@hasna/shortlinks 0.1.22 → 0.1.24

package/dist/pg-store.js

@@ -0,0 +1,913 @@
+// @bun
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __require = import.meta.require;
+
+// src/runtime.ts
+var SHORTLINKS_RUNTIME_ENV = {
+  store: "HASNA_SHORTLINKS_STORE",
+  databaseUrl: "HASNA_SHORTLINKS_DATABASE_URL",
+  databaseSsl: "HASNA_SHORTLINKS_DATABASE_SSL"
+};
+var SHORTLINKS_RUNTIME_FALLBACK_ENV = {
+  store: "SHORTLINKS_STORE",
+  databaseUrl: "SHORTLINKS_DATABASE_URL",
+  databaseSsl: "SHORTLINKS_DATABASE_SSL"
+};
+var CANONICAL_SHORTLINKS_POSTGRES_CLUSTER = "hasna-xyz-infra-apps-prod-postgres";
+var CANONICAL_SHORTLINKS_POSTGRES_DATABASE = "shortlinks";
+var CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH = "hasna/xyz/opensource/shortlinks/prod/postgres";
+function getCanonicalShortlinksPostgresConfig() {
+  return {
+    cluster: CANONICAL_SHORTLINKS_POSTGRES_CLUSTER,
+    database: CANONICAL_SHORTLINKS_POSTGRES_DATABASE,
+    runtimeSecretPath: CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,
+    primaryEnv: SHORTLINKS_RUNTIME_ENV.databaseUrl,
+    fallbackEnv: SHORTLINKS_RUNTIME_FALLBACK_ENV.databaseUrl
+  };
+}
+function parseShortlinksStoreMode(value) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return "local";
+  if (normalized === "local" || normalized === "postgres")
+    return normalized;
+  if (normalized === "pg")
+    return "postgres";
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.store} must be local or postgres`);
+}
+function getShortlinksStoreMode(env = process.env) {
+  return parseShortlinksStoreMode(readRuntimeEnv(env, "store").value);
+}
+function getShortlinksDatabaseUrl(env = process.env) {
+  return readRuntimeEnv(env, "databaseUrl").value;
+}
+function getShortlinksDatabaseSsl(env = process.env) {
+  return parseBoolean(readRuntimeEnv(env, "databaseSsl").value, true);
+}
+function getShortlinksRuntimeEnvName(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  if (clean(env[primary]))
+    return primary;
+  return SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+}
+function loadShortlinksRuntimeConfig(env = process.env) {
+  const mode = getShortlinksStoreMode(env);
+  const databaseUrl = getShortlinksDatabaseUrl(env);
+  return {
+    service: "shortlinks",
+    mode,
+    ...databaseUrl ? {
+      database: {
+        provider: "postgres",
+        url: databaseUrl,
+        ssl: getShortlinksDatabaseSsl(env)
+      }
+    } : {}
+  };
+}
+function assertShortlinksPostgresConfig(config) {
+  if (config.mode !== "postgres")
+    return;
+  if (!config.database?.url) {
+    throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseUrl} is required when ${SHORTLINKS_RUNTIME_ENV.store}=postgres`);
+  }
+}
+function getShortlinksRuntimeStatus(env = process.env) {
+  const issues = [];
+  const warnings = [];
+  let config;
+  try {
+    config = loadShortlinksRuntimeConfig(env);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+    config = { service: "shortlinks", mode: "local" };
+  }
+  try {
+    assertShortlinksPostgresConfig(config);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+  }
+  if (config.mode === "local" && config.database?.url) {
+    warnings.push(`${SHORTLINKS_RUNTIME_ENV.store}=local ignores configured Postgres database settings`);
+  }
+  return {
+    ok: issues.length === 0,
+    service: "shortlinks",
+    mode: config.mode,
+    local_default: config.mode === "local",
+    postgres_enabled: config.mode === "postgres",
+    database: {
+      configured: Boolean(config.database?.url),
+      provider: config.database?.provider ?? null,
+      redacted_url: redactDatabaseUrl(config.database?.url),
+      ssl: config.database?.ssl ?? null
+    },
+    env: runtimeEnvStatus(env),
+    canonical: getCanonicalShortlinksPostgresConfig(),
+    issues,
+    warnings,
+    no_network: true
+  };
+}
+function redactDatabaseUrl(value) {
+  if (!value)
+    return null;
+  try {
+    const url = new URL(value);
+    if (url.username)
+      url.username = "***";
+    if (url.password)
+      url.password = "***";
+    for (const key of Array.from(url.searchParams.keys())) {
+      if (isSensitiveQueryKey(key))
+        url.searchParams.set(key, "***");
+    }
+    return url.toString();
+  } catch {
+    return "(redacted)";
+  }
+}
+function runtimeEnvStatus(env) {
+  return Object.fromEntries(Object.entries(SHORTLINKS_RUNTIME_ENV).map(([key, name]) => {
+    const activeName = getShortlinksRuntimeEnvName(env, key);
+    return [
+      key,
+      {
+        name,
+        active_name: activeName,
+        configured: Boolean(clean(env[activeName]))
+      }
+    ];
+  }));
+}
+function readRuntimeEnv(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  const primaryValue = clean(env[primary]);
+  if (primaryValue)
+    return { name: primary, value: primaryValue };
+  const fallback = SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+  return { name: fallback, value: clean(env[fallback]) };
+}
+function parseBoolean(value, fallback) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return fallback;
+  if (["1", "true", "yes", "on"].includes(normalized))
+    return true;
+  if (["0", "false", "no", "off"].includes(normalized))
+    return false;
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseSsl} must be true or false`);
+}
+function isSensitiveQueryKey(key) {
+  return /(?:^|[_-])(pass(?:word)?|pwd|secret|token|credential|auth|api[_-]?key|access[_-]?key)(?:$|[_-])/i.test(key);
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+// src/pg-store.ts
+import { createHash } from "crypto";
+
+// src/config.ts
+import { existsSync, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
+var SERVICE_NAME = "shortlinks";
+var DEFAULT_DATA_DIR = join(homedir(), ".hasna", SERVICE_NAME);
+function getDataDir() {
+  return resolve(process.env.SHORTLINKS_HOME || DEFAULT_DATA_DIR);
+}
+function ensureDataDir() {
+  const dir = getDataDir();
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+function getConfigPath() {
+  return join(ensureDataDir(), "config.json");
+}
+function getClickSaltPath() {
+  return join(ensureDataDir(), "click-salt");
+}
+function getDatabasePath(explicitPath) {
+  if (explicitPath)
+    return resolve(explicitPath);
+  if (process.env.SHORTLINKS_DB)
+    return resolve(process.env.SHORTLINKS_DB);
+  return join(ensureDataDir(), `${SERVICE_NAME}.db`);
+}
+function readClickSaltFile(path) {
+  try {
+    const saved = readFileSync(path, "utf-8").trim();
+    return saved || null;
+  } catch {
+    return null;
+  }
+}
+function clickSaltError(path, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return new Error(`Could not initialize click salt at ${path}. Set SHORTLINKS_CLICK_SALT or fix data directory permissions. ${detail}`);
+}
+function getClickSalt() {
+  const explicit = process.env.SHORTLINKS_CLICK_SALT?.trim();
+  if (explicit)
+    return explicit;
+  const path = getClickSaltPath();
+  const saved = readClickSaltFile(path);
+  if (saved)
+    return saved;
+  const generated = randomBytes(32).toString("hex");
+  const tempPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, `${generated}
+`, { flag: "wx", mode: 384 });
+    try {
+      linkSync(tempPath, path);
+      return generated;
+    } catch (error) {
+      const winner = readClickSaltFile(path);
+      if (winner)
+        return winner;
+      throw clickSaltError(path, error);
+    } finally {
+      try {
+        unlinkSync(tempPath);
+      } catch {}
+    }
+  } catch (error) {
+    const winner = readClickSaltFile(path);
+    if (winner)
+      return winner;
+    throw clickSaltError(path, error);
+  }
+}
+function loadConfig() {
+  const path = getConfigPath();
+  if (!existsSync(path))
+    return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function saveConfig(config) {
+  const path = getConfigPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`);
+}
+function updateConfig(patch) {
+  const next = {
+    ...loadConfig(),
+    ...patch,
+    cloudflare: {
+      ...loadConfig().cloudflare,
+      ...patch.cloudflare
+    }
+  };
+  saveConfig(next);
+  return next;
+}
+function normalizeHostname(input) {
+  const raw = input.trim().toLowerCase();
+  if (!raw)
+    throw new Error("Domain is required.");
+  const withProtocol = raw.includes("://") ? raw : `https://${raw}`;
+  let hostname;
+  try {
+    hostname = new URL(withProtocol).hostname;
+  } catch {
+    throw new Error(`Invalid domain: ${input}`);
+  }
+  hostname = hostname.replace(/\.$/, "");
+  const labels = hostname.split(".");
+  const labelsAreValid = labels.every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9-]+$/.test(label) && !label.startsWith("-") && !label.endsWith("-"));
+  if (hostname.length > 253 || !labelsAreValid) {
+    throw new Error(`Invalid domain: ${input}`);
+  }
+  return hostname;
+}
+function formatShortUrl(hostname, slug, publicBaseUrl) {
+  if (publicBaseUrl) {
+    const base = publicBaseUrl.endsWith("/") ? publicBaseUrl : `${publicBaseUrl}/`;
+    return new URL(slug, base).toString();
+  }
+  return `https://${hostname}/${slug}`;
+}
+
+// src/database.ts
+import { Database } from "bun:sqlite";
+import { mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+function now() {
+  return new Date().toISOString();
+}
+function makeId(prefix) {
+  const bytes = crypto.getRandomValues(new Uint8Array(12));
+  const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `${prefix}_${hex}`;
+}
+var SQLITE_MIGRATIONS = [
+  `
+  CREATE TABLE IF NOT EXISTS domains (
+    id TEXT PRIMARY KEY,
+    hostname TEXT NOT NULL UNIQUE,
+    provider TEXT NOT NULL DEFAULT 'manual',
+    default_domain INTEGER NOT NULL DEFAULT 0,
+    cloudflare_zone_id TEXT,
+    cloudflare_account_id TEXT,
+    cloudflare_worker_name TEXT,
+    origin_url TEXT,
+    notes TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    machine_id TEXT,
+    synced_at TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS links (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    slug TEXT NOT NULL,
+    destination_url TEXT NOT NULL,
+    title TEXT,
+    active INTEGER NOT NULL DEFAULT 1,
+    expires_at TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    machine_id TEXT,
+    synced_at TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE(domain_id, slug)
+  );
+
+  CREATE TABLE IF NOT EXISTS clicks (
+    id TEXT PRIMARY KEY,
+    link_id TEXT NOT NULL REFERENCES links(id) ON DELETE CASCADE,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    slug TEXT NOT NULL,
+    clicked_at TEXT NOT NULL,
+    ip_hash TEXT,
+    user_agent TEXT,
+    referer TEXT,
+    country TEXT,
+    city TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    machine_id TEXT,
+    synced_at TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_domains_hostname ON domains(hostname);
+  CREATE INDEX IF NOT EXISTS idx_domains_default ON domains(default_domain);
+  CREATE INDEX IF NOT EXISTS idx_links_domain_slug ON links(domain_id, slug);
+  CREATE INDEX IF NOT EXISTS idx_links_active ON links(active);
+  CREATE INDEX IF NOT EXISTS idx_links_updated ON links(updated_at);
+  CREATE INDEX IF NOT EXISTS idx_clicks_link ON clicks(link_id);
+  CREATE INDEX IF NOT EXISTS idx_clicks_domain ON clicks(domain_id);
+  CREATE INDEX IF NOT EXISTS idx_clicks_clicked_at ON clicks(clicked_at);
+  CREATE INDEX IF NOT EXISTS idx_clicks_updated ON clicks(updated_at);
+  `
+];
+
+class ShortlinksDatabase {
+  db;
+  path;
+  constructor(path) {
+    this.path = getDatabasePath(path);
+    mkdirSync2(dirname2(this.path), { recursive: true });
+    this.db = new Database(this.path);
+    this.db.exec("PRAGMA foreign_keys = ON;");
+    this.applyMigrations();
+  }
+  close() {
+    this.db.close();
+  }
+  applyMigrations() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS _migrations (
+        id INTEGER PRIMARY KEY,
+        applied_at TEXT NOT NULL
+      );
+    `);
+    for (let i = 0;i < SQLITE_MIGRATIONS.length; i += 1) {
+      const id = i + 1;
+      const applied = this.db.query("SELECT id FROM _migrations WHERE id = ?").get(id);
+      if (applied)
+        continue;
+      const migration = SQLITE_MIGRATIONS[i];
+      const apply = this.db.transaction(() => {
+        this.db.exec(migration);
+        this.db.query("INSERT INTO _migrations (id, applied_at) VALUES (?, ?)").run(id, now());
+      });
+      apply();
+    }
+  }
+}
+
+// src/machine.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { hostname } from "os";
+import { join as join2 } from "path";
+
+// src/slug.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var SLUG_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var DEFAULT_SLUG_LENGTH = 7;
+function randomToken(length = DEFAULT_SLUG_LENGTH) {
+  if (length < 1 || length > 128)
+    throw new Error("Token length must be between 1 and 128.");
+  const bytes = randomBytes2(length);
+  let out = "";
+  for (let i = 0;i < length; i += 1) {
+    out += SLUG_ALPHABET[bytes[i] % SLUG_ALPHABET.length];
+  }
+  return out;
+}
+function normalizeSlug(slug) {
+  const normalized = slug.trim().replace(/^\/+/, "").replace(/\/+$/, "");
+  if (!normalized)
+    throw new Error("Slug is required.");
+  if (!/^[A-Za-z0-9_-]{1,96}$/.test(normalized)) {
+    throw new Error("Slug can only contain letters, numbers, underscores, and dashes.");
+  }
+  return normalized;
+}
+
+// src/machine.ts
+function getMachineId() {
+  const path = join2(ensureDataDir(), "machine-id");
+  if (existsSync2(path)) {
+    const existing = readFileSync2(path, "utf-8").trim();
+    if (existing)
+      return existing;
+  }
+  const safeHost = hostname().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const id = `${safeHost || "machine"}-${randomToken(8).toLowerCase()}`;
+  writeFileSync2(path, `${id}
+`);
+  return id;
+}
+
+// src/pg-store.ts
+function parseJsonObject(value) {
+  if (!value)
+    return {};
+  if (typeof value === "object" && !Array.isArray(value))
+    return value;
+  try {
+    const parsed = JSON.parse(String(value));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function loadPgPool() {
+  const importer = new Function("specifier", "return import(specifier)");
+  const module = await importer("pg");
+  return module.Pool;
+}
+function toPostgresSql(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function createPgPoolConfig(connectionString, options = {}) {
+  const ssl = options.ssl ?? true;
+  return {
+    connectionString,
+    ...ssl ? { ssl: { rejectUnauthorized: true } } : { ssl: false }
+  };
+}
+
+class PgPoolAdapter {
+  pool;
+  constructor(pool) {
+    this.pool = pool;
+  }
+  static async create(connectionString, options = {}) {
+    const Pool = await loadPgPool();
+    return new PgPoolAdapter(new Pool(createPgPoolConfig(connectionString, options)));
+  }
+  async get(sql, ...params) {
+    const result = await this.pool.query(toPostgresSql(sql), params);
+    return result.rows[0] ?? null;
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(toPostgresSql(sql), params);
+    return result.rows;
+  }
+  async run(sql, ...params) {
+    return this.pool.query(toPostgresSql(sql), params);
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
+function toIsoString(value) {
+  if (value instanceof Date)
+    return value.toISOString();
+  return String(value);
+}
+function nullableIso(value) {
+  if (value === null || value === undefined)
+    return null;
+  return toIsoString(value);
+}
+function domainFromRow(row) {
+  return {
+    ...row,
+    default_domain: Boolean(row.default_domain),
+    synced_at: nullableIso(row.synced_at),
+    created_at: toIsoString(row.created_at),
+    updated_at: toIsoString(row.updated_at),
+    metadata: parseJsonObject(row.metadata)
+  };
+}
+function linkFromRow(row) {
+  return {
+    ...row,
+    active: Boolean(row.active),
+    expires_at: nullableIso(row.expires_at),
+    synced_at: nullableIso(row.synced_at),
+    created_at: toIsoString(row.created_at),
+    updated_at: toIsoString(row.updated_at),
+    metadata: parseJsonObject(row.metadata),
+    short_url: formatShortUrl(row.hostname, row.slug)
+  };
+}
+function validateDestinationUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid destination URL: ${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error("Destination URL must start with http:// or https://.");
+  }
+  return parsed.toString();
+}
+function isoOrNull(input) {
+  if (!input)
+    return null;
+  const date = new Date(input);
+  if (Number.isNaN(date.getTime()))
+    throw new Error(`Invalid date: ${input}`);
+  return date.toISOString();
+}
+function clickFromRow(row) {
+  return {
+    ...row,
+    clicked_at: toIsoString(row.clicked_at),
+    synced_at: nullableIso(row.synced_at),
+    created_at: toIsoString(row.created_at),
+    updated_at: toIsoString(row.updated_at),
+    metadata: parseJsonObject(row.metadata)
+  };
+}
+function createKitPgAdapter(client) {
+  return {
+    async get(sql, ...params) {
+      return client.get(toPostgresSql(sql), params);
+    },
+    async all(sql, ...params) {
+      return client.many(toPostgresSql(sql), params);
+    },
+    async run(sql, ...params) {
+      return client.query(toPostgresSql(sql), params);
+    }
+  };
+}
+
+class PgShortlinksStore {
+  pg;
+  constructor(pg) {
+    this.pg = pg;
+  }
+  static async fromConnectionString(connectionString, options = {}) {
+    return new PgShortlinksStore(await PgPoolAdapter.create(connectionString, options));
+  }
+  static fromQueryClient(client) {
+    return new PgShortlinksStore(createKitPgAdapter(client));
+  }
+  static async fromEnv(env = process.env) {
+    const connectionString = getShortlinksDatabaseUrl(env);
+    if (!connectionString) {
+      throw new Error("HASNA_SHORTLINKS_DATABASE_URL is required when shortlinks uses the postgres store");
+    }
+    return PgShortlinksStore.fromConnectionString(connectionString, { ssl: getShortlinksDatabaseSsl(env) });
+  }
+  async close() {
+    await this.pg.close?.();
+  }
+  async addDomain(input) {
+    const hostname2 = normalizeHostname(input.hostname);
+    const timestamp = now();
+    const machineId = getMachineId();
+    const existing = await this.getDomain(hostname2);
+    const id = existing?.id || makeId("dom");
+    if (input.defaultDomain) {
+      await this.pg.run("UPDATE domains SET default_domain = 0, updated_at = ? WHERE default_domain = 1", timestamp);
+    }
+    await this.pg.run(`
+      INSERT INTO domains (
+        id, hostname, provider, default_domain, cloudflare_zone_id, cloudflare_account_id,
+        cloudflare_worker_name, origin_url, notes, metadata, machine_id, synced_at, created_at, updated_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?)
+      ON CONFLICT(hostname) DO UPDATE SET
+        provider = excluded.provider,
+        default_domain = excluded.default_domain,
+        cloudflare_zone_id = COALESCE(excluded.cloudflare_zone_id, domains.cloudflare_zone_id),
+        cloudflare_account_id = COALESCE(excluded.cloudflare_account_id, domains.cloudflare_account_id),
+        cloudflare_worker_name = COALESCE(excluded.cloudflare_worker_name, domains.cloudflare_worker_name),
+        origin_url = COALESCE(excluded.origin_url, domains.origin_url),
+        notes = COALESCE(excluded.notes, domains.notes),
+        metadata = excluded.metadata,
+        machine_id = excluded.machine_id,
+        synced_at = NULL,
+        updated_at = excluded.updated_at
+    `, id, hostname2, input.provider || existing?.provider || "manual", input.defaultDomain ?? existing?.default_domain ? 1 : 0, input.cloudflareZoneId || existing?.cloudflare_zone_id || null, input.cloudflareAccountId || existing?.cloudflare_account_id || null, input.cloudflareWorkerName || existing?.cloudflare_worker_name || null, input.originUrl || existing?.origin_url || null, input.notes || existing?.notes || null, JSON.stringify(input.metadata || existing?.metadata || {}), machineId, existing?.created_at || timestamp, timestamp);
+    return await this.getDomain(hostname2);
+  }
+  async listDomains() {
+    const rows = await this.pg.all(`
+      SELECT * FROM domains
+      ORDER BY default_domain DESC, hostname ASC
+    `);
+    return rows.map(domainFromRow);
+  }
+  async getDomain(hostnameOrId) {
+    const normalized = hostnameOrId.includes(".") || hostnameOrId.includes("://") ? normalizeHostname(hostnameOrId) : hostnameOrId;
+    const row = await this.pg.get(`
+      SELECT * FROM domains WHERE hostname = ? OR id = ? LIMIT 1
+    `, normalized, hostnameOrId);
+    return row ? domainFromRow(row) : null;
+  }
+  async getDefaultDomain() {
+    const row = await this.pg.get(`
+      SELECT * FROM domains ORDER BY default_domain DESC, created_at ASC LIMIT 1
+    `);
+    return row ? domainFromRow(row) : null;
+  }
+  async createLink(input) {
+    const domain = input.domain ? await this.getDomain(input.domain) : await this.getDefaultDomain();
+    if (!domain) {
+      throw new Error("No domain configured. Run `shortlinks domain add <domain> --default` first.");
+    }
+    const destinationUrl = validateDestinationUrl(input.destinationUrl);
+    const timestamp = now();
+    const machineId = getMachineId();
+    const expiresAt = isoOrNull(input.expiresAt);
+    const slug = input.slug ? normalizeSlug(input.slug) : await this.generateAvailableSlug(domain.id, input.slugLength || DEFAULT_SLUG_LENGTH);
+    try {
+      await this.pg.run(`
+        INSERT INTO links (
+          id, domain_id, slug, destination_url, title, active, expires_at, metadata,
+          machine_id, synced_at, created_at, updated_at
+        )
+        VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?, NULL, ?, ?)
+      `, makeId("lnk"), domain.id, slug, destinationUrl, input.title || null, expiresAt, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("unique") || message.includes("duplicate")) {
+        throw new Error(`Slug already exists for ${domain.hostname}: ${slug}`);
+      }
+      throw error;
+    }
+    return await this.getLink(domain.hostname, slug);
+  }
+  async listLinks(options = {}) {
+    const params = [];
+    let where = "WHERE 1 = 1";
+    if (options.domain) {
+      where += " AND d.hostname = ?";
+      params.push(normalizeHostname(options.domain));
+    }
+    if (options.activeOnly)
+      where += " AND l.active = 1";
+    params.push(options.limit || 100);
+    const rows = await this.pg.all(`
+      SELECT l.*, d.hostname
+      FROM links l
+      JOIN domains d ON d.id = l.domain_id
+      ${where}
+      ORDER BY l.created_at DESC
+      LIMIT ?
+    `, ...params);
+    return rows.map(linkFromRow);
+  }
+  async getLink(domainOrSlug, maybeSlug) {
+    const slug = normalizeSlug(maybeSlug || domainOrSlug);
+    const params = [slug];
+    let domainClause = "";
+    if (maybeSlug) {
+      domainClause = "AND d.hostname = ?";
+      params.push(normalizeHostname(domainOrSlug));
+    }
+    const row = await this.pg.get(`
+      SELECT l.*, d.hostname
+      FROM links l
+      JOIN domains d ON d.id = l.domain_id
+      WHERE l.slug = ? ${domainClause}
+      ORDER BY d.default_domain DESC, l.created_at ASC
+      LIMIT 1
+    `, ...params);
+    return row ? linkFromRow(row) : null;
+  }
+  async totalStats() {
+    const row = await this.pg.get(`
+      SELECT
+        (SELECT COUNT(*)::int FROM domains) AS domains,
+        (SELECT COUNT(*)::int FROM links) AS links,
+        (SELECT COUNT(*)::int FROM clicks) AS clicks
+    `);
+    return row;
+  }
+  async resolve(hostname2, slug) {
+    const normalizedHost = normalizeHostname(hostname2);
+    const normalizedSlug = normalizeSlug(slug);
+    const row = await this.pg.get(`
+      SELECT l.*, d.hostname
+      FROM links l
+      JOIN domains d ON d.id = l.domain_id
+      WHERE d.hostname = ? AND l.slug = ?
+      LIMIT 1
+    `, normalizedHost, normalizedSlug);
+    if (row)
+      return linkFromRow(row);
+    const fallback = await this.pg.get(`
+      SELECT l.*, d.hostname
+      FROM links l
+      JOIN domains d ON d.id = l.domain_id
+      WHERE d.default_domain = 1 AND l.slug = ?
+      ORDER BY d.created_at ASC
+      LIMIT 1
+    `, normalizedSlug);
+    return fallback ? linkFromRow(fallback) : null;
+  }
+  async setLinkActive(domainOrSlug, maybeSlugOrActive, maybeActive) {
+    const active = typeof maybeSlugOrActive === "boolean" ? maybeSlugOrActive : Boolean(maybeActive);
+    const link = typeof maybeSlugOrActive === "boolean" ? await this.getLink(domainOrSlug) : await this.getLink(domainOrSlug, maybeSlugOrActive);
+    if (!link)
+      throw new Error("Link not found.");
+    const timestamp = now();
+    await this.pg.run(`
+      UPDATE links SET active = ?, updated_at = ?, synced_at = NULL WHERE id = ?
+    `, active ? 1 : 0, timestamp, link.id);
+    return await this.getLink(link.hostname, link.slug);
+  }
+  async deleteLink(domainOrSlug, maybeSlug) {
+    const link = maybeSlug ? await this.getLink(domainOrSlug, maybeSlug) : await this.getLink(domainOrSlug);
+    if (!link)
+      throw new Error("Link not found.");
+    await this.pg.run("DELETE FROM links WHERE id = ?", link.id);
+    return link;
+  }
+  async recordClick(link, input = {}) {
+    const timestamp = now();
+    const machineId = getMachineId();
+    const ipHash = input.ip ? this.hashIp(input.ip) : null;
+    const id = makeId("clk");
+    await this.pg.run(`
+      INSERT INTO clicks (
+        id, link_id, domain_id, slug, clicked_at, ip_hash, user_agent, referer,
+        country, city, metadata, machine_id, synced_at, created_at, updated_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?)
+    `, id, link.id, link.domain_id, link.slug, timestamp, ipHash, input.userAgent || null, input.referer || null, input.country || null, input.city || null, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
+    const row = await this.pg.get("SELECT * FROM clicks WHERE id = ?", id);
+    return clickFromRow(row);
+  }
+  async getStats(domainOrSlug, maybeSlug) {
+    const link = maybeSlug ? await this.getLink(domainOrSlug, maybeSlug) : await this.getLink(domainOrSlug);
+    if (!link)
+      throw new Error("Link not found.");
+    const summary = await this.pg.get(`
+      SELECT COUNT(*)::int AS clicks, MAX(clicked_at) AS last_clicked_at FROM clicks WHERE link_id = ?
+    `, link.id);
+    const topReferrers = await this.pg.all(`
+      SELECT referer, COUNT(*)::int AS clicks
+      FROM clicks
+      WHERE link_id = ?
+      GROUP BY referer
+      ORDER BY clicks DESC
+      LIMIT 10
+    `, link.id);
+    const topUserAgents = await this.pg.all(`
+      SELECT user_agent, COUNT(*)::int AS clicks
+      FROM clicks
+      WHERE link_id = ?
+      GROUP BY user_agent
+      ORDER BY clicks DESC
+      LIMIT 10
+    `, link.id);
+    return {
+      link,
+      clicks: summary.clicks,
+      last_clicked_at: nullableIso(summary.last_clicked_at),
+      top_referrers: topReferrers,
+      top_user_agents: topUserAgents
+    };
+  }
+  hashIp(ip) {
+    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
+  }
+  async generateAvailableSlug(domainId, length) {
+    for (let attempt = 0;attempt < 32; attempt += 1) {
+      const slug = randomToken(length);
+      const exists = await this.pg.get(`
+        SELECT 1 FROM links WHERE domain_id = ? AND slug = ? LIMIT 1
+      `, domainId, slug);
+      if (!exists)
+        return slug;
+    }
+    throw new Error("Could not generate an unused slug after 32 attempts.");
+  }
+}
+async function applyPostgresMigrations(connectionString, migrations, options = {}) {
+  const Pool = await loadPgPool();
+  const pool = new Pool(createPgPoolConfig(connectionString, options));
+  const client = await pool.connect();
+  const run = (sql, ...params) => client.query(toPostgresSql(sql), params);
+  const get = async (sql, ...params) => {
+    const result = await run(sql, ...params);
+    return result.rows[0] ?? null;
+  };
+  const applied = [];
+  const skipped = [];
+  try {
+    await run("BEGIN");
+    await run(`
+      SELECT pg_advisory_xact_lock(hashtext(?))
+    `, "shortlinks:migrations");
+    await run(`
+      CREATE TABLE IF NOT EXISTS _shortlinks_migrations (
+        id INTEGER PRIMARY KEY,
+        service TEXT NOT NULL DEFAULT 'shortlinks',
+        applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `);
+    for (let i = 0;i < migrations.length; i += 1) {
+      const id = i + 1;
+      const existing = await get("SELECT id FROM _shortlinks_migrations WHERE id = ? LIMIT 1", id);
+      if (existing) {
+        skipped.push(id);
+        continue;
+      }
+      await run(migrations[i]);
+      await run("INSERT INTO _shortlinks_migrations (id, service, applied_at) VALUES (?, ?, now())", id, "shortlinks");
+      applied.push(id);
+    }
+    await run("COMMIT");
+    return { service: "shortlinks", applied, skipped };
+  } catch (error) {
+    try {
+      await run("ROLLBACK");
+    } catch {}
+    throw error;
+  } finally {
+    client.release();
+    await pool.end();
+  }
+}
+export {
+  createKitPgAdapter,
+  applyPostgresMigrations,
+  PgShortlinksStore
+};