@hot-updater/console 1.1.4 → 1.2.0-rc.1

package/.output/server/_ssr/{badge-BpT7r-ng.mjs → badge-CEdVRgyl.mjs}

@@ -1,7 +1,7 @@
 import "../_runtime.mjs";
 import { bt as require_react, ot as useRender, vt as mergeProps, yt as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
 import { t as cva } from "../_libs/class-variance-authority+clsx.mjs";
-import { k as cn } from "./sidebar-CVsgosaD.mjs";
+import { k as cn } from "./sidebar-DB2YQlok.mjs";
 require_react();
 var import_jsx_runtime = require_jsx_runtime();
 function Card({ className, ...props }) {

package/.output/server/_ssr/{bundleActivity-0qFIcvqt.mjs → bundleActivity-MLrjNJCT.mjs}

@@ -1,4 +1,4 @@
-//#region node_modules/.nitro/vite/services/ssr/assets/bundleActivity-0qFIcvqt.js
+//#region node_modules/.nitro/vite/services/ssr/assets/bundleActivity-MLrjNJCT.js
 async function getBundleActivity(model, inputs) {
 	if (inputs.length === 0) return {};
 	const releases = inputs.map((input) => ({

package/.output/server/_ssr/{config-WVX4IxSR.mjs → config-CjIBFhJX.mjs}

@@ -1,5 +1,5 @@
 import { loadConfig } from "@hot-updater/cli-tools";
-//#region node_modules/.nitro/vite/services/ssr/assets/config-WVX4IxSR.js
+//#region node_modules/.nitro/vite/services/ssr/assets/config-CjIBFhJX.js
 var config_default = async () => {
 	const config = await loadConfig(null);
 	if (config.database === void 0) throw new Error("Set database in hot-updater.config.ts: the database your server runs on, such as d1Database(...), or standaloneRepository({ baseUrl }) to reach a self-hosted server through its admin API.");

package/.output/server/_ssr/config.server-NnMFjMFX.mjs

@@ -0,0 +1,43 @@
+import { i as getRequest } from "./server-BUUKNSPI.mjs";
+import { requireConsoleAccess, t as resolveConsoleConfig } from "./auth.server-DYS1OJ6P.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/config.server-NnMFjMFX.js
+var configPromise = null;
+var core = null;
+var runtime = null;
+var loadCachedConfig = async (request) => {
+	if (!configPromise) configPromise = resolveConsoleConfig(request).catch((error) => {
+		configPromise = null;
+		throw error;
+	});
+	return configPromise;
+};
+/**
+* The console's config, core, and features, without the access check: for
+* routes that take no session, such as a channel link's QR code. Everything
+* else goes through {@link prepareConfig}.
+*/
+var loadConsole = async (request = getRequest()) => {
+	const config = await loadCachedConfig(request);
+	core ??= config.core;
+	if (!runtime) {
+		const { createConsoleRuntime } = await import("./runtime.server-BdMY1blX.mjs");
+		runtime = createConsoleRuntime(config);
+	}
+	return {
+		config,
+		core,
+		runtime,
+		storage: config.storage
+	};
+};
+var prepareConfig = async (request = getRequest()) => {
+	try {
+		await requireConsoleAccess(request);
+		return await loadConsole(request);
+	} catch (error) {
+		if (!(error instanceof Response && (error.status === 401 || error.status === 403))) console.error("Error during configuration initialization:", error);
+		throw error;
+	}
+};
+//#endregion
+export { loadConsole, prepareConfig };

package/.output/server/_ssr/{console-access-aUpQs49I.mjs → console-access-33BNlH97.mjs}

@@ -1,5 +1,5 @@
-import { c as createMiddleware } from "./createMiddleware-B1iPez7u.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/console-access-aUpQs49I.js
+import { t as createMiddleware } from "./createMiddleware-C3ACsfuG.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/console-access-33BNlH97.js
 /**
 * Refuses a caller the console does not authorize before a server function
 * reads its input. TanStack Start runs a function's middleware before the
@@ -9,7 +9,7 @@ import { c as createMiddleware } from "./createMiddleware-B1iPez7u.mjs";
 * `console-access.spec.ts` checks that.
 */
 var consoleAccess = createMiddleware({ type: "function" }).server(async ({ next }) => {
-	const [{ getRequest }, { requireConsoleAccess }] = await Promise.all([import("./server-BxaHSwHh.mjs").then((n) => n.t), import("./auth.server-DR9zc0EU.mjs")]);
+	const [{ getRequest }, { requireConsoleAccess }] = await Promise.all([import("./server-BUUKNSPI.mjs").then((n) => n.t), import("./auth.server-DYS1OJ6P.mjs")]);
 	await requireConsoleAccess(getRequest());
 	return next();
 });

package/.output/server/_ssr/{console-features-4xAGfZHw.mjs → console-features-BTV-XuhQ.mjs}

@@ -1,4 +1,4 @@
-//#region node_modules/.nitro/vite/services/ssr/assets/console-features-4xAGfZHw.js
+//#region node_modules/.nitro/vite/services/ssr/assets/console-features-BTV-XuhQ.js
 /**
 * The console's features and the server plugin each one needs. The console
 * serves a feature only when its config lists the plugin, as the server runs

package/.output/server/_ssr/{console-features-api-DSSgCV3v.mjs → console-features-api-v1fSycue.mjs}

@@ -1,10 +1,10 @@
-import { n as consoleFeatures } from "./console-features-4xAGfZHw.mjs";
-import { u as createServerFn } from "./createMiddleware-B1iPez7u.mjs";
-import { A as createSsrRpc } from "./sidebar-CVsgosaD.mjs";
-import { t as consoleAccess } from "./console-access-aUpQs49I.mjs";
-import { _ as notFound } from "../_libs/@tanstack/react-router+[...].mjs";
+import { l as createServerFn } from "./createServerFn-AQvBMBjJ.mjs";
+import { t as consoleAccess } from "./console-access-33BNlH97.mjs";
+import { A as createSsrRpc } from "./sidebar-DB2YQlok.mjs";
 import { i as useQuery, r as queryOptions } from "../_libs/tanstack__react-query.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/console-features-api-DSSgCV3v.js
+import { n as consoleFeatures } from "./console-features-BTV-XuhQ.mjs";
+import { v as notFound } from "../_libs/@tanstack/react-router+[...].mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/console-features-api-v1fSycue.js
 /** The features this console serves, for navigation and route guards. */
 var getConsoleFeaturesRpc = createServerFn({ method: "GET" }).middleware([consoleAccess]).handler(createSsrRpc("82ec3500e57f9e81dac6d3f3a7bd9e34915da3121429beec87b7ad153dc6eafe"));
 var consoleFeaturesQueryKey = ["console", "features"];

package/.output/server/_ssr/{console-features-rpc-D6kMlR2A.mjs → console-features-rpc-C7XNVqm0.mjs}

@@ -1,14 +1,14 @@
-import { u as createServerFn } from "./createMiddleware-B1iPez7u.mjs";
-import { t as consoleAccess } from "./console-access-aUpQs49I.mjs";
-import { t as createServerRpc } from "./createServerRpc-BaDJLGBx.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/console-features-rpc-D6kMlR2A.js
+import { l as createServerFn } from "./createServerFn-AQvBMBjJ.mjs";
+import { t as consoleAccess } from "./console-access-33BNlH97.mjs";
+import { t as createServerRpc } from "./createServerRpc-BVvRVOz5.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/console-features-rpc-C7XNVqm0.js
 var getConsoleFeaturesRpc_createServerFn_handler = createServerRpc({
 	id: "82ec3500e57f9e81dac6d3f3a7bd9e34915da3121429beec87b7ad153dc6eafe",
 	name: "getConsoleFeaturesRpc",
 	filename: "src/lib/console-features-rpc.ts"
 }, (opts) => getConsoleFeaturesRpc.__executeServer(opts));
 var getConsoleFeaturesRpc = createServerFn({ method: "GET" }).middleware([consoleAccess]).handler(getConsoleFeaturesRpc_createServerFn_handler, async () => {
-	const { prepareConfig } = await import("./config.server-DTdsG47T.mjs");
+	const { prepareConfig } = await import("./config.server-NnMFjMFX.mjs");
 	const { runtime } = await prepareConfig();
 	return {
 		features: await runtime.features(),

package/.output/server/_ssr/createCsrfMiddleware-BwHbC8n-.mjs

@@ -0,0 +1,159 @@
+import { t as createMiddleware } from "./createMiddleware-C3ACsfuG.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/createCsrfMiddleware-BwHbC8n-.js
+function isPromise(value) {
+	return Boolean(value && typeof value === "object" && typeof value.then === "function");
+}
+/**
+* Re-encode characters that are unsafe in URL paths.
+* Includes ASCII control characters (0x00-0x1F, 0x7F) and a subset of the
+* WHATWG URL "path percent-encode set" (", <, >, `, {, }).
+*
+* Space (0x20) is intentionally excluded — decodeURI decodes %20 to space
+* and the router stores decoded spaces in location.pathname. The existing
+* encodePathLikeUrl already handles re-encoding spaces for outgoing URLs.
+*
+* These characters are decoded by decodeURI but must remain percent-encoded
+* in paths to match how upstream layers (CDNs, edge middleware, browsers)
+* interpret the URL, preventing infinite redirect loops and path mismatches.
+*/
+var PATH_UNSAFE_RE = /[\x00-\x1f\x7f"<>`{}]/g;
+function sanitizePathSegment(segment) {
+	return segment.replace(PATH_UNSAFE_RE, (ch) => "%" + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0"));
+}
+function decodeSegment(segment) {
+	let decoded;
+	try {
+		decoded = decodeURI(segment);
+	} catch {
+		decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {
+			try {
+				return decodeURI(match);
+			} catch {
+				return match;
+			}
+		});
+	}
+	return sanitizePathSegment(decoded);
+}
+/**
+* Extract the explicit URL scheme, including its colon, using WHATWG
+* normalization rules. This does not validate the rest of the URL.
+*
+* Returning `undefined` means "no explicit scheme", not "safe URL";
+* protocol-relative URLs such as "//evil.example" require a separate check.
+*/
+function getUrlScheme(url) {
+	if (url[0] === "/") return;
+	if (!url.includes(":")) return;
+	return /^[\x00-\x20]*([a-z][a-z\d+.\t\n\r-]*:)/i.exec(url)?.[1]?.replace(/[\t\n\r]/g, "").toLowerCase();
+}
+var protocolRelativePrefixRegex = /^[\x00-\x20]*[\\/][\t\n\r]*[\\/]/;
+/**
+* Check if a URL string uses a protocol that is not in the allowlist or is
+* protocol-relative (e.g. "//evil.example"), which can navigate to another host.
+* Returns true for blocked protocols like javascript:, blob:, and data:, as
+* well as slash/backslash variants of protocol-relative URLs.
+*
+* Scheme parsing normalizes:
+* - Mixed case (JavaScript: → javascript:)
+* - Whitespace/control characters (java\nscript: → javascript:)
+* - Leading whitespace
+*
+* For relative URLs without a protocol-relative prefix, returns false.
+*
+* @param url - The URL string to check
+* @param allowlist - Set of protocols to allow
+* @returns true if the URL uses a protocol that is not allowed or can escape
+* the current origin through a protocol-relative URL
+*/
+function isDangerousProtocol(url, allowlist) {
+	if (!url) return false;
+	if (protocolRelativePrefixRegex.test(url)) return true;
+	const scheme = getUrlScheme(url);
+	return scheme ? !allowlist.has(scheme) : false;
+}
+function decodePath(path) {
+	if (!path) return path;
+	let result = path;
+	if (/[%\\\x00-\x1f\x7f]/.test(path)) {
+		const re = /%25|%5C/gi;
+		let cursor = 0;
+		let match;
+		result = "";
+		while (null !== (match = re.exec(path))) {
+			result += decodeSegment(path.slice(cursor, match.index)) + match[0];
+			cursor = re.lastIndex;
+		}
+		result += decodeSegment(cursor ? path.slice(cursor) : path);
+	}
+	return result;
+}
+var innerCreateCsrfMiddleware = (opts = {}) => {
+	const continueRequest = (result, ctx) => {
+		return isValidationResultAllowed(result, opts) ? ctx.next() : getFailureResponse(opts, ctx);
+	};
+	const validateRequest = (ctx) => {
+		const result = validateCsrfRequest(opts, ctx);
+		if (isPromise(result)) return result.then((result) => continueRequest(result, ctx));
+		return continueRequest(result, ctx);
+	};
+	return createMiddleware().server((ctx) => {
+		const csrfCtx = ctx;
+		try {
+			if (opts.filter) {
+				const shouldValidate = opts.filter(csrfCtx);
+				if (isPromise(shouldValidate)) return shouldValidate.then((shouldValidate) => shouldValidate ? validateRequest(csrfCtx) : ctx.next());
+				if (!shouldValidate) return ctx.next();
+			}
+			return validateRequest(csrfCtx);
+		} catch (error) {
+			return Promise.reject(error);
+		}
+	});
+};
+var createCsrfMiddleware = innerCreateCsrfMiddleware;
+function isValidationResultAllowed(result, opts) {
+	return result === true || result === void 0 && opts.allowRequestsWithoutOriginCheck === true;
+}
+function validateCsrfRequest(opts, ctx) {
+	const fetchSite = ctx.request.headers.get("Sec-Fetch-Site");
+	if (fetchSite !== null) return matchValue(opts.secFetchSite ?? "same-origin", fetchSite, ctx);
+	const origin = ctx.request.headers.get("Origin");
+	if (origin !== null) {
+		if (opts.origin) return matchValue(opts.origin, origin, ctx);
+		return origin === new URL(ctx.request.url).origin;
+	}
+	const referer = ctx.request.headers.get("Referer");
+	if (referer === null || opts.referer === false) return;
+	if (typeof opts.referer === "function") return opts.referer(referer, ctx);
+	if (opts.origin) {
+		const refererOrigin = getOriginFromUrl(referer);
+		return refererOrigin !== void 0 && matchValue(opts.origin, refererOrigin, ctx);
+	}
+	return isRefererSameOrigin(referer, new URL(ctx.request.url).origin);
+}
+function matchValue(matcher, value, ctx) {
+	if (typeof matcher === "function") return matcher(value, ctx);
+	if (Array.isArray(matcher)) return matcher.includes(value);
+	return value === matcher;
+}
+function getOriginFromUrl(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+}
+function isRefererSameOrigin(referer, requestOrigin) {
+	if (referer === requestOrigin) return true;
+	if (!referer.startsWith(requestOrigin)) return false;
+	if (referer.length === requestOrigin.length) return true;
+	const code = referer.charCodeAt(requestOrigin.length);
+	return code === 47 || code === 63 || code === 35;
+}
+function getFailureResponse(opts, ctx) {
+	if (typeof opts.failureResponse === "function") return opts.failureResponse(ctx);
+	return opts.failureResponse?.clone() ?? new Response("Forbidden", { status: 403 });
+}
+//#endregion
+export { isPromise as i, decodePath as n, isDangerousProtocol as r, createCsrfMiddleware as t };

package/.output/server/_ssr/createMiddleware-C3ACsfuG.mjs

@@ -0,0 +1,24 @@
+//#region node_modules/.nitro/vite/services/ssr/assets/createMiddleware-C3ACsfuG.js
+var createMiddleware = (options, __opts) => {
+	const resolvedOptions = {
+		type: "request",
+		...__opts || options
+	};
+	return {
+		options: resolvedOptions,
+		middleware: (middleware) => {
+			return createMiddleware({}, Object.assign(resolvedOptions, { middleware }));
+		},
+		validator: (validator) => {
+			return createMiddleware({}, Object.assign(resolvedOptions, { validator }));
+		},
+		client: (client) => {
+			return createMiddleware({}, Object.assign(resolvedOptions, { client }));
+		},
+		server: (server) => {
+			return createMiddleware({}, Object.assign(resolvedOptions, { server }));
+		}
+	};
+};
+//#endregion
+export { createMiddleware as t };

package/.output/server/_ssr/{createMiddleware-B1iPez7u.mjs → createServerFn-AQvBMBjJ.mjs}

@@ -1,5 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-//#region node_modules/.nitro/vite/services/ssr/assets/createMiddleware-B1iPez7u.js
+//#region node_modules/.nitro/vite/services/ssr/assets/createServerFn-AQvBMBjJ.js
 var COOKIE_MAX_AGE_LIMIT = 3456e4;
 function endIndex(str, min, len) {
 	const index = str.indexOf(";", min);
@@ -594,26 +594,5 @@ function serverFnBaseToMiddleware(options) {
 		}
 	};
 }
-var createMiddleware = (options, __opts) => {
-	const resolvedOptions = {
-		type: "request",
-		...__opts || options
-	};
-	return {
-		options: resolvedOptions,
-		middleware: (middleware) => {
-			return createMiddleware({}, Object.assign(resolvedOptions, { middleware }));
-		},
-		validator: (validator) => {
-			return createMiddleware({}, Object.assign(resolvedOptions, { validator }));
-		},
-		client: (client) => {
-			return createMiddleware({}, Object.assign(resolvedOptions, { client }));
-		},
-		server: (server) => {
-			return createMiddleware({}, Object.assign(resolvedOptions, { server }));
-		}
-	};
-};
 //#endregion
-export { parseSetCookie as _, TSS_SERVER_FUNCTION as a, serialize as b, createMiddleware as c, flattenMiddlewares as d, getStartContext as f, parse as g, mergeHeaders as h, TSS_FORMDATA_CONTEXT as i, createNullProtoObject as l, isRedirect as m, MAX_FRAME_PAYLOAD_SIZE as n, X_TSS_RAW_RESPONSE as o, getStartOptions as p, TSS_CONTENT_TYPE_FRAMED_VERSIONED as r, X_TSS_SERIALIZED as s, MAX_FRAMED_STREAMS as t, createServerFn as u, runWithStartContext as v, splitSetCookieString as x, safeObjectMerge as y };
+export { runWithStartContext as _, TSS_SERVER_FUNCTION as a, splitSetCookieString as b, createNullProtoObject as c, getStartContext as d, getStartOptions as f, parseSetCookie as g, parse as h, TSS_FORMDATA_CONTEXT as i, createServerFn as l, mergeHeaders as m, MAX_FRAME_PAYLOAD_SIZE as n, X_TSS_RAW_RESPONSE as o, isRedirect as p, TSS_CONTENT_TYPE_FRAMED_VERSIONED as r, X_TSS_SERIALIZED as s, MAX_FRAMED_STREAMS as t, flattenMiddlewares as u, safeObjectMerge as v, serialize as y };

package/.output/server/_ssr/{createServerRpc-BaDJLGBx.mjs → createServerRpc-BVvRVOz5.mjs}

@@ -1,5 +1,5 @@
-import { a as TSS_SERVER_FUNCTION } from "./createMiddleware-B1iPez7u.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/createServerRpc-BaDJLGBx.js
+import { a as TSS_SERVER_FUNCTION } from "./createServerFn-AQvBMBjJ.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/createServerRpc-BVvRVOz5.js
 var createServerRpc = (serverFnMeta, splitImportFn) => {
 	const url = "/_serverFn/" + serverFnMeta.id;
 	return Object.assign(splitImportFn, {

package/.output/server/_ssr/{databaseConfig-C5SkAyUy.mjs → databaseConfig-B_Bg7qS5.mjs}

@@ -1,4 +1,4 @@
-//#region node_modules/.nitro/vite/services/ssr/assets/databaseConfig-C5SkAyUy.js
+//#region node_modules/.nitro/vite/services/ssr/assets/databaseConfig-B_Bg7qS5.js
 /** Whether a configured database is a self-hosted server's. */
 var isRemoteDatabase = (value) => typeof value === "object" && value !== null && "core" in value && "fetchAdmin" in value;
 //#endregion

package/.output/server/_ssr/{databaseJsonValue-Csbuzc9Q.mjs → databaseJsonValue-kS7cvEtz.mjs}

@@ -1,4 +1,4 @@
-//#region node_modules/.nitro/vite/services/ssr/assets/databaseJsonValue-Csbuzc9Q.js
+//#region node_modules/.nitro/vite/services/ssr/assets/databaseJsonValue-kS7cvEtz.js
 /** A bundle an operation names is not stored. */
 var DatabaseBundleNotFoundError = class extends Error {
 	bundleId;

package/.output/server/_ssr/{databaseRows-CPphvbag.mjs → databaseRows-B6H8Cmgq.mjs}

@@ -1,6 +1,6 @@
-import { a as isDatabaseMetadataObject, t as DatabaseAdapterInputError } from "./databaseJsonValue-Csbuzc9Q.mjs";
-import { f as getBundlePatches, m as getManifestStorageUri, p as getManifestFileHash, u as getAssetBaseStorageUri } from "./dist-CbQbBIw-.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/databaseRows-CPphvbag.js
+import { a as isDatabaseMetadataObject, t as DatabaseAdapterInputError } from "./databaseJsonValue-kS7cvEtz.mjs";
+import { d as getAssetBaseStorageUri, h as getManifestStorageUri, m as getManifestFileHash, p as getBundlePatches } from "./dist-TEpM_UAD.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/databaseRows-B6H8Cmgq.js
 var bundleMetadataToRow = (metadata) => {
 	if (metadata === void 0) return {};
 	if (!isDatabaseMetadataObject(metadata)) throw new DatabaseAdapterInputError("invalid-data");

package/.output/server/_ssr/{dialog-B4ALf7NJ.mjs → dialog-C8CS8RMt.mjs}

@@ -1,7 +1,7 @@
 import "../_runtime.mjs";
 import { $ as DialogTitle$1, Q as DialogTrigger$1, at as DialogBackdrop, bt as require_react, et as DialogRoot, it as DialogClose, nt as DialogPopup, rt as DialogDescription$1, tt as DialogPortal$1, yt as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
 import { t as X } from "../_libs/lucide-react.mjs";
-import { k as cn, t as Button$1 } from "./sidebar-CVsgosaD.mjs";
+import { k as cn, t as Button$1 } from "./sidebar-DB2YQlok.mjs";
 require_react();
 var import_jsx_runtime = require_jsx_runtime();
 function Dialog$1({ ...props }) {