emdash 1.2.0 → 1.3.0

package/dist/config--wamYxBW.d.mts

@@ -1,39 +0,0 @@
-//#region src/i18n/config.d.ts
-/**
- * EmDash i18n Configuration
- *
- * Reads locale configuration from the virtual module (sourced from Astro config).
- * Initialized during runtime startup, then available via getI18nConfig().
- */
-interface I18nConfig {
-  defaultLocale: string;
-  locales: string[];
-  fallback?: Record<string, string>;
-  prefixDefaultLocale?: boolean;
-}
-/**
- * Initialize i18n config from virtual module data.
- * Called during runtime initialization.
- */
-declare function setI18nConfig(config: I18nConfig | null): void;
-/**
- * Get the current i18n config.
- * Returns null if i18n is not configured.
- */
-declare function getI18nConfig(): I18nConfig | null;
-/** Resolve the locale for a new content row. */
-declare function resolveContentCreateLocale(locale: unknown, config?: I18nConfig | null): string;
-/**
- * Check if i18n is enabled.
- * Returns true when multiple locales are configured.
- */
-declare function isI18nEnabled(): boolean;
-/**
- * Resolve fallback locale chain for a given locale.
- * Returns array of locales to try, from most preferred to least.
- * Always ends with defaultLocale.
- */
-declare function getFallbackChain(locale: string): string[];
-//#endregion
-export { resolveContentCreateLocale as a, isI18nEnabled as i, getFallbackChain as n, setI18nConfig as o, getI18nConfig as r, I18nConfig as t };
-//# sourceMappingURL=config--wamYxBW.d.mts.map

package/dist/config--wamYxBW.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config--wamYxBW.d.mts","names":[],"sources":["../src/i18n/config.ts"],"mappings":";;AAOA;;;;;UAAiB,UAAA;EAChB,aAAA;EACA,OAAA;EACA,QAAA,GAAW,MAAA;EACX,mBAAA;AAAA;;;;;iBAee,aAAA,CAAc,MAAA,EAAQ,UAAA;;;;;iBAQtB,aAAA,CAAA,GAAiB,UAAA;;iBAmBjB,0BAAA,CACf,MAAA,WACA,MAAA,GAAQ,UAAA;;;AA0BT;;iBAAgB,aAAA,CAAA;;;AAUhB;;;iBAAgB,gBAAA,CAAiB,MAAA"}

package/dist/config-Bo4eOOdV.mjs

@@ -1,228 +0,0 @@
-import { isDid } from "@atcute/lexicons/syntax";
-
-//#region src/registry/config.ts
-/**
-* Helpers for normalizing the registry integration option into the shape
-* exposed on the admin manifest.
-*
-* The integration option accepts a human-friendly duration string for
-* `policy.minimumReleaseAge` (`"48h"`, `"7d"`); the manifest exposes
-* seconds so the browser doesn't need a duration parser.
-*/
-const DEFAULT_REGISTRY_AGGREGATOR_URL = "https://registry.emdashcms.com";
-function resolveRegistryConfigForSandbox(options) {
-	if (options.registry === false) return void 0;
-	if (options.registry !== void 0) return options.registry;
-	if (options.sandboxRunner && options.sandboxEnabled !== false) return DEFAULT_REGISTRY_AGGREGATOR_URL;
-}
-function getRegistryConfigInput(registry) {
-	return registry === false ? void 0 : registry;
-}
-var RegistryConfigurationError = class extends Error {
-	constructor(code, field, message, options) {
-		super(`EmDash registry configuration error in ${field}: ${message}`, options);
-		this.code = code;
-		this.field = field;
-		this.name = "RegistryConfigurationError";
-	}
-};
-function registryField(suffix) {
-	return `registry.${suffix}`;
-}
-/**
-* Canonicalize a capabilities list for set-style comparison.
-*
-* Capabilities (the legacy declared-access shape used by the current
-* sandbox enforcer) are conceptually a *set*: order, duplicates, and
-* non-string entries don't carry meaning. The install handler's drift
-* check compares the admin's acknowledged set against the bundle
-* manifest's set; both sides pass through this canonicalizer first so
-* an aggregator-supplied array with unstable order or junk entries
-* can't cause a spurious drift rejection.
-*
-* Filters non-strings, deduplicates, and sorts lexically. Named to
-* avoid shadowing `@emdash-cms/plugin-types`'s existing
-* `normalizeCapabilities` (which dedupes + applies the deprecated →
-* current alias map but does not filter junk or sort).
-*
-* Exported so the same shape is produced by the browser before sending
-* the `acknowledgedDeclaredAccess` payload and by the server before
-* comparing against the bundle.
-*/
-function canonicalCapabilitiesForDriftCheck(value) {
-	if (!Array.isArray(value)) return [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of value) if (typeof entry === "string" && entry.length > 0) seen.add(entry);
-	return [...seen].toSorted();
-}
-/**
-* Returns whether a `(publisher_did, slug)` pair is on the
-* minimum-release-age exemption list. Exported so the same matcher is
-* used by the browser policy filter and the server-side install
-* enforcement.
-*
-* Matching is DID-only. Handles are aggregator-supplied envelope data
-* (mutable, controlled by an attacker who compromises the aggregator)
-* and cannot be used as a trust input -- a compromised aggregator
-* could claim any handle for any package and bypass the holdback. DIDs
-* are part of the AT URI of the package record and are independently
-* resolvable, so even a compromised aggregator can't lie about the
-* publisher DID without also breaking checksum verification downstream.
-*
-* Entries from config are already lowercased at manifest-build time.
-* Runtime values are lowercased here at compare time.
-*/
-function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
-	if (!exclude || exclude.length === 0) return false;
-	const didLower = publisherDid.toLowerCase();
-	const fullDid = `${didLower}/${slug.toLowerCase()}`;
-	for (const entry of exclude) {
-		if (entry === didLower) return true;
-		if (entry === fullDid) return true;
-	}
-	return false;
-}
-const DURATION_PATTERN = /^(\d+)(s|m|h|d|w)$/;
-/** Trailing slashes on the aggregator URL, stripped during normalization. */
-const TRAILING_SLASHES = /\/+$/;
-/** Trailing dot on a hostname, stripped before URL host comparisons. */
-const TRAILING_DOT = /\.$/;
-const REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
-/**
-* Parse a duration string or raw second count into a non-negative
-* integer count of seconds. Throws on unrecognised input so config
-* mistakes fail at startup rather than silently disabling the policy.
-*/
-function parseDurationSeconds(duration) {
-	if (typeof duration === "number") {
-		if (!Number.isFinite(duration) || duration < 0) throw new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);
-		return Math.floor(duration);
-	}
-	const match = duration.match(DURATION_PATTERN);
-	if (!match) throw new Error(`Invalid duration format: "${duration}". Use a duration string like "48h", "7d", "30m", or a number of seconds.`);
-	const value = parseInt(match[1], 10);
-	const unit = match[2];
-	switch (unit) {
-		case "s": return value;
-		case "m": return value * 60;
-		case "h": return value * 60 * 60;
-		case "d": return value * 24 * 60 * 60;
-		case "w": return value * 7 * 24 * 60 * 60;
-		default: throw new Error(`Unknown duration unit: ${unit}`);
-	}
-}
-/**
-* Validate that `aggregatorUrl` is a safe outbound target for the
-* registry's XRPC calls. Same posture as artifact downloads: HTTPS
-* required in production; `http://localhost` allowed only in dev.
-*
-* The aggregator's responses are the trust source for release records,
-* checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST
-* verification lands). Allowing plain HTTP here would let a network
-* attacker swap a release record and point the artifact URL at their
-* own HTTPS bundle, defeating the checksum trust chain because the
-* attacker controls the unsigned transport that supplied the checksum.
-*/
-function validateAggregatorUrl(aggregatorUrl, options = {}) {
-	let parsed;
-	try {
-		parsed = new URL(aggregatorUrl);
-	} catch (cause) {
-		throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_INVALID", registryField("aggregatorUrl"), "must be a valid URL", { cause });
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTP or HTTPS");
-	if (parsed.username || parsed.password) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must not contain embedded credentials");
-	const rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, "");
-	const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
-	const isLocalhost = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1" || hostname.startsWith("::ffff:127.") || hostname.startsWith("::ffff:7f00:");
-	if (!(options.allowLocalhost ?? import.meta.env.DEV)) {
-		if (parsed.protocol === "http:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTPS outside development");
-		if (isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must not point at localhost outside development");
-	} else if (parsed.protocol === "http:" && !isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTPS unless it points at localhost in development");
-	return parsed;
-}
-/**
-* Expand the `RegistryConfigInput` shorthand into the full
-* `RegistryConfig` object shape.
-*
-* Users can pass a bare aggregator URL string for the common case
-* (`registry: "https://registry.emdashcms.com"`); the
-* normalizer handles either form transparently.
-*
-* Returns `undefined` for `undefined` input so callers can chain with
-* optional chaining.
-*/
-function coerceRegistryConfig(input) {
-	if (input === void 0) return void 0;
-	if (typeof input === "string") return { aggregatorUrl: input };
-	return input;
-}
-/**
-* Normalize the user-supplied `RegistryConfigInput` into the shape that
-* ships to the admin browser via the manifest endpoint.
-*
-* Accepts either the shorthand string form
-* (`"https://registry.emdashcms.com"`) or the full `RegistryConfig`
-* object. Returns `null` when `input` is undefined so callers can
-* spread the result directly into the manifest object.
-*
-* Throws a field-specific configuration error if the aggregator URL is
-* malformed or forbidden, or a registry policy value cannot be normalized.
-* The Astro integration uses this to fail during config loading. Runtime
-* manifest generation uses {@link resolveManifestRegistryConfig} to expose
-* recognized failures without exposing the configured value.
-*/
-function normalizeRegistryConfig(input, options = {}) {
-	const config = coerceRegistryConfig(input);
-	if (!config) return null;
-	const aggregatorUrl = typeof config.aggregatorUrl === "string" ? config.aggregatorUrl.trim() : void 0;
-	if (!aggregatorUrl) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_REQUIRED", registryField("aggregatorUrl"), "is required when the registry is configured");
-	validateAggregatorUrl(aggregatorUrl, options);
-	const out = { aggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, "") };
-	if (config.acceptLabelers) out.acceptLabelers = config.acceptLabelers;
-	const policy = {};
-	let hasPolicy = false;
-	if (config.policy?.minimumReleaseAge !== void 0) {
-		try {
-			policy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);
-		} catch (cause) {
-			throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_INVALID", registryField("policy.minimumReleaseAge"), "must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds", { cause });
-		}
-		hasPolicy = true;
-	}
-	if (config.policy?.minimumReleaseAgeExclude !== void 0) {
-		if (!Array.isArray(config.policy.minimumReleaseAgeExclude)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "must be an array of DIDs or <did>/<slug> entries");
-		const list = config.policy.minimumReleaseAgeExclude.map((entry) => {
-			if (typeof entry !== "string") throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
-			const trimmed = entry.trim();
-			if (!trimmed) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "entries cannot be empty");
-			const lower = trimmed.toLowerCase();
-			const [did, slug, ...extra] = lower.split("/");
-			if (!did || !isDid(did) || extra.length > 0 || slug !== void 0 && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
-			return lower;
-		});
-		if (list.length > 0) {
-			policy.minimumReleaseAgeExclude = list;
-			hasPolicy = true;
-		}
-	}
-	if (hasPolicy) out.policy = policy;
-	return out;
-}
-/** Normalize registry config without allowing a known config error to hide the admin. */
-function resolveManifestRegistryConfig(input, options = {}) {
-	try {
-		const registry = normalizeRegistryConfig(input, options);
-		return registry ? { registry } : {};
-	} catch (error) {
-		if (!(error instanceof RegistryConfigurationError)) throw error;
-		return { error: {
-			code: error.code,
-			field: error.field
-		} };
-	}
-}
-
-//#endregion
-export { parseDurationSeconds as a, resolveRegistryConfigForSandbox as c, normalizeRegistryConfig as i, validateAggregatorUrl as l, coerceRegistryConfig as n, releaseExemptFromMinimumAge as o, getRegistryConfigInput as r, resolveManifestRegistryConfig as s, canonicalCapabilitiesForDriftCheck as t };
-//# sourceMappingURL=config-Bo4eOOdV.mjs.map

package/dist/config-Bo4eOOdV.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-Bo4eOOdV.mjs","names":[],"sources":["../src/registry/config.ts"],"sourcesContent":["/**\n * Helpers for normalizing the registry integration option into the shape\n * exposed on the admin manifest.\n *\n * The integration option accepts a human-friendly duration string for\n * `policy.minimumReleaseAge` (`\"48h\"`, `\"7d\"`); the manifest exposes\n * seconds so the browser doesn't need a duration parser.\n */\n\nimport { isDid } from \"@atcute/lexicons/syntax\";\n\nimport type { RegistryConfig, RegistryConfigInput, RegistryConfigOption } from \"./types.js\";\n\nexport const DEFAULT_REGISTRY_AGGREGATOR_URL = \"https://registry.emdashcms.com\";\n\nexport function resolveRegistryConfigForSandbox(options: {\n\tregistry?: RegistryConfigOption;\n\tsandboxRunner?: string;\n\tsandboxEnabled?: boolean;\n}): RegistryConfigInput | undefined {\n\tif (options.registry === false) return undefined;\n\tif (options.registry !== undefined) return options.registry;\n\tif (options.sandboxRunner && options.sandboxEnabled !== false) {\n\t\treturn DEFAULT_REGISTRY_AGGREGATOR_URL;\n\t}\n\treturn undefined;\n}\n\nexport function getRegistryConfigInput(\n\tregistry: RegistryConfigOption | undefined,\n): RegistryConfigInput | undefined {\n\treturn registry === false ? undefined : registry;\n}\n\n/**\n * Shape returned in the admin manifest's `registry` field. The browser\n * consumes this directly -- all duration normalization and aggregator URL\n * validation has already happened by the time it gets here.\n */\nexport interface ManifestRegistryConfig {\n\taggregatorUrl: string;\n\tacceptLabelers?: string;\n\tpolicy?: {\n\t\tminimumReleaseAgeSeconds?: number;\n\t\t/**\n\t\t * Allowlist of publishers / packages exempt from the\n\t\t * {@link minimumReleaseAgeSeconds} holdback. Each entry is either:\n\t\t *\n\t\t *   - A bare publisher DID: `\"did:plc:abc123\"`. Every package from\n\t\t *     that publisher is exempt.\n\t\t *   - A `<did>/<slug>` pair: only that specific package is exempt.\n\t\t *\n\t\t * Handles are not accepted because they are mutable\n\t\t * aggregator-supplied envelope data.\n\t\t *\n\t\t * Normalized to lowercase strings at config load time so the\n\t\t * browser does case-insensitive comparison. See\n\t\t * {@link releaseExemptFromMinimumAge}.\n\t\t */\n\t\tminimumReleaseAgeExclude?: string[];\n\t};\n}\n\nexport type RegistryConfigurationErrorCode =\n\t| \"REGISTRY_AGGREGATOR_URL_REQUIRED\"\n\t| \"REGISTRY_AGGREGATOR_URL_INVALID\"\n\t| \"REGISTRY_AGGREGATOR_URL_FORBIDDEN\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\";\n\ntype RegistryConfigurationFieldSuffix =\n\t| \"aggregatorUrl\"\n\t| \"policy.minimumReleaseAge\"\n\t| \"policy.minimumReleaseAgeExclude\";\n\nexport type RegistryConfigurationField = `registry.${RegistryConfigurationFieldSuffix}`;\n\nexport interface ManifestRegistryConfigurationError {\n\tcode: RegistryConfigurationErrorCode;\n\tfield: RegistryConfigurationField;\n}\n\nclass RegistryConfigurationError extends Error {\n\tconstructor(\n\t\tpublic readonly code: RegistryConfigurationErrorCode,\n\t\tpublic readonly field: RegistryConfigurationField,\n\t\tmessage: string,\n\t\toptions?: ErrorOptions,\n\t) {\n\t\tsuper(`EmDash registry configuration error in ${field}: ${message}`, options);\n\t\tthis.name = \"RegistryConfigurationError\";\n\t}\n}\n\nexport interface RegistryConfigurationValidationOptions {\n\tallowLocalhost?: boolean;\n}\n\nfunction registryField(suffix: RegistryConfigurationFieldSuffix): RegistryConfigurationField {\n\treturn `registry.${suffix}`;\n}\n\n/**\n * Canonicalize a capabilities list for set-style comparison.\n *\n * Capabilities (the legacy declared-access shape used by the current\n * sandbox enforcer) are conceptually a *set*: order, duplicates, and\n * non-string entries don't carry meaning. The install handler's drift\n * check compares the admin's acknowledged set against the bundle\n * manifest's set; both sides pass through this canonicalizer first so\n * an aggregator-supplied array with unstable order or junk entries\n * can't cause a spurious drift rejection.\n *\n * Filters non-strings, deduplicates, and sorts lexically. Named to\n * avoid shadowing `@emdash-cms/plugin-types`'s existing\n * `normalizeCapabilities` (which dedupes + applies the deprecated →\n * current alias map but does not filter junk or sort).\n *\n * Exported so the same shape is produced by the browser before sending\n * the `acknowledgedDeclaredAccess` payload and by the server before\n * comparing against the bundle.\n */\nexport function canonicalCapabilitiesForDriftCheck(value: unknown): string[] {\n\tif (!Array.isArray(value)) return [];\n\tconst seen = new Set<string>();\n\tfor (const entry of value) {\n\t\tif (typeof entry === \"string\" && entry.length > 0) {\n\t\t\tseen.add(entry);\n\t\t}\n\t}\n\treturn [...seen].toSorted();\n}\n\n/**\n * Returns whether a `(publisher_did, slug)` pair is on the\n * minimum-release-age exemption list. Exported so the same matcher is\n * used by the browser policy filter and the server-side install\n * enforcement.\n *\n * Matching is DID-only. Handles are aggregator-supplied envelope data\n * (mutable, controlled by an attacker who compromises the aggregator)\n * and cannot be used as a trust input -- a compromised aggregator\n * could claim any handle for any package and bypass the holdback. DIDs\n * are part of the AT URI of the package record and are independently\n * resolvable, so even a compromised aggregator can't lie about the\n * publisher DID without also breaking checksum verification downstream.\n *\n * Entries from config are already lowercased at manifest-build time.\n * Runtime values are lowercased here at compare time.\n */\nexport function releaseExemptFromMinimumAge(\n\texclude: readonly string[] | undefined,\n\tpublisherDid: string,\n\tslug: string,\n): boolean {\n\tif (!exclude || exclude.length === 0) return false;\n\tconst didLower = publisherDid.toLowerCase();\n\tconst slugLower = slug.toLowerCase();\n\tconst fullDid = `${didLower}/${slugLower}`;\n\n\tfor (const entry of exclude) {\n\t\tif (entry === didLower) return true;\n\t\tif (entry === fullDid) return true;\n\t}\n\treturn false;\n}\n\nconst DURATION_PATTERN = /^(\\d+)(s|m|h|d|w)$/;\n\n/** Trailing slashes on the aggregator URL, stripped during normalization. */\nconst TRAILING_SLASHES = /\\/+$/;\n\n/** Trailing dot on a hostname, stripped before URL host comparisons. */\nconst TRAILING_DOT = /\\.$/;\n\nconst REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;\n\n/**\n * Parse a duration string or raw second count into a non-negative\n * integer count of seconds. Throws on unrecognised input so config\n * mistakes fail at startup rather than silently disabling the policy.\n */\nexport function parseDurationSeconds(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\tif (!Number.isFinite(duration) || duration < 0) {\n\t\t\tthrow new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);\n\t\t}\n\t\treturn Math.floor(duration);\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use a duration string like \"48h\", \"7d\", \"30m\", or a number of seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 24 * 60 * 60;\n\t\tcase \"w\":\n\t\t\treturn value * 7 * 24 * 60 * 60;\n\t\tdefault:\n\t\t\t// Unreachable given the regex, but keep the exhaustive arm for\n\t\t\t// future maintainers who add a unit to the pattern.\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Validate that `aggregatorUrl` is a safe outbound target for the\n * registry's XRPC calls. Same posture as artifact downloads: HTTPS\n * required in production; `http://localhost` allowed only in dev.\n *\n * The aggregator's responses are the trust source for release records,\n * checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST\n * verification lands). Allowing plain HTTP here would let a network\n * attacker swap a release record and point the artifact URL at their\n * own HTTPS bundle, defeating the checksum trust chain because the\n * attacker controls the unsigned transport that supplied the checksum.\n */\nexport function validateAggregatorUrl(\n\taggregatorUrl: string,\n\toptions: RegistryConfigurationValidationOptions = {},\n): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(aggregatorUrl);\n\t} catch (cause) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_INVALID\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must be a valid URL\",\n\t\t\t{ cause },\n\t\t);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must use HTTP or HTTPS\",\n\t\t);\n\t}\n\t// Reject embedded credentials. The normalized aggregator URL ends\n\t// up in the admin manifest and is shipped to every admin browser;\n\t// browser `fetch()` also outright rejects URLs with `user:pass@`,\n\t// so leaving them in would both leak the credentials and break the\n\t// registry UI at runtime.\n\tif (parsed.username || parsed.password) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must not contain embedded credentials\",\n\t\t);\n\t}\n\n\t// WHATWG URL preserves the brackets on IPv6 hostnames -- strip them\n\t// before any comparison so `https://[::1]/` is recognised as localhost\n\t// and not treated as a generic domain string.\n\tconst rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname =\n\t\trawHostname.startsWith(\"[\") && rawHostname.endsWith(\"]\")\n\t\t\t? rawHostname.slice(1, -1)\n\t\t\t: rawHostname;\n\tconst isLocalhost =\n\t\thostname === \"localhost\" ||\n\t\thostname.endsWith(\".localhost\") ||\n\t\thostname === \"127.0.0.1\" ||\n\t\thostname === \"::1\" ||\n\t\t// IPv4-mapped IPv6 forms of loopback, e.g. `::ffff:127.0.0.1` and `::ffff:7f00:1`.\n\t\thostname.startsWith(\"::ffff:127.\") ||\n\t\thostname.startsWith(\"::ffff:7f00:\");\n\n\tconst allowLocalhost = options.allowLocalhost ?? import.meta.env.DEV;\n\tif (!allowLocalhost) {\n\t\tif (parsed.protocol === \"http:\") {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\t\"must use HTTPS outside development\",\n\t\t\t);\n\t\t}\n\t\tif (isLocalhost) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\t\"must not point at localhost outside development\",\n\t\t\t);\n\t\t}\n\t} else if (parsed.protocol === \"http:\" && !isLocalhost) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must use HTTPS unless it points at localhost in development\",\n\t\t);\n\t}\n\n\treturn parsed;\n}\n\n/**\n * Expand the `RegistryConfigInput` shorthand into the full\n * `RegistryConfig` object shape.\n *\n * Users can pass a bare aggregator URL string for the common case\n * (`registry: \"https://registry.emdashcms.com\"`); the\n * normalizer handles either form transparently.\n *\n * Returns `undefined` for `undefined` input so callers can chain with\n * optional chaining.\n */\nexport function coerceRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n): RegistryConfig | undefined {\n\tif (input === undefined) return undefined;\n\tif (typeof input === \"string\") return { aggregatorUrl: input };\n\treturn input;\n}\n\n/**\n * Normalize the user-supplied `RegistryConfigInput` into the shape that\n * ships to the admin browser via the manifest endpoint.\n *\n * Accepts either the shorthand string form\n * (`\"https://registry.emdashcms.com\"`) or the full `RegistryConfig`\n * object. Returns `null` when `input` is undefined so callers can\n * spread the result directly into the manifest object.\n *\n * Throws a field-specific configuration error if the aggregator URL is\n * malformed or forbidden, or a registry policy value cannot be normalized.\n * The Astro integration uses this to fail during config loading. Runtime\n * manifest generation uses {@link resolveManifestRegistryConfig} to expose\n * recognized failures without exposing the configured value.\n */\nexport function normalizeRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): ManifestRegistryConfig | null {\n\tconst config = coerceRegistryConfig(input);\n\tif (!config) return null;\n\n\tconst aggregatorUrl =\n\t\ttypeof config.aggregatorUrl === \"string\" ? config.aggregatorUrl.trim() : undefined;\n\tif (!aggregatorUrl) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_REQUIRED\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"is required when the registry is configured\",\n\t\t);\n\t}\n\n\tvalidateAggregatorUrl(aggregatorUrl, options);\n\n\tconst out: ManifestRegistryConfig = {\n\t\t// Strip any trailing slash so `${aggregatorUrl}/xrpc/...` works\n\t\t// regardless of how the user wrote it.\n\t\taggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, \"\"),\n\t};\n\n\tif (config.acceptLabelers) {\n\t\tout.acceptLabelers = config.acceptLabelers;\n\t}\n\n\tconst policy: ManifestRegistryConfig[\"policy\"] = {};\n\tlet hasPolicy = false;\n\n\tif (config.policy?.minimumReleaseAge !== undefined) {\n\t\ttry {\n\t\t\tpolicy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);\n\t\t} catch (cause) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\",\n\t\t\t\tregistryField(\"policy.minimumReleaseAge\"),\n\t\t\t\t'must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds',\n\t\t\t\t{ cause },\n\t\t\t);\n\t\t}\n\t\thasPolicy = true;\n\t}\n\n\tif (config.policy?.minimumReleaseAgeExclude !== undefined) {\n\t\tif (!Array.isArray(config.policy.minimumReleaseAgeExclude)) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\"must be an array of DIDs or <did>/<slug> entries\",\n\t\t\t);\n\t\t}\n\t\t// Normalize at load time so callers (browser and server) can do\n\t\t// plain string compares without each one re-implementing the\n\t\t// case-folding rule.\n\t\tconst list = config.policy.minimumReleaseAgeExclude.map((entry) => {\n\t\t\tif (typeof entry !== \"string\") {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst trimmed = entry.trim();\n\t\t\tif (!trimmed) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"entries cannot be empty\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst lower = trimmed.toLowerCase();\n\t\t\tconst [did, slug, ...extra] = lower.split(\"/\");\n\t\t\tif (\n\t\t\t\t!did ||\n\t\t\t\t!isDid(did) ||\n\t\t\t\textra.length > 0 ||\n\t\t\t\t(slug !== undefined && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug))\n\t\t\t) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn lower;\n\t\t});\n\t\tif (list.length > 0) {\n\t\t\tpolicy.minimumReleaseAgeExclude = list;\n\t\t\thasPolicy = true;\n\t\t}\n\t}\n\n\tif (hasPolicy) {\n\t\tout.policy = policy;\n\t}\n\n\treturn out;\n}\n\n/** Normalize registry config without allowing a known config error to hide the admin. */\nexport function resolveManifestRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): {\n\tregistry?: ManifestRegistryConfig;\n\terror?: ManifestRegistryConfigurationError;\n} {\n\ttry {\n\t\tconst registry = normalizeRegistryConfig(input, options);\n\t\treturn registry ? { registry } : {};\n\t} catch (error) {\n\t\tif (!(error instanceof RegistryConfigurationError)) throw error;\n\t\treturn { error: { code: error.code, field: error.field } };\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAaA,MAAa,kCAAkC;AAE/C,SAAgB,gCAAgC,SAIZ;AACnC,KAAI,QAAQ,aAAa,MAAO,QAAO;AACvC,KAAI,QAAQ,aAAa,OAAW,QAAO,QAAQ;AACnD,KAAI,QAAQ,iBAAiB,QAAQ,mBAAmB,MACvD,QAAO;;AAKT,SAAgB,uBACf,UACkC;AAClC,QAAO,aAAa,QAAQ,SAAY;;AAmDzC,IAAM,6BAAN,cAAyC,MAAM;CAC9C,YACC,AAAgB,MAChB,AAAgB,OAChB,SACA,SACC;AACD,QAAM,0CAA0C,MAAM,IAAI,WAAW,QAAQ;EAL7D;EACA;AAKhB,OAAK,OAAO;;;AAQd,SAAS,cAAc,QAAsE;AAC5F,QAAO,YAAY;;;;;;;;;;;;;;;;;;;;;;AAuBpB,SAAgB,mCAAmC,OAA0B;AAC5E,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,EAAE;CACpC,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,SAAS,MACnB,KAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC/C,MAAK,IAAI,MAAM;AAGjB,QAAO,CAAC,GAAG,KAAK,CAAC,UAAU;;;;;;;;;;;;;;;;;;;AAoB5B,SAAgB,4BACf,SACA,cACA,MACU;AACV,KAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;CAC7C,MAAM,WAAW,aAAa,aAAa;CAE3C,MAAM,UAAU,GAAG,SAAS,GADV,KAAK,aAAa;AAGpC,MAAK,MAAM,SAAS,SAAS;AAC5B,MAAI,UAAU,SAAU,QAAO;AAC/B,MAAI,UAAU,QAAS,QAAO;;AAE/B,QAAO;;AAGR,MAAM,mBAAmB;;AAGzB,MAAM,mBAAmB;;AAGzB,MAAM,eAAe;AAErB,MAAM,gCAAgC;;;;;;AAOtC,SAAgB,qBAAqB,UAAmC;AACvE,KAAI,OAAO,aAAa,UAAU;AACjC,MAAI,CAAC,OAAO,SAAS,SAAS,IAAI,WAAW,EAC5C,OAAM,IAAI,MAAM,qBAAqB,SAAS,yCAAyC;AAExF,SAAO,KAAK,MAAM,SAAS;;CAG5B,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,2EACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,IAAI,KAAK,KAAK;EAC9B,QAGC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;;;;;;;;;;AAgBpD,SAAgB,sBACf,eACA,UAAkD,EAAE,EAC9C;CACN,IAAI;AACJ,KAAI;AACH,WAAS,IAAI,IAAI,cAAc;UACvB,OAAO;AACf,QAAM,IAAI,2BACT,mCACA,cAAc,gBAAgB,EAC9B,uBACA,EAAE,OAAO,CACT;;AAEF,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,yBACA;AAOF,KAAI,OAAO,YAAY,OAAO,SAC7B,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,wCACA;CAMF,MAAM,cAAc,OAAO,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;CAC3E,MAAM,WACL,YAAY,WAAW,IAAI,IAAI,YAAY,SAAS,IAAI,GACrD,YAAY,MAAM,GAAG,GAAG,GACxB;CACJ,MAAM,cACL,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,aAAa,SAEb,SAAS,WAAW,cAAc,IAClC,SAAS,WAAW,eAAe;AAGpC,KAAI,EADmB,QAAQ,kBAAkB,OAAO,KAAK,IAAI,MAC5C;AACpB,MAAI,OAAO,aAAa,QACvB,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,qCACA;AAEF,MAAI,YACH,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,kDACA;YAEQ,OAAO,aAAa,WAAW,CAAC,YAC1C,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,8DACA;AAGF,QAAO;;;;;;;;;;;;;AAcR,SAAgB,qBACf,OAC6B;AAC7B,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,SAAU,QAAO,EAAE,eAAe,OAAO;AAC9D,QAAO;;;;;;;;;;;;;;;;;AAkBR,SAAgB,wBACf,OACA,UAAkD,EAAE,EACpB;CAChC,MAAM,SAAS,qBAAqB,MAAM;AAC1C,KAAI,CAAC,OAAQ,QAAO;CAEpB,MAAM,gBACL,OAAO,OAAO,kBAAkB,WAAW,OAAO,cAAc,MAAM,GAAG;AAC1E,KAAI,CAAC,cACJ,OAAM,IAAI,2BACT,oCACA,cAAc,gBAAgB,EAC9B,8CACA;AAGF,uBAAsB,eAAe,QAAQ;CAE7C,MAAM,MAA8B,EAGnC,eAAe,cAAc,QAAQ,kBAAkB,GAAG,EAC1D;AAED,KAAI,OAAO,eACV,KAAI,iBAAiB,OAAO;CAG7B,MAAM,SAA2C,EAAE;CACnD,IAAI,YAAY;AAEhB,KAAI,OAAO,QAAQ,sBAAsB,QAAW;AACnD,MAAI;AACH,UAAO,2BAA2B,qBAAqB,OAAO,OAAO,kBAAkB;WAC/E,OAAO;AACf,SAAM,IAAI,2BACT,wCACA,cAAc,2BAA2B,EACzC,mFACA,EAAE,OAAO,CACT;;AAEF,cAAY;;AAGb,KAAI,OAAO,QAAQ,6BAA6B,QAAW;AAC1D,MAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,yBAAyB,CACzD,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,mDACA;EAKF,MAAM,OAAO,OAAO,OAAO,yBAAyB,KAAK,UAAU;AAClE,OAAI,OAAO,UAAU,SACpB,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,+DACA;GAEF,MAAM,UAAU,MAAM,MAAM;AAC5B,OAAI,CAAC,QACJ,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,0BACA;GAEF,MAAM,QAAQ,QAAQ,aAAa;GACnC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,MAAM,MAAM,IAAI;AAC9C,OACC,CAAC,OACD,CAAC,MAAM,IAAI,IACX,MAAM,SAAS,KACd,SAAS,UAAa,CAAC,8BAA8B,KAAK,KAAK,CAEhE,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,+DACA;AAEF,UAAO;IACN;AACF,MAAI,KAAK,SAAS,GAAG;AACpB,UAAO,2BAA2B;AAClC,eAAY;;;AAId,KAAI,UACH,KAAI,SAAS;AAGd,QAAO;;;AAIR,SAAgB,8BACf,OACA,UAAkD,EAAE,EAInD;AACD,KAAI;EACH,MAAM,WAAW,wBAAwB,OAAO,QAAQ;AACxD,SAAO,WAAW,EAAE,UAAU,GAAG,EAAE;UAC3B,OAAO;AACf,MAAI,EAAE,iBAAiB,4BAA6B,OAAM;AAC1D,SAAO,EAAE,OAAO;GAAE,MAAM,MAAM;GAAM,OAAO,MAAM;GAAO,EAAE"}