npm - dineway - Versions diffs - 0.1.8 → 0.1.11 - Mend

dineway 0.1.8 → 0.1.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (690) hide show

package/dist/preview-C_4DyVox.mjs ADDED Viewed

@@ -0,0 +1,788 @@
+import { runWithContext } from "./request-context.mjs";
+import { n as createDatabase } from "./connection-BCNICDWN.mjs";
+import { a as verifyPreviewSignature, t as buildPreviewSignatureHeader } from "./sidecar-client-vzwV98K4.mjs";
+import { t as generatePreviewToken } from "./tokens-DLTo4dO2.mjs";
+import BetterSqlite3 from "better-sqlite3";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, rmSync, statSync } from "node:fs";
+import { join } from "node:path";
+//#region src/preview/loading.ts
+function renderPreviewLoadingPage() {
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="refresh" content="2">
+<title>Loading preview...</title>
+<link rel="icon" href="/favicon.svg" />
+<style>
+body { font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #fafafa; color: #333; }
+.spinner { width: 40px; height: 40px; border: 3px solid #e0e0e0; border-top-color: #333; border-radius: 50%; animation: spin 0.8s linear infinite; margin-right: 16px; }
+@keyframes spin { to { transform: rotate(360deg); } }
+</style>
+</head>
+<body>
+<div class="spinner"></div>
+<p>Loading preview&hellip;</p>
+</body>
+</html>`;
+}
+//#endregion
+//#region src/preview/routes.ts
+/**
+* Preview mode route gating.
+*
+* Preview is read-only with no authenticated user. All `/_dineway/`
+* routes are blocked by default. Only specific read-only API prefixes
+* are allowlisted.
+*/
+const ALLOWED_API_PREFIXES = [
+	"/_dineway/api/content/",
+	"/_dineway/api/schema",
+	"/_dineway/api/manifest",
+	"/_dineway/api/dashboard",
+	"/_dineway/api/search",
+	"/_dineway/api/media",
+	"/_dineway/api/taxonomies",
+	"/_dineway/api/menus",
+	"/_dineway/api/snapshot"
+];
+function isBlockedInPreview(pathname) {
+	if (!pathname.startsWith("/_dineway/")) return false;
+	for (const prefix of ALLOWED_API_PREFIXES) if (pathname === prefix || pathname.startsWith(prefix)) return false;
+	return true;
+}
+//#endregion
+//#region src/preview/session-database-factory.ts
+function isRecord$1(value) {
+	return value !== null && typeof value === "object";
+}
+function isSessionRow(value) {
+	if (!isRecord$1(value)) return false;
+	return typeof value.id === "string" && typeof value.db_path === "string" && typeof value.created_at === "number" && typeof value.expires_at === "number" && typeof value.last_touched_at === "number";
+}
+function isDbPathRow(value) {
+	return isRecord$1(value) && typeof value.db_path === "string";
+}
+var SessionDatabaseLimitError = class extends Error {
+	constructor(message = "Session disk budget exceeded") {
+		super(message);
+		this.name = "SessionDatabaseLimitError";
+	}
+};
+var FileSessionDatabaseFactory = class {
+	registry;
+	sessionsDir;
+	maxDiskBytes;
+	constructor(options) {
+		this.options = options;
+		mkdirSync(options.rootDir, { recursive: true });
+		this.sessionsDir = join(options.rootDir, options.sessionsDirName ?? "sessions");
+		mkdirSync(this.sessionsDir, { recursive: true });
+		this.maxDiskBytes = options.maxDiskBytes ?? Number.POSITIVE_INFINITY;
+		this.registry = new BetterSqlite3(join(options.rootDir, options.registryFileName ?? "registry.db"));
+		this.registry.exec(`
+			CREATE TABLE IF NOT EXISTS session_databases (
+				id TEXT PRIMARY KEY,
+				db_path TEXT NOT NULL,
+				created_at INTEGER NOT NULL,
+				expires_at INTEGER NOT NULL,
+				last_touched_at INTEGER NOT NULL
+			);
+		`);
+	}
+	async open(input) {
+		const now = input.now ?? Date.now();
+		const row = this.getSessionRow(input.id);
+		if (!row) return null;
+		if (row.expires_at <= now || !existsSync(row.db_path)) {
+			this.deleteSession(row.id, row.db_path);
+			return null;
+		}
+		this.registry.prepare("UPDATE session_databases SET last_touched_at = ? WHERE id = ?").run(now, row.id);
+		const updated = this.getSessionRow(input.id);
+		if (!updated) return null;
+		return this.createHandle(updated, false);
+	}
+	async openOrCreate(input) {
+		const reopened = await this.open({
+			id: input.id,
+			now: input.now
+		});
+		if (reopened) return reopened;
+		const now = input.now ?? Date.now();
+		await this.cleanup(now);
+		if (this.getActiveDiskBytes() >= this.maxDiskBytes) throw new SessionDatabaseLimitError();
+		const dbPath = this.getDbPath(input.id);
+		new BetterSqlite3(dbPath).close();
+		this.registry.prepare(`INSERT OR REPLACE INTO session_databases (
+					id, db_path, created_at, expires_at, last_touched_at
+				) VALUES (?, ?, ?, ?, ?)`).run(input.id, dbPath, now, now + input.ttlMs, now);
+		const row = this.getSessionRow(input.id);
+		if (!row) throw new Error(`Failed to create session database for ${JSON.stringify(input.id)}`);
+		return this.createHandle(row, true);
+	}
+	async destroy(id) {
+		const row = this.getSessionRow(id);
+		if (!row) return false;
+		this.deleteSession(row.id, row.db_path);
+		return true;
+	}
+	async cleanup(now = Date.now()) {
+		const removedSessionIds = [];
+		const removedPaths = /* @__PURE__ */ new Set();
+		const rows = this.listSessionRows();
+		for (const row of rows) if (row.expires_at <= now || !existsSync(row.db_path)) {
+			removedSessionIds.push(row.id);
+			for (const path of this.getManagedPaths(row.db_path)) if (existsSync(path)) {
+				rmSync(path, { force: true });
+				removedPaths.add(path);
+			}
+			this.registry.prepare("DELETE FROM session_databases WHERE id = ?").run(row.id);
+		}
+		const knownPaths = new Set(this.listDbPathRows().flatMap((row) => this.getManagedPaths(row.db_path)));
+		for (const entry of readdirSync(this.sessionsDir)) {
+			const fullPath = join(this.sessionsDir, entry);
+			if (!knownPaths.has(fullPath)) {
+				rmSync(fullPath, {
+					force: true,
+					recursive: false
+				});
+				removedPaths.add(fullPath);
+			}
+		}
+		return {
+			removedSessionIds,
+			removedPaths: [...removedPaths].toSorted()
+		};
+	}
+	async close() {
+		this.registry.close();
+	}
+	createHandle(row, created) {
+		const db = createDatabase({ url: `file:${row.db_path}` });
+		return {
+			created,
+			session: this.toSessionInfo(row),
+			db,
+			close: async () => {
+				await db.destroy();
+			}
+		};
+	}
+	getSessionRow(id) {
+		const row = this.registry.prepare("SELECT * FROM session_databases WHERE id = ?").get(id);
+		return isSessionRow(row) ? row : null;
+	}
+	toSessionInfo(row) {
+		return {
+			id: row.id,
+			dbPath: row.db_path,
+			createdAt: row.created_at,
+			expiresAt: row.expires_at,
+			lastTouchedAt: row.last_touched_at
+		};
+	}
+	deleteSession(id, dbPath) {
+		for (const path of this.getManagedPaths(dbPath)) rmSync(path, { force: true });
+		this.registry.prepare("DELETE FROM session_databases WHERE id = ?").run(id);
+	}
+	getActiveDiskBytes() {
+		return this.listDbPathRows().reduce((total, row) => {
+			return total + this.getManagedPaths(row.db_path).reduce((subtotal, path) => {
+				if (!existsSync(path)) return subtotal;
+				return subtotal + statSync(path).size;
+			}, 0);
+		}, 0);
+	}
+	getDbPath(id) {
+		const hash = createHash("sha256").update(id).digest("hex");
+		return join(this.sessionsDir, `${hash}.db`);
+	}
+	getManagedPaths(dbPath) {
+		return [
+			dbPath,
+			`${dbPath}-wal`,
+			`${dbPath}-shm`
+		];
+	}
+	listSessionRows() {
+		return this.registry.prepare("SELECT * FROM session_databases ORDER BY expires_at ASC, last_touched_at ASC").all().filter(isSessionRow);
+	}
+	listDbPathRows() {
+		return this.registry.prepare("SELECT db_path FROM session_databases").all().filter(isDbPathRow);
+	}
+};
+//#endregion
+//#region src/preview/snapshot-database.ts
+const SAFE_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+const SAFE_COLUMN_TYPES = new Set([
+	"TEXT",
+	"INTEGER",
+	"REAL",
+	"BLOB",
+	"JSON"
+]);
+const SNAPSHOT_META_TABLE = "_dineway_snapshot_meta";
+function quoteIdentifier(name, context) {
+	if (!SAFE_IDENTIFIER.test(name)) throw new Error(`Invalid ${context}: ${JSON.stringify(name)}`);
+	return `"${name}"`;
+}
+function normalizeColumnType(type) {
+	const normalized = type?.toUpperCase() ?? "TEXT";
+	return SAFE_COLUMN_TYPES.has(normalized) ? normalized : "TEXT";
+}
+async function dropSessionDatabaseTables(db) {
+	const tables = await sql`
+		SELECT name FROM sqlite_master
+		WHERE type = 'table'
+		AND name NOT LIKE 'sqlite_%'
+		ORDER BY name
+	`.execute(db);
+	for (const row of tables.rows) {
+		const tableName = quoteIdentifier(row.name, "table name");
+		await sql.raw(`DROP TABLE IF EXISTS ${tableName}`).execute(db);
+	}
+}
+async function applySnapshotToDatabase(db, snapshot, options) {
+	const fetchedAt = options?.fetchedAt ?? Date.now();
+	const shouldReset = options?.reset ?? true;
+	await db.transaction().execute(async (trx) => {
+		if (shouldReset) await dropSessionDatabaseTables(trx);
+		await sql.raw(`CREATE TABLE IF NOT EXISTS ${quoteIdentifier(SNAPSHOT_META_TABLE, "meta table")} (key TEXT PRIMARY KEY, value TEXT)`).execute(trx);
+		for (const [tableName, rows] of Object.entries(snapshot.tables)) {
+			if (tableName === SNAPSHOT_META_TABLE) continue;
+			if (rows.length === 0) continue;
+			const quotedTableName = quoteIdentifier(tableName, "table name");
+			const schemaInfo = snapshot.schema[tableName];
+			const firstRow = rows[0];
+			if (!firstRow) continue;
+			const columns = schemaInfo?.columns ?? Object.keys(firstRow);
+			const quotedColumns = columns.map((column) => quoteIdentifier(column, `column name in ${tableName}`));
+			const columnDefs = columns.map((column, index) => {
+				return `${quotedColumns[index]} ${normalizeColumnType(schemaInfo?.types?.[column])}`;
+			}).join(", ");
+			await sql.raw(`CREATE TABLE IF NOT EXISTS ${quotedTableName} (${columnDefs})`).execute(trx);
+			const columnList = quotedColumns.join(", ");
+			for (const row of rows) {
+				const values = columns.map((column) => row[column] ?? null);
+				await sql`
+					INSERT INTO ${sql.raw(quotedTableName)} (${sql.raw(columnList)})
+					VALUES (${sql.join(values)})
+				`.execute(trx);
+			}
+		}
+		await sql`
+			INSERT OR REPLACE INTO ${sql.raw(quoteIdentifier(SNAPSHOT_META_TABLE, "meta table"))} (key, value)
+			VALUES
+				(${`snapshot_fetched_at`}, ${String(fetchedAt)}),
+				(${`snapshot_generated_at`}, ${snapshot.generatedAt})
+		`.execute(trx);
+	});
+}
+async function getAppliedSnapshotMeta(db) {
+	if ((await sql`
+		SELECT name FROM sqlite_master
+		WHERE type = 'table'
+		AND name = ${SNAPSHOT_META_TABLE}
+		LIMIT 1
+	`.execute(db)).rows.length === 0) return null;
+	const rows = await sql`
+		SELECT key, value FROM ${sql.raw(quoteIdentifier(SNAPSHOT_META_TABLE, "meta table"))}
+		WHERE key IN (${`snapshot_fetched_at`}, ${`snapshot_generated_at`})
+	`.execute(db);
+	const values = new Map(rows.rows.map((row) => [row.key, row.value]));
+	const fetchedAt = values.get("snapshot_fetched_at");
+	const generatedAt = values.get("snapshot_generated_at");
+	if (!fetchedAt || !generatedAt) return null;
+	return {
+		fetchedAt: Number(fetchedAt),
+		generatedAt
+	};
+}
+//#endregion
+//#region src/preview/toolbar.ts
+const RE_AMP = /&/g;
+const RE_QUOT = /"/g;
+const RE_LT = /</g;
+const RE_GT = />/g;
+function renderPreviewToolbar(config) {
+	const { generatedAt, source, error } = config;
+	return `
+<!-- Dineway Preview Toolbar -->
+<div id="dineway-preview-toolbar"${generatedAt ? ` data-generated-at="${escapeAttr(generatedAt)}"` : ""}${source ? ` data-source="${escapeAttr(source)}"` : ""}${error ? ` data-error="${escapeAttr(error)}"` : ""}>
+  <div class="ec-ptb-inner">
+    <span class="ec-ptb-badge">Preview</span>
+    <div class="ec-ptb-divider"></div>
+    <span class="ec-ptb-status" id="ec-ptb-status"></span>
+    <button class="ec-ptb-btn" id="ec-ptb-reload" title="Reload snapshot">
+      <svg class="ec-ptb-icon" id="ec-ptb-reload-icon" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
+    </button>
+    <button class="ec-ptb-btn ec-ptb-close" id="ec-ptb-dismiss" title="Dismiss toolbar">
+      <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+    </button>
+  </div>
+</div>
+<style>
+  #dineway-preview-toolbar {
+    position: fixed;
+    bottom: 16px;
+    left: 50%;
+    transform: translateX(-50%);
+    z-index: 999999;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+    font-size: 13px;
+    line-height: 1;
+    -webkit-font-smoothing: antialiased;
+  }
+  #dineway-preview-toolbar.ec-ptb-hidden {
+    display: none;
+  }
+  .ec-ptb-inner {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 8px 12px 8px 16px;
+    background: #1a1a1a;
+    color: #e0e0e0;
+    border-radius: 999px;
+    box-shadow: 0 4px 24px rgba(0,0,0,0.3), 0 0 0 1px rgba(255,255,255,0.08);
+    white-space: nowrap;
+    user-select: none;
+  }
+  .ec-ptb-badge {
+    display: inline-flex;
+    align-items: center;
+    padding: 3px 8px;
+    border-radius: 999px;
+    font-size: 11px;
+    font-weight: 600;
+    letter-spacing: 0.02em;
+    text-transform: uppercase;
+    background: rgba(139,92,246,0.2);
+    color: #a78bfa;
+  }
+  .ec-ptb-divider {
+    width: 1px;
+    height: 16px;
+    background: rgba(255,255,255,0.15);
+  }
+  .ec-ptb-status {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 12px;
+    color: #999;
+  }
+  .ec-ptb-status--error {
+    color: #f87171;
+  }
+  .ec-ptb-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    background: none;
+    border: none;
+    color: #888;
+    cursor: pointer;
+    padding: 4px;
+    border-radius: 4px;
+    transition: color 0.15s, background 0.15s;
+    font-family: inherit;
+  }
+  .ec-ptb-btn:hover {
+    color: #fff;
+    background: rgba(255,255,255,0.08);
+  }
+  .ec-ptb-icon {
+    transition: transform 0.3s;
+  }
+  .ec-ptb-btn:disabled {
+    opacity: 0.4;
+    cursor: not-allowed;
+  }
+  .ec-ptb-btn:disabled:hover {
+    color: #888;
+    background: none;
+  }
+  @keyframes ec-ptb-spin {
+    to { transform: rotate(360deg); }
+  }
+  .ec-ptb-spinning .ec-ptb-icon {
+    animation: ec-ptb-spin 0.8s linear infinite;
+  }
+</style>
+<script>
+(function() {
+  var toolbar = document.getElementById("dineway-preview-toolbar");
+  var statusEl = document.getElementById("ec-ptb-status");
+  var reloadBtn = document.getElementById("ec-ptb-reload");
+  var dismissBtn = document.getElementById("ec-ptb-dismiss");
+  if (!toolbar || !statusEl || !reloadBtn || !dismissBtn) return;
+  var generatedAt = toolbar.getAttribute("data-generated-at");
+  var source = toolbar.getAttribute("data-source");
+  var error = toolbar.getAttribute("data-error");
+  function formatAge(isoString) {
+    if (!isoString) return null;
+    var then = new Date(isoString).getTime();
+    var now = Date.now();
+    var seconds = Math.floor((now - then) / 1000);
+    if (seconds < 60) return "just now";
+    var minutes = Math.floor(seconds / 60);
+    if (minutes < 60) return minutes + "m ago";
+    var hours = Math.floor(minutes / 60);
+    if (hours < 24) return hours + "h ago";
+    return Math.floor(hours / 24) + "d ago";
+  }
+  function updateStatus() {
+    if (error) {
+      statusEl.className = "ec-ptb-status ec-ptb-status--error";
+      statusEl.textContent = error;
+      return;
+    }
+    var age = formatAge(generatedAt);
+    statusEl.className = "ec-ptb-status";
+    statusEl.textContent = age ? "Snapshot " + age : "Preview mode";
+  }
+  updateStatus();
+  var ageInterval = setInterval(updateStatus, 30000);
+  reloadBtn.addEventListener("click", function() {
+    reloadBtn.disabled = true;
+    reloadBtn.classList.add("ec-ptb-spinning");
+    statusEl.className = "ec-ptb-status";
+    statusEl.textContent = "Reloading\u2026";
+    location.href = "/_preview/reload";
+  });
+  dismissBtn.addEventListener("click", function() {
+    toolbar.classList.add("ec-ptb-hidden");
+    clearInterval(ageInterval);
+  });
+})();
+<\/script>
+`;
+}
+function escapeAttr(str) {
+	return str.replace(RE_AMP, "&amp;").replace(RE_QUOT, "&quot;").replace(RE_LT, "&lt;").replace(RE_GT, "&gt;");
+}
+//#endregion
+//#region src/preview/middleware.ts
+const DEFAULT_TTL_SECONDS = 3600;
+const DEFAULT_COOKIE_NAME = "dineway_preview";
+const DEFAULT_SNAPSHOT_PATH = "/_dineway/api/snapshot";
+const SNAPSHOT_SIGNATURE_HEADER = "X-Preview-Signature";
+function isRecord(value) {
+	return value !== null && typeof value === "object";
+}
+function isStringRecord(value) {
+	return isRecord(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isSnapshot(value) {
+	if (!isRecord(value)) return false;
+	if (typeof value.generatedAt !== "string") return false;
+	if (!isRecord(value.tables) || !isRecord(value.schema)) return false;
+	return Object.values(value.tables).every((rows) => {
+		return Array.isArray(rows) && rows.every((row) => isRecord(row));
+	}) && Object.values(value.schema).every((schemaInfo) => {
+		if (!isRecord(schemaInfo) || !Array.isArray(schemaInfo.columns)) return false;
+		if (!schemaInfo.columns.every((column) => typeof column === "string")) return false;
+		return schemaInfo.types === void 0 || isStringRecord(schemaInfo.types);
+	});
+}
+function parseSnapshot(value) {
+	if (!isSnapshot(value)) throw new Error("Snapshot response has invalid shape");
+	return value;
+}
+function parseStoredPreviewParams(value) {
+	if (!value) return null;
+	const parts = decodeURIComponent(value).split("\n");
+	if (parts.length !== 3) return null;
+	return {
+		source: parts[0] ?? "",
+		exp: parts[1] ?? "",
+		sig: parts[2] ?? ""
+	};
+}
+function buildParamsRedirect(url, params) {
+	if (!params || !params.source || !params.exp || !params.sig) return null;
+	const reloadUrl = new URL(url.pathname + url.search, url.origin);
+	reloadUrl.searchParams.set("source", params.source);
+	reloadUrl.searchParams.set("exp", params.exp);
+	reloadUrl.searchParams.set("sig", params.sig);
+	return reloadUrl.pathname + reloadUrl.search;
+}
+async function injectPreviewToolbar(response, config) {
+	if (!response.headers.get("content-type")?.includes("text/html")) return response;
+	const html = await response.text();
+	if (!html.includes("</body>")) return new Response(html, response);
+	const toolbarHtml = renderPreviewToolbar(config);
+	const injected = html.replace("</body>", `${toolbarHtml}</body>`);
+	return new Response(injected, {
+		status: response.status,
+		headers: response.headers
+	});
+}
+async function populateSessionFromSnapshot(session, options) {
+	const snapshotUrl = new URL(options.snapshotPath, options.sourceUrl);
+	const response = await options.fetchImpl(snapshotUrl, {
+		headers: { [SNAPSHOT_SIGNATURE_HEADER]: options.signature },
+		signal: AbortSignal.timeout(1e4)
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`Snapshot fetch failed: ${response.status} ${response.statusText}${body ? ` — ${body}` : ""}`);
+	}
+	const snapshot = parseSnapshot(await response.json());
+	await applySnapshotToDatabase(session.db, snapshot, { reset: true });
+}
+function createFilePreviewMiddleware(config) {
+	const ttlSeconds = config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+	const cookieName = config.cookieName ?? DEFAULT_COOKIE_NAME;
+	const paramsCookieName = `${cookieName}_params`;
+	const snapshotPath = config.snapshotPath ?? DEFAULT_SNAPSHOT_PATH;
+	const sessionFactory = config.sessionFactory ?? new FileSessionDatabaseFactory({
+		rootDir: config.rootDir ?? (() => {
+			throw new Error("createFilePreviewMiddleware requires either rootDir or sessionFactory");
+		})(),
+		maxDiskBytes: config.maxSessionDiskBytes
+	});
+	const fetchImpl = config.fetch ?? globalThis.fetch;
+	return async function filePreviewMiddleware(context, next) {
+		const { url, cookies } = context;
+		if (url.pathname === "/_preview/reload") {
+			cookies.delete(cookieName, { path: "/" });
+			const redirectTo = buildParamsRedirect(url, parseStoredPreviewParams(cookies.get(paramsCookieName)?.value)) ?? "/";
+			return context.redirect(redirectTo);
+		}
+		if (isBlockedInPreview(url.pathname)) return Response.json({ error: {
+			code: "PREVIEW_MODE",
+			message: "Not available in preview mode"
+		} }, { status: 403 });
+		let sessionToken = cookies.get(cookieName)?.value;
+		let sourceUrl = null;
+		let signature = null;
+		let session = sessionToken ? await sessionFactory.open({ id: sessionToken }) : null;
+		if (sessionToken && !session) {
+			cookies.delete(cookieName, { path: "/" });
+			const redirectTo = buildParamsRedirect(url, parseStoredPreviewParams(cookies.get(paramsCookieName)?.value));
+			if (redirectTo) return context.redirect(redirectTo);
+			return new Response("Preview session expired", { status: 410 });
+		}
+		if (!sessionToken) {
+			const source = url.searchParams.get("source");
+			const exp = url.searchParams.get("exp");
+			const sig = url.searchParams.get("sig");
+			if (!source || !exp || !sig) return new Response("Missing preview parameters", { status: 400 });
+			const expNum = Number.parseInt(exp, 10);
+			if (!Number.isFinite(expNum) || expNum < Date.now() / 1e3) return new Response("Preview link expired", { status: 403 });
+			if (!await verifyPreviewSignature(source, expNum, sig, config.secret)) return new Response("Invalid preview signature", { status: 403 });
+			sessionToken = ulid();
+			sourceUrl = source;
+			signature = buildPreviewSignatureHeader({
+				source,
+				exp: expNum,
+				sig
+			});
+			session = await sessionFactory.openOrCreate({
+				id: sessionToken,
+				ttlMs: ttlSeconds * 1e3
+			});
+		}
+		if (!sessionToken || !session) return new Response("Preview session unavailable", { status: 500 });
+		let snapshotGeneratedAt;
+		let snapshotError;
+		if (sourceUrl && signature) try {
+			await populateSessionFromSnapshot(session, {
+				sourceUrl,
+				snapshotPath,
+				signature,
+				fetchImpl
+			});
+			snapshotGeneratedAt = (await getAppliedSnapshotMeta(session.db))?.generatedAt;
+			cookies.set(cookieName, sessionToken, {
+				httpOnly: true,
+				sameSite: "lax",
+				path: "/",
+				maxAge: ttlSeconds
+			});
+			cookies.set(paramsCookieName, `${sourceUrl}\n${url.searchParams.get("exp")}\n${url.searchParams.get("sig")}`, {
+				sameSite: "lax",
+				path: "/",
+				maxAge: ttlSeconds
+			});
+			const cleanUrl = new URL(url);
+			cleanUrl.searchParams.delete("source");
+			cleanUrl.searchParams.delete("exp");
+			cleanUrl.searchParams.delete("sig");
+			await session.close();
+			return context.redirect(cleanUrl.pathname + cleanUrl.search);
+		} catch (error) {
+			snapshotError = error instanceof Error ? error.message : String(error);
+			await session.close();
+			await sessionFactory.destroy(sessionToken);
+			return new Response(renderPreviewLoadingPage(), {
+				status: 503,
+				headers: {
+					"Content-Type": "text/html",
+					"Retry-After": "2"
+				}
+			});
+		}
+		const storedParams = parseStoredPreviewParams(cookies.get(paramsCookieName)?.value);
+		snapshotGeneratedAt = (await getAppliedSnapshotMeta(session.db))?.generatedAt;
+		try {
+			return await runWithContext({
+				editMode: false,
+				db: session.db
+			}, async () => {
+				return injectPreviewToolbar(await next(), {
+					generatedAt: snapshotGeneratedAt,
+					source: storedParams?.source,
+					error: snapshotError
+				});
+			});
+		} finally {
+			await session.close();
+		}
+	};
+}
+//#endregion
+//#region src/preview/urls.ts
+/**
+* Preview URL generation
+*
+* Creates preview URLs that include a signed token for accessing draft content.
+*/
+const REPEATED_SLASHES_PATTERN = /\/{2,}/g;
+/**
+* Generate a preview URL for content
+*
+* The URL includes a `_preview` query parameter with a signed token.
+*
+* @example
+* ```ts
+* const url = await getPreviewUrl({
+*   collection: "posts",
+*   id: "hello-world",
+*   secret: process.env.PREVIEW_SECRET!,
+* });
+* // Returns: /posts/hello-world?_preview=eyJj...
+*
+* // With base URL:
+* const fullUrl = await getPreviewUrl({
+*   collection: "posts",
+*   id: "hello-world",
+*   secret: process.env.PREVIEW_SECRET!,
+*   baseUrl: "https://example.com",
+* });
+* // Returns: https://example.com/posts/hello-world?_preview=eyJj...
+*
+* // Custom path pattern:
+* const customUrl = await getPreviewUrl({
+*   collection: "posts",
+*   id: "hello-world",
+*   secret: process.env.PREVIEW_SECRET!,
+*   pathPattern: "/blog/{id}",
+* });
+* // Returns: /blog/hello-world?_preview=eyJj...
+* ```
+*/
+async function getPreviewUrl(options) {
+	const { collection, id, secret, expiresIn = "1h", baseUrl, pathPattern = "/{collection}/{id}", locale = "" } = options;
+	const token = await generatePreviewToken({
+		contentId: `${collection}:${id}`,
+		expiresIn,
+		secret
+	});
+	let path = pathPattern.replace("{collection}", collection).replace("{id}", id).replace("{locale}", locale);
+	path = path.replace(REPEATED_SLASHES_PATTERN, "/");
+	if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1);
+	const url = new URL(path, baseUrl || "http://placeholder");
+	url.searchParams.set("_preview", token);
+	if (!baseUrl) return `${url.pathname}${url.search}`;
+	return url.toString();
+}
+/**
+* Build a preview URL from a token (when you already have the token)
+*
+* @example
+* ```ts
+* const url = buildPreviewUrl({
+*   path: "/posts/hello-world",
+*   token: existingToken,
+* });
+* ```
+*/
+function buildPreviewUrl(options) {
+	const { path, token, baseUrl } = options;
+	const url = new URL(path, baseUrl || "http://placeholder");
+	url.searchParams.set("_preview", token);
+	if (!baseUrl) return `${url.pathname}${url.search}`;
+	return url.toString();
+}
+//#endregion
+//#region src/preview/helpers.ts
+/**
+* Preview helpers for Astro pages
+*/
+/**
+* Check if a request is a preview request
+*
+* @example
+* ```ts
+* const isPreview = isPreviewRequest(Astro.url);
+* ```
+*/
+function isPreviewRequest(url) {
+	return url.searchParams.has("_preview");
+}
+/**
+* Get the preview token from a URL
+*
+* @example
+* ```ts
+* const token = getPreviewToken(Astro.url);
+* ```
+*/
+function getPreviewToken(url) {
+	return url.searchParams.get("_preview");
+}
+//#endregion
+export { createFilePreviewMiddleware as a, dropSessionDatabaseTables as c, SessionDatabaseLimitError as d, isBlockedInPreview as f, getPreviewUrl as i, getAppliedSnapshotMeta as l, isPreviewRequest as n, renderPreviewToolbar as o, renderPreviewLoadingPage as p, buildPreviewUrl as r, applySnapshotToDatabase as s, getPreviewToken as t, FileSessionDatabaseFactory as u };