emdash 1.3.1 → 1.4.0

package/dist/config-DBU6iUQB.mjs

@@ -0,0 +1,228 @@
+import { isDid } from "@atcute/lexicons/syntax";
+
+//#region src/registry/config.ts
+/**
+* Helpers for normalizing the registry integration option into the shape
+* exposed on the admin manifest.
+*
+* The integration option accepts a human-friendly duration string for
+* `policy.minimumReleaseAge` (`"48h"`, `"7d"`); the manifest exposes
+* seconds so the browser doesn't need a duration parser.
+*/
+const DEFAULT_REGISTRY_AGGREGATOR_URL = "https://registry.emdashcms.com";
+function resolveRegistryConfigForSandbox(options) {
+	if (options.registry === false) return void 0;
+	if (options.registry !== void 0) return options.registry;
+	if (options.sandboxRunner && options.sandboxEnabled !== false) return DEFAULT_REGISTRY_AGGREGATOR_URL;
+}
+function getRegistryConfigInput(registry) {
+	return registry === false ? void 0 : registry;
+}
+var RegistryConfigurationError = class extends Error {
+	constructor(code, field, message, options) {
+		super(`EmDash registry configuration error in ${field}: ${message}`, options);
+		this.code = code;
+		this.field = field;
+		this.name = "RegistryConfigurationError";
+	}
+};
+function registryField(suffix) {
+	return `registry.${suffix}`;
+}
+/**
+* Canonicalize a capabilities list for set-style comparison.
+*
+* Capabilities (the legacy declared-access shape used by the current
+* sandbox enforcer) are conceptually a *set*: order, duplicates, and
+* non-string entries don't carry meaning. The install handler's drift
+* check compares the admin's acknowledged set against the bundle
+* manifest's set; both sides pass through this canonicalizer first so
+* an aggregator-supplied array with unstable order or junk entries
+* can't cause a spurious drift rejection.
+*
+* Filters non-strings, deduplicates, and sorts lexically. Named to
+* avoid shadowing `@emdash-cms/plugin-types`'s existing
+* `normalizeCapabilities` (which dedupes + applies the deprecated →
+* current alias map but does not filter junk or sort).
+*
+* Exported so the same shape is produced by the browser before sending
+* the `acknowledgedDeclaredAccess` payload and by the server before
+* comparing against the bundle.
+*/
+function canonicalCapabilitiesForDriftCheck(value) {
+	if (!Array.isArray(value)) return [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) if (typeof entry === "string" && entry.length > 0) seen.add(entry);
+	return [...seen].toSorted();
+}
+/**
+* Returns whether a `(publisher_did, slug)` pair is on the
+* minimum-release-age exemption list. Exported so the same matcher is
+* used by the browser policy filter and the server-side install
+* enforcement.
+*
+* Matching is DID-only. Handles are aggregator-supplied envelope data
+* (mutable, controlled by an attacker who compromises the aggregator)
+* and cannot be used as a trust input -- a compromised aggregator
+* could claim any handle for any package and bypass the holdback. DIDs
+* are part of the AT URI of the package record and are independently
+* resolvable, so even a compromised aggregator can't lie about the
+* publisher DID without also breaking checksum verification downstream.
+*
+* Entries from config are already lowercased at manifest-build time.
+* Runtime values are lowercased here at compare time.
+*/
+function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
+	if (!exclude || exclude.length === 0) return false;
+	const didLower = publisherDid.toLowerCase();
+	const fullDid = `${didLower}/${slug.toLowerCase()}`;
+	for (const entry of exclude) {
+		if (entry === didLower) return true;
+		if (entry === fullDid) return true;
+	}
+	return false;
+}
+const DURATION_PATTERN = /^(\d+)(s|m|h|d|w)$/;
+/** Trailing slashes on the aggregator URL, stripped during normalization. */
+const TRAILING_SLASHES = /\/+$/;
+/** Trailing dot on a hostname, stripped before URL host comparisons. */
+const TRAILING_DOT = /\.$/;
+const REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+/**
+* Parse a duration string or raw second count into a non-negative
+* integer count of seconds. Throws on unrecognised input so config
+* mistakes fail at startup rather than silently disabling the policy.
+*/
+function parseDurationSeconds(duration) {
+	if (typeof duration === "number") {
+		if (!Number.isFinite(duration) || duration < 0) throw new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);
+		return Math.floor(duration);
+	}
+	const match = duration.match(DURATION_PATTERN);
+	if (!match) throw new Error(`Invalid duration format: "${duration}". Use a duration string like "48h", "7d", "30m", or a number of seconds.`);
+	const value = parseInt(match[1], 10);
+	const unit = match[2];
+	switch (unit) {
+		case "s": return value;
+		case "m": return value * 60;
+		case "h": return value * 60 * 60;
+		case "d": return value * 24 * 60 * 60;
+		case "w": return value * 7 * 24 * 60 * 60;
+		default: throw new Error(`Unknown duration unit: ${unit}`);
+	}
+}
+/**
+* Validate that `aggregatorUrl` is a safe outbound target for the
+* registry's XRPC calls. Same posture as artifact downloads: HTTPS
+* required in production; `http://localhost` allowed only in dev.
+*
+* The aggregator's responses are the trust source for release records,
+* checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST
+* verification lands). Allowing plain HTTP here would let a network
+* attacker swap a release record and point the artifact URL at their
+* own HTTPS bundle, defeating the checksum trust chain because the
+* attacker controls the unsigned transport that supplied the checksum.
+*/
+function validateAggregatorUrl(aggregatorUrl, options = {}) {
+	let parsed;
+	try {
+		parsed = new URL(aggregatorUrl);
+	} catch (cause) {
+		throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_INVALID", registryField("aggregatorUrl"), "must be a valid URL", { cause });
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTP or HTTPS");
+	if (parsed.username || parsed.password) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must not contain embedded credentials");
+	const rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, "");
+	const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
+	const isLocalhost = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1" || hostname.startsWith("::ffff:127.") || hostname.startsWith("::ffff:7f00:");
+	if (!(options.allowLocalhost ?? import.meta.env.DEV)) {
+		if (parsed.protocol === "http:") throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTPS outside development");
+		if (isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must not point at localhost outside development");
+	} else if (parsed.protocol === "http:" && !isLocalhost) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_FORBIDDEN", registryField("aggregatorUrl"), "must use HTTPS unless it points at localhost in development");
+	return parsed;
+}
+/**
+* Expand the `RegistryConfigInput` shorthand into the full
+* `RegistryConfig` object shape.
+*
+* Users can pass a bare aggregator URL string for the common case
+* (`registry: "https://registry.emdashcms.com"`); the
+* normalizer handles either form transparently.
+*
+* Returns `undefined` for `undefined` input so callers can chain with
+* optional chaining.
+*/
+function coerceRegistryConfig(input) {
+	if (input === void 0) return void 0;
+	if (typeof input === "string") return { aggregatorUrl: input };
+	return input;
+}
+/**
+* Normalize the user-supplied `RegistryConfigInput` into the shape that
+* ships to the admin browser via the manifest endpoint.
+*
+* Accepts either the shorthand string form
+* (`"https://registry.emdashcms.com"`) or the full `RegistryConfig`
+* object. Returns `null` when `input` is undefined so callers can
+* spread the result directly into the manifest object.
+*
+* Throws a field-specific configuration error if the aggregator URL is
+* malformed or forbidden, or a registry policy value cannot be normalized.
+* The Astro integration uses this to fail during config loading. Runtime
+* manifest generation uses {@link resolveManifestRegistryConfig} to expose
+* recognized failures without exposing the configured value.
+*/
+function normalizeRegistryConfig(input, options = {}) {
+	const config = coerceRegistryConfig(input);
+	if (!config) return null;
+	const aggregatorUrl = typeof config.aggregatorUrl === "string" ? config.aggregatorUrl.trim() : void 0;
+	if (!aggregatorUrl) throw new RegistryConfigurationError("REGISTRY_AGGREGATOR_URL_REQUIRED", registryField("aggregatorUrl"), "is required when the registry is configured");
+	validateAggregatorUrl(aggregatorUrl, options);
+	const out = { aggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, "") };
+	if (config.acceptLabelers) out.acceptLabelers = config.acceptLabelers;
+	const policy = {};
+	let hasPolicy = false;
+	if (config.policy?.minimumReleaseAge !== void 0) {
+		try {
+			policy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);
+		} catch (cause) {
+			throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_INVALID", registryField("policy.minimumReleaseAge"), "must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds", { cause });
+		}
+		hasPolicy = true;
+	}
+	if (config.policy?.minimumReleaseAgeExclude !== void 0) {
+		if (!Array.isArray(config.policy.minimumReleaseAgeExclude)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "must be an array of DIDs or <did>/<slug> entries");
+		const list = config.policy.minimumReleaseAgeExclude.map((entry) => {
+			if (typeof entry !== "string") throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
+			const trimmed = entry.trim();
+			if (!trimmed) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "entries cannot be empty");
+			const lower = trimmed.toLowerCase();
+			const [did, slug, ...extra] = lower.split("/");
+			if (!did || !isDid(did) || extra.length > 0 || slug !== void 0 && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug)) throw new RegistryConfigurationError("REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID", registryField("policy.minimumReleaseAgeExclude"), "minimumReleaseAgeExclude entry must be a DID or <did>/<slug>");
+			return lower;
+		});
+		if (list.length > 0) {
+			policy.minimumReleaseAgeExclude = list;
+			hasPolicy = true;
+		}
+	}
+	if (hasPolicy) out.policy = policy;
+	return out;
+}
+/** Normalize registry config without allowing a known config error to hide the admin. */
+function resolveManifestRegistryConfig(input, options = {}) {
+	try {
+		const registry = normalizeRegistryConfig(input, options);
+		return registry ? { registry } : {};
+	} catch (error) {
+		if (!(error instanceof RegistryConfigurationError)) throw error;
+		return { error: {
+			code: error.code,
+			field: error.field
+		} };
+	}
+}
+
+//#endregion
+export { parseDurationSeconds as a, resolveRegistryConfigForSandbox as c, normalizeRegistryConfig as i, validateAggregatorUrl as l, coerceRegistryConfig as n, releaseExemptFromMinimumAge as o, getRegistryConfigInput as r, resolveManifestRegistryConfig as s, canonicalCapabilitiesForDriftCheck as t };
+//# sourceMappingURL=config-DBU6iUQB.mjs.map

package/dist/config-DBU6iUQB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-DBU6iUQB.mjs","names":[],"sources":["../src/registry/config.ts"],"sourcesContent":["/**\n * Helpers for normalizing the registry integration option into the shape\n * exposed on the admin manifest.\n *\n * The integration option accepts a human-friendly duration string for\n * `policy.minimumReleaseAge` (`\"48h\"`, `\"7d\"`); the manifest exposes\n * seconds so the browser doesn't need a duration parser.\n */\n\nimport { isDid } from \"@atcute/lexicons/syntax\";\n\nimport type { RegistryConfig, RegistryConfigInput, RegistryConfigOption } from \"./types.js\";\n\nexport const DEFAULT_REGISTRY_AGGREGATOR_URL = \"https://registry.emdashcms.com\";\n\nexport function resolveRegistryConfigForSandbox(options: {\n\tregistry?: RegistryConfigOption;\n\tsandboxRunner?: string;\n\tsandboxEnabled?: boolean;\n}): RegistryConfigInput | undefined {\n\tif (options.registry === false) return undefined;\n\tif (options.registry !== undefined) return options.registry;\n\tif (options.sandboxRunner && options.sandboxEnabled !== false) {\n\t\treturn DEFAULT_REGISTRY_AGGREGATOR_URL;\n\t}\n\treturn undefined;\n}\n\nexport function getRegistryConfigInput(\n\tregistry: RegistryConfigOption | undefined,\n): RegistryConfigInput | undefined {\n\treturn registry === false ? undefined : registry;\n}\n\n/**\n * Shape returned in the admin manifest's `registry` field. The browser\n * consumes this directly -- all duration normalization and aggregator URL\n * validation has already happened by the time it gets here.\n */\nexport interface ManifestRegistryConfig {\n\taggregatorUrl: string;\n\tacceptLabelers?: string;\n\tpolicy?: {\n\t\tminimumReleaseAgeSeconds?: number;\n\t\t/**\n\t\t * Allowlist of publishers / packages exempt from the\n\t\t * {@link minimumReleaseAgeSeconds} holdback. Each entry is either:\n\t\t *\n\t\t *   - A bare publisher DID: `\"did:plc:abc123\"`. Every package from\n\t\t *     that publisher is exempt.\n\t\t *   - A `<did>/<slug>` pair: only that specific package is exempt.\n\t\t *\n\t\t * Handles are not accepted because they are mutable\n\t\t * aggregator-supplied envelope data.\n\t\t *\n\t\t * Normalized to lowercase strings at config load time so the\n\t\t * browser does case-insensitive comparison. See\n\t\t * {@link releaseExemptFromMinimumAge}.\n\t\t */\n\t\tminimumReleaseAgeExclude?: string[];\n\t};\n}\n\nexport type RegistryConfigurationErrorCode =\n\t| \"REGISTRY_AGGREGATOR_URL_REQUIRED\"\n\t| \"REGISTRY_AGGREGATOR_URL_INVALID\"\n\t| \"REGISTRY_AGGREGATOR_URL_FORBIDDEN\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\"\n\t| \"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\";\n\ntype RegistryConfigurationFieldSuffix =\n\t| \"aggregatorUrl\"\n\t| \"policy.minimumReleaseAge\"\n\t| \"policy.minimumReleaseAgeExclude\";\n\nexport type RegistryConfigurationField = `registry.${RegistryConfigurationFieldSuffix}`;\n\nexport interface ManifestRegistryConfigurationError {\n\tcode: RegistryConfigurationErrorCode;\n\tfield: RegistryConfigurationField;\n}\n\nclass RegistryConfigurationError extends Error {\n\tconstructor(\n\t\tpublic readonly code: RegistryConfigurationErrorCode,\n\t\tpublic readonly field: RegistryConfigurationField,\n\t\tmessage: string,\n\t\toptions?: ErrorOptions,\n\t) {\n\t\tsuper(`EmDash registry configuration error in ${field}: ${message}`, options);\n\t\tthis.name = \"RegistryConfigurationError\";\n\t}\n}\n\nexport interface RegistryConfigurationValidationOptions {\n\tallowLocalhost?: boolean;\n}\n\nfunction registryField(suffix: RegistryConfigurationFieldSuffix): RegistryConfigurationField {\n\treturn `registry.${suffix}`;\n}\n\n/**\n * Canonicalize a capabilities list for set-style comparison.\n *\n * Capabilities (the legacy declared-access shape used by the current\n * sandbox enforcer) are conceptually a *set*: order, duplicates, and\n * non-string entries don't carry meaning. The install handler's drift\n * check compares the admin's acknowledged set against the bundle\n * manifest's set; both sides pass through this canonicalizer first so\n * an aggregator-supplied array with unstable order or junk entries\n * can't cause a spurious drift rejection.\n *\n * Filters non-strings, deduplicates, and sorts lexically. Named to\n * avoid shadowing `@emdash-cms/plugin-types`'s existing\n * `normalizeCapabilities` (which dedupes + applies the deprecated →\n * current alias map but does not filter junk or sort).\n *\n * Exported so the same shape is produced by the browser before sending\n * the `acknowledgedDeclaredAccess` payload and by the server before\n * comparing against the bundle.\n */\nexport function canonicalCapabilitiesForDriftCheck(value: unknown): string[] {\n\tif (!Array.isArray(value)) return [];\n\tconst seen = new Set<string>();\n\tfor (const entry of value) {\n\t\tif (typeof entry === \"string\" && entry.length > 0) {\n\t\t\tseen.add(entry);\n\t\t}\n\t}\n\treturn [...seen].toSorted();\n}\n\n/**\n * Returns whether a `(publisher_did, slug)` pair is on the\n * minimum-release-age exemption list. Exported so the same matcher is\n * used by the browser policy filter and the server-side install\n * enforcement.\n *\n * Matching is DID-only. Handles are aggregator-supplied envelope data\n * (mutable, controlled by an attacker who compromises the aggregator)\n * and cannot be used as a trust input -- a compromised aggregator\n * could claim any handle for any package and bypass the holdback. DIDs\n * are part of the AT URI of the package record and are independently\n * resolvable, so even a compromised aggregator can't lie about the\n * publisher DID without also breaking checksum verification downstream.\n *\n * Entries from config are already lowercased at manifest-build time.\n * Runtime values are lowercased here at compare time.\n */\nexport function releaseExemptFromMinimumAge(\n\texclude: readonly string[] | undefined,\n\tpublisherDid: string,\n\tslug: string,\n): boolean {\n\tif (!exclude || exclude.length === 0) return false;\n\tconst didLower = publisherDid.toLowerCase();\n\tconst slugLower = slug.toLowerCase();\n\tconst fullDid = `${didLower}/${slugLower}`;\n\n\tfor (const entry of exclude) {\n\t\tif (entry === didLower) return true;\n\t\tif (entry === fullDid) return true;\n\t}\n\treturn false;\n}\n\nconst DURATION_PATTERN = /^(\\d+)(s|m|h|d|w)$/;\n\n/** Trailing slashes on the aggregator URL, stripped during normalization. */\nconst TRAILING_SLASHES = /\\/+$/;\n\n/** Trailing dot on a hostname, stripped before URL host comparisons. */\nconst TRAILING_DOT = /\\.$/;\n\nconst REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;\n\n/**\n * Parse a duration string or raw second count into a non-negative\n * integer count of seconds. Throws on unrecognised input so config\n * mistakes fail at startup rather than silently disabling the policy.\n */\nexport function parseDurationSeconds(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\tif (!Number.isFinite(duration) || duration < 0) {\n\t\t\tthrow new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);\n\t\t}\n\t\treturn Math.floor(duration);\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use a duration string like \"48h\", \"7d\", \"30m\", or a number of seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 24 * 60 * 60;\n\t\tcase \"w\":\n\t\t\treturn value * 7 * 24 * 60 * 60;\n\t\tdefault:\n\t\t\t// Unreachable given the regex, but keep the exhaustive arm for\n\t\t\t// future maintainers who add a unit to the pattern.\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Validate that `aggregatorUrl` is a safe outbound target for the\n * registry's XRPC calls. Same posture as artifact downloads: HTTPS\n * required in production; `http://localhost` allowed only in dev.\n *\n * The aggregator's responses are the trust source for release records,\n * checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST\n * verification lands). Allowing plain HTTP here would let a network\n * attacker swap a release record and point the artifact URL at their\n * own HTTPS bundle, defeating the checksum trust chain because the\n * attacker controls the unsigned transport that supplied the checksum.\n */\nexport function validateAggregatorUrl(\n\taggregatorUrl: string,\n\toptions: RegistryConfigurationValidationOptions = {},\n): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(aggregatorUrl);\n\t} catch (cause) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_INVALID\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must be a valid URL\",\n\t\t\t{ cause },\n\t\t);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must use HTTP or HTTPS\",\n\t\t);\n\t}\n\t// Reject embedded credentials. The normalized aggregator URL ends\n\t// up in the admin manifest and is shipped to every admin browser;\n\t// browser `fetch()` also outright rejects URLs with `user:pass@`,\n\t// so leaving them in would both leak the credentials and break the\n\t// registry UI at runtime.\n\tif (parsed.username || parsed.password) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must not contain embedded credentials\",\n\t\t);\n\t}\n\n\t// WHATWG URL preserves the brackets on IPv6 hostnames -- strip them\n\t// before any comparison so `https://[::1]/` is recognised as localhost\n\t// and not treated as a generic domain string.\n\tconst rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname =\n\t\trawHostname.startsWith(\"[\") && rawHostname.endsWith(\"]\")\n\t\t\t? rawHostname.slice(1, -1)\n\t\t\t: rawHostname;\n\tconst isLocalhost =\n\t\thostname === \"localhost\" ||\n\t\thostname.endsWith(\".localhost\") ||\n\t\thostname === \"127.0.0.1\" ||\n\t\thostname === \"::1\" ||\n\t\t// IPv4-mapped IPv6 forms of loopback, e.g. `::ffff:127.0.0.1` and `::ffff:7f00:1`.\n\t\thostname.startsWith(\"::ffff:127.\") ||\n\t\thostname.startsWith(\"::ffff:7f00:\");\n\n\tconst allowLocalhost = options.allowLocalhost ?? import.meta.env.DEV;\n\tif (!allowLocalhost) {\n\t\tif (parsed.protocol === \"http:\") {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\t\"must use HTTPS outside development\",\n\t\t\t);\n\t\t}\n\t\tif (isLocalhost) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\t\"must not point at localhost outside development\",\n\t\t\t);\n\t\t}\n\t} else if (parsed.protocol === \"http:\" && !isLocalhost) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_FORBIDDEN\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"must use HTTPS unless it points at localhost in development\",\n\t\t);\n\t}\n\n\treturn parsed;\n}\n\n/**\n * Expand the `RegistryConfigInput` shorthand into the full\n * `RegistryConfig` object shape.\n *\n * Users can pass a bare aggregator URL string for the common case\n * (`registry: \"https://registry.emdashcms.com\"`); the\n * normalizer handles either form transparently.\n *\n * Returns `undefined` for `undefined` input so callers can chain with\n * optional chaining.\n */\nexport function coerceRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n): RegistryConfig | undefined {\n\tif (input === undefined) return undefined;\n\tif (typeof input === \"string\") return { aggregatorUrl: input };\n\treturn input;\n}\n\n/**\n * Normalize the user-supplied `RegistryConfigInput` into the shape that\n * ships to the admin browser via the manifest endpoint.\n *\n * Accepts either the shorthand string form\n * (`\"https://registry.emdashcms.com\"`) or the full `RegistryConfig`\n * object. Returns `null` when `input` is undefined so callers can\n * spread the result directly into the manifest object.\n *\n * Throws a field-specific configuration error if the aggregator URL is\n * malformed or forbidden, or a registry policy value cannot be normalized.\n * The Astro integration uses this to fail during config loading. Runtime\n * manifest generation uses {@link resolveManifestRegistryConfig} to expose\n * recognized failures without exposing the configured value.\n */\nexport function normalizeRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): ManifestRegistryConfig | null {\n\tconst config = coerceRegistryConfig(input);\n\tif (!config) return null;\n\n\tconst aggregatorUrl =\n\t\ttypeof config.aggregatorUrl === \"string\" ? config.aggregatorUrl.trim() : undefined;\n\tif (!aggregatorUrl) {\n\t\tthrow new RegistryConfigurationError(\n\t\t\t\"REGISTRY_AGGREGATOR_URL_REQUIRED\",\n\t\t\tregistryField(\"aggregatorUrl\"),\n\t\t\t\"is required when the registry is configured\",\n\t\t);\n\t}\n\n\tvalidateAggregatorUrl(aggregatorUrl, options);\n\n\tconst out: ManifestRegistryConfig = {\n\t\t// Strip any trailing slash so `${aggregatorUrl}/xrpc/...` works\n\t\t// regardless of how the user wrote it.\n\t\taggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, \"\"),\n\t};\n\n\tif (config.acceptLabelers) {\n\t\tout.acceptLabelers = config.acceptLabelers;\n\t}\n\n\tconst policy: ManifestRegistryConfig[\"policy\"] = {};\n\tlet hasPolicy = false;\n\n\tif (config.policy?.minimumReleaseAge !== undefined) {\n\t\ttry {\n\t\t\tpolicy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);\n\t\t} catch (cause) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_INVALID\",\n\t\t\t\tregistryField(\"policy.minimumReleaseAge\"),\n\t\t\t\t'must be a duration such as \"48h\", \"7d\", or a non-negative number of seconds',\n\t\t\t\t{ cause },\n\t\t\t);\n\t\t}\n\t\thasPolicy = true;\n\t}\n\n\tif (config.policy?.minimumReleaseAgeExclude !== undefined) {\n\t\tif (!Array.isArray(config.policy.minimumReleaseAgeExclude)) {\n\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\"must be an array of DIDs or <did>/<slug> entries\",\n\t\t\t);\n\t\t}\n\t\t// Normalize at load time so callers (browser and server) can do\n\t\t// plain string compares without each one re-implementing the\n\t\t// case-folding rule.\n\t\tconst list = config.policy.minimumReleaseAgeExclude.map((entry) => {\n\t\t\tif (typeof entry !== \"string\") {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst trimmed = entry.trim();\n\t\t\tif (!trimmed) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"entries cannot be empty\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst lower = trimmed.toLowerCase();\n\t\t\tconst [did, slug, ...extra] = lower.split(\"/\");\n\t\t\tif (\n\t\t\t\t!did ||\n\t\t\t\t!isDid(did) ||\n\t\t\t\textra.length > 0 ||\n\t\t\t\t(slug !== undefined && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug))\n\t\t\t) {\n\t\t\t\tthrow new RegistryConfigurationError(\n\t\t\t\t\t\"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID\",\n\t\t\t\t\tregistryField(\"policy.minimumReleaseAgeExclude\"),\n\t\t\t\t\t\"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn lower;\n\t\t});\n\t\tif (list.length > 0) {\n\t\t\tpolicy.minimumReleaseAgeExclude = list;\n\t\t\thasPolicy = true;\n\t\t}\n\t}\n\n\tif (hasPolicy) {\n\t\tout.policy = policy;\n\t}\n\n\treturn out;\n}\n\n/** Normalize registry config without allowing a known config error to hide the admin. */\nexport function resolveManifestRegistryConfig(\n\tinput: RegistryConfigInput | undefined,\n\toptions: RegistryConfigurationValidationOptions = {},\n): {\n\tregistry?: ManifestRegistryConfig;\n\terror?: ManifestRegistryConfigurationError;\n} {\n\ttry {\n\t\tconst registry = normalizeRegistryConfig(input, options);\n\t\treturn registry ? { registry } : {};\n\t} catch (error) {\n\t\tif (!(error instanceof RegistryConfigurationError)) throw error;\n\t\treturn { error: { code: error.code, field: error.field } };\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAaA,MAAa,kCAAkC;AAE/C,SAAgB,gCAAgC,SAIZ;AACnC,KAAI,QAAQ,aAAa,MAAO,QAAO;AACvC,KAAI,QAAQ,aAAa,OAAW,QAAO,QAAQ;AACnD,KAAI,QAAQ,iBAAiB,QAAQ,mBAAmB,MACvD,QAAO;;AAKT,SAAgB,uBACf,UACkC;AAClC,QAAO,aAAa,QAAQ,SAAY;;AAmDzC,IAAM,6BAAN,cAAyC,MAAM;CAC9C,YACC,AAAgB,MAChB,AAAgB,OAChB,SACA,SACC;AACD,QAAM,0CAA0C,MAAM,IAAI,WAAW,QAAQ;EAL7D;EACA;AAKhB,OAAK,OAAO;;;AAQd,SAAS,cAAc,QAAsE;AAC5F,QAAO,YAAY;;;;;;;;;;;;;;;;;;;;;;AAuBpB,SAAgB,mCAAmC,OAA0B;AAC5E,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,EAAE;CACpC,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,SAAS,MACnB,KAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAC/C,MAAK,IAAI,MAAM;AAGjB,QAAO,CAAC,GAAG,KAAK,CAAC,UAAU;;;;;;;;;;;;;;;;;;;AAoB5B,SAAgB,4BACf,SACA,cACA,MACU;AACV,KAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;CAC7C,MAAM,WAAW,aAAa,aAAa;CAE3C,MAAM,UAAU,GAAG,SAAS,GADV,KAAK,aAAa;AAGpC,MAAK,MAAM,SAAS,SAAS;AAC5B,MAAI,UAAU,SAAU,QAAO;AAC/B,MAAI,UAAU,QAAS,QAAO;;AAE/B,QAAO;;AAGR,MAAM,mBAAmB;;AAGzB,MAAM,mBAAmB;;AAGzB,MAAM,eAAe;AAErB,MAAM,gCAAgC;;;;;;AAOtC,SAAgB,qBAAqB,UAAmC;AACvE,KAAI,OAAO,aAAa,UAAU;AACjC,MAAI,CAAC,OAAO,SAAS,SAAS,IAAI,WAAW,EAC5C,OAAM,IAAI,MAAM,qBAAqB,SAAS,yCAAyC;AAExF,SAAO,KAAK,MAAM,SAAS;;CAG5B,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,2EACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,IAAI,KAAK,KAAK;EAC9B,QAGC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;;;;;;;;;;AAgBpD,SAAgB,sBACf,eACA,UAAkD,EAAE,EAC9C;CACN,IAAI;AACJ,KAAI;AACH,WAAS,IAAI,IAAI,cAAc;UACvB,OAAO;AACf,QAAM,IAAI,2BACT,mCACA,cAAc,gBAAgB,EAC9B,uBACA,EAAE,OAAO,CACT;;AAEF,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,yBACA;AAOF,KAAI,OAAO,YAAY,OAAO,SAC7B,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,wCACA;CAMF,MAAM,cAAc,OAAO,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;CAC3E,MAAM,WACL,YAAY,WAAW,IAAI,IAAI,YAAY,SAAS,IAAI,GACrD,YAAY,MAAM,GAAG,GAAG,GACxB;CACJ,MAAM,cACL,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,aAAa,SAEb,SAAS,WAAW,cAAc,IAClC,SAAS,WAAW,eAAe;AAGpC,KAAI,EADmB,QAAQ,kBAAkB,OAAO,KAAK,IAAI,MAC5C;AACpB,MAAI,OAAO,aAAa,QACvB,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,qCACA;AAEF,MAAI,YACH,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,kDACA;YAEQ,OAAO,aAAa,WAAW,CAAC,YAC1C,OAAM,IAAI,2BACT,qCACA,cAAc,gBAAgB,EAC9B,8DACA;AAGF,QAAO;;;;;;;;;;;;;AAcR,SAAgB,qBACf,OAC6B;AAC7B,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,SAAU,QAAO,EAAE,eAAe,OAAO;AAC9D,QAAO;;;;;;;;;;;;;;;;;AAkBR,SAAgB,wBACf,OACA,UAAkD,EAAE,EACpB;CAChC,MAAM,SAAS,qBAAqB,MAAM;AAC1C,KAAI,CAAC,OAAQ,QAAO;CAEpB,MAAM,gBACL,OAAO,OAAO,kBAAkB,WAAW,OAAO,cAAc,MAAM,GAAG;AAC1E,KAAI,CAAC,cACJ,OAAM,IAAI,2BACT,oCACA,cAAc,gBAAgB,EAC9B,8CACA;AAGF,uBAAsB,eAAe,QAAQ;CAE7C,MAAM,MAA8B,EAGnC,eAAe,cAAc,QAAQ,kBAAkB,GAAG,EAC1D;AAED,KAAI,OAAO,eACV,KAAI,iBAAiB,OAAO;CAG7B,MAAM,SAA2C,EAAE;CACnD,IAAI,YAAY;AAEhB,KAAI,OAAO,QAAQ,sBAAsB,QAAW;AACnD,MAAI;AACH,UAAO,2BAA2B,qBAAqB,OAAO,OAAO,kBAAkB;WAC/E,OAAO;AACf,SAAM,IAAI,2BACT,wCACA,cAAc,2BAA2B,EACzC,mFACA,EAAE,OAAO,CACT;;AAEF,cAAY;;AAGb,KAAI,OAAO,QAAQ,6BAA6B,QAAW;AAC1D,MAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,yBAAyB,CACzD,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,mDACA;EAKF,MAAM,OAAO,OAAO,OAAO,yBAAyB,KAAK,UAAU;AAClE,OAAI,OAAO,UAAU,SACpB,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,+DACA;GAEF,MAAM,UAAU,MAAM,MAAM;AAC5B,OAAI,CAAC,QACJ,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,0BACA;GAEF,MAAM,QAAQ,QAAQ,aAAa;GACnC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,MAAM,MAAM,IAAI;AAC9C,OACC,CAAC,OACD,CAAC,MAAM,IAAI,IACX,MAAM,SAAS,KACd,SAAS,UAAa,CAAC,8BAA8B,KAAK,KAAK,CAEhE,OAAM,IAAI,2BACT,gDACA,cAAc,kCAAkC,EAChD,+DACA;AAEF,UAAO;IACN;AACF,MAAI,KAAK,SAAS,GAAG;AACpB,UAAO,2BAA2B;AAClC,eAAY;;;AAId,KAAI,UACH,KAAI,SAAS;AAGd,QAAO;;;AAIR,SAAgB,8BACf,OACA,UAAkD,EAAE,EAInD;AACD,KAAI;EACH,MAAM,WAAW,wBAAwB,OAAO,QAAQ;AACxD,SAAO,WAAW,EAAE,UAAU,GAAG,EAAE;UAC3B,OAAO;AACf,MAAI,EAAE,iBAAiB,4BAA6B,OAAM;AAC1D,SAAO,EAAE,OAAO;GAAE,MAAM,MAAM;GAAM,OAAO,MAAM;GAAO,EAAE"}