emdash 0.14.0 → 0.15.0

package/dist/bylines-H0Xh5TMy.mjs

@@ -0,0 +1,118 @@
+import { n as getI18nConfig } from "./config-CVssduLe.mjs";
+import { t as BylineRepository } from "./byline-CTaWkMh5.mjs";
+
+//#region src/api/handlers/bylines.ts
+/**
+* Reject locales the site doesn't configure. Returns `null` when the locale
+* is fine (omitted, or matches `locales` in the i18n config, or i18n isn't
+* configured at all).
+*/
+function rejectUnknownLocale(locale) {
+	if (!locale) return null;
+	const config = getI18nConfig();
+	if (!config) return null;
+	if (config.locales.includes(locale)) return null;
+	return {
+		success: false,
+		error: {
+			code: "VALIDATION_ERROR",
+			message: `Locale "${locale}" is not configured for this site`
+		}
+	};
+}
+/**
+* List every translation of a byline (by row id). Returns NOT_FOUND when no
+* row with the given id exists.
+*/
+async function handleBylineTranslations(db, id) {
+	try {
+		const repo = new BylineRepository(db);
+		if (!await repo.findById(id)) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "Byline not found"
+			}
+		};
+		return {
+			success: true,
+			data: { items: await repo.listTranslations(id) }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "BYLINE_TRANSLATIONS_ERROR",
+				message: "Failed to list byline translations"
+			}
+		};
+	}
+}
+/**
+* Create a new byline. When `translationOf` is supplied, the new row joins the
+* source byline's translation_group (a sibling in the same logical identity).
+*
+* Translating from a source row only makes sense when the caller names the
+* target locale, otherwise we'd silently clone into the configured default,
+* which is almost never what's intended (and will collide if the source is
+* already the default-locale row). Mirrors `handleMenuCreate`.
+*/
+async function handleBylineCreate(db, input) {
+	try {
+		if (input.translationOf && !input.locale) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: "`locale` is required when `translationOf` is provided"
+			}
+		};
+		const localeErr = rejectUnknownLocale(input.locale);
+		if (localeErr) return localeErr;
+		const repo = new BylineRepository(db);
+		let sourceGroup;
+		if (input.translationOf) {
+			const source = await repo.findById(input.translationOf);
+			if (!source) return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: "Source byline for translation not found"
+				}
+			};
+			sourceGroup = source.translationGroup ?? source.id;
+		}
+		const effectiveLocale = input.locale ?? getI18nConfig()?.defaultLocale ?? "en";
+		if (sourceGroup) {
+			if ((await repo.findByTranslationGroup(sourceGroup)).some((b) => b.locale === effectiveLocale)) return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: `Translation already exists in locale "${effectiveLocale}" for this byline`
+				}
+			};
+		}
+		if (await repo.findBySlug(input.slug, { locale: effectiveLocale })) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: `Byline "${input.slug}" already exists${input.locale ? ` in locale "${input.locale}"` : ""}`
+			}
+		};
+		return {
+			success: true,
+			data: await repo.create(input)
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "BYLINE_CREATE_ERROR",
+				message: "Failed to create byline"
+			}
+		};
+	}
+}
+
+//#endregion
+export { handleBylineTranslations as n, handleBylineCreate as t };
+//# sourceMappingURL=bylines-H0Xh5TMy.mjs.map

package/dist/bylines-H0Xh5TMy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bylines-H0Xh5TMy.mjs","names":[],"sources":["../src/api/handlers/bylines.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\n\nimport { BylineRepository, type CreateBylineInput } from \"../../database/repositories/byline.js\";\nimport type { BylineSummary } from \"../../database/repositories/types.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { getI18nConfig } from \"../../i18n/config.js\";\nimport type { ApiResult } from \"../types.js\";\n\n/**\n * Reject locales the site doesn't configure. Returns `null` when the locale\n * is fine (omitted, or matches `locales` in the i18n config, or i18n isn't\n * configured at all).\n */\nfunction rejectUnknownLocale(locale: string | undefined): ApiResult<never> | null {\n\tif (!locale) return null;\n\tconst config = getI18nConfig();\n\tif (!config) return null;\n\tif (config.locales.includes(locale)) return null;\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\tmessage: `Locale \"${locale}\" is not configured for this site`,\n\t\t},\n\t};\n}\n\n/**\n * Business-logic helpers for the bylines admin API.\n *\n * Mirrors the shape of `packages/core/src/api/handlers/menus.ts`. Route files\n * stay thin: they parse input, call these handlers, and forward the result via\n * `unwrapResult`. The repository (`BylineRepository`) is strict per locale; the\n * handlers add validation and translation-flow guards on top.\n */\n\nexport interface BylineTranslationsResponse {\n\titems: BylineSummary[];\n}\n\n/**\n * List every translation of a byline (by row id). Returns NOT_FOUND when no\n * row with the given id exists.\n */\nexport async function handleBylineTranslations(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<BylineTranslationsResponse>> {\n\ttry {\n\t\tconst repo = new BylineRepository(db);\n\t\tconst anchor = await repo.findById(id);\n\t\tif (!anchor) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Byline not found\" },\n\t\t\t};\n\t\t}\n\t\tconst items = await repo.listTranslations(id);\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"BYLINE_TRANSLATIONS_ERROR\",\n\t\t\t\tmessage: \"Failed to list byline translations\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Create a new byline. When `translationOf` is supplied, the new row joins the\n * source byline's translation_group (a sibling in the same logical identity).\n *\n * Translating from a source row only makes sense when the caller names the\n * target locale, otherwise we'd silently clone into the configured default,\n * which is almost never what's intended (and will collide if the source is\n * already the default-locale row). Mirrors `handleMenuCreate`.\n */\nexport async function handleBylineCreate(\n\tdb: Kysely<Database>,\n\tinput: CreateBylineInput,\n): Promise<ApiResult<BylineSummary>> {\n\ttry {\n\t\tif (input.translationOf && !input.locale) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: \"`locale` is required when `translationOf` is provided\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst localeErr = rejectUnknownLocale(input.locale);\n\t\tif (localeErr) return localeErr;\n\n\t\tconst repo = new BylineRepository(db);\n\n\t\t// Existence check up front so the repo's \"Source not found\" throw\n\t\t// becomes a clean NOT_FOUND on the API.\n\t\tlet sourceGroup: string | undefined;\n\t\tif (input.translationOf) {\n\t\t\tconst source = await repo.findById(input.translationOf);\n\t\t\tif (!source) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\t\tmessage: \"Source byline for translation not found\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\tsourceGroup = source.translationGroup ?? source.id;\n\t\t}\n\n\t\tconst effectiveLocale = input.locale ?? getI18nConfig()?.defaultLocale ?? \"en\";\n\n\t\t// Translation-group guard: the row-per-locale model (PR #916)\n\t\t// allows exactly one row per (translation_group, locale). Reject\n\t\t// here so callers get a clean 409 instead of a UNIQUE constraint\n\t\t// failure from the partial index. The DB constraint is the safety\n\t\t// net; this is the friendly error.\n\t\tif (sourceGroup) {\n\t\t\tconst siblings = await repo.findByTranslationGroup(sourceGroup);\n\t\t\tif (siblings.some((b) => b.locale === effectiveLocale)) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\t\t\tmessage: `Translation already exists in locale \"${effectiveLocale}\" for this byline`,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Duplicate guard: same (slug, locale) — matches the DB unique key\n\t\t// added in migration 040. Falls back to the configured defaultLocale\n\t\t// when the caller omits `locale`, mirroring the column DEFAULT.\n\t\tconst existing = await repo.findBySlug(input.slug, { locale: effectiveLocale });\n\t\tif (existing) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\t\tmessage: `Byline \"${input.slug}\" already exists${\n\t\t\t\t\t\tinput.locale ? ` in locale \"${input.locale}\"` : \"\"\n\t\t\t\t\t}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst byline = await repo.create(input);\n\t\treturn { success: true, data: byline };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"BYLINE_CREATE_ERROR\", message: \"Failed to create byline\" },\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;AAaA,SAAS,oBAAoB,QAAqD;AACjF,KAAI,CAAC,OAAQ,QAAO;CACpB,MAAM,SAAS,eAAe;AAC9B,KAAI,CAAC,OAAQ,QAAO;AACpB,KAAI,OAAO,QAAQ,SAAS,OAAO,CAAE,QAAO;AAC5C,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS,WAAW,OAAO;GAC3B;EACD;;;;;;AAoBF,eAAsB,yBACrB,IACA,IACiD;AACjD,KAAI;EACH,MAAM,OAAO,IAAI,iBAAiB,GAAG;AAErC,MAAI,CADW,MAAM,KAAK,SAAS,GAAG,CAErC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAoB;GACzD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,OADlB,MAAM,KAAK,iBAAiB,GAAG,EACN;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;AAaH,eAAsB,mBACrB,IACA,OACoC;AACpC,KAAI;AACH,MAAI,MAAM,iBAAiB,CAAC,MAAM,OACjC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,MAAM,YAAY,oBAAoB,MAAM,OAAO;AACnD,MAAI,UAAW,QAAO;EAEtB,MAAM,OAAO,IAAI,iBAAiB,GAAG;EAIrC,IAAI;AACJ,MAAI,MAAM,eAAe;GACxB,MAAM,SAAS,MAAM,KAAK,SAAS,MAAM,cAAc;AACvD,OAAI,CAAC,OACJ,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;AAEF,iBAAc,OAAO,oBAAoB,OAAO;;EAGjD,MAAM,kBAAkB,MAAM,UAAU,eAAe,EAAE,iBAAiB;AAO1E,MAAI,aAEH;QADiB,MAAM,KAAK,uBAAuB,YAAY,EAClD,MAAM,MAAM,EAAE,WAAW,gBAAgB,CACrD,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS,yCAAyC,gBAAgB;KAClE;IACD;;AAQH,MADiB,MAAM,KAAK,WAAW,MAAM,MAAM,EAAE,QAAQ,iBAAiB,CAAC,CAE9E,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,WAAW,MAAM,KAAK,kBAC9B,MAAM,SAAS,eAAe,MAAM,OAAO,KAAK;IAEjD;GACD;AAIF,SAAO;GAAE,SAAS;GAAM,MADT,MAAM,KAAK,OAAO,MAAM;GACD;SAC/B;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA2B;GAC1E"}

package/dist/{cache-CXCpjWiL.mjs → cache-CNk1jIxp.mjs}

@@ -1,4 +1,4 @@
-import { i as __exportAll } from "./runner-DdnQIwz_.mjs";
+import { i as __exportAll } from "./runner-CGlojznK.mjs";
 import { i as matchPattern, n as interpolateDestination, t as compilePattern } from "./patterns-CqG5Ya3i.mjs";
 
 //#region src/redirects/cache.ts
@@ -62,4 +62,4 @@ function matchCachedPatterns(rules, pathname) {
 
 //#endregion
 export { setCachedRedirects as a, matchCachedPatterns as i, getCachedRedirects as n, invalidateRedirectCache as r, cache_exports as t };
-//# sourceMappingURL=cache-CXCpjWiL.mjs.map
+//# sourceMappingURL=cache-CNk1jIxp.mjs.map

package/dist/{cache-CXCpjWiL.mjs.map → cache-CNk1jIxp.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cache-CXCpjWiL.mjs","names":[],"sources":["../src/redirects/cache.ts"],"sourcesContent":["/**\n * Redirect rule cache.\n *\n * Module-level cache for enabled redirect rules. The middleware populates this\n * on first request; route handlers invalidate it on writes.\n *\n * Both exact-match and pattern rules are loaded from one query and cached\n * together: exact rules indexed by source path in a Map, pattern rules\n * pre-compiled into an array. A single warm request issues zero database\n * queries; a cold isolate issues one.\n *\n * This module deliberately has NO Astro imports so it can be safely imported\n * from handlers, seed, CLI, and tests without dragging in `astro:middleware`.\n */\n\nimport type { Redirect } from \"../database/repositories/redirect.js\";\nimport type { CompiledPattern } from \"./patterns.js\";\nimport { compilePattern, interpolateDestination, matchPattern } from \"./patterns.js\";\n\nexport interface CachedRedirectRule {\n\tredirect: Redirect;\n\tcompiled: CompiledPattern;\n}\n\nexport interface CachedRedirects {\n\t/** Exact-match rules indexed by source path (`source` -> `Redirect`). */\n\texact: Map<string, Redirect>;\n\t/** Pattern rules with their compiled regexes, preserving insertion order. */\n\tpatterns: CachedRedirectRule[];\n}\n\n/**\n * Cached enabled redirects.\n * null = not yet populated, object = cached.\n */\nlet cachedRedirects: CachedRedirects | null = null;\n\n/**\n * Invalidate the cached redirects (both exact and pattern).\n * Call when redirects are created, updated, or deleted.\n */\nexport function invalidateRedirectCache(): void {\n\tcachedRedirects = null;\n}\n\n/**\n * Get the cached redirects, or null if the cache is cold.\n */\nexport function getCachedRedirects(): CachedRedirects | null {\n\treturn cachedRedirects;\n}\n\n/**\n * Populate the cache from a list of enabled redirects (both exact and\n * pattern). The caller is responsible for passing only enabled rows — the\n * cache stores them as-is.\n */\nexport function setCachedRedirects(redirects: Redirect[]): CachedRedirects {\n\tconst exact = new Map<string, Redirect>();\n\tconst patterns: CachedRedirectRule[] = [];\n\tfor (const r of redirects) {\n\t\tif (r.isPattern) {\n\t\t\tpatterns.push({ redirect: r, compiled: compilePattern(r.source) });\n\t\t} else {\n\t\t\texact.set(r.source, r);\n\t\t}\n\t}\n\tcachedRedirects = { exact, patterns };\n\treturn cachedRedirects;\n}\n\n/**\n * Match a path against the cached pattern rules.\n * Returns the resolved destination and matching redirect, or null.\n */\nexport function matchCachedPatterns(\n\trules: CachedRedirectRule[],\n\tpathname: string,\n): { redirect: Redirect; destination: string } | null {\n\tfor (const { redirect, compiled } of rules) {\n\t\tconst params = matchPattern(compiled, pathname);\n\t\tif (params) {\n\t\t\tconst dest = interpolateDestination(redirect.destination, params);\n\t\t\treturn { redirect, destination: dest };\n\t\t}\n\t}\n\treturn null;\n}\n"],"mappings":";;;;;;;;;;;;;;AAmCA,IAAI,kBAA0C;;;;;AAM9C,SAAgB,0BAAgC;AAC/C,mBAAkB;;;;;AAMnB,SAAgB,qBAA6C;AAC5D,QAAO;;;;;;;AAQR,SAAgB,mBAAmB,WAAwC;CAC1E,MAAM,wBAAQ,IAAI,KAAuB;CACzC,MAAM,WAAiC,EAAE;AACzC,MAAK,MAAM,KAAK,UACf,KAAI,EAAE,UACL,UAAS,KAAK;EAAE,UAAU;EAAG,UAAU,eAAe,EAAE,OAAO;EAAE,CAAC;KAElE,OAAM,IAAI,EAAE,QAAQ,EAAE;AAGxB,mBAAkB;EAAE;EAAO;EAAU;AACrC,QAAO;;;;;;AAOR,SAAgB,oBACf,OACA,UACqD;AACrD,MAAK,MAAM,EAAE,UAAU,cAAc,OAAO;EAC3C,MAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,OAEH,QAAO;GAAE;GAAU,aADN,uBAAuB,SAAS,aAAa,OAAO;GAC3B;;AAGxC,QAAO"}
+{"version":3,"file":"cache-CNk1jIxp.mjs","names":[],"sources":["../src/redirects/cache.ts"],"sourcesContent":["/**\n * Redirect rule cache.\n *\n * Module-level cache for enabled redirect rules. The middleware populates this\n * on first request; route handlers invalidate it on writes.\n *\n * Both exact-match and pattern rules are loaded from one query and cached\n * together: exact rules indexed by source path in a Map, pattern rules\n * pre-compiled into an array. A single warm request issues zero database\n * queries; a cold isolate issues one.\n *\n * This module deliberately has NO Astro imports so it can be safely imported\n * from handlers, seed, CLI, and tests without dragging in `astro:middleware`.\n */\n\nimport type { Redirect } from \"../database/repositories/redirect.js\";\nimport type { CompiledPattern } from \"./patterns.js\";\nimport { compilePattern, interpolateDestination, matchPattern } from \"./patterns.js\";\n\nexport interface CachedRedirectRule {\n\tredirect: Redirect;\n\tcompiled: CompiledPattern;\n}\n\nexport interface CachedRedirects {\n\t/** Exact-match rules indexed by source path (`source` -> `Redirect`). */\n\texact: Map<string, Redirect>;\n\t/** Pattern rules with their compiled regexes, preserving insertion order. */\n\tpatterns: CachedRedirectRule[];\n}\n\n/**\n * Cached enabled redirects.\n * null = not yet populated, object = cached.\n */\nlet cachedRedirects: CachedRedirects | null = null;\n\n/**\n * Invalidate the cached redirects (both exact and pattern).\n * Call when redirects are created, updated, or deleted.\n */\nexport function invalidateRedirectCache(): void {\n\tcachedRedirects = null;\n}\n\n/**\n * Get the cached redirects, or null if the cache is cold.\n */\nexport function getCachedRedirects(): CachedRedirects | null {\n\treturn cachedRedirects;\n}\n\n/**\n * Populate the cache from a list of enabled redirects (both exact and\n * pattern). The caller is responsible for passing only enabled rows — the\n * cache stores them as-is.\n */\nexport function setCachedRedirects(redirects: Redirect[]): CachedRedirects {\n\tconst exact = new Map<string, Redirect>();\n\tconst patterns: CachedRedirectRule[] = [];\n\tfor (const r of redirects) {\n\t\tif (r.isPattern) {\n\t\t\tpatterns.push({ redirect: r, compiled: compilePattern(r.source) });\n\t\t} else {\n\t\t\texact.set(r.source, r);\n\t\t}\n\t}\n\tcachedRedirects = { exact, patterns };\n\treturn cachedRedirects;\n}\n\n/**\n * Match a path against the cached pattern rules.\n * Returns the resolved destination and matching redirect, or null.\n */\nexport function matchCachedPatterns(\n\trules: CachedRedirectRule[],\n\tpathname: string,\n): { redirect: Redirect; destination: string } | null {\n\tfor (const { redirect, compiled } of rules) {\n\t\tconst params = matchPattern(compiled, pathname);\n\t\tif (params) {\n\t\t\tconst dest = interpolateDestination(redirect.destination, params);\n\t\t\treturn { redirect, destination: dest };\n\t\t}\n\t}\n\treturn null;\n}\n"],"mappings":";;;;;;;;;;;;;;AAmCA,IAAI,kBAA0C;;;;;AAM9C,SAAgB,0BAAgC;AAC/C,mBAAkB;;;;;AAMnB,SAAgB,qBAA6C;AAC5D,QAAO;;;;;;;AAQR,SAAgB,mBAAmB,WAAwC;CAC1E,MAAM,wBAAQ,IAAI,KAAuB;CACzC,MAAM,WAAiC,EAAE;AACzC,MAAK,MAAM,KAAK,UACf,KAAI,EAAE,UACL,UAAS,KAAK;EAAE,UAAU;EAAG,UAAU,eAAe,EAAE,OAAO;EAAE,CAAC;KAElE,OAAM,IAAI,EAAE,QAAQ,EAAE;AAGxB,mBAAkB;EAAE;EAAO;EAAU;AACrC,QAAO;;;;;;AAOR,SAAgB,oBACf,OACA,UACqD;AACrD,MAAK,MAAM,EAAE,UAAU,cAAc,OAAO;EAC3C,MAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,OAEH,QAAO;GAAE;GAAU,aADN,uBAAuB,SAAS,aAAa,OAAO;GAC3B;;AAGxC,QAAO"}

package/dist/{challenge-store-CJ0OOHOr.mjs → challenge-store-Dng1SxKT.mjs}

@@ -46,4 +46,4 @@ async function cleanupExpiredChallenges(db) {
 
 //#endregion
 export { createChallengeStore as n, cleanupExpiredChallenges as t };
-//# sourceMappingURL=challenge-store-CJ0OOHOr.mjs.map
+//# sourceMappingURL=challenge-store-Dng1SxKT.mjs.map

package/dist/{challenge-store-CJ0OOHOr.mjs.map → challenge-store-Dng1SxKT.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"challenge-store-CJ0OOHOr.mjs","names":[],"sources":["../src/auth/challenge-store.ts"],"sourcesContent":["/**\n * Challenge store for WebAuthn\n *\n * Stores WebAuthn challenges in a dedicated table with automatic expiration.\n */\n\nimport type { ChallengeStore, ChallengeData } from \"@emdash-cms/auth/passkey\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nexport function createChallengeStore(db: Kysely<Database>): ChallengeStore {\n\treturn {\n\t\tasync set(challenge: string, data: ChallengeData): Promise<void> {\n\t\t\tconst expiresAt = new Date(data.expiresAt).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge,\n\t\t\t\t\ttype: data.type,\n\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\tdata: null, // Could store additional context if needed\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: data.type,\n\t\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(challenge: string): Promise<ChallengeData | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", challenge)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(challenge);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\ttype: row.type === \"registration\" ? \"registration\" : \"authentication\",\n\t\t\t\tuserId: row.user_id ?? undefined,\n\t\t\t\texpiresAt,\n\t\t\t};\n\t\t},\n\n\t\tasync delete(challenge: string): Promise<void> {\n\t\t\tawait db.deleteFrom(\"auth_challenges\").where(\"challenge\", \"=\", challenge).execute();\n\t\t},\n\t};\n}\n\n/**\n * Clean up expired challenges.\n * Should be called periodically (e.g., on startup, or via cron).\n */\nexport async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {\n\tconst now = new Date().toISOString();\n\n\tconst result = await db\n\t\t.deleteFrom(\"auth_challenges\")\n\t\t.where(\"expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows ?? 0);\n}\n"],"mappings":";AAWA,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,IAAI,WAAmB,MAAoC;GAChE,MAAM,YAAY,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa;AAExD,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP;IACA,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM;IACN,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,WAAkD;GAC3D,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,UAAU,CAClC,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;GAEjB,MAAM,YAAY,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS;AAGpD,OAAI,YAAY,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;;AAGR,UAAO;IACN,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;IACrD,QAAQ,IAAI,WAAW;IACvB;IACA;;EAGF,MAAM,OAAO,WAAkC;AAC9C,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,UAAU,CAAC,SAAS;;EAEpF;;;;;;AAOF,eAAsB,yBAAyB,IAAuC;CACrF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,SAAS,MAAM,GACnB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,IAAI,CAC7B,kBAAkB;AAEpB,QAAO,OAAO,OAAO,kBAAkB,EAAE"}
+{"version":3,"file":"challenge-store-Dng1SxKT.mjs","names":[],"sources":["../src/auth/challenge-store.ts"],"sourcesContent":["/**\n * Challenge store for WebAuthn\n *\n * Stores WebAuthn challenges in a dedicated table with automatic expiration.\n */\n\nimport type { ChallengeStore, ChallengeData } from \"@emdash-cms/auth/passkey\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nexport function createChallengeStore(db: Kysely<Database>): ChallengeStore {\n\treturn {\n\t\tasync set(challenge: string, data: ChallengeData): Promise<void> {\n\t\t\tconst expiresAt = new Date(data.expiresAt).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge,\n\t\t\t\t\ttype: data.type,\n\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\tdata: null, // Could store additional context if needed\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: data.type,\n\t\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(challenge: string): Promise<ChallengeData | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", challenge)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(challenge);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\ttype: row.type === \"registration\" ? \"registration\" : \"authentication\",\n\t\t\t\tuserId: row.user_id ?? undefined,\n\t\t\t\texpiresAt,\n\t\t\t};\n\t\t},\n\n\t\tasync delete(challenge: string): Promise<void> {\n\t\t\tawait db.deleteFrom(\"auth_challenges\").where(\"challenge\", \"=\", challenge).execute();\n\t\t},\n\t};\n}\n\n/**\n * Clean up expired challenges.\n * Should be called periodically (e.g., on startup, or via cron).\n */\nexport async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {\n\tconst now = new Date().toISOString();\n\n\tconst result = await db\n\t\t.deleteFrom(\"auth_challenges\")\n\t\t.where(\"expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows ?? 0);\n}\n"],"mappings":";AAWA,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,IAAI,WAAmB,MAAoC;GAChE,MAAM,YAAY,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa;AAExD,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP;IACA,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM;IACN,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,WAAkD;GAC3D,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,UAAU,CAClC,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;GAEjB,MAAM,YAAY,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS;AAGpD,OAAI,YAAY,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;;AAGR,UAAO;IACN,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;IACrD,QAAQ,IAAI,WAAW;IACvB;IACA;;EAGF,MAAM,OAAO,WAAkC;AAC9C,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,UAAU,CAAC,SAAS;;EAEpF;;;;;;AAOF,eAAsB,yBAAyB,IAAuC;CACrF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,SAAS,MAAM,GACnB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,IAAI,CAC7B,kBAAkB;AAEpB,QAAO,OAAO,OAAO,kBAAkB,EAAE"}

package/dist/{chunks-DyGtu1Bv.mjs → chunks-BkfVdD-3.mjs}

@@ -1,4 +1,4 @@
-import { i as __exportAll } from "./runner-DdnQIwz_.mjs";
+import { i as __exportAll } from "./runner-CGlojznK.mjs";
 
 //#region src/utils/chunks.ts
 var chunks_exports = /* @__PURE__ */ __exportAll({
@@ -22,4 +22,4 @@ const SQL_BATCH_SIZE = 50;
 
 //#endregion
 export { chunks as n, chunks_exports as r, SQL_BATCH_SIZE as t };
-//# sourceMappingURL=chunks-DyGtu1Bv.mjs.map
+//# sourceMappingURL=chunks-BkfVdD-3.mjs.map

package/dist/{chunks-DyGtu1Bv.mjs.map → chunks-BkfVdD-3.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"chunks-DyGtu1Bv.mjs","names":[],"sources":["../src/utils/chunks.ts"],"sourcesContent":["/**\n * Split an array into chunks of at most `size` elements.\n *\n * Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's\n * bound-parameter limit (~100 per statement).\n */\nexport function chunks<T>(arr: T[], size: number): T[][] {\n\tif (arr.length === 0) return [];\n\tconst result: T[][] = [];\n\tfor (let i = 0; i < arr.length; i += size) {\n\t\tresult.push(arr.slice(i, i + size));\n\t}\n\treturn result;\n}\n\n/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */\nexport const SQL_BATCH_SIZE = 50;\n"],"mappings":";;;;;;;;;;;;;AAMA,SAAgB,OAAU,KAAU,MAAqB;AACxD,KAAI,IAAI,WAAW,EAAG,QAAO,EAAE;CAC/B,MAAM,SAAgB,EAAE;AACxB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,KACpC,QAAO,KAAK,IAAI,MAAM,GAAG,IAAI,KAAK,CAAC;AAEpC,QAAO;;;AAIR,MAAa,iBAAiB"}
+{"version":3,"file":"chunks-BkfVdD-3.mjs","names":[],"sources":["../src/utils/chunks.ts"],"sourcesContent":["/**\n * Split an array into chunks of at most `size` elements.\n *\n * Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's\n * bound-parameter limit (~100 per statement).\n */\nexport function chunks<T>(arr: T[], size: number): T[][] {\n\tif (arr.length === 0) return [];\n\tconst result: T[][] = [];\n\tfor (let i = 0; i < arr.length; i += size) {\n\t\tresult.push(arr.slice(i, i + size));\n\t}\n\treturn result;\n}\n\n/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */\nexport const SQL_BATCH_SIZE = 50;\n"],"mappings":";;;;;;;;;;;;;AAMA,SAAgB,OAAU,KAAU,MAAqB;AACxD,KAAI,IAAI,WAAW,EAAG,QAAO,EAAE;CAC/B,MAAM,SAAgB,EAAE;AACxB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,KACpC,QAAO,KAAK,IAAI,MAAM,GAAG,IAAI,KAAK,CAAC;AAEpC,QAAO;;;AAIR,MAAa,iBAAiB"}

package/dist/cli/index.mjs

@@ -1,33 +1,34 @@
 #!/usr/bin/env node
-import { i as __exportAll, r as runMigrations, t as getMigrationStatus } from "../runner-DdnQIwz_.mjs";
+import { i as __exportAll, r as runMigrations, t as getMigrationStatus } from "../runner-CGlojznK.mjs";
 import { n as createDatabase } from "../connection-2igzM-AT.mjs";
 import { c as listTablesLike } from "../dialect-helpers-BKCvISIQ.mjs";
 import { r as isI18nEnabled } from "../config-CVssduLe.mjs";
 import { n as slugify } from "../slugify-Cjh1ssOZ.mjs";
-import { t as ContentRepository } from "../content-D6YG26WG.mjs";
+import { t as ContentRepository } from "../content-C0ooIs-f.mjs";
 import { i as encodeBase64url } from "../base64-CqR-7kqF.mjs";
-import "../types-CwXMEPRr.mjs";
-import { t as MediaRepository } from "../media-Dg7he9uK.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-wPfusMK9.mjs";
+import "../types-ByV5sgsv.mjs";
+import { t as MediaRepository } from "../media-oqRcNiQf.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-D4Uc2LsZ.mjs";
 import { t as OptionsRepository } from "../options-BL4X94qY.mjs";
-import "../redirect-DkaDxq8e.mjs";
-import "../byline-D09BaS4j.mjs";
+import "../redirect-CNv4mHX2.mjs";
+import "../byline-CTaWkMh5.mjs";
 import "../request-cache-dzCt8TZB.mjs";
-import "../fts-manager-B633C-kQ.mjs";
-import { n as SchemaRegistry } from "../registry-BnCeHYsf.mjs";
-import "../loader-Cs6-Bqe6.mjs";
-import "../settings-xQKsWnzQ.mjs";
-import { i as pluginManifestSchema } from "../manifest-schema-HCtSh4Jq.mjs";
-import { n as isDeprecatedCapability, t as CAPABILITY_RENAMES } from "../types-Db67HHlU.mjs";
-import "../ssrf-DzFN_qV-.mjs";
-import "../ssrf-CTul4uQi.mjs";
-import { t as validateSeed } from "../validate-DlFxcVVK.mjs";
-import { t as applySeed } from "../apply-v4DBgjPw.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-6pgZyq0K.mjs";
+import "../fts-manager-Mnrtn-r2.mjs";
+import { n as SchemaRegistry } from "../registry-DqrAQDXH.mjs";
+import "../loader-Chm5h7Gr.mjs";
+import "../settings-hcubRfkr.mjs";
+import { i as pluginManifestSchema } from "../manifest-schema-Czqf0TLu.mjs";
+import { n as isDeprecatedCapability, t as CAPABILITY_RENAMES } from "../types-1NNkmTIn.mjs";
+import "../ssrf-MZ-zrG6-.mjs";
+import "../ssrf-BIcd-aXW.mjs";
+import { t as validateSeed } from "../validate-mz87i8_1.mjs";
+import { t as applySeed } from "../apply-wJhM_bwU.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-rPdhEBkD.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { o as convertDataForRead } from "../transport-fw-mKJzT.mjs";
+import { o as convertDataForRead } from "../transport-B6CHddbu.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
 import { EmDashClient } from "../client/index.mjs";
+import { sql } from "kysely";
 import { imageSize } from "image-size";
 import { createGzipDecoder, unpackTar } from "modern-tar";
 import { basename, dirname, extname, join, resolve } from "node:path";
@@ -1572,22 +1573,13 @@ async function readPackageJson$1(cwd) {
 }
 async function runSqlFile(db, filePath) {
 	const statements = (await readFile(filePath, "utf-8")).split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
-	for (const statement of statements) await db.executeQuery({
-		sql: statement,
-		parameters: [],
-		query: {
-			kind: "RawNode",
-			sqlFragments: [statement],
-			parameters: []
-		}
-	});
+	for (const statement of statements) await db.executeQuery(sql.raw(statement).compile(db));
 }
 /**
 * Check if database has already been initialized with template schema
 */
 async function isAlreadyInitialized(db) {
 	try {
-		const { sql } = await import("kysely");
 		const row = (await sql`SELECT COUNT(id) as count FROM _emdash_collections`.execute(db)).rows[0];
 		return row ? row.count > 0 : false;
 	} catch {