@siteping/server 0.0.0-stage → 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1270 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createSitepingHandler: () => createSitepingHandler,
+  dispatchWebhook: () => dispatchWebhook,
+  dispatchWebhooks: () => dispatchWebhooks
+});
+module.exports = __toCommonJS(index_exports);
+
+// ../core/src/email.ts
+var EMAIL_PATTERN = /^(?!\.)(?!.*\.\.)[\p{L}\p{M}\p{N}!#$%&'*+/=?^_`{|}~.-]{0,63}[\p{L}\p{M}\p{N}!#$%&'*+/=?^_`{|}~-]@(?:[\p{L}\p{N}](?:[\p{L}\p{M}\p{N}-]{0,61}[\p{L}\p{M}\p{N}])?\.)+[\p{L}\p{N}][\p{L}\p{M}\p{N}-]{0,61}[\p{L}\p{M}\p{N}]$/u;
+
+// ../core/src/type-utils.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function hasOwn(value, key) {
+  return isRecord(value) && key in value;
+}
+
+// ../core/src/types.ts
+var IDENTITY_FIELD_MAX_LENGTH = 200;
+var FEEDBACK_TYPES = ["question", "change", "bug", "other"];
+var FEEDBACK_STATUSES = ["open", "in_progress", "resolved", "wont_fix"];
+var CLOSED_FEEDBACK_STATUSES = ["resolved", "wont_fix"];
+function isClosedStatus(status) {
+  return CLOSED_FEEDBACK_STATUSES.includes(status);
+}
+function toFeedbackUpdate(status, closedAt = /* @__PURE__ */ new Date()) {
+  return isClosedStatus(status) ? { status, resolvedAt: closedAt } : { status, resolvedAt: null };
+}
+var COMMENT_AUTHOR_ROLES = ["client", "team"];
+var COMMENT_BODY_MAX_LENGTH = 5e3;
+var MAX_COMMENTS_PER_FEEDBACK = 100;
+var StoreNotFoundError = class extends Error {
+  code = "STORE_NOT_FOUND";
+  constructor(message = "Record not found", options) {
+    super(message, options);
+    this.name = "StoreNotFoundError";
+  }
+};
+var StoreDuplicateError = class extends Error {
+  code = "STORE_DUPLICATE";
+  constructor(message = "Duplicate record", options) {
+    super(message, options);
+    this.name = "StoreDuplicateError";
+  }
+};
+var StoreLimitError = class extends Error {
+  code = "STORE_LIMIT";
+  constructor(message = "Store limit reached", options) {
+    super(message, options);
+    this.name = "StoreLimitError";
+  }
+};
+var StoreValueTooLongError = class extends Error {
+  code = "STORE_VALUE_TOO_LONG";
+  constructor(message = "Value too long for the store", options) {
+    super(message, options);
+    this.name = "StoreValueTooLongError";
+  }
+};
+function hasErrorCode(error, code) {
+  return hasOwn(error, "code") && error.code === code;
+}
+function isStoreNotFound(error) {
+  if (error instanceof StoreNotFoundError) return true;
+  return hasErrorCode(error, "STORE_NOT_FOUND") || hasErrorCode(error, "P2025");
+}
+function isStoreDuplicate(error) {
+  if (error instanceof StoreDuplicateError) return true;
+  return hasErrorCode(error, "STORE_DUPLICATE") || hasErrorCode(error, "P2002");
+}
+function isStoreLimit(error) {
+  if (error instanceof StoreLimitError) return true;
+  return hasErrorCode(error, "STORE_LIMIT");
+}
+function isStoreValueTooLong(error) {
+  if (error instanceof StoreValueTooLongError) return true;
+  return hasErrorCode(error, "STORE_VALUE_TOO_LONG");
+}
+function flattenAnnotation(ann) {
+  return {
+    cssSelector: ann.anchor.cssSelector,
+    xpath: ann.anchor.xpath,
+    textSnippet: ann.anchor.textSnippet,
+    elementTag: ann.anchor.elementTag,
+    elementId: ann.anchor.elementId,
+    textPrefix: ann.anchor.textPrefix,
+    textSuffix: ann.anchor.textSuffix,
+    fingerprint: ann.anchor.fingerprint,
+    neighborText: ann.anchor.neighborText,
+    anchorKey: ann.anchor.anchorKey ?? null,
+    xPct: ann.rect.xPct,
+    yPct: ann.rect.yPct,
+    wPct: ann.rect.wPct,
+    hPct: ann.rect.hPct,
+    scrollX: ann.scrollX,
+    scrollY: ann.scrollY,
+    viewportW: ann.viewportW,
+    viewportH: ann.viewportH,
+    devicePixelRatio: ann.devicePixelRatio
+  };
+}
+var CONSOLE_DIAGNOSTIC_LEVELS = ["log", "info", "warn", "error"];
+var ANCHOR_ELEMENT_TAG_MAX = 191;
+var ANCHOR_ELEMENT_ID_MAX = 191;
+
+// src/constants.ts
+var MAX_ANNOTATIONS_PER_FEEDBACK = 50;
+var DEFAULT_MAX_BODY_BYTES = 4 * 1024 * 1024;
+var MAX_VALIDATION_ISSUES = 20;
+var DRY_RUN_CONCURRENCY = 8;
+var ERROR_MESSAGES = {
+  invalidJson: "Invalid JSON",
+  bodyTooLarge: "Request body too large",
+  unauthorized: "Unauthorized",
+  apiKeyRequiredForDestructive: "apiKey required for destructive operations",
+  forbidden: "Forbidden",
+  unsupportedMediaType: "Content-Type must be application/json",
+  feedbackNotFound: "Feedback not found",
+  commentNotFound: "Comment not found",
+  clientIdUsedByAnotherProject: "clientId already used by another project",
+  clientIdUsedByAnotherFeedback: "clientId already used on another feedback",
+  commentsUnsupported: "Comments are not supported by this store",
+  tooManyComments: `Too many client comments on this feedback (max ${MAX_COMMENTS_PER_FEEDBACK})`,
+  tooManyAnnotations: `Too many annotations (max ${MAX_ANNOTATIONS_PER_FEEDBACK})`,
+  valueTooLong: "A value is too long for this server's database",
+  deletionAborted: "Deletion aborted: a linked resource could not be cleaned up",
+  internalServerError: "Internal server error"
+};
+var LIST_QUERY_KEYS = [
+  "projectName",
+  "page",
+  "limit",
+  "type",
+  "status",
+  "statuses",
+  "search",
+  "url",
+  "urlPattern"
+];
+
+// src/access.ts
+var textEncoder = new TextEncoder();
+function safeCompare(a, b) {
+  const bytesA = textEncoder.encode(a);
+  const bytesB = textEncoder.encode(b);
+  if (bytesA.length !== bytesB.length) return false;
+  let difference = 0;
+  for (let index = 0; index < bytesA.length; index++) {
+    difference |= (bytesA[index] ?? 0) ^ (bytesB[index] ?? 0);
+  }
+  return difference === 0;
+}
+function isProductionEnvironment() {
+  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+function createApiKeyGate({
+  apiKey,
+  publicEndpoints = apiKey ? ["POST", "OPTIONS"] : void 0,
+  requireAuthForDestructive = true,
+  redactUnauthenticatedEmails = true
+}) {
+  if (!apiKey && requireAuthForDestructive && isProductionEnvironment()) {
+    throw new Error(
+      "[siteping] createSitepingHandler: apiKey is required in production. Set `apiKey` to enable destructive endpoints, pass `access` to plug in your own authentication, or pass `requireAuthForDestructive: false` if SitePing sits behind your own auth middleware."
+    );
+  }
+  const publicMethods = publicEndpoints ? new Set(publicEndpoints) : null;
+  const isBearerAuthenticated = (request) => {
+    if (!apiKey) return false;
+    const header = request.headers.get("Authorization");
+    return header !== null && safeCompare(header, `Bearer ${apiKey}`);
+  };
+  const authenticate = async (request, method) => {
+    const canReadAuthorEmail = !redactUnauthenticatedEmails || isBearerAuthenticated(request);
+    if (!apiKey) {
+      if (requireAuthForDestructive && (method === "DELETE" || method === "PATCH")) {
+        return { ok: false, status: 401, error: ERROR_MESSAGES.apiKeyRequiredForDestructive };
+      }
+      return { ok: true, principal: null, canReadAuthorEmail };
+    }
+    if (publicMethods?.has(method) || isBearerAuthenticated(request)) {
+      return { ok: true, principal: null, canReadAuthorEmail };
+    }
+    return { ok: false, status: 401, error: ERROR_MESSAGES.unauthorized };
+  };
+  return {
+    echoesAuthorEmailOnCreate: true,
+    // The key travels in a header a forged cross-site request cannot set.
+    guardsMutations: false,
+    listCacheControl: "private, max-age=5",
+    authenticate,
+    // This policy admits by method: a visitor reads, the key holder triages.
+    async admits(request, method) {
+      return (await authenticate(request, method)).ok;
+    },
+    async authorize() {
+      return true;
+    },
+    // The key proves the caller is the project side; a public POST does not.
+    async canCommentAsTeam({ request }) {
+      return isBearerAuthenticated(request);
+    }
+  };
+}
+function createAccessGate(access) {
+  return {
+    echoesAuthorEmailOnCreate: false,
+    guardsMutations: true,
+    listCacheControl: "no-store",
+    async authenticate(request) {
+      const principal = await access.authenticate(request);
+      if (!principal) {
+        return { ok: false, status: 401, error: ERROR_MESSAGES.unauthorized };
+      }
+      return { ok: true, principal, canReadAuthorEmail: await access.canReadAuthorEmail?.(principal) === true };
+    },
+    // A dry run reuses the response's request, so `authenticate` is never asked
+    // about another method: `authorize` decides, by action.
+    async admits() {
+      return true;
+    },
+    async authorize(context) {
+      return access.authorize ? access.authorize(context) : true;
+    },
+    // Speaking as the team is an impersonation privilege: without the host's
+    // word for it (its own callback, or the email access it grants), refuse.
+    async canCommentAsTeam({ principal }, canReadAuthorEmail) {
+      return access.canCommentAsTeam ? await access.canCommentAsTeam(principal) === true : canReadAuthorEmail;
+    }
+  };
+}
+
+// src/cors.ts
+var DEFAULT_ALLOWED_HEADERS = ["Content-Type", "Authorization"];
+var HEADER_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function buildCorsHeaders(request, allowedOrigins) {
+  if (!allowedOrigins) return {};
+  const origin = request.headers.get("Origin");
+  if (!origin || !allowedOrigins.includes(origin)) return { Vary: "Origin" };
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": DEFAULT_ALLOWED_HEADERS.join(", "),
+    "Access-Control-Allow-Credentials": "true",
+    "Access-Control-Max-Age": "86400",
+    Vary: "Origin"
+  };
+}
+function withCors(response, corsHeaders) {
+  for (const [key, value] of Object.entries(corsHeaders)) {
+    response.headers.set(key, value);
+  }
+  return response;
+}
+function preflightAllowedHeaders(request) {
+  const allowed = [...DEFAULT_ALLOWED_HEADERS];
+  const seen = new Set(allowed.map((name) => name.toLowerCase()));
+  for (const raw of (request.headers.get("Access-Control-Request-Headers") ?? "").split(",")) {
+    const name = raw.trim();
+    if (!HEADER_TOKEN.test(name) || seen.has(name.toLowerCase())) continue;
+    seen.add(name.toLowerCase());
+    allowed.push(name);
+  }
+  return allowed.join(", ");
+}
+function preflightResponse(request, allowedOrigins) {
+  const corsHeaders = buildCorsHeaders(request, allowedOrigins);
+  const headers = corsHeaders["Access-Control-Allow-Origin"] ? {
+    ...corsHeaders,
+    "Access-Control-Allow-Headers": preflightAllowedHeaders(request),
+    Vary: "Origin, Access-Control-Request-Headers"
+  } : corsHeaders;
+  return new Response(null, { status: 204, headers });
+}
+
+// src/validation.ts
+var zod = __toESM(require("zod"), 1);
+var z2 = "z" in zod ? zod.z : zod;
+function boundedArray(element, max) {
+  return z2.array(z2.unknown()).max(max).pipe(z2.array(element));
+}
+var anchorSchema = z2.object({
+  cssSelector: z2.string().min(1).max(2e3),
+  xpath: z2.string().min(1).max(2e3),
+  textSnippet: z2.string().max(500),
+  elementTag: z2.string().min(1).max(ANCHOR_ELEMENT_TAG_MAX),
+  // A resolver hint: an over-long id is dropped, as the widget now does,
+  // rather than failing the whole payload — earlier widgets send it unbounded.
+  elementId: z2.string().transform((id) => id.length <= ANCHOR_ELEMENT_ID_MAX ? id : void 0).optional(),
+  textPrefix: z2.string().max(200),
+  textSuffix: z2.string().max(200),
+  fingerprint: z2.string().max(200),
+  neighborText: z2.string().max(500),
+  // Optional semantic anchor identifier from `data-feedback-anchor`.
+  // Null when no semantic ancestor exists; widget always sends this field.
+  anchorKey: z2.string().max(200).nullable().optional()
+});
+var rectSchema = z2.object({
+  xPct: z2.number().min(0).max(1),
+  yPct: z2.number().min(0).max(1),
+  wPct: z2.number().min(0).max(1),
+  hPct: z2.number().min(0).max(1)
+});
+var annotationSchema = z2.object({
+  anchor: anchorSchema,
+  rect: rectSchema,
+  // Raw `window.scrollX/Y` — no lower bound: scrollX is negative on a
+  // scrolled `dir="rtl"` page. `z.number()` already rejects NaN/±Infinity.
+  scrollX: z2.number(),
+  scrollY: z2.number(),
+  // Upper bound = the `Int` (INT4) column max, so oversized input is a 400
+  // here rather than a database error at insert time.
+  viewportW: z2.number().int().positive().max(2147483647),
+  viewportH: z2.number().int().positive().max(2147483647),
+  devicePixelRatio: z2.number().positive().default(1)
+});
+var consoleEntrySchema = z2.object({
+  level: z2.enum(CONSOLE_DIAGNOSTIC_LEVELS),
+  timestamp: z2.string().max(50),
+  message: z2.string().max(600)
+});
+var networkEntrySchema = z2.object({
+  url: z2.string().max(2e3),
+  method: z2.string().max(20),
+  status: z2.number().int().min(0).max(599),
+  durationMs: z2.number().min(0).max(6e5),
+  timestamp: z2.string().max(50)
+});
+var diagnosticsSchema = z2.object({
+  console: boundedArray(consoleEntrySchema, 50),
+  network: boundedArray(networkEntrySchema, 20)
+});
+var screenshotRegionSchema = z2.strictObject({
+  xPct: z2.number().min(0).max(1),
+  yPct: z2.number().min(0).max(1),
+  wPct: z2.number().min(0).max(1),
+  hPct: z2.number().min(0).max(1)
+});
+var clientIdSchema = z2.string().min(1).max(200).regex(/^[a-zA-Z0-9_-]+$/, "clientId must be alphanumeric (a-z, A-Z, 0-9, _, -)");
+var feedbackCreateSchema = z2.object({
+  projectName: z2.string().min(1).max(200),
+  type: z2.enum(FEEDBACK_TYPES),
+  message: z2.string().min(1).max(5e3),
+  // Page-scope identifier the widget uses to group feedbacks. Defaults to
+  // `window.location.pathname` ("/orders/42"), but hosts can override
+  // `getPageScope()` to return a full URL, an opaque slug, anything they
+  // want. We trim + require non-empty so whitespace-only payloads don't
+  // leak into the DB; otherwise the value is opaque to the server and only
+  // used as a literal Prisma equality filter, so the loose shape is safe.
+  url: z2.string().trim().min(1).max(2e3),
+  // Optional parameterized URL template (e.g. "/orders/:orderId") provided
+  // by the host via `getPageScope()`. Null when host omits it.
+  urlPattern: z2.string().max(2e3).nullable().optional(),
+  viewport: z2.string().min(1).max(50),
+  userAgent: z2.string().min(1).max(500),
+  // The widget's identity modal validates against the same core pattern and
+  // length cap, so an identity the modal accepts (and persists) is never a
+  // 400 here.
+  authorName: z2.string().min(1).max(IDENTITY_FIELD_MAX_LENGTH),
+  authorEmail: z2.email({ pattern: EMAIL_PATTERN }).max(IDENTITY_FIELD_MAX_LENGTH),
+  annotations: boundedArray(annotationSchema, 50),
+  clientId: clientIdSchema,
+  // Optional base64 JPEG data URL captured by the widget when
+  // `enableScreenshot: true`. ~1.5 MB cap = roughly a 1.1 MB JPEG, well
+  // above typical sizes (the widget downscales to 1200px). Rejects abuse
+  // without truncating legitimate captures.
+  screenshotDataUrl: z2.string().max(15e5).regex(/^data:image\/(jpeg|png|webp);base64,/, "screenshotDataUrl must be a data:image/* base64 URL").nullable().optional(),
+  // Optional annotation-rect position within the screenshot. Sent by widgets
+  // that capture context around the drawn rect; null + omitted are both
+  // accepted so legacy clients (and captures without a screenshot) keep
+  // working unchanged.
+  screenshotRegion: screenshotRegionSchema.nullable().optional(),
+  // Optional console + failed-network snapshot. The widget only attaches
+  // this when `captureDiagnostics` is enabled; null + omitted are both
+  // accepted so existing clients keep working unchanged.
+  diagnostics: diagnosticsSchema.nullable().optional()
+});
+var commentCreateSchema = z2.object({
+  projectName: z2.string().min(1).max(200),
+  feedbackId: z2.string().min(1).max(200),
+  // Trimmed, so a whitespace-only reply is a 400 rather than an empty bubble.
+  body: z2.string().trim().min(1).max(COMMENT_BODY_MAX_LENGTH),
+  authorName: z2.string().min(1).max(IDENTITY_FIELD_MAX_LENGTH),
+  // The widget's reviewers always have an email; a dashboard user may have
+  // none on file, sent as "". Anything else must be a real address.
+  authorEmail: z2.union([z2.literal(""), z2.email({ pattern: EMAIL_PATTERN }).max(IDENTITY_FIELD_MAX_LENGTH)]),
+  // A claim, not a fact: the handler keeps "team" only when the access
+  // policy vouches for the caller.
+  authorRole: z2.enum(COMMENT_AUTHOR_ROLES).default("client"),
+  clientId: clientIdSchema
+});
+var commentDeleteSchema = z2.object({
+  projectName: z2.string().min(1).max(200),
+  feedbackId: z2.string().min(1).max(200),
+  commentId: z2.string().min(1).max(200)
+});
+var feedbackPatchSchema = z2.object({
+  id: z2.string().min(1),
+  projectName: z2.string().min(1).max(200),
+  status: z2.enum(FEEDBACK_STATUSES)
+});
+var feedbackDeleteSchema = z2.union([
+  z2.object({ id: z2.string().min(1), projectName: z2.string().min(1).max(200) }),
+  z2.object({ projectName: z2.string().min(1).max(200), deleteAll: z2.literal(true) })
+]);
+var getQuerySchema = z2.object({
+  projectName: z2.string().min(1).max(200),
+  page: z2.coerce.number().int().min(1).default(1),
+  limit: z2.coerce.number().int().min(1).max(100).default(50),
+  type: z2.enum(FEEDBACK_TYPES).optional(),
+  status: z2.enum(FEEDBACK_STATUSES).optional(),
+  // Bucket status filter serialized as CSV over the wire (e.g.
+  // `statuses=open,in_progress`). Non-empty strings are split before each value
+  // is validated against the known statuses; `statuses` wins over the exact
+  // `status` filter downstream. Capped at 4 — the number of known statuses.
+  statuses: z2.preprocess(
+    (val) => typeof val === "string" && val.length > 0 ? val.split(",") : val,
+    boundedArray(z2.enum(FEEDBACK_STATUSES), 4)
+  ).optional(),
+  search: z2.string().max(200).optional(),
+  // Page scope filters — used by the panel's "this page / this type" controls
+  url: z2.string().max(2e3).optional(),
+  urlPattern: z2.string().max(2e3).optional()
+});
+function formatValidationErrors(error) {
+  return error.issues.slice(0, MAX_VALIDATION_ISSUES).map((issue) => ({
+    field: issue.path.map(String).join("."),
+    message: issue.message
+  }));
+}
+
+// src/operations/create-comment.ts
+function createCommentOperation({
+  store,
+  pipeline,
+  beforeComment
+}) {
+  return async (scope, body) => {
+    const payload = pipeline.validate(scope, commentCreateSchema, body);
+    if (!payload.ok) return payload.response;
+    try {
+      const { projectName, feedbackId, authorRole, ...comment } = beforeComment ? await beforeComment(payload.value, scope.context) : payload.value;
+      const refusal = await pipeline.authorize(scope, { action: "createComment", projectName, feedbackId });
+      if (refusal) return refusal;
+      if (!store.addComment) return pipeline.error(scope, 501, ERROR_MESSAGES.commentsUnsupported);
+      if (store.verifyProjectOwnership && !await store.verifyProjectOwnership(feedbackId, projectName)) {
+        return pipeline.error(scope, 404, ERROR_MESSAGES.feedbackNotFound);
+      }
+      const role = authorRole === "team" && await pipeline.canCommentAsTeam(scope) ? "team" : "client";
+      const stored = await store.addComment(feedbackId, { ...comment, authorRole: role });
+      if (stored.feedbackId !== feedbackId) {
+        return pipeline.error(scope, 409, ERROR_MESSAGES.clientIdUsedByAnotherFeedback);
+      }
+      return pipeline.json(scope, pipeline.presentCreatedComment(scope, stored), { status: 201 });
+    } catch (error) {
+      if (isStoreNotFound(error)) return pipeline.error(scope, 404, ERROR_MESSAGES.feedbackNotFound);
+      if (isStoreLimit(error)) return pipeline.error(scope, 409, ERROR_MESSAGES.tooManyComments);
+      if (isStoreValueTooLong(error)) return pipeline.refuseTooLong(scope, error);
+      return pipeline.fail(scope, "[siteping] Failed to add comment", error);
+    }
+  };
+}
+
+// src/webhooks.ts
+var DEFAULT_TIMEOUT_MS = 5e3;
+var TIMER_MAX_DELAY_MS = 2147483647;
+function timeoutProblem(timeoutMs) {
+  if (timeoutMs === void 0 || Number.isSafeInteger(timeoutMs) && timeoutMs > 0 && timeoutMs <= TIMER_MAX_DELAY_MS) {
+    return null;
+  }
+  return `timeoutMs must be a positive integer of at most ${TIMER_MAX_DELAY_MS}, got ${timeoutMs}`;
+}
+function checkWebhookTimeouts(configs) {
+  for (const config of configs) {
+    const problem = timeoutProblem(config.timeoutMs);
+    if (problem) {
+      throw new Error(`[siteping] createSitepingHandler: webhook to ${webhookOrigin(config.url)}: ${problem}.`);
+    }
+  }
+}
+var DISCORD_COLORS = {
+  bug: 15680580,
+  question: 3900150,
+  change: 16096779,
+  other: 7041664
+};
+var DEFAULT_DISCORD_COLOR = 7041664;
+function truncate(text, max = 300) {
+  if (text.length <= max) return text;
+  return `${text.slice(0, max - 1)}\u2026`;
+}
+function fitEscaped(units, max) {
+  const escaped = units.join("");
+  if (escaped.length <= max) return escaped;
+  let out = "";
+  for (const unit of units) {
+    if (out.length + unit.length > max - 1) break;
+    out += unit;
+  }
+  return `${out}\u2026`;
+}
+var SLACK_HEADER_MAX = 150;
+var SLACK_TEXT_MAX = 3e3;
+function escapeSlackText(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function buildSlackPayload(feedback) {
+  const preview = escapeSlackText(truncate(feedback.message));
+  const escapeField = (value, max) => fitEscaped(Array.from(value, escapeSlackText), max);
+  const fromHalf = Math.floor((SLACK_TEXT_MAX - 11) / 2);
+  const headline = `New ${feedback.type} feedback from ${feedback.authorName}`;
+  return {
+    text: `${escapeSlackText(headline)}: ${preview}`,
+    blocks: [
+      {
+        type: "header",
+        text: { type: "plain_text", text: truncate(headline, SLACK_HEADER_MAX), emoji: true }
+      },
+      {
+        type: "section",
+        text: { type: "mrkdwn", text: preview }
+      },
+      {
+        type: "context",
+        elements: [
+          { type: "mrkdwn", text: `*Project:* ${escapeField(feedback.projectName, SLACK_TEXT_MAX - 11)}` },
+          { type: "mrkdwn", text: `*Type:* ${feedback.type}` },
+          { type: "mrkdwn", text: `*URL:* ${escapeField(feedback.url, SLACK_TEXT_MAX - 7)}` },
+          {
+            type: "mrkdwn",
+            text: `*From:* ${escapeField(feedback.authorName, fromHalf)} (${escapeField(feedback.authorEmail, fromHalf)})`
+          }
+        ]
+      }
+    ]
+  };
+}
+var DISCORD_CONTENT_MAX = 2e3;
+var DISCORD_TITLE_MAX = 256;
+var DISCORD_FIELD_VALUE_MAX = 1024;
+var DISCORD_MARKDOWN = /[\\*_~`|>#[\]()<]/g;
+var DISCORD_AUTOLINK = /(<https?:\/\/[^\s<>]+>|https?:\/\/[^\s<>]+)/i;
+var DISCORD_LINK_TRAILER = `.,:;"')]`;
+var escapeMarkdownChar = (char) => char.replace(DISCORD_MARKDOWN, "\\$&");
+var encodeLinkChar = (char) => char.replace(/[[\]()]/g, (bracket) => `%${bracket.charCodeAt(0).toString(16).toUpperCase()}`);
+var count = (text, char) => text.split(char).length - 1;
+function discordUrlUnits(url) {
+  const open = { ")": count(url, "(") - count(url, ")"), "]": count(url, "[") - count(url, "]") };
+  let end = url.length;
+  while (end > 0) {
+    const last = url.charAt(end - 1);
+    if (!DISCORD_LINK_TRAILER.includes(last)) break;
+    if (last === ")" || last === "]") {
+      if (open[last] >= 0) break;
+      open[last] += 1;
+    }
+    end -= 1;
+  }
+  return [...Array.from(url.slice(0, end), encodeLinkChar), ...url.slice(end)];
+}
+function escapeDiscordText(text, max) {
+  const units = text.split(DISCORD_AUTOLINK).flatMap((part, index) => index % 2 === 1 ? discordUrlUnits(part) : Array.from(part, escapeMarkdownChar));
+  return fitEscaped(units, max);
+}
+function buildDiscordPayload(feedback) {
+  const contentLead = `New **${feedback.type}** feedback from **`;
+  const titleLead = `${feedback.type} \u2014 `;
+  const authorHalf = Math.floor((DISCORD_FIELD_VALUE_MAX - 3) / 2);
+  return {
+    content: `${contentLead}${escapeDiscordText(feedback.authorName, DISCORD_CONTENT_MAX - contentLead.length - 2)}**`,
+    embeds: [
+      {
+        title: `${titleLead}${escapeDiscordText(feedback.projectName, DISCORD_TITLE_MAX - titleLead.length)}`,
+        description: escapeDiscordText(feedback.message, 300),
+        color: DISCORD_COLORS[feedback.type] ?? DEFAULT_DISCORD_COLOR,
+        fields: [
+          { name: "URL", value: escapeDiscordText(feedback.url, DISCORD_FIELD_VALUE_MAX), inline: false },
+          {
+            name: "Author",
+            value: `${escapeDiscordText(feedback.authorName, authorHalf)} (${escapeDiscordText(feedback.authorEmail, authorHalf)})`,
+            inline: true
+          },
+          { name: "Viewport", value: escapeDiscordText(feedback.viewport, DISCORD_FIELD_VALUE_MAX), inline: true }
+        ],
+        timestamp: new Date(feedback.createdAt).toISOString()
+      }
+    ],
+    allowed_mentions: { parse: [] }
+  };
+}
+function buildGenericPayload(feedback) {
+  const { clientId: _clientId, comments, ...payload } = feedback;
+  if (!comments) return payload;
+  return { ...payload, comments: comments.map(({ clientId: _commentClientId, ...comment }) => comment) };
+}
+function buildWebhookPayload(type, feedback) {
+  switch (type) {
+    case "slack":
+      return buildSlackPayload(feedback);
+    case "discord":
+      return buildDiscordPayload(feedback);
+    default:
+      return buildGenericPayload(feedback);
+  }
+}
+async function dispatchWebhook(config, feedback) {
+  const problem = timeoutProblem(config.timeoutMs);
+  if (problem) return reportError(config, new RangeError(problem), feedback.id);
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const controller = new AbortController();
+  let timer;
+  try {
+    const body = JSON.stringify(buildWebhookPayload(config.type ?? "generic", feedback));
+    const custom = config.headers ?? {};
+    const setsContentType = Object.keys(custom).some((name) => name.toLowerCase() === "content-type");
+    const headers = setsContentType ? custom : { "Content-Type": "application/json", ...custom };
+    timer = setTimeout(() => controller.abort(), timeoutMs);
+    const response = await fetch(config.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!response.ok) {
+      const err = new Error(`Webhook responded with HTTP ${response.status}`);
+      await reportError(config, err, feedback.id);
+    }
+  } catch (rawError) {
+    clearTimeout(timer);
+    const err = rawError instanceof Error ? rawError : new Error(String(rawError));
+    await reportError(config, err, feedback.id);
+  }
+}
+async function reportError(config, err, feedbackId) {
+  if (config.onError) {
+    try {
+      await config.onError(err, feedbackId);
+    } catch (callbackErr) {
+      warnWithoutUrl(
+        config.url,
+        `webhook onError() callback threw for feedback ${feedbackId}: ${String(callbackErr)} (original error: ${err.message})`
+      );
+    }
+    return;
+  }
+  warnWithoutUrl(
+    config.url,
+    `webhook to ${webhookOrigin(config.url)} failed for feedback ${feedbackId}: ${err.message}`
+  );
+}
+function webhookOrigin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return "<invalid URL>";
+  }
+}
+function warnWithoutUrl(url, message) {
+  console.warn(`[siteping] ${url ? message.split(url).join(webhookOrigin(url)) : message}`);
+}
+async function dispatchWebhooks(configs, feedback) {
+  if (configs.length === 0) return;
+  await Promise.all(configs.map((c) => dispatchWebhook(c, feedback)));
+}
+
+// src/operations/create-feedback.ts
+var FAILED_TO_CREATE = "[siteping] Failed to create feedback";
+function toCreateInput(data) {
+  return {
+    projectName: data.projectName,
+    type: data.type,
+    message: data.message,
+    status: "open",
+    url: data.url,
+    urlPattern: data.urlPattern ?? null,
+    viewport: data.viewport,
+    userAgent: data.userAgent,
+    authorName: data.authorName,
+    authorEmail: data.authorEmail,
+    clientId: data.clientId,
+    annotations: data.annotations.map(flattenAnnotation),
+    screenshotDataUrl: data.screenshotDataUrl ?? null,
+    screenshotRegion: data.screenshotRegion ?? null,
+    diagnostics: data.diagnostics ?? null
+  };
+}
+function createFeedbackOperation({
+  store,
+  pipeline,
+  webhooks,
+  waitUntil,
+  beforeCreate,
+  onCreated
+}) {
+  const inflightCreates = /* @__PURE__ */ new Map();
+  async function createOrReplay(input) {
+    if (store.createFeedbackIfAbsent) {
+      const { feedback, created } = await store.createFeedbackIfAbsent(input);
+      return { feedback, inserted: created };
+    }
+    const replayed = await store.findByClientId(input.clientId);
+    if (replayed) return { feedback: replayed, inserted: false };
+    return { feedback: await store.createFeedback(input), inserted: true };
+  }
+  return async (scope, body) => {
+    const payload = pipeline.validate(scope, feedbackCreateSchema, body);
+    if (!payload.ok) return payload.response;
+    if (payload.value.annotations.length > MAX_ANNOTATIONS_PER_FEEDBACK) {
+      return pipeline.error(scope, 400, ERROR_MESSAGES.tooManyAnnotations);
+    }
+    let input;
+    try {
+      const validated = toCreateInput(payload.value);
+      input = beforeCreate ? await beforeCreate(validated, scope.context) : validated;
+      const refusal = await pipeline.authorize(scope, { action: "create", projectName: input.projectName });
+      if (refusal) return refusal;
+    } catch (error) {
+      return pipeline.fail(scope, FAILED_TO_CREATE, error);
+    }
+    let pending = inflightCreates.get(input.clientId);
+    const owner = pending === void 0;
+    if (!pending) {
+      pending = createOrReplay(input);
+      inflightCreates.set(input.clientId, pending);
+    }
+    let outcome;
+    try {
+      outcome = await pending;
+    } catch (error) {
+      if (isStoreValueTooLong(error)) return pipeline.refuseTooLong(scope, error);
+      let existing = null;
+      if (isStoreDuplicate(error)) {
+        try {
+          existing = await store.findByClientId(input.clientId);
+        } catch (lookupError) {
+          pipeline.logError(scope, "[siteping] Failed to look up the duplicate clientId", {
+            error: lookupError,
+            projectName: input.projectName
+          });
+        }
+      }
+      if (!existing) return pipeline.fail(scope, FAILED_TO_CREATE, error);
+      outcome = { feedback: existing, inserted: false };
+    } finally {
+      if (owner) inflightCreates.delete(input.clientId);
+    }
+    const { feedback, inserted } = outcome;
+    const subject = { feedbackId: feedback.id, projectName: feedback.projectName };
+    try {
+      if (owner && inserted && feedback.projectName === input.projectName) {
+        if (webhooks.length > 0) {
+          const delivery = dispatchWebhooks(webhooks, feedback);
+          try {
+            waitUntil?.(delivery);
+          } catch (error) {
+            pipeline.logError(scope, "[siteping] waitUntil failed", { error, ...subject });
+          }
+        }
+        if (onCreated) await pipeline.runHook(scope, "onCreated", subject, () => onCreated(feedback, scope.context));
+      }
+      if (feedback.projectName !== input.projectName) {
+        return pipeline.error(scope, 409, ERROR_MESSAGES.clientIdUsedByAnotherProject);
+      }
+      return pipeline.json(scope, await pipeline.presentCreated(scope, feedback), { status: 201 });
+    } catch (error) {
+      return pipeline.fail(scope, FAILED_TO_CREATE, error);
+    }
+  };
+}
+
+// src/operations/delete-comment.ts
+function deleteCommentOperation({ store, pipeline }) {
+  return async (scope, body) => {
+    const payload = pipeline.validate(scope, commentDeleteSchema, body);
+    if (!payload.ok) return payload.response;
+    const { projectName, feedbackId, commentId } = payload.value;
+    try {
+      const refusal = await pipeline.authorize(scope, { action: "deleteComment", projectName, feedbackId, commentId });
+      if (refusal) return refusal;
+      if (!store.deleteComment) return pipeline.error(scope, 501, ERROR_MESSAGES.commentsUnsupported);
+      if (store.verifyProjectOwnership && !await store.verifyProjectOwnership(feedbackId, projectName)) {
+        return pipeline.error(scope, 404, ERROR_MESSAGES.feedbackNotFound);
+      }
+      await store.deleteComment(feedbackId, commentId);
+      return pipeline.json(scope, { deleted: true });
+    } catch (error) {
+      if (isStoreNotFound(error)) return pipeline.error(scope, 404, ERROR_MESSAGES.commentNotFound);
+      return pipeline.fail(scope, "[siteping] Failed to delete comment", error);
+    }
+  };
+}
+
+// src/operations/delete-feedback.ts
+function deleteFeedbackOperation({
+  store,
+  pipeline,
+  onDeleting,
+  onDeleted
+}) {
+  return async (scope, body) => {
+    const payload = pipeline.validate(scope, feedbackDeleteSchema, body);
+    if (!payload.ok) return payload.response;
+    const target = "deleteAll" in payload.value ? { kind: "project", projectName: payload.value.projectName } : { kind: "single", id: payload.value.id, projectName: payload.value.projectName };
+    try {
+      const refusal = await pipeline.authorize(
+        scope,
+        target.kind === "project" ? { action: "deleteAll", projectName: target.projectName } : { action: "delete", projectName: target.projectName, feedbackId: target.id }
+      );
+      if (refusal) return refusal;
+      if (target.kind === "single" && store.verifyProjectOwnership && !await store.verifyProjectOwnership(target.id, target.projectName)) {
+        return pipeline.error(scope, 404, ERROR_MESSAGES.feedbackNotFound);
+      }
+      if (onDeleting) {
+        try {
+          await onDeleting(target, scope.context);
+        } catch (error) {
+          pipeline.logError(scope, "[siteping] Hook onDeleting aborted the deletion", { error, target });
+          return pipeline.error(scope, 502, ERROR_MESSAGES.deletionAborted);
+        }
+      }
+      if (target.kind === "project") await store.deleteAllFeedbacks(target.projectName);
+      else await store.deleteFeedback(target.id);
+      if (onDeleted) await pipeline.runHook(scope, "onDeleted", { target }, () => onDeleted(target, scope.context));
+      return pipeline.json(scope, { deleted: true });
+    } catch (error) {
+      if (isStoreNotFound(error)) return pipeline.error(scope, 404, ERROR_MESSAGES.feedbackNotFound);
+      return pipeline.fail(scope, "[siteping] Failed to delete feedback", error);
+    }
+  };
+}
+
+// src/operations/list-feedbacks.ts
+function readListQuery(request) {
+  const searchParams = new URL(request.url).searchParams;
+  const rawQuery = {};
+  for (const key of LIST_QUERY_KEYS) {
+    const value = searchParams.get(key);
+    if (value !== null) rawQuery[key] = value;
+  }
+  return rawQuery;
+}
+function listFeedbacksOperation({ store, pipeline }) {
+  return async (request) => {
+    const entry = await pipeline.enter(request, "GET");
+    if (!entry.ok) return entry.response;
+    const scope = entry.value;
+    const query = pipeline.validate(scope, getQuerySchema, readListQuery(request));
+    if (!query.ok) return query.response;
+    try {
+      const { projectName } = query.value;
+      const refusal = await pipeline.authorize(scope, { action: "list", projectName });
+      if (refusal) return refusal;
+      const page = await store.getFeedbacks(query.value);
+      const [feedbacks, canDeleteAll] = await Promise.all([
+        Promise.all(page.feedbacks.map((feedback) => pipeline.present(scope, feedback))),
+        pipeline.may(scope, "DELETE", { action: "deleteAll", projectName })
+      ]);
+      return pipeline.json(
+        scope,
+        {
+          ...page,
+          feedbacks,
+          // Lets clients hide their comment composer, and delete buttons, up front instead of meeting a 501.
+          capabilities: {
+            comments: store.addComment !== void 0,
+            deleteComments: store.deleteComment !== void 0
+          },
+          // And the actions this requester would be refused.
+          permissions: { canDeleteAll }
+        },
+        { headers: { "Cache-Control": pipeline.listCacheControl } }
+      );
+    } catch (error) {
+      return pipeline.fail(scope, "[siteping] Failed to fetch feedbacks", error);
+    }
+  };
+}
+
+// src/operations/update-feedback.ts
+function updateFeedbackOperation({
+  store,
+  pipeline,
+  onUpdated
+}) {
+  return async (request) => {
+    const entry = await pipeline.enter(request, "PATCH");
+    if (!entry.ok) return entry.response;
+    const scope = entry.value;
+    const payload = await pipeline.readBody(scope, feedbackPatchSchema);
+    if (!payload.ok) return payload.response;
+    const { id, projectName, status } = payload.value;
+    try {
+      const refusal = await pipeline.authorize(scope, { action: "update", projectName, feedbackId: id });
+      if (refusal) return refusal;
+      if (store.verifyProjectOwnership && !await store.verifyProjectOwnership(id, projectName)) {
+        return pipeline.error(scope, 404, ERROR_MESSAGES.feedbackNotFound);
+      }
+      const feedback = await store.updateFeedback(id, toFeedbackUpdate(status));
+      if (onUpdated) {
+        const subject = { feedbackId: feedback.id, projectName: feedback.projectName };
+        await pipeline.runHook(scope, "onUpdated", subject, () => onUpdated(feedback, scope.context));
+      }
+      return pipeline.json(scope, await pipeline.present(scope, feedback));
+    } catch (error) {
+      if (isStoreNotFound(error)) return pipeline.error(scope, 404, ERROR_MESSAGES.feedbackNotFound);
+      return pipeline.fail(scope, "[siteping] Failed to update feedback", error);
+    }
+  };
+}
+
+// src/csrf.ts
+var MAX_LOGGED_ORIGIN_LENGTH = 128;
+function csrfRefusal(request, method, allowedOrigins) {
+  if (method !== "POST" && method !== "PATCH" && method !== "DELETE") return null;
+  const origin = request.headers.get("Origin");
+  if (allowedOrigins && origin !== null && !allowedOrigins.includes(origin) && origin !== new URL(request.url).origin) {
+    return { status: 403, origin: origin.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, MAX_LOGGED_ORIGIN_LENGTH) };
+  }
+  const [mediaType = ""] = (request.headers.get("Content-Type") ?? "").split(";");
+  if (mediaType.trim().toLowerCase() !== "application/json") return { status: 415 };
+  return null;
+}
+
+// src/pipeline.ts
+function toWireComment(comment, includeEmail) {
+  const { clientId: _clientId, ...wire } = comment;
+  return includeEmail ? wire : { ...wire, authorEmail: "" };
+}
+function toWireFeedback(feedback, includeEmail, includeCommentEmails) {
+  const { clientId: _clientId, comments, ...wire } = feedback;
+  return {
+    ...wire,
+    ...includeEmail ? {} : { authorEmail: "" },
+    comments: (comments ?? []).map((comment) => toWireComment(comment, includeCommentEmails))
+  };
+}
+function createSlots(size) {
+  let running = 0;
+  const waiting = [];
+  return async (task) => {
+    if (running < size) running += 1;
+    else await new Promise((resolve) => waiting.push(resolve));
+    try {
+      return await task();
+    } finally {
+      const next = waiting.shift();
+      if (next) next();
+      else running -= 1;
+    }
+  };
+}
+async function readText(request, maxBytes) {
+  if (Number(request.headers.get("Content-Length")) > maxBytes) return null;
+  if (!request.body) return "";
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let received = 0;
+  for (let chunk = await reader.read(); !chunk.done; chunk = await reader.read()) {
+    received += chunk.value.byteLength;
+    if (received > maxBytes) {
+      await reader.cancel().catch(() => {
+      });
+      return null;
+    }
+    text += decoder.decode(chunk.value, { stream: true });
+  }
+  return text + decoder.decode();
+}
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function requestContext(request) {
+  return { method: request.method, path: new URL(request.url).pathname };
+}
+function createPipeline({
+  gate,
+  allowedOrigins,
+  logger,
+  describeError,
+  presentFeedback,
+  maxBodyBytes
+}) {
+  const json = (scope, body, init) => withCors(Response.json(body, init), scope.corsHeaders);
+  const error = (scope, status, message) => json(scope, { error: message }, { status });
+  const fail = (request, scope, message, failure) => {
+    logger.error(message, { error: failure, ...requestContext(request) });
+    return error(scope, 500, describeError?.(failure) ?? ERROR_MESSAGES.internalServerError);
+  };
+  const logError = (scope, message, details) => {
+    logger.error(message, { ...details, ...requestContext(scope.context.request) });
+  };
+  const validate = (scope, schema, input) => {
+    const parsed = schema.safeParse(input);
+    if (parsed.success) return { ok: true, value: parsed.data };
+    return { ok: false, response: json(scope, { errors: formatValidationErrors(parsed.error) }, { status: 400 }) };
+  };
+  const readJson = async (scope) => {
+    const text = await readText(scope.context.request, maxBodyBytes).catch(() => "");
+    if (text === null) return { ok: false, response: error(scope, 413, ERROR_MESSAGES.bodyTooLarge) };
+    const body = parseJson(text);
+    if (!body) return { ok: false, response: error(scope, 400, ERROR_MESSAGES.invalidJson) };
+    return { ok: true, value: body };
+  };
+  const loggedDryRunFailures = /* @__PURE__ */ new WeakSet();
+  const dryRunSlots = /* @__PURE__ */ new WeakMap();
+  const may = async (scope, method, target) => {
+    const { request } = scope.context;
+    const slots = dryRunSlots.get(request) ?? createSlots(DRY_RUN_CONCURRENCY);
+    dryRunSlots.set(request, slots);
+    try {
+      return await slots(
+        async () => await gate.admits(request, method) && await gate.authorize({ ...scope.context, ...target, dryRun: true })
+      );
+    } catch (failure) {
+      if (!loggedDryRunFailures.has(request)) {
+        loggedDryRunFailures.add(request);
+        logger.error("[siteping] authorize failed on a dry run", {
+          error: failure,
+          action: target.action,
+          ...requestContext(request)
+        });
+      }
+      return false;
+    }
+  };
+  const permissions = async (scope, feedback) => {
+    const target = { projectName: feedback.projectName, feedbackId: feedback.id };
+    const [canChangeStatus, canDelete, canComment, canDeleteComment] = await Promise.all([
+      may(scope, "PATCH", { action: "update", ...target }),
+      may(scope, "DELETE", { action: "delete", ...target }),
+      may(scope, "POST", { action: "createComment", ...target }),
+      may(scope, "DELETE", { action: "deleteComment", ...target })
+    ]);
+    return { canChangeStatus, canDelete, canComment, canDeleteComment };
+  };
+  const present = async (scope, feedback, includeEmail = scope.canReadAuthorEmail) => ({
+    ...toWireFeedback(
+      presentFeedback ? presentFeedback(feedback, scope.context) : feedback,
+      includeEmail,
+      scope.canReadAuthorEmail
+    ),
+    permissions: await permissions(scope, feedback)
+  });
+  return {
+    json,
+    error,
+    validate,
+    may,
+    present,
+    /**
+     * Open a request: the CSRF guards when the policy needs them, then the
+     * access gate. A throwing `access` callback (session store down…)
+     * answers the logged 500 with CORS headers rather than rejecting, which
+     * a browser would only see as an opaque network error.
+     */
+    async enter(request, method) {
+      const corsHeaders = buildCorsHeaders(request, allowedOrigins);
+      if (gate.guardsMutations) {
+        const refusal = csrfRefusal(request, method, allowedOrigins);
+        if (refusal?.status === 403) {
+          logger.error("[siteping] Refused a mutation from an origin outside allowedOrigins", {
+            origin: refusal.origin,
+            ...requestContext(request)
+          });
+          return { ok: false, response: error({ corsHeaders }, 403, ERROR_MESSAGES.forbidden) };
+        }
+        if (refusal) return { ok: false, response: error({ corsHeaders }, 415, ERROR_MESSAGES.unsupportedMediaType) };
+      }
+      let outcome;
+      try {
+        outcome = await gate.authenticate(request, method);
+      } catch (failure) {
+        return {
+          ok: false,
+          response: fail(request, { corsHeaders }, "[siteping] Failed to authenticate request", failure)
+        };
+      }
+      if (!outcome.ok) return { ok: false, response: error({ corsHeaders }, outcome.status, outcome.error) };
+      return {
+        ok: true,
+        value: {
+          context: { request, principal: outcome.principal },
+          corsHeaders,
+          canReadAuthorEmail: outcome.canReadAuthorEmail
+        }
+      };
+    },
+    readJson,
+    /** Read and validate a JSON body. */
+    async readBody(scope, schema) {
+      const body = await readJson(scope);
+      return body.ok ? validate(scope, schema, body.value) : body;
+    },
+    /** `null` when the policy allows the request, its 403 otherwise. */
+    async authorize(scope, target) {
+      return await gate.authorize({ ...scope.context, ...target }) ? null : error(scope, 403, ERROR_MESSAGES.forbidden);
+    },
+    /**
+     * Wire shape of a record answering a POST (fresh or replayed): the
+     * requester's email permission, unless the policy echoes the email to
+     * its submitter — who supplied the feedback's, never its thread's.
+     */
+    presentCreated(scope, feedback) {
+      return present(scope, feedback, gate.echoesAuthorEmailOnCreate || scope.canReadAuthorEmail);
+    },
+    /** Wire shape of a comment answering a POST — the same echo rule as {@link presentCreated}. */
+    presentCreatedComment(scope, comment) {
+      return toWireComment(comment, gate.echoesAuthorEmailOnCreate || scope.canReadAuthorEmail);
+    },
+    /** Whether this caller's comment keeps the `team` role it asks for — see `AccessGate.canCommentAsTeam`. */
+    canCommentAsTeam(scope) {
+      return gate.canCommentAsTeam(scope.context, scope.canReadAuthorEmail);
+    },
+    /**
+     * Answer a value the store cannot hold with a 422, which a client does
+     * not retry, and log it: the database's columns are narrower than what
+     * the validation accepts, which only the operator can fix.
+     */
+    refuseTooLong(scope, failure) {
+      logError(scope, "[siteping] A value is too long for the store", { error: failure });
+      return error(scope, 422, ERROR_MESSAGES.valueTooLong);
+    },
+    /** Log an unexpected failure of an operation and answer its JSON 500. */
+    fail(scope, message, failure) {
+      return fail(scope.context.request, scope, message, failure);
+    },
+    logError,
+    /** Run a lifecycle hook after a write; a failure is logged with `subject`, never surfaced — the write happened. */
+    async runHook(scope, name, subject, invoke) {
+      try {
+        await invoke();
+      } catch (failure) {
+        logError(scope, `[siteping] Hook ${name} failed`, { error: failure, ...subject });
+      }
+    },
+    /** The list response's `Cache-Control`. */
+    listCacheControl: gate.listCacheControl
+  };
+}
+
+// src/handler.ts
+var consoleLogger = {
+  error(message, context) {
+    console.error(message, context);
+  }
+};
+function safeLogger(logger) {
+  return {
+    error(message, context) {
+      try {
+        Promise.resolve(logger.error(message, context)).catch(() => consoleLogger.error(message, context));
+      } catch {
+        consoleLogger.error(message, context);
+      }
+    }
+  };
+}
+function routeByBody(pipeline, method, commentKey, comment, feedback) {
+  return async (request) => {
+    const entry = await pipeline.enter(request, method);
+    if (!entry.ok) return entry.response;
+    const body = await pipeline.readJson(entry.value);
+    if (!body.ok) return body.response;
+    return (hasOwn(body.value, commentKey) ? comment : feedback)(entry.value, body.value);
+  };
+}
+function createSitepingHandler(options) {
+  const {
+    store,
+    allowedOrigins,
+    webhooks,
+    waitUntil,
+    beforeCreate,
+    beforeComment,
+    presentFeedback,
+    hooks = {},
+    logger: customLogger,
+    describeError,
+    maxBodyBytes = DEFAULT_MAX_BODY_BYTES
+  } = options;
+  if (!store) {
+    throw new Error("[siteping] createSitepingHandler requires a `store`.");
+  }
+  if (!Number.isSafeInteger(maxBodyBytes) || maxBodyBytes <= 0) {
+    throw new Error(
+      `[siteping] createSitepingHandler: \`maxBodyBytes\` must be a positive integer, got ${maxBodyBytes}.`
+    );
+  }
+  if (options.access?.authorize && !store.verifyProjectOwnership) {
+    throw new Error(
+      "[siteping] createSitepingHandler: `access.authorize` needs a store implementing `verifyProjectOwnership`. Without it, a caller authorized for one project could PATCH or DELETE another project's feedback by id."
+    );
+  }
+  const gate = options.access ? createAccessGate(options.access) : createApiKeyGate(options);
+  const logger = customLogger ? safeLogger(customLogger) : consoleLogger;
+  const pipeline = createPipeline({ gate, allowedOrigins, logger, describeError, presentFeedback, maxBodyBytes });
+  const webhookList = webhooks ? Array.isArray(webhooks) ? webhooks : [webhooks] : [];
+  checkWebhookTimeouts(webhookList);
+  return {
+    OPTIONS: (request) => preflightResponse(request, allowedOrigins),
+    POST: routeByBody(
+      pipeline,
+      "POST",
+      "feedbackId",
+      createCommentOperation({ store, pipeline, beforeComment }),
+      createFeedbackOperation({
+        store,
+        pipeline,
+        webhooks: webhookList,
+        waitUntil,
+        beforeCreate,
+        // Bound so hooks written as class methods keep their `this`.
+        onCreated: hooks.onCreated?.bind(hooks)
+      })
+    ),
+    GET: listFeedbacksOperation({ store, pipeline }),
+    PATCH: updateFeedbackOperation({ store, pipeline, onUpdated: hooks.onUpdated?.bind(hooks) }),
+    DELETE: routeByBody(
+      pipeline,
+      "DELETE",
+      "commentId",
+      deleteCommentOperation({ store, pipeline }),
+      deleteFeedbackOperation({
+        store,
+        pipeline,
+        onDeleting: hooks.onDeleting?.bind(hooks),
+        onDeleted: hooks.onDeleted?.bind(hooks)
+      })
+    )
+  };
+}
+//# sourceMappingURL=index.cjs.map