emdash 1.2.0 → 1.3.1

package/dist/comments-Da_dI2O1.mjs

@@ -1,195 +0,0 @@
-import { i as InvalidCursorError } from "./types-C-Xp0CcN.mjs";
-import { t as CommentRepository } from "./comment-CWla6OHV.mjs";
-
-//#region src/api/handlers/comments.ts
-async function handleCommentList(db, collection, contentId, options = {}) {
-	try {
-		const repo = new CommentRepository(db);
-		const total = await repo.countByContent(collection, contentId, "approved");
-		let publicItems;
-		let nextCursor;
-		if (options.threaded) {
-			const result = await repo.findByContent(collection, contentId, {
-				status: "approved",
-				limit: 500
-			});
-			publicItems = CommentRepository.assembleThreads(result.items).map((c) => CommentRepository.toPublicComment(c));
-		} else {
-			const result = await repo.findByContent(collection, contentId, {
-				status: "approved",
-				limit: options.limit,
-				cursor: options.cursor
-			});
-			publicItems = result.items.map((c) => CommentRepository.toPublicComment(c));
-			nextCursor = result.nextCursor;
-		}
-		return {
-			success: true,
-			data: {
-				items: publicItems,
-				nextCursor,
-				total
-			}
-		};
-	} catch (error) {
-		if (error instanceof InvalidCursorError) return {
-			success: false,
-			error: {
-				code: "INVALID_CURSOR",
-				message: error.message
-			}
-		};
-		console.error("Comment list error:", error);
-		return {
-			success: false,
-			error: {
-				code: "COMMENT_LIST_ERROR",
-				message: "Failed to list comments"
-			}
-		};
-	}
-}
-async function handleCommentInbox(db, options = {}) {
-	try {
-		const repo = new CommentRepository(db);
-		const status = options.status ?? "pending";
-		const result = await repo.findByStatus(status, {
-			collection: options.collection,
-			search: options.search,
-			limit: options.limit,
-			cursor: options.cursor
-		});
-		return {
-			success: true,
-			data: {
-				items: result.items,
-				nextCursor: result.nextCursor
-			}
-		};
-	} catch (error) {
-		if (error instanceof InvalidCursorError) return {
-			success: false,
-			error: {
-				code: "INVALID_CURSOR",
-				message: error.message
-			}
-		};
-		console.error("Comment inbox error:", error);
-		return {
-			success: false,
-			error: {
-				code: "COMMENT_INBOX_ERROR",
-				message: "Failed to list comments"
-			}
-		};
-	}
-}
-async function handleCommentCounts(db) {
-	try {
-		return {
-			success: true,
-			data: await new CommentRepository(db).countByStatus()
-		};
-	} catch (error) {
-		console.error("Comment counts error:", error);
-		return {
-			success: false,
-			error: {
-				code: "COMMENT_COUNTS_ERROR",
-				message: "Failed to get comment counts"
-			}
-		};
-	}
-}
-async function handleCommentGet(db, id) {
-	try {
-		const comment = await new CommentRepository(db).findById(id);
-		if (!comment) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Comment not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: comment
-		};
-	} catch (error) {
-		console.error("Comment get error:", error);
-		return {
-			success: false,
-			error: {
-				code: "COMMENT_GET_ERROR",
-				message: "Failed to get comment"
-			}
-		};
-	}
-}
-async function handleCommentDelete(db, id) {
-	try {
-		if (!await new CommentRepository(db).delete(id)) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Comment not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: { deleted: true }
-		};
-	} catch (error) {
-		console.error("Comment delete error:", error);
-		return {
-			success: false,
-			error: {
-				code: "COMMENT_DELETE_ERROR",
-				message: "Failed to delete comment"
-			}
-		};
-	}
-}
-async function handleCommentBulk(db, ids, action) {
-	try {
-		const repo = new CommentRepository(db);
-		let affected;
-		if (action === "delete") affected = await repo.bulkDelete(ids);
-		else affected = await repo.bulkUpdateStatus(ids, {
-			approve: "approved",
-			spam: "spam",
-			trash: "trash"
-		}[action]);
-		return {
-			success: true,
-			data: { affected }
-		};
-	} catch (error) {
-		console.error("Comment bulk error:", error);
-		return {
-			success: false,
-			error: {
-				code: "COMMENT_BULK_ERROR",
-				message: "Failed to perform bulk operation"
-			}
-		};
-	}
-}
-/**
-* Hash an IP address for storage (never store cleartext IPs).
-*
-* Uses full SHA-256 with a site-specific salt to prevent rainbow-table
-* recovery of IPs. The salt must be provided by the caller — typically
-* via `resolveSecretsCached(db).ipSalt` from `#config/secrets.js`. The
-* salt is generated and persisted on first need so it's stable across
-* requests within a deployment but unique per install.
-*/
-async function hashIp(ip, salt) {
-	const data = `ip:${salt}:${ip}`;
-	const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data));
-	return Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join("");
-}
-
-//#endregion
-export { handleCommentInbox as a, handleCommentGet as i, handleCommentCounts as n, handleCommentList as o, handleCommentDelete as r, hashIp as s, handleCommentBulk as t };
-//# sourceMappingURL=comments-Da_dI2O1.mjs.map

package/dist/comments-Da_dI2O1.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"comments-Da_dI2O1.mjs","names":[],"sources":["../src/api/handlers/comments.ts"],"sourcesContent":["/**\n * Comment handlers — business logic for comment API routes.\n *\n * Standalone functions that return ApiResult<T>. Routes are thin wrappers.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { CommentRepository } from \"../../database/repositories/comment.js\";\nimport type { Comment, CommentStatus, PublicComment } from \"../../database/repositories/comment.js\";\nimport { InvalidCursorError } from \"../../database/repositories/types.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Public: List approved comments for content\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentList(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tcontentId: string,\n\toptions: { limit?: number; cursor?: string; threaded?: boolean } = {},\n): Promise<ApiResult<{ items: PublicComment[]; nextCursor?: string; total: number }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\n\t\t// Get total approved count\n\t\tconst total = await repo.countByContent(collection, contentId, \"approved\");\n\n\t\tlet publicItems: PublicComment[];\n\t\tlet nextCursor: string | undefined;\n\n\t\tif (options.threaded) {\n\t\t\t// Threaded mode: fetch all approved comments (capped) so threading\n\t\t\t// doesn't lose children that would fall on later pages.\n\t\t\tconst MAX_THREADED = 500;\n\t\t\tconst result = await repo.findByContent(collection, contentId, {\n\t\t\t\tstatus: \"approved\",\n\t\t\t\tlimit: MAX_THREADED,\n\t\t\t});\n\t\t\tconst threaded = CommentRepository.assembleThreads(result.items);\n\t\t\tpublicItems = threaded.map((c) => CommentRepository.toPublicComment(c));\n\t\t\t// No cursor for threaded mode — all comments returned at once\n\t\t} else {\n\t\t\tconst result = await repo.findByContent(collection, contentId, {\n\t\t\t\tstatus: \"approved\",\n\t\t\t\tlimit: options.limit,\n\t\t\t\tcursor: options.cursor,\n\t\t\t});\n\t\t\tpublicItems = result.items.map((c) => CommentRepository.toPublicComment(c));\n\t\t\tnextCursor = result.nextCursor;\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\titems: publicItems,\n\t\t\t\tnextCursor,\n\t\t\t\ttotal,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Comment list error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list comments\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Moderation inbox\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentInbox(\n\tdb: Kysely<Database>,\n\toptions: {\n\t\tstatus?: CommentStatus;\n\t\tcollection?: string;\n\t\tsearch?: string;\n\t\tlimit?: number;\n\t\tcursor?: string;\n\t} = {},\n): Promise<ApiResult<{ items: Comment[]; nextCursor?: string }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst status = options.status ?? \"pending\";\n\n\t\tconst result = await repo.findByStatus(status, {\n\t\t\tcollection: options.collection,\n\t\t\tsearch: options.search,\n\t\t\tlimit: options.limit,\n\t\t\tcursor: options.cursor,\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\titems: result.items,\n\t\t\t\tnextCursor: result.nextCursor,\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CURSOR\", message: error.message },\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"Comment inbox error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_INBOX_ERROR\",\n\t\t\t\tmessage: \"Failed to list comments\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Status counts for inbox badges\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentCounts(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<Record<CommentStatus, number>>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst counts = await repo.countByStatus();\n\t\treturn { success: true, data: counts };\n\t} catch (error) {\n\t\tconsole.error(\"Comment counts error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_COUNTS_ERROR\",\n\t\t\t\tmessage: \"Failed to get comment counts\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Get single comment detail\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentGet(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<Comment>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst comment = await repo.findById(id);\n\n\t\tif (!comment) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Comment not found: ${id}` },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: comment };\n\t} catch (error) {\n\t\tconsole.error(\"Comment get error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get comment\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Change comment status\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentStatusChange(\n\tdb: Kysely<Database>,\n\tid: string,\n\tstatus: CommentStatus,\n): Promise<ApiResult<Comment>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst updated = await repo.updateStatus(id, status);\n\n\t\tif (!updated) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Comment not found: ${id}` },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: updated };\n\t} catch (error) {\n\t\tconsole.error(\"Comment status change error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_STATUS_ERROR\",\n\t\t\t\tmessage: \"Failed to update comment status\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Hard delete comment\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentDelete(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<{ deleted: true }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\t\tconst deleted = await repo.delete(id);\n\n\t\tif (!deleted) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: `Comment not found: ${id}` },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { deleted: true } };\n\t} catch (error) {\n\t\tconsole.error(\"Comment delete error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete comment\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Admin: Bulk operations\n// ---------------------------------------------------------------------------\n\nexport async function handleCommentBulk(\n\tdb: Kysely<Database>,\n\tids: string[],\n\taction: \"approve\" | \"spam\" | \"trash\" | \"delete\",\n): Promise<ApiResult<{ affected: number }>> {\n\ttry {\n\t\tconst repo = new CommentRepository(db);\n\n\t\tlet affected: number;\n\t\tif (action === \"delete\") {\n\t\t\taffected = await repo.bulkDelete(ids);\n\t\t} else {\n\t\t\tconst statusMap: Record<string, CommentStatus> = {\n\t\t\t\tapprove: \"approved\",\n\t\t\t\tspam: \"spam\",\n\t\t\t\ttrash: \"trash\",\n\t\t\t};\n\t\t\taffected = await repo.bulkUpdateStatus(ids, statusMap[action]);\n\t\t}\n\n\t\treturn { success: true, data: { affected } };\n\t} catch (error) {\n\t\tconsole.error(\"Comment bulk error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"COMMENT_BULK_ERROR\",\n\t\t\t\tmessage: \"Failed to perform bulk operation\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Hash an IP address for storage (never store cleartext IPs).\n *\n * Uses full SHA-256 with a site-specific salt to prevent rainbow-table\n * recovery of IPs. The salt must be provided by the caller — typically\n * via `resolveSecretsCached(db).ipSalt` from `#config/secrets.js`. The\n * salt is generated and persisted on first need so it's stable across\n * requests within a deployment but unique per install.\n */\nexport async function hashIp(ip: string, salt: string): Promise<string> {\n\tconst data = `ip:${salt}:${ip}`;\n\tconst buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(data));\n\treturn Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n"],"mappings":";;;;AAkBA,eAAsB,kBACrB,IACA,YACA,WACA,UAAmE,EAAE,EACgB;AACrF,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EAGtC,MAAM,QAAQ,MAAM,KAAK,eAAe,YAAY,WAAW,WAAW;EAE1E,IAAI;EACJ,IAAI;AAEJ,MAAI,QAAQ,UAAU;GAIrB,MAAM,SAAS,MAAM,KAAK,cAAc,YAAY,WAAW;IAC9D,QAAQ;IACR,OAHoB;IAIpB,CAAC;AAEF,iBADiB,kBAAkB,gBAAgB,OAAO,MAAM,CACzC,KAAK,MAAM,kBAAkB,gBAAgB,EAAE,CAAC;SAEjE;GACN,MAAM,SAAS,MAAM,KAAK,cAAc,YAAY,WAAW;IAC9D,QAAQ;IACR,OAAO,QAAQ;IACf,QAAQ,QAAQ;IAChB,CAAC;AACF,iBAAc,OAAO,MAAM,KAAK,MAAM,kBAAkB,gBAAgB,EAAE,CAAC;AAC3E,gBAAa,OAAO;;AAGrB,SAAO;GACN,SAAS;GACT,MAAM;IACL,OAAO;IACP;IACA;IACA;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,UAAQ,MAAM,uBAAuB,MAAM;AAC3C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,mBACrB,IACA,UAMI,EAAE,EAC0D;AAChE,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EACtC,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;GAC9C,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB,CAAC;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IACL,OAAO,OAAO;IACd,YAAY,OAAO;IACnB;GACD;UACO,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GACzD;AAEF,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,oBACrB,IACoD;AACpD,KAAI;AAGH,SAAO;GAAE,SAAS;GAAM,MADT,MADF,IAAI,kBAAkB,GAAG,CACZ,eAAe;GACH;UAC9B,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,iBACrB,IACA,IAC8B;AAC9B,KAAI;EAEH,MAAM,UAAU,MADH,IAAI,kBAAkB,GAAG,CACX,SAAS,GAAG;AAEvC,MAAI,CAAC,QACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,sBAAsB;IAAM;GACjE;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM;GAAS;UAC/B,OAAO;AACf,UAAQ,MAAM,sBAAsB,MAAM;AAC1C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAyCH,eAAsB,oBACrB,IACA,IACwC;AACxC,KAAI;AAIH,MAAI,CAFY,MADH,IAAI,kBAAkB,GAAG,CACX,OAAO,GAAG,CAGpC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS,sBAAsB;IAAM;GACjE;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;UACzC,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;AAQH,eAAsB,kBACrB,IACA,KACA,QAC2C;AAC3C,KAAI;EACH,MAAM,OAAO,IAAI,kBAAkB,GAAG;EAEtC,IAAI;AACJ,MAAI,WAAW,SACd,YAAW,MAAM,KAAK,WAAW,IAAI;MAOrC,YAAW,MAAM,KAAK,iBAAiB,KALU;GAChD,SAAS;GACT,MAAM;GACN,OAAO;GACP,CACqD,QAAQ;AAG/D,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,UAAU;GAAE;UACpC,OAAO;AACf,UAAQ,MAAM,uBAAuB,MAAM;AAC3C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;AAaH,eAAsB,OAAO,IAAY,MAA+B;CACvE,MAAM,OAAO,MAAM,KAAK,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC;AACjF,QAAO,MAAM,KAAK,IAAI,WAAW,IAAI,GAAG,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG"}

package/dist/components-oFXumpf5.mjs

@@ -1,112 +0,0 @@
-//#region src/widgets/components.ts
-/**
-* Core widget components registry
-* These are built-in widgets that ship with EmDash
-*/
-const coreWidgetComponents = [
-	{
-		id: "core:recent-posts",
-		label: "Recent Posts",
-		description: "Display a list of recent posts",
-		props: {
-			count: {
-				type: "number",
-				label: "Number of posts",
-				default: 5
-			},
-			showThumbnails: {
-				type: "boolean",
-				label: "Show thumbnails",
-				default: false
-			},
-			showDate: {
-				type: "boolean",
-				label: "Show date",
-				default: true
-			},
-			urlTemplate: {
-				type: "string",
-				label: "URL template (e.g. /blog/:slug)"
-			}
-		}
-	},
-	{
-		id: "core:categories",
-		label: "Categories",
-		description: "Display category list",
-		props: {
-			showCount: {
-				type: "boolean",
-				label: "Show post count",
-				default: true
-			},
-			hierarchical: {
-				type: "boolean",
-				label: "Show hierarchy",
-				default: true
-			}
-		}
-	},
-	{
-		id: "core:tags",
-		label: "Tags",
-		description: "Display tag cloud",
-		props: {
-			showCount: {
-				type: "boolean",
-				label: "Show count",
-				default: false
-			},
-			limit: {
-				type: "number",
-				label: "Maximum tags",
-				default: 20
-			}
-		}
-	},
-	{
-		id: "core:search",
-		label: "Search",
-		description: "Search form",
-		props: { placeholder: {
-			type: "string",
-			label: "Placeholder text",
-			default: "Search..."
-		} }
-	},
-	{
-		id: "core:archives",
-		label: "Archives",
-		description: "Monthly/yearly archives",
-		props: {
-			type: {
-				type: "select",
-				label: "Group by",
-				default: "monthly",
-				options: [{
-					value: "monthly",
-					label: "Monthly"
-				}, {
-					value: "yearly",
-					label: "Yearly"
-				}]
-			},
-			limit: {
-				type: "number",
-				label: "Limit",
-				default: 12
-			}
-		}
-	}
-];
-/**
-* Get all widget component definitions (core + plugin-registered)
-* For now, only returns core components. Plugin widgets will be added later.
-*/
-function getWidgetComponents() {
-	return [...coreWidgetComponents];
-}
-
-//#endregion
-export { getWidgetComponents as t };
-//# sourceMappingURL=components-oFXumpf5.mjs.map

package/dist/components-oFXumpf5.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"components-oFXumpf5.mjs","names":[],"sources":["../src/widgets/components.ts"],"sourcesContent":["import type { WidgetComponentDef } from \"./types.js\";\n\n/**\n * Core widget components registry\n * These are built-in widgets that ship with EmDash\n */\nexport const coreWidgetComponents: WidgetComponentDef[] = [\n\t{\n\t\tid: \"core:recent-posts\",\n\t\tlabel: \"Recent Posts\",\n\t\tdescription: \"Display a list of recent posts\",\n\t\tprops: {\n\t\t\tcount: {\n\t\t\t\ttype: \"number\",\n\t\t\t\tlabel: \"Number of posts\",\n\t\t\t\tdefault: 5,\n\t\t\t},\n\t\t\tshowThumbnails: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show thumbnails\",\n\t\t\t\tdefault: false,\n\t\t\t},\n\t\t\tshowDate: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show date\",\n\t\t\t\tdefault: true,\n\t\t\t},\n\t\t\turlTemplate: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tlabel: \"URL template (e.g. /blog/:slug)\",\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:categories\",\n\t\tlabel: \"Categories\",\n\t\tdescription: \"Display category list\",\n\t\tprops: {\n\t\t\tshowCount: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show post count\",\n\t\t\t\tdefault: true,\n\t\t\t},\n\t\t\thierarchical: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show hierarchy\",\n\t\t\t\tdefault: true,\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:tags\",\n\t\tlabel: \"Tags\",\n\t\tdescription: \"Display tag cloud\",\n\t\tprops: {\n\t\t\tshowCount: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\tlabel: \"Show count\",\n\t\t\t\tdefault: false,\n\t\t\t},\n\t\t\tlimit: {\n\t\t\t\ttype: \"number\",\n\t\t\t\tlabel: \"Maximum tags\",\n\t\t\t\tdefault: 20,\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:search\",\n\t\tlabel: \"Search\",\n\t\tdescription: \"Search form\",\n\t\tprops: {\n\t\t\tplaceholder: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tlabel: \"Placeholder text\",\n\t\t\t\tdefault: \"Search...\",\n\t\t\t},\n\t\t},\n\t},\n\t{\n\t\tid: \"core:archives\",\n\t\tlabel: \"Archives\",\n\t\tdescription: \"Monthly/yearly archives\",\n\t\tprops: {\n\t\t\ttype: {\n\t\t\t\ttype: \"select\",\n\t\t\t\tlabel: \"Group by\",\n\t\t\t\tdefault: \"monthly\",\n\t\t\t\toptions: [\n\t\t\t\t\t{ value: \"monthly\", label: \"Monthly\" },\n\t\t\t\t\t{ value: \"yearly\", label: \"Yearly\" },\n\t\t\t\t],\n\t\t\t},\n\t\t\tlimit: {\n\t\t\t\ttype: \"number\",\n\t\t\t\tlabel: \"Limit\",\n\t\t\t\tdefault: 12,\n\t\t\t},\n\t\t},\n\t},\n];\n\n/**\n * Get all widget component definitions (core + plugin-registered)\n * For now, only returns core components. Plugin widgets will be added later.\n */\nexport function getWidgetComponents(): WidgetComponentDef[] {\n\treturn [...coreWidgetComponents];\n}\n"],"mappings":";;;;;AAMA,MAAa,uBAA6C;CACzD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,OAAO;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,gBAAgB;IACf,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,UAAU;IACT,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,aAAa;IACZ,MAAM;IACN,OAAO;IACP;GACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,WAAW;IACV,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,cAAc;IACb,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,WAAW;IACV,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD,OAAO;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO,EACN,aAAa;GACZ,MAAM;GACN,OAAO;GACP,SAAS;GACT,EACD;EACD;CACD;EACC,IAAI;EACJ,OAAO;EACP,aAAa;EACb,OAAO;GACN,MAAM;IACL,MAAM;IACN,OAAO;IACP,SAAS;IACT,SAAS,CACR;KAAE,OAAO;KAAW,OAAO;KAAW,EACtC;KAAE,OAAO;KAAU,OAAO;KAAU,CACpC;IACD;GACD,OAAO;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT;GACD;EACD;CACD;;;;;AAMD,SAAgB,sBAA4C;AAC3D,QAAO,CAAC,GAAG,qBAAqB"}

package/dist/config--wamYxBW.d.mts

@@ -1,39 +0,0 @@
-//#region src/i18n/config.d.ts
-/**
- * EmDash i18n Configuration
- *
- * Reads locale configuration from the virtual module (sourced from Astro config).
- * Initialized during runtime startup, then available via getI18nConfig().
- */
-interface I18nConfig {
-  defaultLocale: string;
-  locales: string[];
-  fallback?: Record<string, string>;
-  prefixDefaultLocale?: boolean;
-}
-/**
- * Initialize i18n config from virtual module data.
- * Called during runtime initialization.
- */
-declare function setI18nConfig(config: I18nConfig | null): void;
-/**
- * Get the current i18n config.
- * Returns null if i18n is not configured.
- */
-declare function getI18nConfig(): I18nConfig | null;
-/** Resolve the locale for a new content row. */
-declare function resolveContentCreateLocale(locale: unknown, config?: I18nConfig | null): string;
-/**
- * Check if i18n is enabled.
- * Returns true when multiple locales are configured.
- */
-declare function isI18nEnabled(): boolean;
-/**
- * Resolve fallback locale chain for a given locale.
- * Returns array of locales to try, from most preferred to least.
- * Always ends with defaultLocale.
- */
-declare function getFallbackChain(locale: string): string[];
-//#endregion
-export { resolveContentCreateLocale as a, isI18nEnabled as i, getFallbackChain as n, setI18nConfig as o, getI18nConfig as r, I18nConfig as t };
-//# sourceMappingURL=config--wamYxBW.d.mts.map

package/dist/config--wamYxBW.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config--wamYxBW.d.mts","names":[],"sources":["../src/i18n/config.ts"],"mappings":";;AAOA;;;;;UAAiB,UAAA;EAChB,aAAA;EACA,OAAA;EACA,QAAA,GAAW,MAAA;EACX,mBAAA;AAAA;;;;;iBAee,aAAA,CAAc,MAAA,EAAQ,UAAA;;;;;iBAQtB,aAAA,CAAA,GAAiB,UAAA;;iBAmBjB,0BAAA,CACf,MAAA,WACA,MAAA,GAAQ,UAAA;;;AA0BT;;iBAAgB,aAAA,CAAA;;;AAUhB;;;iBAAgB,gBAAA,CAAiB,MAAA"}

package/dist/config-Bo4eOOdV.mjs

@@ -1,228 +0,0 @@
-import { isDid } from "@atcute/lexicons/syntax";
-
-//#region src/registry/config.ts
-/**
-* Helpers for normalizing the registry integration option into the shape
-* exposed on the admin manifest.
-*
-* The integration option accepts a human-friendly duration string for
-* `policy.minimumReleaseAge` (`"48h"`, `"7d"`); the manifest exposes
-* seconds so the browser doesn't need a duration parser.
-*/
-const DEFAULT_REGISTRY_AGGREGATOR_URL = "https://registry.emdashcms.com";
-function resolveRegistryConfigForSandbox(options) {
-	if (options.registry === false) return void 0;
-	if (options.registry !== void 0) return options.registry;
-	if (options.sandboxRunner && options.sandboxEnabled !== false) return DEFAULT_REGISTRY_AGGREGATOR_URL;
-}
-function getRegistryConfigInput(registry) {
-	return registry === false ? void 0 : registry;
-}
-var RegistryConfigurationError = class extends Error {
-	constructor(code, field, message, options) {
-		super(`EmDash registry configuration error in ${field}: ${message}`, options);
-		this.code = code;
-		this.field = field;
-		this.name = "RegistryConfigurationError";
-	}
-};
-function registryField(suffix) {
-	return `registry.${suffix}`;
-}
-/**
-* Canonicalize a capabilities list for set-style comparison.
-*
-* Capabilities (the legacy declared-access shape used by the current
-* sandbox enforcer) are conceptually a *set*: order, duplicates, and
-* non-string entries don't carry meaning. The install handler's drift
-* check compares the admin's acknowledged set against the bundle
-* manifest's set; both sides pass through this canonicalizer first so
-* an aggregator-supplied array with unstable order or junk entries
-* can't cause a spurious drift rejection.
-*
-* Filters non-strings, deduplicates, and sorts lexically. Named to
-* avoid shadowing `@emdash-cms/plugin-types`'s existing
-* `normalizeCapabilities` (which dedupes + applies the deprecated →
-* current alias map but does not filter junk or sort).
-*
-* Exported so the same shape is produced by the browser before sending
-* the `acknowledgedDeclaredAccess` payload and by the server before
-* comparing against the bundle.
-*/
-function canonicalCapabilitiesForDriftCheck(value) {
-	if (!Array.isArray(value)) return [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of value) if (typeof entry === "string" && entry.length > 0) seen.add(entry);
-	return [...seen].toSorted();
-}
-/**
-* Returns whether a `(publisher_did, slug)` pair is on the
-* minimum-release-age exemption list. Exported so the same matcher is
-* used by the browser policy filter and the server-side install
-* enforcement.
-*
-* Matching is DID-only. Handles are aggregator-supplied envelope data
-* (mutable, controlled by an attacker who compromises the aggregator)
-* and cannot be used as a trust input -- a compromised aggregator
-* could claim any handle for any package and bypass the holdback. DIDs
-* are part of the AT URI of the package record and are independently
-* resolvable, so even a compromised aggregator can't lie about the
-* publisher DID without also breaking checksum verification downstream.
-*
-* Entries from config are already lowercased at manifest-build time.
-* Runtime values are lowercased here at compare time.
-*/
-function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
-	if (!exclude || exclude.length === 0) return false;
-	const didLower = publisherDid.toLowerCase();
-	const fullDid = `${didLower}/${slug.toLowerCase()}`;
-	for (const entry of exclude) {
-		if (entry === didLower) return true;
-		if (entry === fullDid) return true;
-	}
-	return false;
-}
-const DURATION_PATTERN = /^(\d+)(s|m|h|d|w)$/;
-/** Trailing slashes on the aggregator URL, stripped during normalization. */
-const TRAILING_SLASHES = /\/+$/;
-/** Trailing dot on a hostname, stripped before URL host comparisons. */
-const TRAILING_DOT = /\.$/;
-const REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
-/**
-* Parse a duration string or raw second count into a non-negative
-* integer count of seconds. Throws on unrecognised input so config
-* mistakes fail at startup rather than silently disabling the policy.
-*/
-function parseDurationSeconds(duration) {
-	if (typeof duration === "number") {
-		if (!Number.isFinite(duration) || duration < 0) throw new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);
-		return Math.floor(duration);
-	}
-	const match = duration.match(DURATION_PATTERN);
-	if (!match) throw new Error(`Invalid duration format: "${duration}". Use a duration string like "48h", "7d", "30m", or a number of seconds.`);
-	const value = parseInt(match[1], 10);
-	const unit = match[2];
-	switch (unit) {
-		case "s": return value;
-		case "m": return value * 60;
-		case "h": return value * 60 * 60;
-		case "d": return value * 24 * 60 * 60;
-		case "w": return value * 7 * 24 * 60 * 60;
-		default: throw new Error(`Unknown duration unit: ${unit}`);
-	}
-}
-/**
-* Validate that `aggregatorUrl` is a safe outbound target for the
-* registry's XRPC calls. Same posture as artifact downloads: HTTPS
-* required in production; `http://localhost` allowed only in dev.
-*
-* The aggregator's responses are the trust source for release records,
-* checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST
-* verification lands). Allowing plain HTTP here would let a network
-* attacker swap a release record and point the artifact URL at their
-* own HTTPS bundle, defeating the checksum trust chain because the
-* attacker controls the unsigned transport that supplied the checksum.
-*/
-function validateAggregatorUrl(aggregatorUrl, options = {}) {
-	let parsed;
-	try {
-		parsed = new URL(aggregatorUrl);
-	} catch (cause) {
-		throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_INVALID", registryField("aggregatorUrl"), "must be a valid URL", { cause });
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTP or HTTPS");
-	if (parsed.username || parsed.password) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must not contain embedded credentials");
-	const rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, "");
-	const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
-	const isLocalhost = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1" || hostname.startsWith("::ffff:127.") || hostname.startsWith("::ffff:7f00:");
-	if (!(options.allowLocalhost ?? import.meta.env.DEV)) {
-		if (parsed.protocol === "http:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTPS outside development");
-		if (isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must not point at localhost outside development");
-	} else if (parsed.protocol === "http:" && !isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTPS unless it points at localhost in development");
-	return parsed;
-}
-/**
-* Expand the `RegistryConfigInput` shorthand into the full
-* `RegistryConfig` object shape.
-*
-* Users can pass a bare aggregator URL string for the common case
-* (`registry: "https://registry.emdashcms.com"`); the
-* normalizer handles either form transparently.
-*
-* Returns `undefined` for `undefined` input so callers can chain with
-* optional chaining.
-*/
-function coerceRegistryConfig(input) {
-	if (input === void 0) return void 0;
-	if (typeof input === "string") return { aggregatorUrl: input };
-	return input;
-}
-/**
-* Normalize the user-supplied `RegistryConfigInput` into the shape that
-* ships to the admin browser via the manifest endpoint.
-*
-* Accepts either the shorthand string form
-* (`"https://registry.emdashcms.com"`) or the full `RegistryConfig`
-* object. Returns `null` when `input` is undefined so callers can
-* spread the result directly into the manifest object.
-*
-* Throws a field-specific configuration error if the aggregator URL is
-* malformed or forbidden, or a registry policy value cannot be normalized.
-* The Astro integration uses this to fail during config loading. Runtime
-* manifest generation uses {@link resolveManifestRegistryConfig} to expose
-* recognized failures without exposing the configured value.
-*/
-function normalizeRegistryConfig(input, options = {}) {
-	const config = coerceRegistryConfig(input);
-	if (!config) return null;
-	const aggregatorUrl = typeof config.aggregatorUrl === "string" ? config.aggregatorUrl.trim() : void 0;
-	if (!aggregatorUrl) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_REQUIRED", registryField("aggregatorUrl"), "is required when the registry is configured");
-	validateAggregatorUrl(aggregatorUrl, options);
-	const out = { aggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, "") };
-	if (config.acceptLabelers) out.acceptLabelers = config.acceptLabelers;
-	const policy = {};
-	let hasPolicy = false;
-	if (config.policy?.minimumReleaseAge !== void 0) {
-		try {
-			policy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);
-		} catch (cause) {
-			throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_INVALID", registryField("policy.minimumReleaseAge"), "must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds", { cause });
-		}
-		hasPolicy = true;
-	}
-	if (config.policy?.minimumReleaseAgeExclude !== void 0) {
-		if (!Array.isArray(config.policy.minimumReleaseAgeExclude)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "must be an array of DIDs or <did>/<slug> entries");
-		const list = config.policy.minimumReleaseAgeExclude.map((entry) => {
-			if (typeof entry !== "string") throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
-			const trimmed = entry.trim();
-			if (!trimmed) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "entries cannot be empty");
-			const lower = trimmed.toLowerCase();
-			const [did, slug, ...extra] = lower.split("/");
-			if (!did || !isDid(did) || extra.length > 0 || slug !== void 0 && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
-			return lower;
-		});
-		if (list.length > 0) {
-			policy.minimumReleaseAgeExclude = list;
-			hasPolicy = true;
-		}
-	}
-	if (hasPolicy) out.policy = policy;
-	return out;
-}
-/** Normalize registry config without allowing a known config error to hide the admin. */
-function resolveManifestRegistryConfig(input, options = {}) {
-	try {
-		const registry = normalizeRegistryConfig(input, options);
-		return registry ? { registry } : {};
-	} catch (error) {
-		if (!(error instanceof RegistryConfigurationError)) throw error;
-		return { error: {
-			code: error.code,
-			field: error.field
-		} };
-	}
-}
-
-//#endregion
-export { parseDurationSeconds as a, resolveRegistryConfigForSandbox as c, normalizeRegistryConfig as i, validateAggregatorUrl as l, coerceRegistryConfig as n, releaseExemptFromMinimumAge as o, getRegistryConfigInput as r, resolveManifestRegistryConfig as s, canonicalCapabilitiesForDriftCheck as t };
-//# sourceMappingURL=config-Bo4eOOdV.mjs.map

package/dist/config-Bo4eOOdV.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-Bo4eOOdV.mjs","names":[],"sources":["../src/registry/config.ts"],"sourcesContent":["/**\n * Helpers for normalizing the registry integration option into the shape\n * exposed on the admin manifest.\n *\n * The integration option accepts a human-friendly duration string for\n * `policy.minimumReleaseAge` (`\"48h\"`, `\"7d\"`); the manifest exposes\n * seconds so the browser doesn't need a duration parser.\n */\n\nimport { isDid } from \"@atcute/lexicons/syntax\";\n\nimport type { RegistryConfig, RegistryConfigInput, RegistryConfigOption } from \"./types.js\";\n\nexport const DEFAULT_REGISTRY_AGGREGATOR_URL = \"https://registry.emdashcms.com\";\n\nexport function resolveRegistryConfigForSandbox(options: {\n\tregistry?: RegistryConfigOption;\n\tsandboxRunner?: string;\n\tsandboxEnabled?: boolean;\n}): RegistryConfigInput | undefined {\n\tif (options.registry === false) return undefined;\n\tif (options.registry !== undefined) return options.registry;\n\tif (options.sandboxRunner && options.sandboxEnabled !== false) {\n\t\treturn DEFAULT_REGISTRY_AGGREGATOR_URL;\n\t}\n\treturn undefined;\n}\n\nexport function getRegistryConfigInput(\n\tregistry: RegistryConfigOption | undefined,\n): RegistryConfigInput | undefined {\n\treturn registry === false ? undefined : registry;\n}\n\n/**\n * Shape returned in the admin manifest's `registry` field. The browser\n * consumes this directly -- all duration normalization and aggregator URL\n * validation has already happened by the time it gets here.\n */\nexport interface ManifestRegistryConfig {\n\taggregatorUrl: string;\n\tacceptLabelers?: string;\n\tpolicy?: {\n\t\tminimumReleaseAgeSeconds?: number;\n\t\t/**\n\t\t * Allowlist of publishers / packages exempt from the\n\t\t * {@link minimumReleaseAgeSeconds} holdback. Each entry is either:\n\t\t *\n\t\t *   - A bare publisher DID: `\"did:plc:abc123\"`. Every package from\n\t\t *     that publisher is exempt.\n\t\t *   - A `<did>/<slug>` pair: only that specific package is exempt.\n\t\t *\n\t\t * Handles are not accepted because they are mutable\n\t\t * aggregator-supplied envelope data.\n\t\t *\n\t\t * Normalized to lowercase strings at config load time so the\n\t\t * browser does case-insensitive comparison. See\n\t\t * {@link releaseExemptFromMinimumAge}.\n\t\t */\n\t\tminimumReleaseAgeExclude?: string[];\n\t};\n}\n\nexport type RegistryConfigurationErrorCode =\n\t| \"REGISTRY_AGGREGATOR_URL_REQUIRED\"\n\t| \"REGISTRY_AGGREGATOR_URL_INVALID\"\n\t| \"REGISTRY_AGGREGATOR_URL_FORBIDDEN\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\";\n\ntype RegistryConfigurationFieldSuffix =\n\t| \"aggregatorUrl\"\n\t| \"policy.minimumReleaseAge\"\n\t| \"policy.minimumReleaseAgeExclude\";\n\nexport type RegistryConfigurationField = `registry.${RegistryConfigurationFieldSuffix}`;\n\nexport interface ManifestRegistryConfigurationError {\n\tcode: RegistryConfigurationErrorCode;\n\tfield: RegistryConfigurationField;\n}\n\nclass RegistryConfigurationError extends Error {\n\tconstructor(\n\t\tpublic readonly code: RegistryConfigurationErrorCode,\n\t\tpublic readonly field: RegistryConfigurationField,\n\t\tmessage: string,\n\t\toptions?: ErrorOptions,\n\t) {\n\t\tsuper(`EmDash registry configuration error in ${field}: ${message}`, options);\n\t\tthis.name = \"RegistryConfigurationError\";\n\t}\n}\n\nexport interface RegistryConfigurationValidationOptions {\n\tallowLocalhost?: boolean;\n}\n\nfunction registryField(suffix: RegistryConfigurationFieldSuffix): RegistryConfigurationField {\n\treturn `registry.${suffix}`;\n}\n\n/**\n * Canonicalize a capabilities list for set-style comparison.\n *\n * Capabilities (the legacy declared-access shape used by the current\n * sandbox enforcer) are conceptually a *set*: order, duplicates, and\n * non-string entries don't carry meaning. The install handler's drift\n * check compares the admin's acknowledged set against the bundle\n * manifest's set; both sides pass through this canonicalizer first so\n * an aggregator-supplied array with unstable order or junk entries\n * can't cause a spurious drift rejection.\n *\n * Filters non-strings, deduplicates, and sorts lexically. Named to\n * avoid shadowing `@emdash-cms/plugin-types`'s existing\n * `normalizeCapabilities` (which dedupes + applies the deprecated →\n * current alias map but does not filter junk or sort).\n *\n * Exported so the same shape is produced by the browser before sending\n * the `acknowledgedDeclaredAccess` payload and by the server before\n * comparing against the bundle.\n */\nexport function canonicalCapabilitiesForDriftCheck(value: unknown): string[] {\n\tif (!Array.isArray(value)) return [];\n\tconst seen = new Set<string>();\n\tfor (const entry of value) {\n\t\tif (typeof entry === \"string\" && entry.length > 0) {\n\t\t\tseen.add(entry);\n\t\t}\n\t}\n\treturn [...seen].toSorted();\n}\n\n/**\n * Returns whether a `(publisher_did, slug)` pair is on the\n * minimum-release-age exemption list. Exported so the same matcher is\n * used by the browser policy filter and the server-side install\n * enforcement.\n *\n * Matching is DID-only. Handles are aggregator-supplied envelope data\n * (mutable, controlled by an attacker who compromises the aggregator)\n * and cannot be used as a trust input -- a compromised aggregator\n * could claim any handle for any package and bypass the holdback. DIDs\n * are part of the AT URI of the package record and are independently\n * resolvable, so even a compromised aggregator can't lie about the\n * publisher DID without also breaking checksum verification downstream.\n *\n * Entries from config are already lowercased at manifest-build time.\n * Runtime values are lowercased here at compare time.\n */\nexport function releaseExemptFromMinimumAge(\n\texclude: readonly string[] | undefined,\n\tpublisherDid: string,\n\tslug: string,\n): boolean {\n\tif (!exclude || exclude.length === 0) return false;\n\tconst didLower = publisherDid.toLowerCase();\n\tconst slugLower = slug.toLowerCase();\n\tconst fullDid = `${didLower}/${slugLower}`;\n\n\tfor (const entry of exclude) {\n\t\tif (entry === didLower) return true;\n\t\tif (entry === fullDid) return true;\n\t}\n\treturn false;\n}\n\nconst DURATION_PATTERN = /^(\\d+)(s|m|h|d|w)$/;\n\n/** Trailing slashes on the aggregator URL, stripped during normalization. */\nconst TRAILING_SLASHES = /\\/+$/;\n\n/** Trailing dot on a hostname, stripped before URL host comparisons. */\nconst TRAILING_DOT = /\\.$/;\n\nconst REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;\n\n/**\n * Parse a duration string or raw second count into a non-negative\n * integer count of seconds. Throws on unrecognised input so config\n * mistakes fail at startup rather than silently disabling the policy.\n */\nexport function parseDurationSeconds(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\tif (!Number.isFinite(duration) || duration < 0) {\n\t\t\tthrow new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);\n\t\t}\n\t\treturn Math.floor(duration);\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use a duration string like \"48h\", \"7d\", \"30m\", or a number of seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 24 * 60 * 60;\n\t\tcase \"w\":\n\t\t\treturn value * 7 * 24 * 60 * 60;\n\t\tdefault:\n\t\t\t// Unreachable given the regex, but keep the exhaustive arm for\n\t\t\t// future maintainers who add a unit to the pattern.\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Validate that `aggregatorUrl` is a safe outbound target for the\n * registry's XRPC calls. Same posture as artifact downloads: HTTPS\n * required in production; `http://localhost` allowed only in dev.\n *\n * The aggregator's responses are the trust source for release records,\n * checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST\n * verification lands). Allowing plain HTTP here would let a network\n * attacker swap a release record and point the artifact URL at their\n * own HTTPS bundle, defeating the checksum trust chain because the\n * attacker controls the unsigned transport that supplied the checksum.\n */\nexport function validateAggregatorUrl(\n\taggregatorUrl: string,\n\toptions: RegistryConfigurationValidationOptions = {},\n): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(aggregatorUrl);\n\t} catch (cause) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_INVALID\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must be a valid URL\",\n\t\t\t{ cause },\n\t\t);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must use HTTP or HTTPS\",\n\t\t);\n\t}\n\t// Reject embedded credentials. The normalized aggregator URL ends\n\t// up in the admin manifest and is shipped to every admin browser;\n\t// browser `fetch()` also outright rejects URLs with `user:pass@`,\n\t// so leaving them in would both leak the credentials and break the\n\t// registry UI at runtime.\n\tif (parsed.username || parsed.password) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must not contain embedded credentials\",\n\t\t);\n\t}\n\n\t// WHATWG URL preserves the brackets on IPv6 hostnames -- strip them\n\t// before any comparison so `https://[::1]/` is recognised as localhost\n\t// and not treated as a generic domain string.\n\tconst rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname =\n\t\trawHostname.startsWith(\"[\") && rawHostname.endsWith(\"]\")\n\t\t\t? rawHostname.slice(1, -1)\n\t\t\t: rawHostname;\n\tconst isLocalhost =\n\t\thostname === \"localhost\" ||\n\t\thostname.endsWith(\".localhost\") ||\n\t\thostname === \"127.0.0.1\" ||\n\t\thostname === \"::1\" ||\n\t\t// IPv4-mapped IPv6 forms of loopback, e.g. `::ffff:127.0.0.1` and `::ffff:7f00:1`.\n\t\thostname.startsWith(\"::ffff:127.\") ||\n\t\thostname.startsWith(\"::ffff:7f00:\");\n\n\tconst allowLocalhost = options.allowLocalhost ?? import.meta.env.DEV;\n\tif (!allowLocalhost) {\n\t\tif (parsed.protocol === \"http:\") {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\t\"must use HTTPS outside development\",\n\t\t\t);\n\t\t}\n\t\tif (isLocalhost) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\t\"must not point at localhost outside development\",\n\t\t\t);\n\t\t}\n\t} else if (parsed.protocol === \"http:\" && !isLocalhost) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must use HTTPS unless it points at localhost in development\",\n\t\t);\n\t}\n\n\treturn parsed;\n}\n\n/**\n * Expand the `RegistryConfigInput` shorthand into the full\n * `RegistryConfig` object shape.\n *\n * Users can pass a bare aggregator URL string for the common case\n * (`registry: \"https://registry.emdashcms.com\"`); the\n * normalizer handles either form transparently.\n *\n * Returns `undefined` for `undefined` input so callers can chain with\n * optional chaining.\n */\nexport function coerceRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n): RegistryConfig | undefined {\n\tif (input === undefined) return undefined;\n\tif (typeof input === \"string\") return { aggregatorUrl: input };\n\treturn input;\n}\n\n/**\n * Normalize the user-supplied `RegistryConfigInput` into the shape that\n * ships to the admin browser via the manifest endpoint.\n *\n * Accepts either the shorthand string form\n * (`\"https://registry.emdashcms.com\"`) or the full `RegistryConfig`\n * object. Returns `null` when `input` is undefined so callers can\n * spread the result directly into the manifest object.\n *\n * Throws a field-specific configuration error if the aggregator URL is\n * malformed or forbidden, or a registry policy value cannot be normalized.\n * The Astro integration uses this to fail during config loading. Runtime\n * manifest generation uses {@link resolveManifestRegistryConfig} to expose\n * recognized failures without exposing the configured value.\n */\nexport function normalizeRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): ManifestRegistryConfig | null {\n\tconst config = coerceRegistryConfig(input);\n\tif (!config) return null;\n\n\tconst aggregatorUrl =\n\t\ttypeof config.aggregatorUrl === \"string\" ? config.aggregatorUrl.trim() : undefined;\n\tif (!aggregatorUrl) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_REQUIRED\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"is required when the registry is configured\",\n\t\t);\n\t}\n\n\tvalidateAggregatorUrl(aggregatorUrl, options);\n\n\tconst out: ManifestRegistryConfig = {\n\t\t// Strip any trailing slash so `${aggregatorUrl}/xrpc/...` works\n\t\t// regardless of how the user wrote it.\n\t\taggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, \"\"),\n\t};\n\n\tif (config.acceptLabelers) {\n\t\tout.acceptLabelers = config.acceptLabelers;\n\t}\n\n\tconst policy: ManifestRegistryConfig[\"policy\"] = {};\n\tlet hasPolicy = false;\n\n\tif (config.policy?.minimumReleaseAge !== undefined) {\n\t\ttry {\n\t\t\tpolicy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);\n\t\t} catch (cause) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\",\n\t\t\t\tregistryField(\"policy.minimumReleaseAge\"),\n\t\t\t\t'must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds',\n\t\t\t\t{ cause },\n\t\t\t);\n\t\t}\n\t\thasPolicy = true;\n\t}\n\n\tif (config.policy?.minimumReleaseAgeExclude !== undefined) {\n\t\tif (!Array.isArray(config.policy.minimumReleaseAgeExclude)) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\"must be an array of DIDs or <did>/<slug> entries\",\n\t\t\t);\n\t\t}\n\t\t// Normalize at load time so callers (browser and server) can do\n\t\t// plain string compares without each one re-implementing the\n\t\t// case-folding rule.\n\t\tconst list = config.policy.minimumReleaseAgeExclude.map((entry) => {\n\t\t\tif (typeof entry !== \"string\") {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst trimmed = entry.trim();\n\t\t\tif (!trimmed) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"entries cannot be empty\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst lower = trimmed.toLowerCase();\n\t\t\tconst [did, slug, ...extra] = lower.split(\"/\");\n\t\t\tif (\n\t\t\t\t!did ||\n\t\t\t\t!isDid(did) ||\n\t\t\t\textra.length > 0 ||\n\t\t\t\t(slug !== undefined && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug))\n\t\t\t) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn lower;\n\t\t});\n\t\tif (list.length > 0) {\n\t\t\tpolicy.minimumReleaseAgeExclude = list;\n\t\t\thasPolicy = true;\n\t\t}\n\t}\n\n\tif (hasPolicy) {\n\t\tout.policy = policy;\n\t}\n\n\treturn out;\n}\n\n/** Normalize registry config without allowing a known config error to hide the admin. */\nexport function resolveManifestRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): {\n\tregistry?: ManifestRegistryConfig;\n\terror?: ManifestRegistryConfigurationError;\n} {\n\ttry {\n\t\tconst registry = normalizeRegistryConfig(input, options);\n\t\treturn registry ? { registry } : {};\n\t} catch (error) {\n\t\tif (!(error instanceof RegistryConfigurationError)) throw error;\n\t\treturn { error: { code: error.code, field: error.field } };\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAaA,MAAa,kCAAkC;AAE/C,SAAgB,gCAAgC,SAIZ;AACnC,KAAI,QAAQ,aAAa,MAAO,QAAO;AACvC,KAAI,QAAQ,aAAa,OAAW,QAAO,QAAQ;AACnD,KAAI,QAAQ,iBAAiB,QAAQ,mBAAmB,MACvD,QAAO;;AAKT,SAAgB,uBACf,UACkC;AAClC,QAAO,aAAa,QAAQ,SAAY;;AAmDzC,IAAM,6BAAN,cAAyC,MAAM;CAC9C,YACC,AAAgB,MAChB,AAAgB,OAChB,SACA,SACC;AACD,QAAM,0CAA0C,MAAM,IAAI,WAAW,QAAQ;EAL7D;EACA;AAKhB,OAAK,OAAO;;;AAQd,SAAS,cAAc,QAAsE;AAC5F,QAAO,YAAY;;;;;;;;;;;;;;;;;;;;;;AAuBpB,SAAgB,mCAAmC,OAA0B;AAC5E,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,EAAE;CACpC,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,SAAS,MACnB,KAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC/C,MAAK,IAAI,MAAM;AAGjB,QAAO,CAAC,GAAG,KAAK,CAAC,UAAU;;;;;;;;;;;;;;;;;;;AAoB5B,SAAgB,4BACf,SACA,cACA,MACU;AACV,KAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;CAC7C,MAAM,WAAW,aAAa,aAAa;CAE3C,MAAM,UAAU,GAAG,SAAS,GADV,KAAK,aAAa;AAGpC,MAAK,MAAM,SAAS,SAAS;AAC5B,MAAI,UAAU,SAAU,QAAO;AAC/B,MAAI,UAAU,QAAS,QAAO;;AAE/B,QAAO;;AAGR,MAAM,mBAAmB;;AAGzB,MAAM,mBAAmB;;AAGzB,MAAM,eAAe;AAErB,MAAM,gCAAgC;;;;;;AAOtC,SAAgB,qBAAqB,UAAmC;AACvE,KAAI,OAAO,aAAa,UAAU;AACjC,MAAI,CAAC,OAAO,SAAS,SAAS,IAAI,WAAW,EAC5C,OAAM,IAAI,MAAM,qBAAqB,SAAS,yCAAyC;AAExF,SAAO,KAAK,MAAM,SAAS;;CAG5B,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,2EACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,IAAI,KAAK,KAAK;EAC9B,QAGC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;;;;;;;;;;AAgBpD,SAAgB,sBACf,eACA,UAAkD,EAAE,EAC9C;CACN,IAAI;AACJ,KAAI;AACH,WAAS,IAAI,IAAI,cAAc;UACvB,OAAO;AACf,QAAM,IAAI,2BACT,mCACA,cAAc,gBAAgB,EAC9B,uBACA,EAAE,OAAO,CACT;;AAEF,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,yBACA;AAOF,KAAI,OAAO,YAAY,OAAO,SAC7B,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,wCACA;CAMF,MAAM,cAAc,OAAO,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;CAC3E,MAAM,WACL,YAAY,WAAW,IAAI,IAAI,YAAY,SAAS,IAAI,GACrD,YAAY,MAAM,GAAG,GAAG,GACxB;CACJ,MAAM,cACL,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,aAAa,SAEb,SAAS,WAAW,cAAc,IAClC,SAAS,WAAW,eAAe;AAGpC,KAAI,EADmB,QAAQ,kBAAkB,OAAO,KAAK,IAAI,MAC5C;AACpB,MAAI,OAAO,aAAa,QACvB,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,qCACA;AAEF,MAAI,YACH,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,kDACA;YAEQ,OAAO,aAAa,WAAW,CAAC,YAC1C,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,8DACA;AAGF,QAAO;;;;;;;;;;;;;AAcR,SAAgB,qBACf,OAC6B;AAC7B,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,SAAU,QAAO,EAAE,eAAe,OAAO;AAC9D,QAAO;;;;;;;;;;;;;;;;;AAkBR,SAAgB,wBACf,OACA,UAAkD,EAAE,EACpB;CAChC,MAAM,SAAS,qBAAqB,MAAM;AAC1C,KAAI,CAAC,OAAQ,QAAO;CAEpB,MAAM,gBACL,OAAO,OAAO,kBAAkB,WAAW,OAAO,cAAc,MAAM,GAAG;AAC1E,KAAI,CAAC,cACJ,OAAM,IAAI,2BACT,oCACA,cAAc,gBAAgB,EAC9B,8CACA;AAGF,uBAAsB,eAAe,QAAQ;CAE7C,MAAM,MAA8B,EAGnC,eAAe,cAAc,QAAQ,kBAAkB,GAAG,EAC1D;AAED,KAAI,OAAO,eACV,KAAI,iBAAiB,OAAO;CAG7B,MAAM,SAA2C,EAAE;CACnD,IAAI,YAAY;AAEhB,KAAI,OAAO,QAAQ,sBAAsB,QAAW;AACnD,MAAI;AACH,UAAO,2BAA2B,qBAAqB,OAAO,OAAO,kBAAkB;WAC/E,OAAO;AACf,SAAM,IAAI,2BACT,wCACA,cAAc,2BAA2B,EACzC,mFACA,EAAE,OAAO,CACT;;AAEF,cAAY;;AAGb,KAAI,OAAO,QAAQ,6BAA6B,QAAW;AAC1D,MAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,yBAAyB,CACzD,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,mDACA;EAKF,MAAM,OAAO,OAAO,OAAO,yBAAyB,KAAK,UAAU;AAClE,OAAI,OAAO,UAAU,SACpB,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,+DACA;GAEF,MAAM,UAAU,MAAM,MAAM;AAC5B,OAAI,CAAC,QACJ,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,0BACA;GAEF,MAAM,QAAQ,QAAQ,aAAa;GACnC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,MAAM,MAAM,IAAI;AAC9C,OACC,CAAC,OACD,CAAC,MAAM,IAAI,IACX,MAAM,SAAS,KACd,SAAS,UAAa,CAAC,8BAA8B,KAAK,KAAK,CAEhE,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,+DACA;AAEF,UAAO;IACN;AACF,MAAI,KAAK,SAAS,GAAG;AACpB,UAAO,2BAA2B;AAClC,eAAY;;;AAId,KAAI,UACH,KAAI,SAAS;AAGd,QAAO;;;AAIR,SAAgB,8BACf,OACA,UAAkD,EAAE,EAInD;AACD,KAAI;EACH,MAAM,WAAW,wBAAwB,OAAO,QAAQ;AACxD,SAAO,WAAW,EAAE,UAAU,GAAG,EAAE;UAC3B,OAAO;AACf,MAAI,EAAE,iBAAiB,4BAA6B,OAAM;AAC1D,SAAO,EAAE,OAAO;GAAE,MAAM,MAAM;GAAM,OAAO,MAAM;GAAO,EAAE"}