emdash 0.19.0 → 0.20.0

package/dist/{bylines-wurS258E.mjs.map → bylines-s8c2DXbH.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"bylines-wurS258E.mjs","names":[],"sources":["../src/bylines/index.ts"],"sourcesContent":["/**\n * Runtime API for bylines\n *\n * Provides functions to query byline profiles and byline credits\n * associated with content entries. Follows the same pattern as\n * the taxonomies runtime API.\n *\n * i18n model (migration 040): byline rows are per-locale and share a\n * `translation_group`. Credits on `_emdash_content_bylines.byline_id` store\n * the translation_group, so a single credit spans every locale of a byline.\n *\n * Hydration is strict per locale: a credit at locale X renders iff a byline\n * row exists at locale X within the credited translation_group. There is no\n * read-time fallback. Mirrors `getEntryTerms` and the convention in PR #916.\n * Locale is passed in by callers — `query.ts` resolves it from the entry's\n * own `data.locale` for the runtime path.\n */\n\nimport { sql } from \"kysely\";\n\nimport { BylineRepository } from \"../database/repositories/byline.js\";\nimport type { BylineSummary, ContentBylineCredit } from \"../database/repositories/types.js\";\nimport { validateIdentifier } from \"../database/validate.js\";\nimport { resolveLocaleChain } from \"../i18n/resolve.js\";\nimport { getDb } from \"../loader.js\";\nimport { requestCached } from \"../request-cache.js\";\nimport { isMissingTableError } from \"../utils/db-errors.js\";\n\n/**\n * No-op — kept for API compatibility.\n *\n * Used to invalidate a worker-lifetime \"has any byline?\" probe. That\n * probe added a query on every cold isolate to save one query on sites\n * with zero bylines (i.e. the wrong tradeoff), so we dropped it. The\n * batch byline join below returns an empty map for empty sites at the\n * same cost as the probe, without the pre-check.\n */\nexport function invalidateBylineCache(): void {\n\t// Intentionally empty.\n}\n\n/**\n * Get a byline by ID.\n *\n * @example\n * ```ts\n * import { getByline } from \"emdash\";\n *\n * const byline = await getByline(\"01HXYZ...\");\n * if (byline) {\n *   console.log(byline.displayName);\n * }\n * ```\n */\nexport async function getByline(id: string): Promise<BylineSummary | null> {\n\tconst db = await getDb();\n\tconst repo = new BylineRepository(db);\n\treturn repo.findById(id);\n}\n\n/**\n * Get a byline by slug.\n *\n * Standalone identity lookup (e.g. rendering an author profile page). Walks\n * the configured locale fallback chain — same pattern as `getMenu` and\n * `getTerm`, see PR #916. Returns the first match found, walking\n * `[requestedLocale, ...fallbacks, defaultLocale]` in order.\n *\n * Note: this is intentionally different from credit hydration on a content\n * entry (`getEntryBylines`), which is strict per locale with no fallback.\n * The distinction: identity lookups answer \"give me this byline\", and\n * falling back to another locale's display name is acceptable. Credit\n * hydration answers \"what should render on this entry\", where falling back\n * silently surfaces a stale-locale name and contradicts editorial intent.\n *\n * @example\n * ```ts\n * import { getBylineBySlug } from \"emdash\";\n *\n * const byline = await getBylineBySlug(\"jane-doe\", { locale: \"de-de\" });\n * if (byline) {\n *   console.log(byline.displayName);\n * }\n * ```\n */\nexport async function getBylineBySlug(\n\tslug: string,\n\toptions?: { locale?: string },\n): Promise<BylineSummary | null> {\n\tconst chain = resolveLocaleChain(options?.locale);\n\tconst cacheKey = `byline-by-slug:${slug}:${chain.length > 0 ? chain.join(\",\") : \"*\"}`;\n\treturn requestCached(cacheKey, async () => {\n\t\tconst db = await getDb();\n\t\tconst repo = new BylineRepository(db);\n\n\t\tif (chain.length === 0) {\n\t\t\t// No i18n or no resolved locale — fall back to the repo's\n\t\t\t// \"lowest-locale-code\" deterministic match.\n\t\t\treturn repo.findBySlug(slug);\n\t\t}\n\n\t\tfor (const locale of chain) {\n\t\t\tconst row = await repo.findBySlug(slug, { locale });\n\t\t\tif (row) return row;\n\t\t}\n\t\treturn null;\n\t});\n}\n\n/**\n * Get byline credits for a single content entry.\n *\n * Strict per locale (post-migration 040): a credit renders iff a byline row\n * exists at the requested locale within the credited translation_group.\n * Callers wanting fallback behaviour apply it themselves. When `locale` is\n * omitted, returns every locale variant of every credit on the entry —\n * useful for admin tooling, not for end-user rendering.\n *\n * Internal: not re-exported from the `emdash` package entry point. Every\n * entry returned by `getEmDashCollection` / `getEmDashEntry` already has\n * `data.bylines` populated by `hydrateEntryBylines` (which uses the batch\n * helper `getBylinesForEntries` directly). Site code should read those\n * fields rather than calling this function.\n */\nexport async function getEntryBylines(\n\tcollection: string,\n\tentryId: string,\n\toptions?: { locale?: string },\n): Promise<ContentBylineCredit[]> {\n\tvalidateIdentifier(collection, \"collection\");\n\tconst db = await getDb();\n\tconst repo = new BylineRepository(db);\n\n\tconst localeOpt = options?.locale !== undefined ? { locale: options.locale } : undefined;\n\tconst explicit = await repo.getContentBylines(collection, entryId, localeOpt);\n\tif (explicit.length > 0) {\n\t\treturn explicit.map((c) => ({ ...c, source: \"explicit\" as const }));\n\t}\n\n\t// `primary_byline_id` is the explicit-credit sentinel: non-null\n\t// suppresses author fallback even when the credit doesn't resolve\n\t// at this locale.\n\tconst ctx = await getEntryContext(db, collection, entryId);\n\tif (ctx.primaryBylineId) return [];\n\n\tif (ctx.authorId) {\n\t\tconst fallback = await repo.findByUserId(ctx.authorId, localeOpt);\n\t\tif (fallback) {\n\t\t\treturn [{ byline: fallback, sortOrder: 0, roleLabel: null, source: \"inferred\" }];\n\t\t}\n\t}\n\n\treturn [];\n}\n\n/**\n * Entry reference for batch byline lookups. Passing `authorId`,\n * `primaryBylineId`, and `locale` in directly avoids a per-entry\n * `SELECT` against the content table during hydration.\n *\n * `primaryBylineId` is the explicit-credit sentinel — non-null suppresses\n * author fallback. `locale` drives the strict per-locale join.\n */\nexport interface BylineEntry {\n\tid: string;\n\tauthorId: string | null;\n\tprimaryBylineId?: string | null;\n\tlocale?: string | null;\n}\n\n/**\n * Batch-fetch byline credits for multiple content entries.\n *\n * Per-entry strict-locale hydration: entries are bucketed by `entry.locale`\n * and each bucket gets a single batched call to the strict-locale repo\n * method. Items with no `locale` field (legacy / single-locale installs)\n * share an unscoped bucket.\n *\n * Internal: consumed by `hydrateEntryBylines` in `query.ts` so that every\n * entry returned from `getEmDashCollection` / `getEmDashEntry` already has\n * `data.bylines` populated. Site code should rely on that eager hydration\n * rather than calling this directly -- this function is not re-exported\n * from the `emdash` package entry point.\n *\n * @param collection - The collection slug (e.g., \"posts\")\n * @param entries - Entry id + authorId + locale (each entry resolves at its own locale)\n * @returns Map from entry ID to array of byline credits\n */\nexport async function getBylinesForEntries(\n\tcollection: string,\n\tentries: BylineEntry[],\n): Promise<Map<string, ContentBylineCredit[]>> {\n\tvalidateIdentifier(collection, \"collection\");\n\tconst result = new Map<string, ContentBylineCredit[]>();\n\n\tfor (const { id } of entries) {\n\t\tresult.set(id, []);\n\t}\n\n\tif (entries.length === 0) {\n\t\treturn result;\n\t}\n\n\tconst db = await getDb();\n\tconst repo = new BylineRepository(db);\n\n\t// Bucket entries by locale so each bucket fires a single strict-locale\n\t// `getContentBylinesMany` call. Items with no locale field share a\n\t// bucket keyed by null (no `WHERE locale = ?` applied — legacy\n\t// pre-i18n shape).\n\tconst buckets = new Map<string | null, BylineEntry[]>();\n\tfor (const entry of entries) {\n\t\tconst key = entry.locale ?? null;\n\t\tconst bucket = buckets.get(key);\n\t\tif (bucket) bucket.push(entry);\n\t\telse buckets.set(key, [entry]);\n\t}\n\n\t// Sites with no bylines get an empty map back at the same cost as the\n\t// previous \"has any bylines\" probe, without the extra round-trip.\n\t// Pre-migration databases (bylines table missing) fall through to the\n\t// `isMissingTableError` catch below and return empty.\n\t//\n\t// Each bucket's `getContentBylinesMany` call uses `skipHydration: true`\n\t// so the per-bucket fetches return bylines with `customFields = {}`.\n\t// We then hydrate the union of returned bylines in a SINGLE batched\n\t// pass via `hydrateBylineCustomFields`. This keeps mixed-locale list\n\t// hydration at one batched group-shared query (and one batched\n\t// translatable query) per request, even when locale buckets reference\n\t// disjoint translation_groups — the strict reading of the Phase 3\n\t// query-count envelope.\n\tconst explicitByEntry = new Map<string, ContentBylineCredit[]>();\n\tconst entriesNeedingAuthorCheck: BylineEntry[] = [];\n\tconst hydrationTargets: BylineSummary[] = [];\n\tfor (const [locale, bucket] of buckets) {\n\t\tconst localeOpt = locale ? { locale, skipHydration: true } : { skipHydration: true };\n\t\tconst bucketIds = bucket.map((e) => e.id);\n\t\tlet bylinesMap;\n\t\ttry {\n\t\t\tbylinesMap = await repo.getContentBylinesMany(collection, bucketIds, localeOpt);\n\t\t} catch (error) {\n\t\t\tif (isMissingTableError(error)) return result;\n\t\t\tthrow error;\n\t\t}\n\t\tfor (const [id, list] of bylinesMap) {\n\t\t\texplicitByEntry.set(id, list);\n\t\t\tfor (const credit of list) hydrationTargets.push(credit.byline);\n\t\t}\n\n\t\tfor (const entry of bucket) {\n\t\t\tconst hasResolved = bylinesMap.has(entry.id) && bylinesMap.get(entry.id)!.length > 0;\n\t\t\tif (hasResolved) continue;\n\t\t\tif (entry.authorId) entriesNeedingAuthorCheck.push(entry);\n\t\t}\n\t}\n\n\t// Only entries without an explicit credit (primaryBylineId null) are\n\t// eligible for author fallback.\n\tconst fallbackByEntry = new Map<string, BylineSummary>();\n\tif (entriesNeedingAuthorCheck.length > 0) {\n\t\tconst authorBuckets = new Map<string | null, BylineEntry[]>();\n\t\tfor (const entry of entriesNeedingAuthorCheck) {\n\t\t\tif (entry.primaryBylineId) continue;\n\t\t\tconst key = entry.locale ?? null;\n\t\t\tconst bucket = authorBuckets.get(key);\n\t\t\tif (bucket) bucket.push(entry);\n\t\t\telse authorBuckets.set(key, [entry]);\n\t\t}\n\n\t\tfor (const [locale, bucket] of authorBuckets) {\n\t\t\tconst localeOpt: { locale?: string; skipHydration: true } = locale\n\t\t\t\t? { locale, skipHydration: true }\n\t\t\t\t: { skipHydration: true };\n\t\t\tconst authorIds = bucket.map((e) => e.authorId).filter((id): id is string => id !== null);\n\t\t\tconst uniqueAuthorIds = [...new Set(authorIds)];\n\t\t\tif (uniqueAuthorIds.length === 0) continue;\n\t\t\t// `skipHydration: true` returns bylines with `customFields = {}`\n\t\t\t// so the fallback path participates in the single batched\n\t\t\t// `hydrateBylineCustomFields` call below — keeping the query\n\t\t\t// envelope at \"+1 group-shared query per hydration pass\" even\n\t\t\t// when author bylines across locale buckets reference disjoint\n\t\t\t// translation_groups.\n\t\t\tconst authorBylineMap = await repo.findByUserIds(uniqueAuthorIds, localeOpt);\n\t\t\tfor (const entry of bucket) {\n\t\t\t\tif (!entry.authorId) continue;\n\t\t\t\tconst f = authorBylineMap.get(entry.authorId);\n\t\t\t\tif (f) {\n\t\t\t\t\tfallbackByEntry.set(entry.id, f);\n\t\t\t\t\thydrationTargets.push(f);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// Single batched hydration over every byline returned from both the\n\t// per-bucket explicit-credit fetches AND the per-bucket author-\n\t// fallback fetches. One translatable query + one group-shared query\n\t// for the whole pass, regardless of bucket count or whether\n\t// translation_groups overlap across locales.\n\tif (hydrationTargets.length > 0) {\n\t\tawait repo.hydrateBylineCustomFields(hydrationTargets);\n\t}\n\n\tfor (const { id } of entries) {\n\t\tconst explicit = explicitByEntry.get(id);\n\t\tif (explicit && explicit.length > 0) {\n\t\t\tresult.set(\n\t\t\t\tid,\n\t\t\t\texplicit.map((c) => ({ ...c, source: \"explicit\" as const })),\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst fallback = fallbackByEntry.get(id);\n\t\tif (fallback) {\n\t\t\tresult.set(id, [{ byline: fallback, sortOrder: 0, roleLabel: null, source: \"inferred\" }]);\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/**\n * Get content entries credited to a byline, in any credit position.\n *\n * Unlike filtering on the content table's `primary_byline_id` column (which\n * only finds entries where the byline is the first/primary credit), this\n * matches every explicit credit recorded in `_emdash_content_bylines`, so\n * co-authored entries where the byline is a secondary credit are included.\n *\n * `byline` is matched against the byline's `translation_group` (the value\n * stored on credits since migration 040), so a single credit spans every\n * locale variant of the byline. Pass `byline.translationGroup ?? byline.id`\n * from `getByline` / `getBylineBySlug`. An array matches any of the given\n * bylines (OR).\n *\n * The result respects the active locale, status, ordering, and eager\n * hydration of `getEmDashCollection`.\n *\n * @example\n * ```ts\n * import { getBylineBySlug, getEntriesByByline } from \"emdash\";\n *\n * const byline = await getBylineBySlug(\"jane-doe\");\n * if (byline) {\n *   const posts = await getEntriesByByline(\"posts\", byline.translationGroup ?? byline.id, {\n *     orderBy: { published_at: \"desc\" },\n *   });\n * }\n * ```\n *\n * @param collection - The collection slug (e.g. \"posts\")\n * @param byline - A byline translation group, or an array of them (OR)\n * @param options - Optional locale, ordering, status, and limit\n */\nexport async function getEntriesByByline(\n\tcollection: string,\n\tbyline: string | string[],\n\toptions: {\n\t\tlocale?: string;\n\t\torderBy?: Record<string, \"asc\" | \"desc\">;\n\t\tstatus?: \"draft\" | \"published\" | \"archived\";\n\t\tlimit?: number;\n\t} = {},\n): Promise<Array<{ id: string; data: Record<string, unknown> }>> {\n\tconst { getEmDashCollection } = await import(\"../query.js\");\n\n\tconst queryOptions: Record<string, unknown> = {\n\t\twhere: { byline },\n\t};\n\tif (options.locale !== undefined) queryOptions.locale = options.locale;\n\tif (options.orderBy !== undefined) queryOptions.orderBy = options.orderBy;\n\tif (options.status !== undefined) queryOptions.status = options.status;\n\tif (options.limit !== undefined) queryOptions.limit = options.limit;\n\n\tconst { entries } = await getEmDashCollection(collection, queryOptions);\n\treturn entries;\n}\n\n/** Reads `author_id` + `primary_byline_id` for one entry in a single query. */\nasync function getEntryContext(\n\tdb: Awaited<ReturnType<typeof getDb>>,\n\tcollection: string,\n\tentryId: string,\n): Promise<{ authorId: string | null; primaryBylineId: string | null }> {\n\tvalidateIdentifier(collection, \"collection\");\n\tconst tableName = `ec_${collection}`;\n\n\tconst result = await sql<{\n\t\tauthor_id: string | null;\n\t\tprimary_byline_id: string | null;\n\t}>`\n\t\tSELECT author_id, primary_byline_id FROM ${sql.ref(tableName)}\n\t\tWHERE id = ${entryId}\n\t\tLIMIT 1\n\t`.execute(db);\n\n\tconst row = result.rows[0];\n\treturn {\n\t\tauthorId: row?.author_id ?? null,\n\t\tprimaryBylineId: row?.primary_byline_id ?? null,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAgB,wBAA8B;;;;;;;;;;;;;;AAiB9C,eAAsB,UAAU,IAA2C;AAG1E,QADa,IAAI,iBADN,MAAM,OAAO,CACa,CACzB,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BzB,eAAsB,gBACrB,MACA,SACgC;CAChC,MAAM,QAAQ,mBAAmB,SAAS,OAAO;AAEjD,QAAO,cADU,kBAAkB,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,GAAG,OACjD,YAAY;EAE1C,MAAM,OAAO,IAAI,iBADN,MAAM,OAAO,CACa;AAErC,MAAI,MAAM,WAAW,EAGpB,QAAO,KAAK,WAAW,KAAK;AAG7B,OAAK,MAAM,UAAU,OAAO;GAC3B,MAAM,MAAM,MAAM,KAAK,WAAW,MAAM,EAAE,QAAQ,CAAC;AACnD,OAAI,IAAK,QAAO;;AAEjB,SAAO;GACN;;;;;;;;;;;;;;;;;;;;AAkFH,eAAsB,qBACrB,YACA,SAC8C;AAC9C,oBAAmB,YAAY,aAAa;CAC5C,MAAM,yBAAS,IAAI,KAAoC;AAEvD,MAAK,MAAM,EAAE,QAAQ,QACpB,QAAO,IAAI,IAAI,EAAE,CAAC;AAGnB,KAAI,QAAQ,WAAW,EACtB,QAAO;CAIR,MAAM,OAAO,IAAI,iBADN,MAAM,OAAO,CACa;CAMrC,MAAM,0BAAU,IAAI,KAAmC;AACvD,MAAK,MAAM,SAAS,SAAS;EAC5B,MAAM,MAAM,MAAM,UAAU;EAC5B,MAAM,SAAS,QAAQ,IAAI,IAAI;AAC/B,MAAI,OAAQ,QAAO,KAAK,MAAM;MACzB,SAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;;CAgB/B,MAAM,kCAAkB,IAAI,KAAoC;CAChE,MAAM,4BAA2C,EAAE;CACnD,MAAM,mBAAoC,EAAE;AAC5C,MAAK,MAAM,CAAC,QAAQ,WAAW,SAAS;EACvC,MAAM,YAAY,SAAS;GAAE;GAAQ,eAAe;GAAM,GAAG,EAAE,eAAe,MAAM;EACpF,MAAM,YAAY,OAAO,KAAK,MAAM,EAAE,GAAG;EACzC,IAAI;AACJ,MAAI;AACH,gBAAa,MAAM,KAAK,sBAAsB,YAAY,WAAW,UAAU;WACvE,OAAO;AACf,OAAI,oBAAoB,MAAM,CAAE,QAAO;AACvC,SAAM;;AAEP,OAAK,MAAM,CAAC,IAAI,SAAS,YAAY;AACpC,mBAAgB,IAAI,IAAI,KAAK;AAC7B,QAAK,MAAM,UAAU,KAAM,kBAAiB,KAAK,OAAO,OAAO;;AAGhE,OAAK,MAAM,SAAS,QAAQ;AAE3B,OADoB,WAAW,IAAI,MAAM,GAAG,IAAI,WAAW,IAAI,MAAM,GAAG,CAAE,SAAS,EAClE;AACjB,OAAI,MAAM,SAAU,2BAA0B,KAAK,MAAM;;;CAM3D,MAAM,kCAAkB,IAAI,KAA4B;AACxD,KAAI,0BAA0B,SAAS,GAAG;EACzC,MAAM,gCAAgB,IAAI,KAAmC;AAC7D,OAAK,MAAM,SAAS,2BAA2B;AAC9C,OAAI,MAAM,gBAAiB;GAC3B,MAAM,MAAM,MAAM,UAAU;GAC5B,MAAM,SAAS,cAAc,IAAI,IAAI;AACrC,OAAI,OAAQ,QAAO,KAAK,MAAM;OACzB,eAAc,IAAI,KAAK,CAAC,MAAM,CAAC;;AAGrC,OAAK,MAAM,CAAC,QAAQ,WAAW,eAAe;GAC7C,MAAM,YAAsD,SACzD;IAAE;IAAQ,eAAe;IAAM,GAC/B,EAAE,eAAe,MAAM;GAC1B,MAAM,YAAY,OAAO,KAAK,MAAM,EAAE,SAAS,CAAC,QAAQ,OAAqB,OAAO,KAAK;GACzF,MAAM,kBAAkB,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC;AAC/C,OAAI,gBAAgB,WAAW,EAAG;GAOlC,MAAM,kBAAkB,MAAM,KAAK,cAAc,iBAAiB,UAAU;AAC5E,QAAK,MAAM,SAAS,QAAQ;AAC3B,QAAI,CAAC,MAAM,SAAU;IACrB,MAAM,IAAI,gBAAgB,IAAI,MAAM,SAAS;AAC7C,QAAI,GAAG;AACN,qBAAgB,IAAI,MAAM,IAAI,EAAE;AAChC,sBAAiB,KAAK,EAAE;;;;;AAW5B,KAAI,iBAAiB,SAAS,EAC7B,OAAM,KAAK,0BAA0B,iBAAiB;AAGvD,MAAK,MAAM,EAAE,QAAQ,SAAS;EAC7B,MAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,MAAI,YAAY,SAAS,SAAS,GAAG;AACpC,UAAO,IACN,IACA,SAAS,KAAK,OAAO;IAAE,GAAG;IAAG,QAAQ;IAAqB,EAAE,CAC5D;AACD;;EAGD,MAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,MAAI,SACH,QAAO,IAAI,IAAI,CAAC;GAAE,QAAQ;GAAU,WAAW;GAAG,WAAW;GAAM,QAAQ;GAAY,CAAC,CAAC;;AAI3F,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCR,eAAsB,mBACrB,YACA,QACA,UAKI,EAAE,EAC0D;CAChE,MAAM,EAAE,wBAAwB,MAAM,OAAO;CAE7C,MAAM,eAAwC,EAC7C,OAAO,EAAE,QAAQ,EACjB;AACD,KAAI,QAAQ,WAAW,OAAW,cAAa,SAAS,QAAQ;AAChE,KAAI,QAAQ,YAAY,OAAW,cAAa,UAAU,QAAQ;AAClE,KAAI,QAAQ,WAAW,OAAW,cAAa,SAAS,QAAQ;AAChE,KAAI,QAAQ,UAAU,OAAW,cAAa,QAAQ,QAAQ;CAE9D,MAAM,EAAE,YAAY,MAAM,oBAAoB,YAAY,aAAa;AACvE,QAAO"}
+{"version":3,"file":"bylines-s8c2DXbH.mjs","names":[],"sources":["../src/bylines/index.ts"],"sourcesContent":["/**\n * Runtime API for bylines\n *\n * Provides functions to query byline profiles and byline credits\n * associated with content entries. Follows the same pattern as\n * the taxonomies runtime API.\n *\n * i18n model (migration 040): byline rows are per-locale and share a\n * `translation_group`. Credits on `_emdash_content_bylines.byline_id` store\n * the translation_group, so a single credit spans every locale of a byline.\n *\n * Hydration is strict per locale: a credit at locale X renders iff a byline\n * row exists at locale X within the credited translation_group. There is no\n * read-time fallback. Mirrors `getEntryTerms` and the convention in PR #916.\n * Locale is passed in by callers — `query.ts` resolves it from the entry's\n * own `data.locale` for the runtime path.\n */\n\nimport { sql } from \"kysely\";\n\nimport { BylineRepository } from \"../database/repositories/byline.js\";\nimport type { BylineSummary, ContentBylineCredit } from \"../database/repositories/types.js\";\nimport { validateIdentifier } from \"../database/validate.js\";\nimport { resolveLocaleChain } from \"../i18n/resolve.js\";\nimport { getDb } from \"../loader.js\";\nimport { requestCached } from \"../request-cache.js\";\nimport { isMissingTableError } from \"../utils/db-errors.js\";\n\n/**\n * No-op — kept for API compatibility.\n *\n * Used to invalidate a worker-lifetime \"has any byline?\" probe. That\n * probe added a query on every cold isolate to save one query on sites\n * with zero bylines (i.e. the wrong tradeoff), so we dropped it. The\n * batch byline join below returns an empty map for empty sites at the\n * same cost as the probe, without the pre-check.\n */\nexport function invalidateBylineCache(): void {\n\t// Intentionally empty.\n}\n\n/**\n * Get a byline by ID.\n *\n * @example\n * ```ts\n * import { getByline } from \"emdash\";\n *\n * const byline = await getByline(\"01HXYZ...\");\n * if (byline) {\n *   console.log(byline.displayName);\n * }\n * ```\n */\nexport async function getByline(id: string): Promise<BylineSummary | null> {\n\tconst db = await getDb();\n\tconst repo = new BylineRepository(db);\n\treturn repo.findById(id);\n}\n\n/**\n * Get a byline by slug.\n *\n * Standalone identity lookup (e.g. rendering an author profile page). Walks\n * the configured locale fallback chain — same pattern as `getMenu` and\n * `getTerm`, see PR #916. Returns the first match found, walking\n * `[requestedLocale, ...fallbacks, defaultLocale]` in order.\n *\n * Note: this is intentionally different from credit hydration on a content\n * entry (`getEntryBylines`), which is strict per locale with no fallback.\n * The distinction: identity lookups answer \"give me this byline\", and\n * falling back to another locale's display name is acceptable. Credit\n * hydration answers \"what should render on this entry\", where falling back\n * silently surfaces a stale-locale name and contradicts editorial intent.\n *\n * @example\n * ```ts\n * import { getBylineBySlug } from \"emdash\";\n *\n * const byline = await getBylineBySlug(\"jane-doe\", { locale: \"de-de\" });\n * if (byline) {\n *   console.log(byline.displayName);\n * }\n * ```\n */\nexport async function getBylineBySlug(\n\tslug: string,\n\toptions?: { locale?: string },\n): Promise<BylineSummary | null> {\n\tconst chain = resolveLocaleChain(options?.locale);\n\tconst cacheKey = `byline-by-slug:${slug}:${chain.length > 0 ? chain.join(\",\") : \"*\"}`;\n\treturn requestCached(cacheKey, async () => {\n\t\tconst db = await getDb();\n\t\tconst repo = new BylineRepository(db);\n\n\t\tif (chain.length === 0) {\n\t\t\t// No i18n or no resolved locale — fall back to the repo's\n\t\t\t// \"lowest-locale-code\" deterministic match.\n\t\t\treturn repo.findBySlug(slug);\n\t\t}\n\n\t\tfor (const locale of chain) {\n\t\t\tconst row = await repo.findBySlug(slug, { locale });\n\t\t\tif (row) return row;\n\t\t}\n\t\treturn null;\n\t});\n}\n\n/**\n * Get byline credits for a single content entry.\n *\n * Strict per locale (post-migration 040): a credit renders iff a byline row\n * exists at the requested locale within the credited translation_group.\n * Callers wanting fallback behaviour apply it themselves. When `locale` is\n * omitted, returns every locale variant of every credit on the entry —\n * useful for admin tooling, not for end-user rendering.\n *\n * Internal: not re-exported from the `emdash` package entry point. Every\n * entry returned by `getEmDashCollection` / `getEmDashEntry` already has\n * `data.bylines` populated by `hydrateEntryBylines` (which uses the batch\n * helper `getBylinesForEntries` directly). Site code should read those\n * fields rather than calling this function.\n */\nexport async function getEntryBylines(\n\tcollection: string,\n\tentryId: string,\n\toptions?: { locale?: string },\n): Promise<ContentBylineCredit[]> {\n\tvalidateIdentifier(collection, \"collection\");\n\tconst db = await getDb();\n\tconst repo = new BylineRepository(db);\n\n\tconst localeOpt = options?.locale !== undefined ? { locale: options.locale } : undefined;\n\tconst explicit = await repo.getContentBylines(collection, entryId, localeOpt);\n\tif (explicit.length > 0) {\n\t\treturn explicit.map((c) => ({ ...c, source: \"explicit\" as const }));\n\t}\n\n\t// `primary_byline_id` is the explicit-credit sentinel: non-null\n\t// suppresses author fallback even when the credit doesn't resolve\n\t// at this locale.\n\tconst ctx = await getEntryContext(db, collection, entryId);\n\tif (ctx.primaryBylineId) return [];\n\n\tif (ctx.authorId) {\n\t\tconst fallback = await repo.findByUserId(ctx.authorId, localeOpt);\n\t\tif (fallback) {\n\t\t\treturn [{ byline: fallback, sortOrder: 0, roleLabel: null, source: \"inferred\" }];\n\t\t}\n\t}\n\n\treturn [];\n}\n\n/**\n * Entry reference for batch byline lookups. Passing `authorId`,\n * `primaryBylineId`, and `locale` in directly avoids a per-entry\n * `SELECT` against the content table during hydration.\n *\n * `primaryBylineId` is the explicit-credit sentinel — non-null suppresses\n * author fallback. `locale` drives the strict per-locale join.\n */\nexport interface BylineEntry {\n\tid: string;\n\tauthorId: string | null;\n\tprimaryBylineId?: string | null;\n\tlocale?: string | null;\n}\n\n/**\n * Batch-fetch byline credits for multiple content entries.\n *\n * Per-entry strict-locale hydration: entries are bucketed by `entry.locale`\n * and each bucket gets a single batched call to the strict-locale repo\n * method. Items with no `locale` field (legacy / single-locale installs)\n * share an unscoped bucket.\n *\n * Internal: consumed by `hydrateEntryBylines` in `query.ts` so that every\n * entry returned from `getEmDashCollection` / `getEmDashEntry` already has\n * `data.bylines` populated. Site code should rely on that eager hydration\n * rather than calling this directly -- this function is not re-exported\n * from the `emdash` package entry point.\n *\n * @param collection - The collection slug (e.g., \"posts\")\n * @param entries - Entry id + authorId + locale (each entry resolves at its own locale)\n * @returns Map from entry ID to array of byline credits\n */\nexport async function getBylinesForEntries(\n\tcollection: string,\n\tentries: BylineEntry[],\n): Promise<Map<string, ContentBylineCredit[]>> {\n\tvalidateIdentifier(collection, \"collection\");\n\tconst result = new Map<string, ContentBylineCredit[]>();\n\n\tfor (const { id } of entries) {\n\t\tresult.set(id, []);\n\t}\n\n\tif (entries.length === 0) {\n\t\treturn result;\n\t}\n\n\tconst db = await getDb();\n\tconst repo = new BylineRepository(db);\n\n\t// Bucket entries by locale so each bucket fires a single strict-locale\n\t// `getContentBylinesMany` call. Items with no locale field share a\n\t// bucket keyed by null (no `WHERE locale = ?` applied — legacy\n\t// pre-i18n shape).\n\tconst buckets = new Map<string | null, BylineEntry[]>();\n\tfor (const entry of entries) {\n\t\tconst key = entry.locale ?? null;\n\t\tconst bucket = buckets.get(key);\n\t\tif (bucket) bucket.push(entry);\n\t\telse buckets.set(key, [entry]);\n\t}\n\n\t// Sites with no bylines get an empty map back at the same cost as the\n\t// previous \"has any bylines\" probe, without the extra round-trip.\n\t// Pre-migration databases (bylines table missing) fall through to the\n\t// `isMissingTableError` catch below and return empty.\n\t//\n\t// Each bucket's `getContentBylinesMany` call uses `skipHydration: true`\n\t// so the per-bucket fetches return bylines with `customFields = {}`.\n\t// We then hydrate the union of returned bylines in a SINGLE batched\n\t// pass via `hydrateBylineCustomFields`. This keeps mixed-locale list\n\t// hydration at one batched group-shared query (and one batched\n\t// translatable query) per request, even when locale buckets reference\n\t// disjoint translation_groups — the strict reading of the Phase 3\n\t// query-count envelope.\n\tconst explicitByEntry = new Map<string, ContentBylineCredit[]>();\n\tconst entriesNeedingAuthorCheck: BylineEntry[] = [];\n\tconst hydrationTargets: BylineSummary[] = [];\n\tfor (const [locale, bucket] of buckets) {\n\t\tconst localeOpt = locale ? { locale, skipHydration: true } : { skipHydration: true };\n\t\tconst bucketIds = bucket.map((e) => e.id);\n\t\tlet bylinesMap;\n\t\ttry {\n\t\t\tbylinesMap = await repo.getContentBylinesMany(collection, bucketIds, localeOpt);\n\t\t} catch (error) {\n\t\t\tif (isMissingTableError(error)) return result;\n\t\t\tthrow error;\n\t\t}\n\t\tfor (const [id, list] of bylinesMap) {\n\t\t\texplicitByEntry.set(id, list);\n\t\t\tfor (const credit of list) hydrationTargets.push(credit.byline);\n\t\t}\n\n\t\tfor (const entry of bucket) {\n\t\t\tconst hasResolved = bylinesMap.has(entry.id) && bylinesMap.get(entry.id)!.length > 0;\n\t\t\tif (hasResolved) continue;\n\t\t\tif (entry.authorId) entriesNeedingAuthorCheck.push(entry);\n\t\t}\n\t}\n\n\t// Only entries without an explicit credit (primaryBylineId null) are\n\t// eligible for author fallback.\n\tconst fallbackByEntry = new Map<string, BylineSummary>();\n\tif (entriesNeedingAuthorCheck.length > 0) {\n\t\tconst authorBuckets = new Map<string | null, BylineEntry[]>();\n\t\tfor (const entry of entriesNeedingAuthorCheck) {\n\t\t\tif (entry.primaryBylineId) continue;\n\t\t\tconst key = entry.locale ?? null;\n\t\t\tconst bucket = authorBuckets.get(key);\n\t\t\tif (bucket) bucket.push(entry);\n\t\t\telse authorBuckets.set(key, [entry]);\n\t\t}\n\n\t\tfor (const [locale, bucket] of authorBuckets) {\n\t\t\tconst localeOpt: { locale?: string; skipHydration: true } = locale\n\t\t\t\t? { locale, skipHydration: true }\n\t\t\t\t: { skipHydration: true };\n\t\t\tconst authorIds = bucket.map((e) => e.authorId).filter((id): id is string => id !== null);\n\t\t\tconst uniqueAuthorIds = [...new Set(authorIds)];\n\t\t\tif (uniqueAuthorIds.length === 0) continue;\n\t\t\t// `skipHydration: true` returns bylines with `customFields = {}`\n\t\t\t// so the fallback path participates in the single batched\n\t\t\t// `hydrateBylineCustomFields` call below — keeping the query\n\t\t\t// envelope at \"+1 group-shared query per hydration pass\" even\n\t\t\t// when author bylines across locale buckets reference disjoint\n\t\t\t// translation_groups.\n\t\t\tconst authorBylineMap = await repo.findByUserIds(uniqueAuthorIds, localeOpt);\n\t\t\tfor (const entry of bucket) {\n\t\t\t\tif (!entry.authorId) continue;\n\t\t\t\tconst f = authorBylineMap.get(entry.authorId);\n\t\t\t\tif (f) {\n\t\t\t\t\tfallbackByEntry.set(entry.id, f);\n\t\t\t\t\thydrationTargets.push(f);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// Single batched hydration over every byline returned from both the\n\t// per-bucket explicit-credit fetches AND the per-bucket author-\n\t// fallback fetches. One translatable query + one group-shared query\n\t// for the whole pass, regardless of bucket count or whether\n\t// translation_groups overlap across locales.\n\tif (hydrationTargets.length > 0) {\n\t\tawait repo.hydrateBylineCustomFields(hydrationTargets);\n\t}\n\n\tfor (const { id } of entries) {\n\t\tconst explicit = explicitByEntry.get(id);\n\t\tif (explicit && explicit.length > 0) {\n\t\t\tresult.set(\n\t\t\t\tid,\n\t\t\t\texplicit.map((c) => ({ ...c, source: \"explicit\" as const })),\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst fallback = fallbackByEntry.get(id);\n\t\tif (fallback) {\n\t\t\tresult.set(id, [{ byline: fallback, sortOrder: 0, roleLabel: null, source: \"inferred\" }]);\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/**\n * Get content entries credited to a byline, in any credit position.\n *\n * Unlike filtering on the content table's `primary_byline_id` column (which\n * only finds entries where the byline is the first/primary credit), this\n * matches every explicit credit recorded in `_emdash_content_bylines`, so\n * co-authored entries where the byline is a secondary credit are included.\n *\n * `byline` is matched against the byline's `translation_group` (the value\n * stored on credits since migration 040), so a single credit spans every\n * locale variant of the byline. Pass `byline.translationGroup ?? byline.id`\n * from `getByline` / `getBylineBySlug`. An array matches any of the given\n * bylines (OR).\n *\n * The result respects the active locale, status, ordering, and eager\n * hydration of `getEmDashCollection`.\n *\n * @example\n * ```ts\n * import { getBylineBySlug, getEntriesByByline } from \"emdash\";\n *\n * const byline = await getBylineBySlug(\"jane-doe\");\n * if (byline) {\n *   const posts = await getEntriesByByline(\"posts\", byline.translationGroup ?? byline.id, {\n *     orderBy: { published_at: \"desc\" },\n *   });\n * }\n * ```\n *\n * @param collection - The collection slug (e.g. \"posts\")\n * @param byline - A byline translation group, or an array of them (OR)\n * @param options - Optional locale, ordering, status, and limit\n */\nexport async function getEntriesByByline(\n\tcollection: string,\n\tbyline: string | string[],\n\toptions: {\n\t\tlocale?: string;\n\t\torderBy?: Record<string, \"asc\" | \"desc\">;\n\t\tstatus?: \"draft\" | \"published\" | \"archived\";\n\t\tlimit?: number;\n\t} = {},\n): Promise<Array<{ id: string; data: Record<string, unknown> }>> {\n\tconst { getEmDashCollection } = await import(\"../query.js\");\n\n\tconst queryOptions: Record<string, unknown> = {\n\t\twhere: { byline },\n\t};\n\tif (options.locale !== undefined) queryOptions.locale = options.locale;\n\tif (options.orderBy !== undefined) queryOptions.orderBy = options.orderBy;\n\tif (options.status !== undefined) queryOptions.status = options.status;\n\tif (options.limit !== undefined) queryOptions.limit = options.limit;\n\n\tconst { entries } = await getEmDashCollection(collection, queryOptions);\n\treturn entries;\n}\n\n/** Reads `author_id` + `primary_byline_id` for one entry in a single query. */\nasync function getEntryContext(\n\tdb: Awaited<ReturnType<typeof getDb>>,\n\tcollection: string,\n\tentryId: string,\n): Promise<{ authorId: string | null; primaryBylineId: string | null }> {\n\tvalidateIdentifier(collection, \"collection\");\n\tconst tableName = `ec_${collection}`;\n\n\tconst result = await sql<{\n\t\tauthor_id: string | null;\n\t\tprimary_byline_id: string | null;\n\t}>`\n\t\tSELECT author_id, primary_byline_id FROM ${sql.ref(tableName)}\n\t\tWHERE id = ${entryId}\n\t\tLIMIT 1\n\t`.execute(db);\n\n\tconst row = result.rows[0];\n\treturn {\n\t\tauthorId: row?.author_id ?? null,\n\t\tprimaryBylineId: row?.primary_byline_id ?? null,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAgB,wBAA8B;;;;;;;;;;;;;;AAiB9C,eAAsB,UAAU,IAA2C;AAG1E,QADa,IAAI,iBADN,MAAM,OAAO,CACa,CACzB,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BzB,eAAsB,gBACrB,MACA,SACgC;CAChC,MAAM,QAAQ,mBAAmB,SAAS,OAAO;AAEjD,QAAO,cADU,kBAAkB,KAAK,GAAG,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,GAAG,OACjD,YAAY;EAE1C,MAAM,OAAO,IAAI,iBADN,MAAM,OAAO,CACa;AAErC,MAAI,MAAM,WAAW,EAGpB,QAAO,KAAK,WAAW,KAAK;AAG7B,OAAK,MAAM,UAAU,OAAO;GAC3B,MAAM,MAAM,MAAM,KAAK,WAAW,MAAM,EAAE,QAAQ,CAAC;AACnD,OAAI,IAAK,QAAO;;AAEjB,SAAO;GACN;;;;;;;;;;;;;;;;;;;;AAkFH,eAAsB,qBACrB,YACA,SAC8C;AAC9C,oBAAmB,YAAY,aAAa;CAC5C,MAAM,yBAAS,IAAI,KAAoC;AAEvD,MAAK,MAAM,EAAE,QAAQ,QACpB,QAAO,IAAI,IAAI,EAAE,CAAC;AAGnB,KAAI,QAAQ,WAAW,EACtB,QAAO;CAIR,MAAM,OAAO,IAAI,iBADN,MAAM,OAAO,CACa;CAMrC,MAAM,0BAAU,IAAI,KAAmC;AACvD,MAAK,MAAM,SAAS,SAAS;EAC5B,MAAM,MAAM,MAAM,UAAU;EAC5B,MAAM,SAAS,QAAQ,IAAI,IAAI;AAC/B,MAAI,OAAQ,QAAO,KAAK,MAAM;MACzB,SAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;;CAgB/B,MAAM,kCAAkB,IAAI,KAAoC;CAChE,MAAM,4BAA2C,EAAE;CACnD,MAAM,mBAAoC,EAAE;AAC5C,MAAK,MAAM,CAAC,QAAQ,WAAW,SAAS;EACvC,MAAM,YAAY,SAAS;GAAE;GAAQ,eAAe;GAAM,GAAG,EAAE,eAAe,MAAM;EACpF,MAAM,YAAY,OAAO,KAAK,MAAM,EAAE,GAAG;EACzC,IAAI;AACJ,MAAI;AACH,gBAAa,MAAM,KAAK,sBAAsB,YAAY,WAAW,UAAU;WACvE,OAAO;AACf,OAAI,oBAAoB,MAAM,CAAE,QAAO;AACvC,SAAM;;AAEP,OAAK,MAAM,CAAC,IAAI,SAAS,YAAY;AACpC,mBAAgB,IAAI,IAAI,KAAK;AAC7B,QAAK,MAAM,UAAU,KAAM,kBAAiB,KAAK,OAAO,OAAO;;AAGhE,OAAK,MAAM,SAAS,QAAQ;AAE3B,OADoB,WAAW,IAAI,MAAM,GAAG,IAAI,WAAW,IAAI,MAAM,GAAG,CAAE,SAAS,EAClE;AACjB,OAAI,MAAM,SAAU,2BAA0B,KAAK,MAAM;;;CAM3D,MAAM,kCAAkB,IAAI,KAA4B;AACxD,KAAI,0BAA0B,SAAS,GAAG;EACzC,MAAM,gCAAgB,IAAI,KAAmC;AAC7D,OAAK,MAAM,SAAS,2BAA2B;AAC9C,OAAI,MAAM,gBAAiB;GAC3B,MAAM,MAAM,MAAM,UAAU;GAC5B,MAAM,SAAS,cAAc,IAAI,IAAI;AACrC,OAAI,OAAQ,QAAO,KAAK,MAAM;OACzB,eAAc,IAAI,KAAK,CAAC,MAAM,CAAC;;AAGrC,OAAK,MAAM,CAAC,QAAQ,WAAW,eAAe;GAC7C,MAAM,YAAsD,SACzD;IAAE;IAAQ,eAAe;IAAM,GAC/B,EAAE,eAAe,MAAM;GAC1B,MAAM,YAAY,OAAO,KAAK,MAAM,EAAE,SAAS,CAAC,QAAQ,OAAqB,OAAO,KAAK;GACzF,MAAM,kBAAkB,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC;AAC/C,OAAI,gBAAgB,WAAW,EAAG;GAOlC,MAAM,kBAAkB,MAAM,KAAK,cAAc,iBAAiB,UAAU;AAC5E,QAAK,MAAM,SAAS,QAAQ;AAC3B,QAAI,CAAC,MAAM,SAAU;IACrB,MAAM,IAAI,gBAAgB,IAAI,MAAM,SAAS;AAC7C,QAAI,GAAG;AACN,qBAAgB,IAAI,MAAM,IAAI,EAAE;AAChC,sBAAiB,KAAK,EAAE;;;;;AAW5B,KAAI,iBAAiB,SAAS,EAC7B,OAAM,KAAK,0BAA0B,iBAAiB;AAGvD,MAAK,MAAM,EAAE,QAAQ,SAAS;EAC7B,MAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,MAAI,YAAY,SAAS,SAAS,GAAG;AACpC,UAAO,IACN,IACA,SAAS,KAAK,OAAO;IAAE,GAAG;IAAG,QAAQ;IAAqB,EAAE,CAC5D;AACD;;EAGD,MAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,MAAI,SACH,QAAO,IAAI,IAAI,CAAC;GAAE,QAAQ;GAAU,WAAW;GAAG,WAAW;GAAM,QAAQ;GAAY,CAAC,CAAC;;AAI3F,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCR,eAAsB,mBACrB,YACA,QACA,UAKI,EAAE,EAC0D;CAChE,MAAM,EAAE,wBAAwB,MAAM,OAAO;CAE7C,MAAM,eAAwC,EAC7C,OAAO,EAAE,QAAQ,EACjB;AACD,KAAI,QAAQ,WAAW,OAAW,cAAa,SAAS,QAAQ;AAChE,KAAI,QAAQ,YAAY,OAAW,cAAa,UAAU,QAAQ;AAClE,KAAI,QAAQ,WAAW,OAAW,cAAa,SAAS,QAAQ;AAChE,KAAI,QAAQ,UAAU,OAAW,cAAa,QAAQ,QAAQ;CAE9D,MAAM,EAAE,YAAY,MAAM,oBAAoB,YAAY,aAAa;AACvE,QAAO"}

package/dist/{challenge-store-DGwuCc4R.mjs → challenge-store-DXX3rfdI.mjs}

@@ -46,4 +46,4 @@ async function cleanupExpiredChallenges(db) {
 
 //#endregion
 export { createChallengeStore as n, cleanupExpiredChallenges as t };
-//# sourceMappingURL=challenge-store-DGwuCc4R.mjs.map
+//# sourceMappingURL=challenge-store-DXX3rfdI.mjs.map

package/dist/{challenge-store-DGwuCc4R.mjs.map → challenge-store-DXX3rfdI.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"challenge-store-DGwuCc4R.mjs","names":[],"sources":["../src/auth/challenge-store.ts"],"sourcesContent":["/**\n * Challenge store for WebAuthn\n *\n * Stores WebAuthn challenges in a dedicated table with automatic expiration.\n */\n\nimport type { ChallengeStore, ChallengeData } from \"@emdash-cms/auth/passkey\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nexport function createChallengeStore(db: Kysely<Database>): ChallengeStore {\n\treturn {\n\t\tasync set(challenge: string, data: ChallengeData): Promise<void> {\n\t\t\tconst expiresAt = new Date(data.expiresAt).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge,\n\t\t\t\t\ttype: data.type,\n\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\tdata: null, // Could store additional context if needed\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: data.type,\n\t\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(challenge: string): Promise<ChallengeData | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", challenge)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(challenge);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\ttype: row.type === \"registration\" ? \"registration\" : \"authentication\",\n\t\t\t\tuserId: row.user_id ?? undefined,\n\t\t\t\texpiresAt,\n\t\t\t};\n\t\t},\n\n\t\tasync delete(challenge: string): Promise<void> {\n\t\t\tawait db.deleteFrom(\"auth_challenges\").where(\"challenge\", \"=\", challenge).execute();\n\t\t},\n\t};\n}\n\n/**\n * Clean up expired challenges.\n * Should be called periodically (e.g., on startup, or via cron).\n */\nexport async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {\n\tconst now = new Date().toISOString();\n\n\tconst result = await db\n\t\t.deleteFrom(\"auth_challenges\")\n\t\t.where(\"expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows ?? 0);\n}\n"],"mappings":";AAWA,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,IAAI,WAAmB,MAAoC;GAChE,MAAM,YAAY,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa;AAExD,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP;IACA,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM;IACN,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,WAAkD;GAC3D,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,UAAU,CAClC,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;GAEjB,MAAM,YAAY,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS;AAGpD,OAAI,YAAY,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;;AAGR,UAAO;IACN,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;IACrD,QAAQ,IAAI,WAAW;IACvB;IACA;;EAGF,MAAM,OAAO,WAAkC;AAC9C,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,UAAU,CAAC,SAAS;;EAEpF;;;;;;AAOF,eAAsB,yBAAyB,IAAuC;CACrF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,SAAS,MAAM,GACnB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,IAAI,CAC7B,kBAAkB;AAEpB,QAAO,OAAO,OAAO,kBAAkB,EAAE"}
+{"version":3,"file":"challenge-store-DXX3rfdI.mjs","names":[],"sources":["../src/auth/challenge-store.ts"],"sourcesContent":["/**\n * Challenge store for WebAuthn\n *\n * Stores WebAuthn challenges in a dedicated table with automatic expiration.\n */\n\nimport type { ChallengeStore, ChallengeData } from \"@emdash-cms/auth/passkey\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nexport function createChallengeStore(db: Kysely<Database>): ChallengeStore {\n\treturn {\n\t\tasync set(challenge: string, data: ChallengeData): Promise<void> {\n\t\t\tconst expiresAt = new Date(data.expiresAt).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge,\n\t\t\t\t\ttype: data.type,\n\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\tdata: null, // Could store additional context if needed\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: data.type,\n\t\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(challenge: string): Promise<ChallengeData | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", challenge)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(challenge);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\ttype: row.type === \"registration\" ? \"registration\" : \"authentication\",\n\t\t\t\tuserId: row.user_id ?? undefined,\n\t\t\t\texpiresAt,\n\t\t\t};\n\t\t},\n\n\t\tasync delete(challenge: string): Promise<void> {\n\t\t\tawait db.deleteFrom(\"auth_challenges\").where(\"challenge\", \"=\", challenge).execute();\n\t\t},\n\t};\n}\n\n/**\n * Clean up expired challenges.\n * Should be called periodically (e.g., on startup, or via cron).\n */\nexport async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {\n\tconst now = new Date().toISOString();\n\n\tconst result = await db\n\t\t.deleteFrom(\"auth_challenges\")\n\t\t.where(\"expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows ?? 0);\n}\n"],"mappings":";AAWA,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,IAAI,WAAmB,MAAoC;GAChE,MAAM,YAAY,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa;AAExD,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP;IACA,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM;IACN,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,WAAkD;GAC3D,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,UAAU,CAClC,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;GAEjB,MAAM,YAAY,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS;AAGpD,OAAI,YAAY,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;;AAGR,UAAO;IACN,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;IACrD,QAAQ,IAAI,WAAW;IACvB;IACA;;EAGF,MAAM,OAAO,WAAkC;AAC9C,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,UAAU,CAAC,SAAS;;EAEpF;;;;;;AAOF,eAAsB,yBAAyB,IAAuC;CACrF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,SAAS,MAAM,GACnB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,IAAI,CAC7B,kBAAkB;AAEpB,QAAO,OAAO,OAAO,kBAAkB,EAAE"}

package/dist/cli/index.mjs

@@ -19,17 +19,17 @@ import { n as isMissingTableError } from "../db-errors-CtzxKBxe.mjs";
 import "../fts-manager-1RgHmopc.mjs";
 import { n as SchemaRegistry } from "../registry-brYh-rAT.mjs";
 import { kyselyLogOption } from "../database/instrumentation.mjs";
-import "../loader-CpZKpFz0.mjs";
-import "../settings-B1p-gPUK.mjs";
-import { i as pluginManifestSchema } from "../manifest-schema-Cj-YrzrF.mjs";
-import { n as isDeprecatedCapability, t as CAPABILITY_RENAMES } from "../types-Cj2S6FuC.mjs";
+import "../loader-ZN1ll-d-.mjs";
+import "../settings-DfxiWY_s.mjs";
+import { i as pluginManifestSchema } from "../manifest-schema-BtwbL_vj.mjs";
+import { i as isDeprecatedCapability, n as capabilitiesToDeclaredAccess, t as CAPABILITY_RENAMES } from "../types-CZI4E3qG.mjs";
 import "../ssrf-BsVGIE0Z.mjs";
 import "../ssrf-BvgVcfNQ.mjs";
-import { t as validateSeed } from "../validate-ZP9Dvg0P.mjs";
-import { t as applySeed } from "../apply-hQkKKBCf.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-C_ZtRos3.mjs";
+import { t as validateSeed } from "../validate-Bz4vqcX1.mjs";
+import { t as applySeed } from "../apply-Dr7snAMT.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-ChPTmy9x.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { o as convertDataForRead } from "../transport--Ck3RBin.mjs";
+import { o as convertDataForRead } from "../transport-CmpLD7W3.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
 import { EmDashClient } from "../client/index.mjs";
 import { Kysely, SqliteDialect, sql } from "kysely";
@@ -2493,6 +2493,7 @@ function extractManifest(plugin) {
 	return {
 		id: plugin.id,
 		version: plugin.version,
+		declaredAccess: capabilitiesToDeclaredAccess(plugin.capabilities, plugin.allowedHosts),
 		capabilities: plugin.capabilities,
 		allowedHosts: plugin.allowedHosts,
 		storage: plugin.storage,
@@ -4055,7 +4056,7 @@ const searchCommand = defineCommand({
 * Pure (no-DB) commands for working with EmDash secrets:
 *
 * - `emdash secrets generate` — emits a fresh `EMDASH_ENCRYPTION_KEY`.
-*   Optionally writes it to `.dev.vars` (Workers) or `.env` (Node).
+*   Optionally writes it to a local-secrets file (`.env`).
 * - `emdash secrets fingerprint <key>` — prints the kid for a key,
 *   useful in CI for verifying what's been deployed without exposing
 *   the raw value.
@@ -4107,7 +4108,7 @@ const generateCommand = defineCommand({
 	args: {
 		write: {
 			type: "string",
-			description: "Optional path to write the key to (e.g. .dev.vars or .env). Won't overwrite an existing entry without --force."
+			description: "Optional path to write the key to (e.g. .env). Won't overwrite an existing entry without --force."
 		},
 		force: {
 			type: "boolean",