,eAAe,EAAE;GACpD,MAAM,QAAQ,MAAM,IAClB,WAAW,6BAA6B,CACxC,OAAO;IAAC;IAAU;IAAQ;IAAU,CAAC,CACrC,MAAM,UAAU,MAAM,MAAM,CAC5B,SAAS;AACX,QAAK,MAAM,OAAO,MAAO,QAAO,IAAI,IAAI,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI,UAAU;;AAE/E,OAAK,MAAM,YAAY,WAAW;GACjC,MAAM,UAAU,GAAG,SAAS,KAAK,IAAI,SAAS;AAC9C,OAAI,OAAO,IAAI,SAAS,OAAO,KAAK,QAAS;AAC7C,UAAO,IAAI,SAAS,QAAQ,QAAQ;AAEpC,SAAM,IACJ,WAAW,6BAA6B,CACxC,OAAO,SAAS,CAChB,YAAY,aACZ,SAAS,OAAO,SAAS,CAAC,YAAY;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;IAAS,CAAC,CACzF,CACA,SAAS;;EAGZ,MAAM,QAAQ,UAAU,KAAK,UAAU,cAAc;GACpD;GACA;GACA,QAAQ,SAAS;GACjB,EAAE;AACH,OAAK,MAAM,SAAS,OAAO,OAAO,gBAAgB,CACjD,OAAM,IACJ,WAAW,wCAAwC,CACnD,OAAO,MAAM,CACb,YAAY,aACZ,SACE,QAAQ,CAAC,cAAc,WAAW,CAAC,CACnC,aAAa,QAAQ,EAAE,QAAQ,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAC9D,CACA,SAAS;AAEZ,QAAM,IACJ,WAAW,wCAAwC,CACnD,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,MAAM,MAAM,OAAO,CACrC,SAAS;EAEX,MAAM,YAAY,MAAM,IACtB,YAAY,yBAAyB,CACrC,IAAI;GAAE;GAAY,qBAAqB;GAAU,CAAC,CAClD,MAAM,MAAM,KAAK,EAAE,CACnB,MAAM,uBAAuB,MAAM,SAAS,CAC5C,kBAAkB;AACpB,MAAI,OAAO,UAAU,eAAe,KAAK,GAAI;AAG7C,QAAM,IACJ,WAAW,wCAAwC,CACnD,OAAO,OACP,GACC,cACA,MACA,GAAG,WAAW,yBAAyB,CAAC,OAAO,aAAa,CAAC,MAAM,MAAM,KAAK,EAAE,CAChF,CACD,CACA,SAAS;AACX,QAAM,IACJ,WAAW,6BAA6B,CACxC,OAAO,EAAE,QAAQ,KAAK,iBACtB,IACC,OACC,WAAW,wCAAwC,CACjD,OAAO,+CAA+C,CACtD,SACA,gDACA,KACA,oCACA,CACF,CACD,CACD,CACA,SAAS;GACV;;;;;;;AAQH,eAAsB,uBAAuB,IAAqC;AACjF,KAAI;AACH,QAAM,yBAAyB,GAAG;UAC1B,OAAO;AACf,UAAQ,MAAM,4DAA4D,MAAM;;AAEjF,0BAAyB;;AAG1B,SAAS,gBAAgB,OAAwC;AAChE,QACC,MAAM,QAAQ,MAAM,IACpB,MAAM,WAAW,KACjB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO;;AAItB,SAAS,aAAa,SAAyC;AAC9D,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,QAAQ;AAC3C,SAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,MAAM,gBAAgB,GAAG,SAAS;SAClE;AACP,SAAO;;;;;;;;AAST,eAAe,uBAAuB,IAAuD;CAC5F,MAAM,OAAO,MAAM,GACjB,WAAW,kCAAkC,CAC7C,SACA,iDACA,mBACA,mBACA,CACA,SAAS,0CAA0C,mBAAmB,cAAc,CACpF,OAAO;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,CACD,MAAM,YAAY,KAAK,EAAE,CACzB,QAAQ,iBAAiB,MAAM,CAC/B,SAAS;CAEX,MAAM,QAAQ,KAAK;AACnB,KAAI,CAAC,OAAO,WAAY,QAAO;AAC/B,KAAI,OAAO,MAAM,SAAS,GAAG,OAAO,MAAM,oBAAoB,CAAE,QAAO;CAEvE,MAAM,QAAwB,EAAE;CAChC,MAAM,WAA2B,EAAE;CACnC,MAAM,UAAoB,EAAE;CAC5B,MAAM,QAAQ,KAAK,QAAQ,QAAQ,IAAI,aAAa,KAAK;AACzD,MAAK,MAAM,CAAC,OAAO,SAAS,MAAM,SAAS,EAAE;AAC5C,MACC,OAAO,KAAK,SAAS,KAAK,SAC1B,CAAC,KAAK,UACN,KAAK,YAAY,QAChB,KAAK,SAAS,WAAW,KAAK,SAAS,UAExC,QAAO;AAER,MAAK,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,KAAK,UAAU,KAAM,KAAK,OAC/D,QAAO;EAER,MAAM,UAAU,aAAa,KAAK,QAAQ;AAC1C,MAAI,CAAC,QAAS,QAAO;EACrB,MAAM,SAAS,KAAK,SAAS,UAAU,QAAQ;AAC/C,OAAK,MAAM,CAAC,IAAI,QAAQ,aAAa,SAAS,QAC7C,QAAO,KAAK;GAAE;GAAI;GAAQ;GAAa;GAAM,CAAC;AAE/C,UAAQ,KAAK,KAAK,OAAO;;AAE1B,KAAK,MAAM,aAAa,QAAQ,KAAM,MAAM,WAAY,QAAO;AAE/D,QAAO;EAAE,SAAS,MAAM;EAAY;EAAO;EAAU;;AAGtD,eAAe,eAAe,IAAgD;AAE7E,QAAO,WADW,MAAM,IAAI,mBAAmB,GAAG,CAAC,gBAAgB,EAExD,KAAK,EAAE,IAAI,QAAQ,aAAa,MAAM,iBAAiB;EAChE;EACA;EACA;EACA;EACA;EACA,EAAE,EACH,KACA;;AAOF,MAAM,mBAAmB,OAAO,IAAI,kCAAkC;AACtE,MAAM,IAAI;AACV,MAAM,cAEJ,EAAE,4BACI;CACN,MAAM,QAAqB,EAAE,cAAc,GAAG;AAC9C,GAAE,oBAAoB;AACtB,QAAO;IACJ;;;;;AAML,eAAe,wBAAwB,IAAqC;CAC3E,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,YAAY,MAAM;CACxB,MAAM,QAAQ,MAAM,GAClB,YAAY,yBAAyB,CACrC,IAAI,EAAE,mBAAmB,WAAW,CAAC,CACrC,MAAM,MAAM,KAAK,EAAE,CACnB,MAAM,qBAAqB,KAAK,IAAI,CACpC,kBAAkB;AACpB,KAAI,OAAO,MAAM,eAAe,KAAK,GAAI;AACzC,KAAI;AACH,QAAM,yBAAyB,GAAG;WACzB;AACT,QAAM,GACJ,YAAY,yBAAyB,CACrC,IAAI,EAAE,mBAAmB,GAAG,CAAC,CAC7B,MAAM,MAAM,KAAK,EAAE,CACnB,MAAM,qBAAqB,KAAK,UAAU,CAC1C,SAAS;;;AAIb,SAAS,uBAAuB,IAA4B;CAC3D,MAAM,MAAM,KAAK,KAAK;AACtB,KAAI,YAAY,eAAe,IAAK;CACpC,MAAM,eAAe,MAAM;AAC3B,aAAY,eAAe;AAC3B,OAAM,YAAY;AACjB,MAAI;AACH,SAAM,wBAAwB,GAAG;WACzB,OAAO;AACf,WAAQ,MAAM,2DAA2D,MAAM;YACtE;AACT,OAAI,YAAY,iBAAiB,aAAc,aAAY,eAAe;;GAE1E;;;;;;;AAQH,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,OAAO;GACZ,IAAI;AACJ,OAAI;AACH,gBAAY,MAAM,uBAAuB,GAAG;YACpC,OAAO;AACf,QAAI,oBAAoB,MAAM,CAAE,QAAO,eAAe,GAAG;AACzD,UAAM;;AAEP,OAAI,UAAW,QAAO;AACtB,0BAAuB,GAAG;AAC1B,UAAO,eAAe,GAAG;;EAE1B,MAAM,UAAU,SAAS;GACxB,MAAM,QAAQ,MAAM,GAClB,WAAW,yBAAyB,CACpC,OAAO;IAAC;IAAY;IAAc;IAAsB,CAAC,CACzD,MAAM,MAAM,KAAK,EAAE,CACnB,kBAAkB;AACpB,UACC,OAAO,eAAe,WAAW,OAAO,MAAM,SAAS,IAAI,OAAO,MAAM,oBAAoB;;EAG9F"}

package/dist/astro/image-endpoint.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"image-endpoint.d.mts","names":[],"sources":["../../src/astro/image-endpoint.ts"],"mappings":";;;cAsBa,SAAA;AAAA,cAsBA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"image-endpoint.d.mts","names":[],"sources":["../../src/astro/image-endpoint.ts"],"mappings":";;;cAyBa,SAAA;AAAA,cA+CA,GAAA,EAAK,QAAA"}

package/dist/astro/image-endpoint.mjs

@@ -1,4 +1,4 @@
-import { MUTABLE_MEDIA_CACHE_CONTROL, matchInternalMediaKey, originalMediaHeaders } from "../media/image-endpoint.mjs";
+import { MUTABLE_MEDIA_CACHE_CONTROL, getTransformFingerprint, isNotModified, matchInternalMediaKey, originalMediaHeaders, validatorHeaders } from "../media/image-endpoint.mjs";
 import { GET as GET$1 } from "astro/assets/endpoint/generic";
 import { getConfiguredImageService, imageConfig } from "astro:assets";
 
@@ -15,10 +15,21 @@ const FORMAT_MIME = {
 function isNotFound(error) {
 	return error instanceof Error && (error.message.includes("not found") || error.message.includes("NOT_FOUND"));
 }
-function streamOriginal(body, contentType) {
+function streamOriginal(body, contentType, size, lastModified) {
 	return new Response(body, {
 		status: 200,
-		headers: originalMediaHeaders(contentType)
+		headers: originalMediaHeaders(contentType, size, lastModified)
+	});
+}
+function notModifiedResponse(contentType, size, lastModified, suffix) {
+	return new Response(null, {
+		status: 304,
+		headers: {
+			"Content-Type": contentType,
+			"Cache-Control": MUTABLE_MEDIA_CACHE_CONTROL,
+			"X-Content-Type-Options": "nosniff",
+			...validatorHeaders(size, lastModified, suffix)
+		}
 	});
 }
 const GET = async (ctx) => {
@@ -30,9 +41,17 @@ const GET = async (ctx) => {
 	if (!("transform" in service)) return GET$1(ctx);
 	try {
 		const source = await storage.download(key);
-		if (!source.contentType.startsWith("image/")) return streamOriginal(source.body, source.contentType);
+		if (!source.contentType.startsWith("image/")) {
+			if (isNotModified(ctx.request, source.size, source.lastModified)) return notModifiedResponse(source.contentType, source.size, source.lastModified);
+			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
+		}
 		const transform = await service.parseURL(url, imageConfig);
-		if (!transform) return streamOriginal(source.body, source.contentType);
+		if (!transform) {
+			if (isNotModified(ctx.request, source.size, source.lastModified)) return notModifiedResponse(source.contentType, source.size, source.lastModified);
+			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
+		}
+		const fingerprint = getTransformFingerprint(url.searchParams);
+		if (isNotModified(ctx.request, source.size, source.lastModified, fingerprint)) return notModifiedResponse(source.contentType, source.size, source.lastModified, fingerprint);
 		const inputBuffer = new Uint8Array(await new Response(source.body).arrayBuffer());
 		const { data, format } = await service.transform(inputBuffer, transform, imageConfig);
 		return new Response(data, {
@@ -40,7 +59,8 @@ const GET = async (ctx) => {
 			headers: {
 				"Content-Type": FORMAT_MIME[format] ?? source.contentType,
 				"Cache-Control": MUTABLE_MEDIA_CACHE_CONTROL,
-				"X-Content-Type-Options": "nosniff"
+				"X-Content-Type-Options": "nosniff",
+				...validatorHeaders(source.size, source.lastModified, fingerprint)
 			}
 		});
 	} catch (error) {

package/dist/astro/image-endpoint.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"image-endpoint.mjs","names":["genericGET"],"sources":["../../src/astro/image-endpoint.ts"],"sourcesContent":["/**\n * Node image endpoint -- the `image.endpoint` EmDash installs on non-Cloudflare\n * platforms whose image service is local (sharp).\n *\n * It wraps Astro's generic endpoint: for an EmDash media URL it loads the source\n * bytes straight from the storage adapter (no HTTP, so it works behind any auth\n * gate) and runs the configured image service's `transform`; every other image\n * is delegated to the stock endpoint unchanged.\n */\n\nimport type { APIRoute } from \"astro\";\n// @ts-ignore - astro/assets internal endpoint, resolved by the consumer's Astro build\nimport { GET as genericGET } from \"astro/assets/endpoint/generic\";\n// @ts-ignore - astro:assets is resolved by the consumer's Astro build\nimport { getConfiguredImageService, imageConfig } from \"astro:assets\";\n\nimport {\n\tmatchInternalMediaKey,\n\tMUTABLE_MEDIA_CACHE_CONTROL,\n\toriginalMediaHeaders,\n} from \"../media/image-endpoint.js\";\n\nexport const prerender = false;\n\nconst FORMAT_MIME: Record<string, string> = {\n\twebp: \"image/webp\",\n\tavif: \"image/avif\",\n\tpng: \"image/png\",\n\tjpeg: \"image/jpeg\",\n\tjpg: \"image/jpeg\",\n\tgif: \"image/gif\",\n};\n\nfunction isNotFound(error: unknown): boolean {\n\treturn (\n\t\terror instanceof Error &&\n\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t);\n}\n\nfunction streamOriginal(body: ReadableStream<Uint8Array>, contentType: string): Response {\n\treturn new Response(body, { status: 200, headers: originalMediaHeaders(contentType) });\n}\n\nexport const GET: APIRoute = async (ctx) => {\n\tconst url = new URL(ctx.request.url);\n\tconst key = matchInternalMediaKey(url.searchParams.get(\"href\"));\n\tconst storage = ctx.locals.emdash?.storage;\n\n\t// Not EmDash media, or storage unavailable: let the stock endpoint handle it\n\t// (bundled assets, allowed remote, `publicUrl` media).\n\tif (!key || !storage) return genericGET(ctx);\n\n\tconst service = await getConfiguredImageService();\n\tif (!(\"transform\" in service)) return genericGET(ctx);\n\n\ttry {\n\t\tconst source = await storage.download(key);\n\n\t\t// Only raster images are transformable; serve anything else unchanged.\n\t\tif (!source.contentType.startsWith(\"image/\")) {\n\t\t\treturn streamOriginal(source.body, source.contentType);\n\t\t}\n\n\t\tconst transform = await service.parseURL(url, imageConfig);\n\t\tif (!transform) return streamOriginal(source.body, source.contentType);\n\n\t\tconst inputBuffer = new Uint8Array(await new Response(source.body).arrayBuffer());\n\t\tconst { data, format } = await service.transform(inputBuffer, transform, imageConfig);\n\n\t\treturn new Response(data, {\n\t\t\tstatus: 200,\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": FORMAT_MIME[format] ?? source.contentType,\n\t\t\t\t\"Cache-Control\": MUTABLE_MEDIA_CACHE_CONTROL,\n\t\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (isNotFound(error)) return new Response(\"Not Found\", { status: 404 });\n\t\tconsole.error(\"[emdash] image transform failed:\", error);\n\t\treturn new Response(\"Internal Server Error\", { status: 500 });\n\t}\n};\n"],"mappings":";;;;;AAsBA,MAAa,YAAY;AAEzB,MAAM,cAAsC;CAC3C,MAAM;CACN,MAAM;CACN,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL;AAED,SAAS,WAAW,OAAyB;AAC5C,QACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY;;AAI7E,SAAS,eAAe,MAAkC,aAA+B;AACxF,QAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK,SAAS,qBAAqB,YAAY;EAAE,CAAC;;AAGvF,MAAa,MAAgB,OAAO,QAAQ;CAC3C,MAAM,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI;CACpC,MAAM,MAAM,sBAAsB,IAAI,aAAa,IAAI,OAAO,CAAC;CAC/D,MAAM,UAAU,IAAI,OAAO,QAAQ;AAInC,KAAI,CAAC,OAAO,CAAC,QAAS,QAAOA,MAAW,IAAI;CAE5C,MAAM,UAAU,MAAM,2BAA2B;AACjD,KAAI,EAAE,eAAe,SAAU,QAAOA,MAAW,IAAI;AAErD,KAAI;EACH,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI;AAG1C,MAAI,CAAC,OAAO,YAAY,WAAW,SAAS,CAC3C,QAAO,eAAe,OAAO,MAAM,OAAO,YAAY;EAGvD,MAAM,YAAY,MAAM,QAAQ,SAAS,KAAK,YAAY;AAC1D,MAAI,CAAC,UAAW,QAAO,eAAe,OAAO,MAAM,OAAO,YAAY;EAEtE,MAAM,cAAc,IAAI,WAAW,MAAM,IAAI,SAAS,OAAO,KAAK,CAAC,aAAa,CAAC;EACjF,MAAM,EAAE,MAAM,WAAW,MAAM,QAAQ,UAAU,aAAa,WAAW,YAAY;AAErF,SAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS;IACR,gBAAgB,YAAY,WAAW,OAAO;IAC9C,iBAAiB;IACjB,0BAA0B;IAC1B;GACD,CAAC;UACM,OAAO;AACf,MAAI,WAAW,MAAM,CAAE,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AACxE,UAAQ,MAAM,oCAAoC,MAAM;AACxD,SAAO,IAAI,SAAS,yBAAyB,EAAE,QAAQ,KAAK,CAAC"}
+{"version":3,"file":"image-endpoint.mjs","names":["genericGET"],"sources":["../../src/astro/image-endpoint.ts"],"sourcesContent":["/**\n * Node image endpoint -- the `image.endpoint` EmDash installs on non-Cloudflare\n * platforms whose image service is local (sharp).\n *\n * It wraps Astro's generic endpoint: for an EmDash media URL it loads the source\n * bytes straight from the storage adapter (no HTTP, so it works behind any auth\n * gate) and runs the configured image service's `transform`; every other image\n * is delegated to the stock endpoint unchanged.\n */\n\nimport type { APIRoute } from \"astro\";\n// @ts-ignore - astro/assets internal endpoint, resolved by the consumer's Astro build\nimport { GET as genericGET } from \"astro/assets/endpoint/generic\";\n// @ts-ignore - astro:assets is resolved by the consumer's Astro build\nimport { getConfiguredImageService, imageConfig } from \"astro:assets\";\n\nimport {\n\tgetTransformFingerprint,\n\tmatchInternalMediaKey,\n\tMUTABLE_MEDIA_CACHE_CONTROL,\n\toriginalMediaHeaders,\n\tvalidatorHeaders,\n\tisNotModified,\n} from \"../media/image-endpoint.js\";\n\nexport const prerender = false;\n\nconst FORMAT_MIME: Record<string, string> = {\n\twebp: \"image/webp\",\n\tavif: \"image/avif\",\n\tpng: \"image/png\",\n\tjpeg: \"image/jpeg\",\n\tjpg: \"image/jpeg\",\n\tgif: \"image/gif\",\n};\n\nfunction isNotFound(error: unknown): boolean {\n\treturn (\n\t\terror instanceof Error &&\n\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t);\n}\n\nfunction streamOriginal(\n\tbody: ReadableStream<Uint8Array>,\n\tcontentType: string,\n\tsize: number,\n\tlastModified?: Date,\n): Response {\n\treturn new Response(body, {\n\t\tstatus: 200,\n\t\theaders: originalMediaHeaders(contentType, size, lastModified),\n\t});\n}\n\nfunction notModifiedResponse(\n\tcontentType: string,\n\tsize: number,\n\tlastModified?: Date,\n\tsuffix?: string,\n): Response {\n\treturn new Response(null, {\n\t\tstatus: 304,\n\t\theaders: {\n\t\t\t\"Content-Type\": contentType,\n\t\t\t\"Cache-Control\": MUTABLE_MEDIA_CACHE_CONTROL,\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t...validatorHeaders(size, lastModified, suffix),\n\t\t},\n\t});\n}\n\nexport const GET: APIRoute = async (ctx) => {\n\tconst url = new URL(ctx.request.url);\n\tconst key = matchInternalMediaKey(url.searchParams.get(\"href\"));\n\tconst storage = ctx.locals.emdash?.storage;\n\n\t// Not EmDash media, or storage unavailable: let the stock endpoint handle it\n\t// (bundled assets, allowed remote, `publicUrl` media).\n\tif (!key || !storage) return genericGET(ctx);\n\n\tconst service = await getConfiguredImageService();\n\tif (!(\"transform\" in service)) return genericGET(ctx);\n\n\ttry {\n\t\tconst source = await storage.download(key);\n\n\t\t// Only raster images are transformable; serve anything else unchanged.\n\t\tif (!source.contentType.startsWith(\"image/\")) {\n\t\t\tif (isNotModified(ctx.request, source.size, source.lastModified)) {\n\t\t\t\treturn notModifiedResponse(source.contentType, source.size, source.lastModified);\n\t\t\t}\n\t\t\treturn streamOriginal(source.body, source.contentType, source.size, source.lastModified);\n\t\t}\n\n\t\tconst transform = await service.parseURL(url, imageConfig);\n\t\tif (!transform) {\n\t\t\tif (isNotModified(ctx.request, source.size, source.lastModified)) {\n\t\t\t\treturn notModifiedResponse(source.contentType, source.size, source.lastModified);\n\t\t\t}\n\t\t\treturn streamOriginal(source.body, source.contentType, source.size, source.lastModified);\n\t\t}\n\n\t\tconst fingerprint = getTransformFingerprint(url.searchParams);\n\t\tif (isNotModified(ctx.request, source.size, source.lastModified, fingerprint)) {\n\t\t\treturn notModifiedResponse(source.contentType, source.size, source.lastModified, fingerprint);\n\t\t}\n\n\t\tconst inputBuffer = new Uint8Array(await new Response(source.body).arrayBuffer());\n\t\tconst { data, format } = await service.transform(inputBuffer, transform, imageConfig);\n\n\t\treturn new Response(data, {\n\t\t\tstatus: 200,\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": FORMAT_MIME[format] ?? source.contentType,\n\t\t\t\t\"Cache-Control\": MUTABLE_MEDIA_CACHE_CONTROL,\n\t\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t\t...validatorHeaders(source.size, source.lastModified, fingerprint),\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (isNotFound(error)) return new Response(\"Not Found\", { status: 404 });\n\t\tconsole.error(\"[emdash] image transform failed:\", error);\n\t\treturn new Response(\"Internal Server Error\", { status: 500 });\n\t}\n};\n"],"mappings":";;;;;AAyBA,MAAa,YAAY;AAEzB,MAAM,cAAsC;CAC3C,MAAM;CACN,MAAM;CACN,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL;AAED,SAAS,WAAW,OAAyB;AAC5C,QACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY;;AAI7E,SAAS,eACR,MACA,aACA,MACA,cACW;AACX,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ;EACR,SAAS,qBAAqB,aAAa,MAAM,aAAa;EAC9D,CAAC;;AAGH,SAAS,oBACR,aACA,MACA,cACA,QACW;AACX,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ;EACR,SAAS;GACR,gBAAgB;GAChB,iBAAiB;GACjB,0BAA0B;GAC1B,GAAG,iBAAiB,MAAM,cAAc,OAAO;GAC/C;EACD,CAAC;;AAGH,MAAa,MAAgB,OAAO,QAAQ;CAC3C,MAAM,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI;CACpC,MAAM,MAAM,sBAAsB,IAAI,aAAa,IAAI,OAAO,CAAC;CAC/D,MAAM,UAAU,IAAI,OAAO,QAAQ;AAInC,KAAI,CAAC,OAAO,CAAC,QAAS,QAAOA,MAAW,IAAI;CAE5C,MAAM,UAAU,MAAM,2BAA2B;AACjD,KAAI,EAAE,eAAe,SAAU,QAAOA,MAAW,IAAI;AAErD,KAAI;EACH,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI;AAG1C,MAAI,CAAC,OAAO,YAAY,WAAW,SAAS,EAAE;AAC7C,OAAI,cAAc,IAAI,SAAS,OAAO,MAAM,OAAO,aAAa,CAC/D,QAAO,oBAAoB,OAAO,aAAa,OAAO,MAAM,OAAO,aAAa;AAEjF,UAAO,eAAe,OAAO,MAAM,OAAO,aAAa,OAAO,MAAM,OAAO,aAAa;;EAGzF,MAAM,YAAY,MAAM,QAAQ,SAAS,KAAK,YAAY;AAC1D,MAAI,CAAC,WAAW;AACf,OAAI,cAAc,IAAI,SAAS,OAAO,MAAM,OAAO,aAAa,CAC/D,QAAO,oBAAoB,OAAO,aAAa,OAAO,MAAM,OAAO,aAAa;AAEjF,UAAO,eAAe,OAAO,MAAM,OAAO,aAAa,OAAO,MAAM,OAAO,aAAa;;EAGzF,MAAM,cAAc,wBAAwB,IAAI,aAAa;AAC7D,MAAI,cAAc,IAAI,SAAS,OAAO,MAAM,OAAO,cAAc,YAAY,CAC5E,QAAO,oBAAoB,OAAO,aAAa,OAAO,MAAM,OAAO,cAAc,YAAY;EAG9F,MAAM,cAAc,IAAI,WAAW,MAAM,IAAI,SAAS,OAAO,KAAK,CAAC,aAAa,CAAC;EACjF,MAAM,EAAE,MAAM,WAAW,MAAM,QAAQ,UAAU,aAAa,WAAW,YAAY;AAErF,SAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS;IACR,gBAAgB,YAAY,WAAW,OAAO;IAC9C,iBAAiB;IACjB,0BAA0B;IAC1B,GAAG,iBAAiB,OAAO,MAAM,OAAO,cAAc,YAAY;IAClE;GACD,CAAC;UACM,OAAO;AACf,MAAI,WAAW,MAAM,CAAE,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AACxE,UAAQ,MAAM,oCAAoC,MAAM;AACxD,SAAO,IAAI,SAAS,yBAAyB,EAAE,QAAQ,KAAK,CAAC"}

package/dist/astro/index.d.mts

@@ -1,17 +1,17 @@
-import { i as ContentItem } from "../types-LtS0SM4F.mjs";
-import "../parse-QVS0t5oR.mjs";
-import "../types-ifgOkcBa.mjs";
-import { Cn as ResolvedPlugin } from "../types-BT1p3uyb.mjs";
-import "../options-B41aLm1I.mjs";
-import "../entry-lock-esmMbgI9.mjs";
-import { Fr as S3StorageConfig, Ir as StorageDescriptor, Nr as getStoredConfig, Pr as LocalStorageConfig, jr as EmDashConfig } from "../config-B6BDSsz2.mjs";
-import "../runner-J3Cj6DGk.mjs";
-import { $ as MediaItem } from "../storage-query-C7iy6eUb.mjs";
-import "../index-B4sIdCAT.mjs";
-import { i as ObjectCacheRuntimeConfig, r as ObjectCacheDescriptor } from "../types-DOfVMPoo.mjs";
-import "../types-CV5xszpF.mjs";
-import "../hreflang-egumj6WF.mjs";
-import "../validate-CfQ9_YlD.mjs";
+import { i as ContentItem } from "../types-Ff85fTzU.mjs";
+import "../parse-BOGhrwSq.mjs";
+import "../types-UKr5Sf4y.mjs";
+import { Cn as ResolvedPlugin } from "../types-C4P7F1Vq.mjs";
+import "../options-BR9XZl7h.mjs";
+import "../entry-lock-BAAlKYrz.mjs";
+import { Fr as LocalStorageConfig, Ir as S3StorageConfig, Lr as StorageDescriptor, Mr as EmDashConfig, Pr as getStoredConfig } from "../config-C4-UxIk7.mjs";
+import "../runner-DkeafPBA.mjs";
+import { $ as MediaItem } from "../storage-query-BOBmeDMD.mjs";
+import "../index-DYsn97dY.mjs";
+import { i as ObjectCacheRuntimeConfig, r as ObjectCacheDescriptor } from "../types-DcRJp0vS.mjs";
+import "../types-Bq9Wohd7.mjs";
+import "../hreflang-BsYo4x_M.mjs";
+import "../validate-Dfv0DpZi.mjs";
 import { EmDashHandlers, EmDashManifest, ManifestCollection } from "./types.mjs";
 import { AstroIntegration } from "astro";
 

package/dist/astro/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/astro/storage/adapters.ts","../../src/astro/object-cache/adapters.ts","../../src/astro/integration/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkFA;;;;;;;;;;;;AC3DA;;;;;AAqBA;;;;;;;;;;iBDiBgB,EAAA,CAAG,MAAA,GAAQ,OAAA,CAAQ,eAAA,IAAwB,iBAAA;;AEsV3D;;;;;;;;;;;;;iBFjUgB,KAAA,CAAM,MAAA,EAAQ,kBAAA,GAAqB,iBAAA;;;;UC3DlC,kBAAA,SAA2B,wBAAA;EDsCjB;;;;ECjC1B,UAAA;AAAA;;;;;ADsDD;;;;;;;;;iBCtCgB,WAAA,CAAY,OAAA,GAAS,kBAAA,GAA0B,qBAAA;;;;;;iBCuW/C,MAAA,CAAO,MAAA,GAAQ,YAAA,GAAoB,gBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/astro/storage/adapters.ts","../../src/astro/object-cache/adapters.ts","../../src/astro/integration/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkFA;;;;;;;;;;;;AC3DA;;;;;AAqBA;;;;;;;;;;iBDiBgB,EAAA,CAAG,MAAA,GAAQ,OAAA,CAAQ,eAAA,IAAwB,iBAAA;;AEwW3D;;;;;;;;;;;;;iBFnVgB,KAAA,CAAM,MAAA,EAAQ,kBAAA,GAAqB,iBAAA;;;;UC3DlC,kBAAA,SAA2B,wBAAA;EDsCjB;;;;ECjC1B,UAAA;AAAA;;;;;ADsDD;;;;;;;;;iBCtCgB,WAAA,CAAY,OAAA,GAAS,kBAAA,GAA0B,qBAAA;;;;;;iBCyX/C,MAAA,CAAO,MAAA,GAAQ,YAAA,GAAoB,gBAAA"}