@beezping/adapter-prisma 0.7.0

package/dist/index.cjs

@@ -0,0 +1,1241 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  PrismaStore: () => PrismaStore,
+  StoreDuplicateError: () => StoreDuplicateError,
+  StoreNotFoundError: () => StoreNotFoundError,
+  StorePersistenceError: () => StorePersistenceError,
+  createSitepingHandler: () => createSitepingHandler2,
+  dispatchWebhook: () => dispatchWebhook,
+  dispatchWebhooks: () => dispatchWebhooks,
+  flattenAnnotation: () => flattenAnnotation,
+  isStorePersistence: () => isStorePersistence
+});
+module.exports = __toCommonJS(index_exports);
+
+// ../core/src/filters.ts
+var DEFAULT_PAGE_LIMIT = 50;
+var MAX_PAGE_LIMIT = 100;
+function toPositiveInteger(value, fallback) {
+  return value !== void 0 && Number.isFinite(value) ? Math.max(1, Math.floor(value)) : fallback;
+}
+function clampPagination(query) {
+  const page = toPositiveInteger(query.page, 1);
+  const limit = Math.min(toPositiveInteger(query.limit, DEFAULT_PAGE_LIMIT), MAX_PAGE_LIMIT);
+  return { page, limit, skip: (page - 1) * limit };
+}
+function isUnreachableOffset(skip) {
+  return !Number.isSafeInteger(skip);
+}
+
+// ../core/src/type-utils.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function hasOwn(value, key) {
+  return isRecord(value) && key in value;
+}
+
+// ../core/src/types.ts
+var StoreNotFoundError = class extends Error {
+  code = "STORE_NOT_FOUND";
+  constructor(message = "Record not found", options) {
+    super(message, options);
+    this.name = "StoreNotFoundError";
+  }
+};
+var StoreDuplicateError = class extends Error {
+  code = "STORE_DUPLICATE";
+  constructor(message = "Duplicate record", options) {
+    super(message, options);
+    this.name = "StoreDuplicateError";
+  }
+};
+var StorePersistenceError = class extends Error {
+  code = "STORE_PERSISTENCE";
+  constructor(message = "Failed to persist store mutation", options) {
+    super(message, options);
+    this.name = "StorePersistenceError";
+  }
+};
+function hasErrorCode(error, code) {
+  return hasOwn(error, "code") && error.code === code;
+}
+function isStoreNotFound(error) {
+  if (error instanceof StoreNotFoundError) return true;
+  return hasErrorCode(error, "STORE_NOT_FOUND") || hasErrorCode(error, "P2025");
+}
+function isStoreDuplicate(error) {
+  if (error instanceof StoreDuplicateError) return true;
+  return hasErrorCode(error, "STORE_DUPLICATE") || hasErrorCode(error, "P2002");
+}
+function isStorePersistence(error) {
+  if (error instanceof StorePersistenceError) return true;
+  return hasErrorCode(error, "STORE_PERSISTENCE");
+}
+function flattenAnnotation(ann) {
+  return {
+    cssSelector: ann.anchor.cssSelector,
+    xpath: ann.anchor.xpath,
+    textSnippet: ann.anchor.textSnippet,
+    elementTag: ann.anchor.elementTag,
+    elementId: ann.anchor.elementId,
+    textPrefix: ann.anchor.textPrefix,
+    textSuffix: ann.anchor.textSuffix,
+    fingerprint: ann.anchor.fingerprint,
+    neighborText: ann.anchor.neighborText,
+    anchorKey: ann.anchor.anchorKey ?? null,
+    xPct: ann.rect.xPct,
+    yPct: ann.rect.yPct,
+    wPct: ann.rect.wPct,
+    hPct: ann.rect.hPct,
+    scrollX: ann.scrollX,
+    scrollY: ann.scrollY,
+    viewportW: ann.viewportW,
+    viewportH: ann.viewportH,
+    devicePixelRatio: ann.devicePixelRatio
+  };
+}
+
+// ../server/dist/index.js
+var zod = __toESM(require("zod"), 1);
+var MAX_ANNOTATIONS_PER_FEEDBACK = 50;
+var MAX_LOGGED_ORIGIN_LENGTH = 128;
+var MAX_REPORTED_HEADER_NAME_LENGTH = 64;
+var SITEPING_ERROR_MESSAGES = {
+  invalidJson: "Invalid JSON",
+  unauthorized: "Unauthorized",
+  apiKeyRequiredForDestructive: "apiKey required for destructive operations",
+  forbidden: "Forbidden",
+  unsupportedMediaType: "Content-Type must be application/json",
+  feedbackNotFound: "Feedback not found",
+  clientIdUsedByAnotherProject: "clientId already used by another project",
+  tooManyAnnotations: `Too many annotations (max ${MAX_ANNOTATIONS_PER_FEEDBACK})`,
+  deletionAborted: "Deletion aborted: a linked resource could not be cleaned up",
+  internalServerError: "Internal server error"
+};
+var SITEPING_CONFIGURATION_ERROR_MESSAGES = {
+  ownershipVerificationRequired: "[siteping] createSitepingHandler: `access.authorize` needs a store implementing `verifyProjectOwnership`. Without it, a caller authorized for one project could PATCH or DELETE another project's feedback by id. Implement `verifyProjectOwnership` on the store (createCollectionStore and PrismaStore already do).",
+  invalidAllowedHeader: "[siteping] allowedHeaders: every entry must be a valid HTTP header name (letters, digits and !#$%&'*+-.^_`|~, no spaces or commas). Invalid entry:"
+};
+function accessGateFromControl(access) {
+  return {
+    echoesAuthorEmailOnCreate: false,
+    async authenticate(request) {
+      const principal = await access.authenticate(request);
+      if (principal === null) return { ok: false, status: 401, error: SITEPING_ERROR_MESSAGES.unauthorized };
+      return { ok: true, principal, canReadAuthorEmail: access.canReadAuthorEmail?.(principal) ?? true };
+    },
+    async authorize(context) {
+      return access.authorize ? access.authorize(context) : true;
+    }
+  };
+}
+var textEncoder = new TextEncoder();
+function constantTimeEqual(received, expected) {
+  const receivedBytes = textEncoder.encode(received);
+  const expectedBytes = textEncoder.encode(expected);
+  if (receivedBytes.length !== expectedBytes.length) return false;
+  let difference = 0;
+  for (let index = 0; index < receivedBytes.length; index++) {
+    difference |= (receivedBytes[index] ?? 0) ^ (expectedBytes[index] ?? 0);
+  }
+  return difference === 0;
+}
+function isProductionEnvironment() {
+  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+function createApiKeyGate({
+  apiKey,
+  publicEndpoints = apiKey ? ["POST", "OPTIONS"] : void 0,
+  requireAuthForDestructive = true,
+  redactUnauthenticatedEmails = true
+}) {
+  if (!apiKey && requireAuthForDestructive && isProductionEnvironment()) {
+    throw new Error(
+      "[siteping] createSitepingHandler: apiKey is required in production. Set `apiKey` to enable destructive endpoints, pass `access` to plug your own auth, or pass `requireAuthForDestructive: false` if SitePing sits behind your own auth middleware."
+    );
+  }
+  const publicMethods = publicEndpoints ? new Set(publicEndpoints) : null;
+  const isBearerAuthenticated = (request) => {
+    if (!apiKey) return false;
+    const header = request.headers.get("Authorization");
+    return header !== null && constantTimeEqual(header, `Bearer ${apiKey}`);
+  };
+  return {
+    // Legacy contract: a successful POST echoes the email back to its author.
+    echoesAuthorEmailOnCreate: true,
+    async authenticate(request, method) {
+      const canReadAuthorEmail = !redactUnauthenticatedEmails || isBearerAuthenticated(request);
+      if (!apiKey) {
+        if (requireAuthForDestructive && (method === "DELETE" || method === "PATCH")) {
+          return { ok: false, status: 401, error: SITEPING_ERROR_MESSAGES.apiKeyRequiredForDestructive };
+        }
+        return { ok: true, principal: null, canReadAuthorEmail };
+      }
+      if (publicMethods?.has(method) || isBearerAuthenticated(request)) {
+        return { ok: true, principal: null, canReadAuthorEmail };
+      }
+      return { ok: false, status: 401, error: SITEPING_ERROR_MESSAGES.unauthorized };
+    },
+    async authorize() {
+      return true;
+    }
+  };
+}
+var LIST_CACHE_CONTROL = "no-store";
+var CSRF_PROTECTED_METHODS = ["POST", "PATCH", "DELETE"];
+var JSON_MEDIA_TYPE = "application/json";
+var CORS_ALLOWED_METHODS = "GET, POST, PATCH, DELETE, OPTIONS";
+var CORS_DEFAULT_ALLOWED_HEADERS = ["Content-Type", "Authorization"];
+var HTTP_HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var CORS_MAX_AGE_SECONDS = 86400;
+var LIST_QUERY_KEYS = [
+  "projectName",
+  "page",
+  "limit",
+  "type",
+  "status",
+  "statuses",
+  "search",
+  "url",
+  "urlPattern"
+];
+function resolveAllowedHeaders(extraHeaders) {
+  const headersByLowercaseName = /* @__PURE__ */ new Map();
+  for (const header of [...CORS_DEFAULT_ALLOWED_HEADERS, ...extraHeaders ?? []]) {
+    if (typeof header !== "string" || !HTTP_HEADER_NAME_PATTERN.test(header)) {
+      const reported = String(header).slice(0, MAX_REPORTED_HEADER_NAME_LENGTH);
+      throw new Error(`${SITEPING_CONFIGURATION_ERROR_MESSAGES.invalidAllowedHeader} ${JSON.stringify(reported)}`);
+    }
+    const lowercaseName = header.toLowerCase();
+    if (!headersByLowercaseName.has(lowercaseName)) headersByLowercaseName.set(lowercaseName, header);
+  }
+  return [...headersByLowercaseName.values()].join(", ");
+}
+function createCorsPolicy({ allowedOrigins, allowedHeaders, allowedMethods }) {
+  return { allowedOrigins, allowedMethods, allowedHeaders: resolveAllowedHeaders(allowedHeaders) };
+}
+function buildCorsHeaders(request, policy) {
+  if (!policy.allowedOrigins) return {};
+  const origin = request.headers.get("Origin");
+  if (!origin || !policy.allowedOrigins.includes(origin)) return {};
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": policy.allowedMethods,
+    "Access-Control-Allow-Headers": policy.allowedHeaders,
+    "Access-Control-Allow-Credentials": "true",
+    "Access-Control-Max-Age": String(CORS_MAX_AGE_SECONDS),
+    Vary: "Origin"
+  };
+}
+function preflightResponse(request, policy) {
+  return new Response(null, { status: 204, headers: buildCorsHeaders(request, policy) });
+}
+function withCors(response, corsHeaders) {
+  for (const [key, value] of Object.entries(corsHeaders)) {
+    response.headers.set(key, value);
+  }
+  return response;
+}
+var defaultLogger = {
+  error(message, context) {
+    console.error(message, context);
+  }
+};
+function internalErrorResponse({
+  logger,
+  describeError,
+  source,
+  operation,
+  request,
+  corsHeaders,
+  headers,
+  failure
+}) {
+  logger.error(`[siteping] ${source}: ${operation} failed`, {
+    error: failure,
+    method: request.method,
+    path: new URL(request.url).pathname
+  });
+  const message = describeError?.(failure) ?? SITEPING_ERROR_MESSAGES.internalServerError;
+  return withCors(Response.json({ error: message }, { status: 500, ...headers ? { headers } : {} }), corsHeaders);
+}
+var EMAIL_PATTERN = /^(?!\.)(?!.*\.\.)[\p{L}\p{N}!#$%&'*+/=?^_`{|}~.-]{0,63}[\p{L}\p{N}!#$%&'*+/=?^_`{|}~-]@(?:[\p{L}\p{N}](?:[\p{L}\p{N}-]{0,61}[\p{L}\p{N}])?\.)+[\p{L}\p{N}-]{2,63}$/u;
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function hasOwn2(value, key) {
+  return isRecord2(value) && key in value;
+}
+var FEEDBACK_TYPES2 = ["question", "change", "bug", "other"];
+var FEEDBACK_STATUSES2 = ["open", "in_progress", "resolved", "wont_fix"];
+var CLOSED_FEEDBACK_STATUSES2 = ["resolved", "wont_fix"];
+function isClosedStatus2(status) {
+  return CLOSED_FEEDBACK_STATUSES2.includes(status);
+}
+function toFeedbackUpdate2(status, closedAt = /* @__PURE__ */ new Date()) {
+  return isClosedStatus2(status) ? { status, resolvedAt: closedAt } : { status, resolvedAt: null };
+}
+var StoreNotFoundError2 = class extends Error {
+  code = "STORE_NOT_FOUND";
+  constructor(message = "Record not found", options) {
+    super(message, options);
+    this.name = "StoreNotFoundError";
+  }
+};
+var StoreDuplicateError2 = class extends Error {
+  code = "STORE_DUPLICATE";
+  constructor(message = "Duplicate record", options) {
+    super(message, options);
+    this.name = "StoreDuplicateError";
+  }
+};
+function hasErrorCode2(error, code) {
+  return hasOwn2(error, "code") && error.code === code;
+}
+function isStoreNotFound2(error) {
+  if (error instanceof StoreNotFoundError2) return true;
+  return hasErrorCode2(error, "STORE_NOT_FOUND") || hasErrorCode2(error, "P2025");
+}
+function isStoreDuplicate2(error) {
+  if (error instanceof StoreDuplicateError2) return true;
+  return hasErrorCode2(error, "STORE_DUPLICATE") || hasErrorCode2(error, "P2002");
+}
+function flattenAnnotation2(ann) {
+  return {
+    cssSelector: ann.anchor.cssSelector,
+    xpath: ann.anchor.xpath,
+    textSnippet: ann.anchor.textSnippet,
+    elementTag: ann.anchor.elementTag,
+    elementId: ann.anchor.elementId,
+    textPrefix: ann.anchor.textPrefix,
+    textSuffix: ann.anchor.textSuffix,
+    fingerprint: ann.anchor.fingerprint,
+    neighborText: ann.anchor.neighborText,
+    anchorKey: ann.anchor.anchorKey ?? null,
+    xPct: ann.rect.xPct,
+    yPct: ann.rect.yPct,
+    wPct: ann.rect.wPct,
+    hPct: ann.rect.hPct,
+    scrollX: ann.scrollX,
+    scrollY: ann.scrollY,
+    viewportW: ann.viewportW,
+    viewportH: ann.viewportH,
+    devicePixelRatio: ann.devicePixelRatio
+  };
+}
+var CONSOLE_DIAGNOSTIC_LEVELS2 = ["log", "info", "warn", "error"];
+var z2 = "z" in zod ? zod.z : zod;
+var anchorSchema = z2.object({
+  cssSelector: z2.string().min(1).max(2e3),
+  xpath: z2.string().min(1).max(2e3),
+  textSnippet: z2.string().max(500),
+  elementTag: z2.string().min(1),
+  elementId: z2.string().optional(),
+  textPrefix: z2.string().max(200),
+  textSuffix: z2.string().max(200),
+  fingerprint: z2.string().max(200),
+  neighborText: z2.string().max(500),
+  // Optional semantic anchor identifier from `data-feedback-anchor`.
+  // Null when no semantic ancestor exists; widget always sends this field.
+  anchorKey: z2.string().max(200).nullable().optional()
+});
+var rectSchema = z2.object({
+  xPct: z2.number().min(0).max(1),
+  yPct: z2.number().min(0).max(1),
+  wPct: z2.number().min(0).max(1),
+  hPct: z2.number().min(0).max(1)
+});
+var annotationSchema = z2.object({
+  anchor: anchorSchema,
+  rect: rectSchema,
+  scrollX: z2.number().min(0),
+  scrollY: z2.number().min(0),
+  viewportW: z2.number().int().positive(),
+  viewportH: z2.number().int().positive(),
+  devicePixelRatio: z2.number().positive().default(1)
+});
+var consoleEntrySchema = z2.object({
+  level: z2.enum(CONSOLE_DIAGNOSTIC_LEVELS2),
+  timestamp: z2.string().max(50),
+  message: z2.string().max(600)
+});
+var networkEntrySchema = z2.object({
+  url: z2.string().max(2e3),
+  method: z2.string().max(20),
+  status: z2.number().int().min(0).max(599),
+  durationMs: z2.number().min(0).max(6e5),
+  timestamp: z2.string().max(50)
+});
+var diagnosticsSchema = z2.object({
+  console: z2.array(consoleEntrySchema).max(50),
+  network: z2.array(networkEntrySchema).max(20)
+});
+var screenshotRegionSchema = z2.strictObject({
+  xPct: z2.number().min(0).max(1),
+  yPct: z2.number().min(0).max(1),
+  wPct: z2.number().min(0).max(1),
+  hPct: z2.number().min(0).max(1)
+});
+var feedbackCreateSchema = z2.object({
+  projectName: z2.string().min(1).max(200),
+  type: z2.enum(FEEDBACK_TYPES2),
+  message: z2.string().min(1).max(5e3),
+  // Page-scope identifier the widget uses to group feedbacks. Defaults to
+  // `window.location.pathname` ("/orders/42"), but hosts can override
+  // `getPageScope()` to return a full URL, an opaque slug, anything they
+  // want. We trim + require non-empty so whitespace-only payloads don't
+  // leak into the DB; otherwise the value is opaque to the server and only
+  // used as a literal Prisma equality filter, so the loose shape is safe.
+  url: z2.string().trim().min(1).max(2e3),
+  // Optional parameterized URL template (e.g. "/orders/:orderId") provided
+  // by the host via `getPageScope()`. Null when host omits it.
+  urlPattern: z2.string().max(2e3).nullable().optional(),
+  viewport: z2.string().min(1).max(50),
+  userAgent: z2.string().min(1).max(500),
+  authorName: z2.string().min(1).max(200),
+  // The widget's identity modal validates against the same core pattern, so
+  // an address the modal accepts (and persists) is never a 400 here.
+  authorEmail: z2.email({ pattern: EMAIL_PATTERN }).max(200),
+  annotations: z2.array(annotationSchema).max(50),
+  // Restrict to URL-safe identifiers. The widget generates UUIDs (or a
+  // Date+Math.random fallback), both of which match. Anything outside this
+  // alphabet — `..`, `/`, NUL, etc. — would be a path-traversal vector once
+  // the adapter forwards clientId to `screenshotStorage.upload({ feedbackId })`
+  // (e.g. an S3 key prefix or a local FS path).
+  clientId: z2.string().min(1).max(200).regex(/^[a-zA-Z0-9_-]+$/, "clientId must be alphanumeric (a-z, A-Z, 0-9, _, -)"),
+  // Optional base64 JPEG data URL captured by the widget when
+  // `enableScreenshot: true`. ~1.5 MB cap = roughly a 1.1 MB JPEG, well
+  // above typical sizes (the widget downscales to 1200px). Rejects abuse
+  // without truncating legitimate captures.
+  screenshotDataUrl: z2.string().max(15e5).regex(/^data:image\/(jpeg|png|webp);base64,/, "screenshotDataUrl must be a data:image/* base64 URL").nullable().optional(),
+  // Optional annotation-rect position within the screenshot. Sent by widgets
+  // that capture context around the drawn rect; null + omitted are both
+  // accepted so legacy clients (and captures without a screenshot) keep
+  // working unchanged.
+  screenshotRegion: screenshotRegionSchema.nullable().optional(),
+  // Optional console + failed-network snapshot. The widget only attaches
+  // this when `captureDiagnostics` is enabled; null + omitted are both
+  // accepted so existing clients keep working unchanged.
+  diagnostics: diagnosticsSchema.nullable().optional()
+});
+var feedbackPatchSchema = z2.object({
+  id: z2.string().min(1),
+  projectName: z2.string().min(1).max(200),
+  status: z2.enum(FEEDBACK_STATUSES2)
+});
+var feedbackDeleteSchema = z2.union([
+  z2.object({ id: z2.string().min(1), projectName: z2.string().min(1).max(200) }),
+  z2.object({ projectName: z2.string().min(1).max(200), deleteAll: z2.literal(true) })
+]);
+var getQuerySchema = z2.object({
+  projectName: z2.string().min(1).max(200),
+  page: z2.coerce.number().int().min(1).default(1),
+  limit: z2.coerce.number().int().min(1).max(100).default(50),
+  type: z2.enum(FEEDBACK_TYPES2).optional(),
+  status: z2.enum(FEEDBACK_STATUSES2).optional(),
+  // Bucket status filter serialized as CSV over the wire (e.g.
+  // `statuses=open,in_progress`). Non-empty strings are split before each value
+  // is validated against the known statuses; `statuses` wins over the exact
+  // `status` filter downstream. Capped at 4 — the number of known statuses.
+  statuses: z2.preprocess(
+    (val) => typeof val === "string" && val.length > 0 ? val.split(",") : val,
+    z2.array(z2.enum(FEEDBACK_STATUSES2)).max(4)
+  ).optional(),
+  search: z2.string().max(200).optional(),
+  // Page scope filters — used by the panel's "this page / this type" controls
+  url: z2.string().max(2e3).optional(),
+  urlPattern: z2.string().max(2e3).optional()
+});
+function formatValidationErrors(error) {
+  return error.issues.map((issue) => ({
+    field: issue.path.map(String).join("."),
+    message: issue.message
+  }));
+}
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DISCORD_COLORS = {
+  bug: 15680580,
+  question: 3900150,
+  change: 16096779,
+  other: 7041664
+};
+var DEFAULT_DISCORD_COLOR = 7041664;
+function truncate(text, max = 300) {
+  if (text.length <= max) return text;
+  return `${text.slice(0, max - 1)}\u2026`;
+}
+var SLACK_HEADER_MAX = 150;
+function escapeSlackText(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function buildSlackPayload(feedback) {
+  const preview = escapeSlackText(truncate(feedback.message));
+  const author = escapeSlackText(feedback.authorName);
+  const headline = `New ${feedback.type} feedback from ${feedback.authorName}`;
+  return {
+    text: `${escapeSlackText(headline)}: ${preview}`,
+    blocks: [
+      {
+        type: "header",
+        text: { type: "plain_text", text: truncate(headline, SLACK_HEADER_MAX), emoji: true }
+      },
+      {
+        type: "section",
+        text: { type: "mrkdwn", text: preview }
+      },
+      {
+        type: "context",
+        elements: [
+          { type: "mrkdwn", text: `*Project:* ${escapeSlackText(feedback.projectName)}` },
+          { type: "mrkdwn", text: `*Type:* ${feedback.type}` },
+          { type: "mrkdwn", text: `*URL:* ${escapeSlackText(feedback.url)}` },
+          { type: "mrkdwn", text: `*From:* ${author} (${escapeSlackText(feedback.authorEmail)})` }
+        ]
+      }
+    ]
+  };
+}
+function buildDiscordPayload(feedback) {
+  const preview = truncate(feedback.message);
+  return {
+    content: `New **${feedback.type}** feedback from **${feedback.authorName}**`,
+    embeds: [
+      {
+        title: `${feedback.type} \u2014 ${feedback.projectName}`,
+        description: preview,
+        color: DISCORD_COLORS[feedback.type] ?? DEFAULT_DISCORD_COLOR,
+        fields: [
+          { name: "URL", value: feedback.url, inline: false },
+          { name: "Author", value: `${feedback.authorName} (${feedback.authorEmail})`, inline: true },
+          { name: "Viewport", value: feedback.viewport, inline: true }
+        ],
+        timestamp: new Date(feedback.createdAt).toISOString()
+      }
+    ],
+    allowed_mentions: { parse: [] }
+  };
+}
+function buildGenericPayload(feedback) {
+  const { clientId: _clientId, ...payload } = feedback;
+  return payload;
+}
+function buildWebhookPayload(type, feedback) {
+  switch (type) {
+    case "slack":
+      return buildSlackPayload(feedback);
+    case "discord":
+      return buildDiscordPayload(feedback);
+    default:
+      return buildGenericPayload(feedback);
+  }
+}
+async function dispatchWebhook(config, feedback) {
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const body = JSON.stringify(buildWebhookPayload(config.type ?? "generic", feedback));
+  const headers = { "Content-Type": "application/json", ...config.headers ?? {} };
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(config.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!response.ok) {
+      const err = new Error(`Webhook responded with HTTP ${response.status}`);
+      reportError(config, err, feedback.id);
+    }
+  } catch (rawError) {
+    clearTimeout(timer);
+    const err = rawError instanceof Error ? rawError : new Error(String(rawError));
+    reportError(config, err, feedback.id);
+  }
+}
+function reportError(config, err, feedbackId) {
+  if (config.onError) {
+    try {
+      config.onError(err, feedbackId);
+    } catch (callbackErr) {
+      console.warn(
+        `[siteping] webhook onError() callback threw for feedback ${feedbackId}: ${String(callbackErr)} (original error: ${err.message})`
+      );
+    }
+    return;
+  }
+  console.warn(`[siteping] webhook to ${config.url} failed for feedback ${feedbackId}: ${err.message}`);
+}
+async function dispatchWebhooks(configs, feedback) {
+  if (configs.length === 0) return;
+  await Promise.all(configs.map((c) => dispatchWebhook(c, feedback)));
+}
+function toCreateInput(payload) {
+  return {
+    projectName: payload.projectName,
+    type: payload.type,
+    message: payload.message,
+    status: "open",
+    url: payload.url,
+    urlPattern: payload.urlPattern ?? null,
+    viewport: payload.viewport,
+    userAgent: payload.userAgent,
+    authorName: payload.authorName,
+    authorEmail: payload.authorEmail,
+    clientId: payload.clientId,
+    annotations: payload.annotations.map(flattenAnnotation2),
+    screenshotDataUrl: payload.screenshotDataUrl ?? null,
+    screenshotRegion: payload.screenshotRegion ?? null,
+    diagnostics: payload.diagnostics ?? null
+  };
+}
+function createFeedbackOperation({
+  store,
+  pipeline,
+  beforeCreate,
+  onCreated,
+  webhooks
+}) {
+  const respondCreated = (scope, feedback, projectName) => feedback.projectName === projectName ? pipeline.json(scope, pipeline.presentCreated(scope, feedback), { status: 201 }) : pipeline.error(scope, 409, SITEPING_ERROR_MESSAGES.clientIdUsedByAnotherProject);
+  const insert = async (input) => {
+    try {
+      if (store.createFeedbackIfAbsent) {
+        const { feedback, created } = await store.createFeedbackIfAbsent(input);
+        return { feedback, isNew: created };
+      }
+      return { feedback: await store.createFeedback(input), isNew: true };
+    } catch (error) {
+      if (isStoreDuplicate2(error)) {
+        const existing = await store.findByClientId(input.clientId);
+        if (existing) return { feedback: existing, isNew: false };
+      }
+      throw error;
+    }
+  };
+  return async (request) => {
+    const authentication = await pipeline.authenticate(request, "POST");
+    if (!authentication.ok) return authentication.response;
+    const scope = authentication.value;
+    const payload = await pipeline.readBody(scope, feedbackCreateSchema);
+    if (!payload.ok) return payload.response;
+    if (payload.value.annotations.length > MAX_ANNOTATIONS_PER_FEEDBACK) {
+      return pipeline.error(scope, 400, SITEPING_ERROR_MESSAGES.tooManyAnnotations);
+    }
+    try {
+      const validatedInput = toCreateInput(payload.value);
+      const input = beforeCreate ? await beforeCreate(validatedInput, scope.context) : validatedInput;
+      const refusal = await pipeline.authorize(scope, { action: "create", projectName: input.projectName });
+      if (refusal) return refusal;
+      const replayed = await store.findByClientId(input.clientId);
+      if (replayed) return respondCreated(scope, replayed, input.projectName);
+      const { feedback, isNew } = await insert(input);
+      if (isNew && feedback.projectName === input.projectName) {
+        if (webhooks.length > 0) void dispatchWebhooks(webhooks, feedback);
+        if (onCreated) await pipeline.runHook("onCreated", () => onCreated(feedback, scope.context));
+      }
+      return respondCreated(scope, feedback, input.projectName);
+    } catch (error) {
+      return pipeline.internalError(scope, "create feedback", error);
+    }
+  };
+}
+function toDeletionTarget(deletion) {
+  return "deleteAll" in deletion ? { kind: "project", projectName: deletion.projectName } : { kind: "single", id: deletion.id, projectName: deletion.projectName };
+}
+function deleteFeedbackOperation({
+  store,
+  pipeline,
+  onDeleting,
+  onDeleted
+}) {
+  const removeTarget = (target) => target.kind === "project" ? store.deleteAllFeedbacks(target.projectName) : store.deleteFeedback(target.id);
+  return async (request) => {
+    const authentication = await pipeline.authenticate(request, "DELETE");
+    if (!authentication.ok) return authentication.response;
+    const scope = authentication.value;
+    const payload = await pipeline.readBody(scope, feedbackDeleteSchema);
+    if (!payload.ok) return payload.response;
+    const target = toDeletionTarget(payload.value);
+    try {
+      const refusal = await pipeline.authorize(
+        scope,
+        target.kind === "project" ? { action: "deleteAll", projectName: target.projectName } : { action: "delete", projectName: target.projectName, feedbackId: target.id }
+      );
+      if (refusal) return refusal;
+      if (target.kind === "single" && store.verifyProjectOwnership && !await store.verifyProjectOwnership(target.id, target.projectName)) {
+        return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
+      }
+      if (onDeleting) {
+        try {
+          await onDeleting(target, scope.context);
+        } catch (error) {
+          pipeline.logger.error("[siteping] createSitepingHandler: hook onDeleting aborted the deletion", {
+            error,
+            target
+          });
+          return pipeline.error(scope, 502, SITEPING_ERROR_MESSAGES.deletionAborted);
+        }
+      }
+      await removeTarget(target);
+      if (onDeleted) await pipeline.runHook("onDeleted", () => onDeleted(target, scope.context));
+      return pipeline.json(scope, { deleted: true });
+    } catch (error) {
+      if (isStoreNotFound2(error)) return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
+      return pipeline.internalError(scope, "delete feedback", error);
+    }
+  };
+}
+function readListQuery(request) {
+  const searchParams = new URL(request.url).searchParams;
+  const rawQuery = {};
+  for (const key of LIST_QUERY_KEYS) {
+    const value = searchParams.get(key);
+    if (value !== null) rawQuery[key] = value;
+  }
+  return rawQuery;
+}
+function listFeedbacksOperation({ store, pipeline }) {
+  return async (request) => {
+    const authentication = await pipeline.authenticate(request, "GET");
+    if (!authentication.ok) return authentication.response;
+    const scope = authentication.value;
+    const query = pipeline.validate(scope, getQuerySchema, readListQuery(request));
+    if (!query.ok) return query.response;
+    try {
+      const refusal = await pipeline.authorize(scope, { action: "list", projectName: query.value.projectName });
+      if (refusal) return refusal;
+      const page = await store.getFeedbacks(query.value);
+      return pipeline.json(
+        scope,
+        { ...page, feedbacks: page.feedbacks.map((feedback) => pipeline.present(scope, feedback)) },
+        { headers: { "Cache-Control": LIST_CACHE_CONTROL } }
+      );
+    } catch (error) {
+      return pipeline.internalError(scope, "list feedbacks", error);
+    }
+  };
+}
+function updateFeedbackOperation({
+  store,
+  pipeline,
+  onUpdated
+}) {
+  return async (request) => {
+    const authentication = await pipeline.authenticate(request, "PATCH");
+    if (!authentication.ok) return authentication.response;
+    const scope = authentication.value;
+    const payload = await pipeline.readBody(scope, feedbackPatchSchema);
+    if (!payload.ok) return payload.response;
+    const { id, projectName, status } = payload.value;
+    try {
+      const refusal = await pipeline.authorize(scope, { action: "update", projectName, feedbackId: id });
+      if (refusal) return refusal;
+      if (store.verifyProjectOwnership && !await store.verifyProjectOwnership(id, projectName)) {
+        return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
+      }
+      const feedback = await store.updateFeedback(id, toFeedbackUpdate2(status));
+      if (onUpdated) await pipeline.runHook("onUpdated", () => onUpdated(feedback, scope.context));
+      return pipeline.json(scope, pipeline.present(scope, feedback));
+    } catch (error) {
+      if (isStoreNotFound2(error)) return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
+      return pipeline.internalError(scope, "update feedback", error);
+    }
+  };
+}
+function isCsrfProtectedMethod(method) {
+  return CSRF_PROTECTED_METHODS.includes(method);
+}
+function isMutationOriginAllowed(request, policy) {
+  if (!policy.allowedOrigins) return true;
+  const origin = request.headers.get("Origin");
+  if (origin === null) return true;
+  if (policy.allowedOrigins.includes(origin)) return true;
+  return origin === new URL(request.url).origin;
+}
+function hasJsonContentType(request) {
+  const contentType = request.headers.get("Content-Type");
+  if (contentType === null) return false;
+  const [mediaType = ""] = contentType.split(";");
+  return mediaType.trim().toLowerCase() === JSON_MEDIA_TYPE;
+}
+function describeOriginForLog(request) {
+  const origin = request.headers.get("Origin") ?? "";
+  return origin.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, MAX_LOGGED_ORIGIN_LENGTH);
+}
+function toWireFeedback(feedback, includeEmail) {
+  const { clientId: _clientId, ...wire } = feedback;
+  return includeEmail ? wire : { ...wire, authorEmail: "" };
+}
+function createRequestPipeline({
+  gate,
+  corsPolicy,
+  logger,
+  describeError,
+  presentFeedback
+}) {
+  const json = (scope, body, init) => withCors(Response.json(body, init), scope.corsHeaders);
+  const error = (scope, status, message) => json(scope, { error: message }, { status });
+  const validate = (scope, schema, input) => {
+    const parsed = schema.safeParse(input);
+    if (parsed.success) return { ok: true, value: parsed.data };
+    return { ok: false, response: json(scope, { errors: formatValidationErrors(parsed.error) }, { status: 400 }) };
+  };
+  const internalError = (request, corsHeaders, operation, failure) => internalErrorResponse({
+    logger,
+    describeError,
+    source: "createSitepingHandler",
+    operation,
+    request,
+    corsHeaders,
+    failure
+  });
+  const present = (scope, feedback, includeEmail = scope.canReadAuthorEmail) => toWireFeedback(presentFeedback ? presentFeedback(feedback, scope.context) : feedback, includeEmail);
+  return {
+    json,
+    error,
+    /**
+     * Refuse forged mutations, then run the access gate. Mutating methods
+     * from an origin outside `allowedOrigins` answer 403 and non-JSON bodies
+     * 415, before the body is parsed, the caller authenticated or any hook
+     * run (see `request-guards.ts`). A throwing `authenticate` (session store
+     * down…) answers the logged 500 with CORS headers instead of rejecting
+     * the handler, which a browser would only see as an opaque network error.
+     */
+    async authenticate(request, method) {
+      const corsHeaders = buildCorsHeaders(request, corsPolicy);
+      if (isCsrfProtectedMethod(method)) {
+        if (!isMutationOriginAllowed(request, corsPolicy)) {
+          logger.error("[siteping] createSitepingHandler: refused a mutation from an origin outside allowedOrigins", {
+            method,
+            path: new URL(request.url).pathname,
+            origin: describeOriginForLog(request)
+          });
+          return { ok: false, response: error({ corsHeaders }, 403, SITEPING_ERROR_MESSAGES.forbidden) };
+        }
+        if (!hasJsonContentType(request)) {
+          return { ok: false, response: error({ corsHeaders }, 415, SITEPING_ERROR_MESSAGES.unsupportedMediaType) };
+        }
+      }
+      let outcome;
+      try {
+        outcome = await gate.authenticate(request, method);
+      } catch (failure) {
+        return { ok: false, response: internalError(request, corsHeaders, "authenticate request", failure) };
+      }
+      if (!outcome.ok) return { ok: false, response: error({ corsHeaders }, outcome.status, outcome.error) };
+      return {
+        ok: true,
+        value: {
+          context: { request, principal: outcome.principal },
+          canReadAuthorEmail: outcome.canReadAuthorEmail,
+          corsHeaders
+        }
+      };
+    },
+    validate,
+    /** Read and validate a JSON body. */
+    async readBody(scope, schema) {
+      const body = await scope.context.request.json().catch(() => null);
+      if (!body) return { ok: false, response: error(scope, 400, SITEPING_ERROR_MESSAGES.invalidJson) };
+      return validate(scope, schema, body);
+    },
+    /** `null` when allowed, the 403 response otherwise. */
+    async authorize(scope, authorization) {
+      const allowed = await gate.authorize({ ...scope.context, ...authorization });
+      return allowed ? null : error(scope, 403, SITEPING_ERROR_MESSAGES.forbidden);
+    },
+    present,
+    /**
+     * Wire shape of a record answering a `POST` (fresh or replayed): the
+     * requester's email policy, except under a gate that echoes the email to
+     * its submitter (legacy api-key policy).
+     */
+    presentCreated(scope, feedback) {
+      return present(scope, feedback, gate.echoesAuthorEmailOnCreate || scope.canReadAuthorEmail);
+    },
+    /** Log an unexpected failure and answer 500 (with `describeError`'s hint when it has one). */
+    internalError(scope, operation, failure) {
+      return internalError(scope.context.request, scope.corsHeaders, operation, failure);
+    },
+    /** Run a post-write hook; its failure is logged, never surfaced. */
+    async runHook(name, invoke) {
+      try {
+        await invoke();
+      } catch (failure) {
+        logger.error(`[siteping] createSitepingHandler: hook ${name} failed`, { error: failure });
+      }
+    },
+    logger
+  };
+}
+function toWebhookList(webhooks) {
+  if (!webhooks) return [];
+  return Array.isArray(webhooks) ? webhooks : [webhooks];
+}
+function createSitepingHandler(options) {
+  const {
+    store,
+    allowedOrigins,
+    allowedHeaders,
+    beforeCreate,
+    presentFeedback,
+    hooks = {},
+    logger = defaultLogger,
+    describeError
+  } = options;
+  if (!store) {
+    throw new Error("[siteping] createSitepingHandler requires a `store`.");
+  }
+  if (options.access?.authorize && !store.verifyProjectOwnership) {
+    throw new Error(SITEPING_CONFIGURATION_ERROR_MESSAGES.ownershipVerificationRequired);
+  }
+  const corsPolicy = createCorsPolicy({ allowedOrigins, allowedHeaders, allowedMethods: CORS_ALLOWED_METHODS });
+  const gate = options.access ? accessGateFromControl(options.access) : createApiKeyGate(options);
+  const pipeline = createRequestPipeline({ gate, corsPolicy, logger, describeError, presentFeedback });
+  return {
+    /** CORS preflight. Configure `allowedOrigins` (and `allowedHeaders`) for cross-origin widgets. */
+    OPTIONS: (request) => preflightResponse(request, corsPolicy),
+    POST: createFeedbackOperation({
+      store,
+      pipeline,
+      beforeCreate,
+      onCreated: hooks.onCreated?.bind(hooks),
+      webhooks: toWebhookList(options.webhooks)
+    }),
+    GET: listFeedbacksOperation({ store, pipeline }),
+    PATCH: updateFeedbackOperation({ store, pipeline, onUpdated: hooks.onUpdated?.bind(hooks) }),
+    DELETE: deleteFeedbackOperation({
+      store,
+      pipeline,
+      onDeleting: hooks.onDeleting?.bind(hooks),
+      onDeleted: hooks.onDeleted?.bind(hooks)
+    })
+  };
+}
+
+// src/index.ts
+var INCLUDE_ANNOTATIONS = { annotations: true };
+var PROVIDERS_SUPPORTING_INSENSITIVE_MODE = /* @__PURE__ */ new Set([
+  "postgresql",
+  "postgres",
+  "mongodb",
+  "cockroachdb"
+]);
+function detectActiveProvider(prisma) {
+  try {
+    const candidate = prisma;
+    const fromActive = candidate?._activeProvider;
+    if (typeof fromActive === "string") return fromActive;
+    const fromEngineConfig = candidate?._engineConfig?.activeProvider;
+    if (typeof fromEngineConfig === "string") return fromEngineConfig;
+    const fromEngine = candidate?._engine?.config?.activeProvider;
+    if (typeof fromEngine === "string") return fromEngine;
+    return null;
+  } catch {
+    return null;
+  }
+}
+function toStoreError(error) {
+  if (error instanceof StoreNotFoundError || error instanceof StoreDuplicateError) return error;
+  if (isStoreNotFound(error)) return new StoreNotFoundError(void 0, { cause: error });
+  if (isStoreDuplicate(error)) return new StoreDuplicateError(void 0, { cause: error });
+  return error;
+}
+function isStoredScreenshotUrl(url) {
+  return typeof url === "string" && url.length > 0 && !url.startsWith("data:");
+}
+var PrismaStore = class {
+  /** @internal */
+  prisma;
+  screenshotStorage;
+  /** Module-level flag would leak across PrismaStore instances in tests; use per-instance. */
+  inlineFallbackWarned = false;
+  /** @internal */
+  caseInsensitiveSearch;
+  constructor(prisma, options = {}) {
+    this.prisma = prisma;
+    this.screenshotStorage = options.screenshotStorage;
+    if (typeof options.caseInsensitiveSearch === "boolean") {
+      this.caseInsensitiveSearch = options.caseInsensitiveSearch;
+    } else {
+      const provider = detectActiveProvider(prisma);
+      this.caseInsensitiveSearch = provider !== null && PROVIDERS_SUPPORTING_INSENSITIVE_MODE.has(provider);
+    }
+  }
+  async createFeedback(data) {
+    const screenshotUrl = await this.persistScreenshot(data.screenshotDataUrl, data.clientId);
+    try {
+      return await this.insertFeedback(data, screenshotUrl);
+    } catch (error) {
+      if (isStoreDuplicate(error)) await this.discardScreenshots([screenshotUrl]);
+      throw toStoreError(error);
+    }
+  }
+  async insertFeedback(data, screenshotUrl) {
+    return await this.prisma.sitepingFeedback.create({
+      data: {
+        projectName: data.projectName,
+        type: data.type,
+        message: data.message,
+        status: data.status,
+        url: data.url,
+        urlPattern: data.urlPattern ?? null,
+        screenshotUrl,
+        // Persisted as JSON when the model has a `screenshotRegion Json?`
+        // column — same omit-when-null contract as `diagnostics` below, so
+        // hosts that haven't run `npx siteping sync` keep working.
+        ...data.screenshotRegion ? { screenshotRegion: data.screenshotRegion } : {},
+        // Persisted as JSON when the model has a `diagnostics Json?` column.
+        // Hosts that haven't run `npx siteping sync` keep their schema as-is
+        // and Prisma will throw if we pass an unknown column, so omit the
+        // key entirely when diagnostics is null.
+        ...data.diagnostics ? { diagnostics: data.diagnostics } : {},
+        viewport: data.viewport,
+        userAgent: data.userAgent,
+        authorName: data.authorName,
+        authorEmail: data.authorEmail,
+        clientId: data.clientId,
+        annotations: {
+          create: data.annotations.map((ann) => ({
+            cssSelector: ann.cssSelector,
+            xpath: ann.xpath,
+            textSnippet: ann.textSnippet,
+            elementTag: ann.elementTag,
+            elementId: ann.elementId,
+            textPrefix: ann.textPrefix,
+            textSuffix: ann.textSuffix,
+            fingerprint: ann.fingerprint,
+            neighborText: ann.neighborText,
+            anchorKey: ann.anchorKey ?? null,
+            xPct: ann.xPct,
+            yPct: ann.yPct,
+            wPct: ann.wPct,
+            hPct: ann.hPct,
+            scrollX: ann.scrollX,
+            scrollY: ann.scrollY,
+            viewportW: ann.viewportW,
+            viewportH: ann.viewportH,
+            devicePixelRatio: ann.devicePixelRatio
+          }))
+        }
+      },
+      include: INCLUDE_ANNOTATIONS
+    });
+  }
+  /**
+   * Resolve the value to persist on `Feedback.screenshotUrl`.
+   *
+   * - No data URL → null
+   * - Storage configured → upload, return remote URL. Upload failures
+   *   persist `null` (drop the screenshot) rather than silently inlining
+   *   the data URL — an inline fallback would bloat Postgres unnoticed
+   *   during a multi-minute storage outage. The feedback message itself is
+   *   preserved; only the screenshot is missing, and the warn surfaces it.
+   * - No storage → inline base64, with a one-time warn so prod operators
+   *   notice the footgun.
+   *
+   * Operators who prefer the legacy inline-on-failure behaviour can wrap
+   * their `ScreenshotStorage.upload` with their own catch + return the
+   * data URL — the adapter treats whatever the storage returns as final.
+   */
+  async persistScreenshot(dataUrl, clientId) {
+    if (!dataUrl) return null;
+    if (this.screenshotStorage) {
+      try {
+        const { url } = await this.screenshotStorage.upload(dataUrl, {
+          feedbackId: clientId,
+          mimeType: "image/jpeg"
+        });
+        return url;
+      } catch (err) {
+        console.warn(
+          "[siteping] screenshotStorage.upload failed \u2014 feedback will be saved without a screenshot. Wrap your storage's upload to handle this differently:",
+          err
+        );
+        return null;
+      }
+    }
+    if (!this.inlineFallbackWarned) {
+      this.inlineFallbackWarned = true;
+      console.warn(
+        "[siteping] enableScreenshot is on but no `screenshotStorage` is configured \u2014 base64 data URLs will be persisted inline on Feedback.screenshotUrl. Configure a ScreenshotStorage (S3/R2/\u2026) for production."
+      );
+    }
+    return dataUrl;
+  }
+  /**
+   * Best-effort cleanup of stored screenshots through `ScreenshotStorage.delete`
+   * — the hook the interface documents for feedback deletion. Failures are
+   * logged and swallowed: an orphaned object is preferable to a delete that
+   * reports failure after the row is already gone. Inline `data:` URLs and
+   * stores without a `delete` hook are skipped.
+   */
+  async discardScreenshots(urls) {
+    const remove = this.screenshotStorage?.delete?.bind(this.screenshotStorage);
+    if (!remove) return;
+    const stored = urls.filter(isStoredScreenshotUrl);
+    if (stored.length === 0) return;
+    const results = await Promise.allSettled(stored.map((url) => remove(url)));
+    results.forEach((result, index) => {
+      if (result.status === "rejected") {
+        console.warn(
+          `[siteping] screenshotStorage.delete failed for ${stored[index]} \u2014 object left in place:`,
+          result.reason
+        );
+      }
+    });
+  }
+  /** URLs of the stored screenshots in `projectName` — only fetched when a `delete` hook can use them. */
+  async storedScreenshotUrls(projectName) {
+    if (!this.screenshotStorage?.delete) return [];
+    const rows = await this.prisma.sitepingFeedback.findMany({
+      where: { projectName, screenshotUrl: { not: null } },
+      select: { screenshotUrl: true }
+    });
+    return rows.map((row) => row.screenshotUrl).filter(isStoredScreenshotUrl);
+  }
+  async findByClientId(clientId) {
+    return await this.prisma.sitepingFeedback.findUnique({
+      where: { clientId },
+      include: INCLUDE_ANNOTATIONS
+    });
+  }
+  async getFeedbacks(query) {
+    const { projectName, type, status, statuses, search, url, urlPattern } = query;
+    const { limit, skip } = clampPagination(query);
+    const where = { projectName };
+    if (type) where.type = type;
+    if (statuses && statuses.length > 0) {
+      where.status = { in: [...statuses] };
+    } else if (status) {
+      where.status = status;
+    }
+    if (url) where.url = url;
+    if (urlPattern) where.urlPattern = urlPattern;
+    if (search) {
+      where.message = this.caseInsensitiveSearch ? { contains: search, mode: "insensitive" } : { contains: search };
+    }
+    if (isUnreachableOffset(skip)) {
+      return { feedbacks: [], total: await this.prisma.sitepingFeedback.count({ where }) };
+    }
+    const [feedbacks, total] = await Promise.all([
+      this.prisma.sitepingFeedback.findMany({
+        where,
+        include: INCLUDE_ANNOTATIONS,
+        orderBy: { createdAt: "desc" },
+        skip,
+        take: limit
+      }),
+      this.prisma.sitepingFeedback.count({ where })
+    ]);
+    return { feedbacks, total };
+  }
+  async updateFeedback(id, data) {
+    try {
+      return await this.prisma.sitepingFeedback.update({
+        where: { id },
+        data: {
+          status: data.status,
+          resolvedAt: data.resolvedAt
+        },
+        include: INCLUDE_ANNOTATIONS
+      });
+    } catch (error) {
+      throw toStoreError(error);
+    }
+  }
+  async deleteFeedback(id) {
+    let deleted;
+    try {
+      deleted = await this.prisma.sitepingFeedback.delete({ where: { id } });
+    } catch (error) {
+      throw toStoreError(error);
+    }
+    await this.discardScreenshots([deleted?.screenshotUrl]);
+  }
+  async deleteAllFeedbacks(projectName) {
+    const screenshotUrls = await this.storedScreenshotUrls(projectName);
+    await this.prisma.sitepingFeedback.deleteMany({ where: { projectName } });
+    await this.discardScreenshots(screenshotUrls);
+  }
+  /**
+   * Verify that a feedback record with `id` belongs to `projectName`.
+   * Returns `true` when the record exists and matches, `false` otherwise.
+   */
+  async verifyProjectOwnership(id, projectName) {
+    const record = await this.prisma.sitepingFeedback.findUnique({
+      where: { id }
+      // Only need projectName for the check — skip annotations
+    });
+    return record !== null && record.projectName === projectName;
+  }
+};
+function createSitepingHandler2({
+  prisma,
+  store: providedStore,
+  screenshotStorage,
+  caseInsensitiveSearch,
+  ...handlerOptions
+}) {
+  if (!providedStore && !prisma) {
+    throw new Error("[siteping] createSitepingHandler requires either `store` or `prisma`.");
+  }
+  const store = providedStore ?? new PrismaStore(prisma, {
+    screenshotStorage,
+    ...typeof caseInsensitiveSearch === "boolean" ? { caseInsensitiveSearch } : {}
+  });
+  return createSitepingHandler({ ...handlerOptions, store, describeError: actionableErrorMessage });
+}
+function isTableNotFoundError(error) {
+  return hasOwn(error, "code") && error.code === "P2021";
+}
+function actionableErrorMessage(error) {
+  if (isTableNotFoundError(error)) {
+    return "Table 'SitepingFeedback' not found. Run 'npx prisma db push' to create it.";
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PrismaStore,
+  StoreDuplicateError,
+  StoreNotFoundError,
+  StorePersistenceError,
+  createSitepingHandler,
+  dispatchWebhook,
+  dispatchWebhooks,
+  flattenAnnotation,
+  isStorePersistence
+});
+//# sourceMappingURL=index.cjs.map