emdash 0.28.1 → 0.30.0

package/dist/{taxonomy-BxGxZZdu.mjs → taxonomy-DfVooU4W.mjs}

@@ -1,9 +1,20 @@
-import { a as __exportAll } from "./runner-K8XK101B.mjs";
+import { o as __exportAll } from "./runner-DfnZ5eUr.mjs";
+import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
 import { d as invalidateTaxonomyObjectCache } from "./object-cache-Bok5j2ae.mjs";
+import { n as isMissingTableError } from "./db-errors-CcWLaRiR.mjs";
+import { sql } from "kysely";
 import { ulid } from "ulidx";
 
 //#region src/database/repositories/taxonomy.ts
 var taxonomy_exports = /* @__PURE__ */ __exportAll({ TaxonomyRepository: () => TaxonomyRepository });
+const EMPTY_DENORM = {
+	status: null,
+	scheduled_at: null,
+	deleted_at: null,
+	locale: null,
+	published_at: null,
+	created_at: null
+};
 /**
 * Taxonomy repository for categories, tags, and other classification.
 *
@@ -124,12 +135,13 @@ var TaxonomyRepository = class {
 	async attachToEntry(collection, entryId, taxonomyId) {
 		const group = await this.resolveTranslationGroup(taxonomyId);
 		if (!group) return;
-		const row = {
+		const denorm = await this.fetchEntryDenorm(collection, entryId);
+		await this.db.insertInto("content_taxonomies").values({
 			collection,
 			entry_id: entryId,
-			taxonomy_id: group
-		};
-		await this.db.insertInto("content_taxonomies").values(row).onConflict((oc) => oc.doNothing()).execute();
+			taxonomy_id: group,
+			...denorm
+		}).onConflict((oc) => oc.doNothing()).execute();
 		invalidateTaxonomyObjectCache();
 	}
 	async detachFromEntry(collection, entryId, taxonomyId) {
@@ -165,11 +177,15 @@ var TaxonomyRepository = class {
 		const toRemove = [...currentGroups].filter((g) => !newGroups.has(g));
 		if (toRemove.length > 0) await this.db.deleteFrom("content_taxonomies").where("collection", "=", collection).where("entry_id", "=", entryId).where("taxonomy_id", "in", toRemove).execute();
 		const toAdd = [...newGroups].filter((g) => !currentGroups.has(g));
-		if (toAdd.length > 0) await this.db.insertInto("content_taxonomies").values(toAdd.map((taxonomy_id) => ({
-			collection,
-			entry_id: entryId,
-			taxonomy_id
-		}))).onConflict((oc) => oc.doNothing()).execute();
+		if (toAdd.length > 0) {
+			const denorm = await this.fetchEntryDenorm(collection, entryId);
+			await this.db.insertInto("content_taxonomies").values(toAdd.map((taxonomy_id) => ({
+				collection,
+				entry_id: entryId,
+				taxonomy_id,
+				...denorm
+			}))).onConflict((oc) => oc.doNothing()).execute();
+		}
 		if (toRemove.length > 0 || toAdd.length > 0) invalidateTaxonomyObjectCache();
 	}
 	async clearEntryTerms(collection, entryId) {
@@ -186,16 +202,44 @@ var TaxonomyRepository = class {
 	async copyEntryTerms(collection, sourceEntryId, targetEntryId) {
 		const rows = await this.db.selectFrom("content_taxonomies").select(["taxonomy_id"]).where("collection", "=", collection).where("entry_id", "=", sourceEntryId).execute();
 		if (rows.length === 0) return;
+		const denorm = await this.fetchEntryDenorm(collection, targetEntryId);
 		await this.db.insertInto("content_taxonomies").values(rows.map((r) => ({
 			collection,
 			entry_id: targetEntryId,
-			taxonomy_id: r.taxonomy_id
+			taxonomy_id: r.taxonomy_id,
+			...denorm
 		}))).onConflict((oc) => oc.doNothing()).execute();
 		invalidateTaxonomyObjectCache();
 	}
 	/**
+	* Read the denormalized filter + sort columns from an entry's `ec_*` row so
+	* they can be stamped onto new pivot rows (migration 051). A missing table or
+	* missing row yields all-nulls: the pivot columns are advisory, and the
+	* listing read path re-checks the authoritative `ec_*` row regardless.
+	*/
+	async fetchEntryDenorm(collection, entryId) {
+		validateIdentifier(collection, "collection type");
+		const tableName = `ec_${collection}`;
+		try {
+			return (await sql`
+				SELECT status, scheduled_at, deleted_at, locale, published_at, created_at
+				FROM ${sql.ref(tableName)}
+				WHERE id = ${entryId}
+			`.execute(this.db)).rows[0] ?? EMPTY_DENORM;
+		} catch (error) {
+			if (isMissingTableError(error)) return EMPTY_DENORM;
+			throw error;
+		}
+	}
+	/**
 	* Count content entries that use any translation of this term. Accepts
 	* either a term id or a translation_group — we normalise to the group.
+	*
+	* Counts raw pivot rows regardless of the entry's status or deletion —
+	* drafts and trashed entries are included. User-facing counts (admin term
+	* list/get, public widget and term pages) use `fetchVisibleTermCounts`
+	* from `taxonomies/term-counts.ts` instead, which counts only publicly
+	* visible entries.
 	*/
 	async countEntriesWithTerm(termIdOrGroup) {
 		const group = await this.resolveTranslationGroup(termIdOrGroup);
@@ -227,10 +271,13 @@ var TaxonomyRepository = class {
 	*
 	* Pass translation_groups (not term ids) — `content_taxonomies.taxonomy_id`
 	* stores the translation_group so a single assignment spans every locale.
+	*
+	* Like `countEntriesWithTerm`, this counts raw pivot rows regardless of
+	* status/deletion; user-facing counts go through `fetchVisibleTermCounts`.
 	*/
 	async countEntriesForTerms(translationGroups) {
 		if (translationGroups.length === 0) return /* @__PURE__ */ new Map();
-		const { chunks, SQL_BATCH_SIZE } = await import("./chunks-B2isWQhr.mjs").then((n) => n.r);
+		const { chunks, SQL_BATCH_SIZE } = await import("./chunks-BxXyunY-.mjs").then((n) => n.r);
 		const counts = /* @__PURE__ */ new Map();
 		for (const chunk of chunks(translationGroups, SQL_BATCH_SIZE)) {
 			const rows = await this.db.selectFrom("content_taxonomies").select(["taxonomy_id", (eb) => eb.fn.count("entry_id").as("count")]).where("taxonomy_id", "in", chunk).groupBy("taxonomy_id").execute();
@@ -254,4 +301,4 @@ var TaxonomyRepository = class {
 
 //#endregion
 export { taxonomy_exports as n, TaxonomyRepository as t };
-//# sourceMappingURL=taxonomy-BxGxZZdu.mjs.map
+//# sourceMappingURL=taxonomy-DfVooU4W.mjs.map

package/dist/taxonomy-DfVooU4W.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy-DfVooU4W.mjs","names":[],"sources":["../src/database/repositories/taxonomy.ts"],"sourcesContent":["import { sql, type Kysely, type Selectable } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { invalidateTaxonomyObjectCache } from \"../../object-cache/index.js\";\nimport { isMissingTableError } from \"../../utils/db-errors.js\";\nimport type { Database, TaxonomyTable } from \"../types.js\";\nimport { validateIdentifier } from \"../validate.js\";\n\n/**\n * Filter + sort columns denormalized from an entry's `ec_*` row onto its\n * `content_taxonomies` pivot rows (migration 051). Stamped at insert time so a\n * newly-tagged entry is immediately seekable by a taxonomy-filtered listing.\n */\ninterface PivotDenorm {\n\tstatus: string | null;\n\tscheduled_at: string | null;\n\tdeleted_at: string | null;\n\tlocale: string | null;\n\tpublished_at: string | null;\n\tcreated_at: string | null;\n}\n\nconst EMPTY_DENORM: PivotDenorm = {\n\tstatus: null,\n\tscheduled_at: null,\n\tdeleted_at: null,\n\tlocale: null,\n\tpublished_at: null,\n\tcreated_at: null,\n};\n\nexport interface Taxonomy {\n\tid: string;\n\tname: string;\n\tslug: string;\n\tlabel: string;\n\tparentId: string | null;\n\tdata: Record<string, unknown> | null;\n\tlocale: string;\n\ttranslationGroup: string | null;\n}\n\nexport interface CreateTaxonomyInput {\n\tname: string;\n\tslug: string;\n\tlabel: string;\n\tparentId?: string;\n\tdata?: Record<string, unknown>;\n\t/** Omit to let the DB default (current value: 'en') apply. Higher layers\n\t * resolve the locale from the request context / i18n config. */\n\tlocale?: string;\n\t/** When set, links the new term into the source term's translation_group. */\n\ttranslationOf?: string;\n}\n\nexport interface UpdateTaxonomyInput {\n\tslug?: string;\n\tlabel?: string;\n\tparentId?: string | null;\n\tdata?: Record<string, unknown>;\n}\n\nexport interface FindOptions {\n\tparentId?: string | null;\n\tlocale?: string;\n}\n\n/**\n * Taxonomy repository for categories, tags, and other classification.\n *\n * Terms are per-locale. Translations of the same term share a `translation_group`\n * ULID. `content_taxonomies.taxonomy_id` stores the translation_group so a single\n * association spans every locale of a post.\n *\n * The repository does not resolve locale fallbacks on its own — callers supply\n * the locale they want. Runtime helpers and handlers use `getFallbackChain()`\n * from `i18n/config` when they need fallback behaviour.\n */\nexport class TaxonomyRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\t/**\n\t * Create a new taxonomy term. When `translationOf` is set the new row joins\n\t * the source term's translation_group; otherwise a fresh group is minted\n\t * (matching the migration backfill pattern `translation_group = id`).\n\t */\n\tasync create(input: CreateTaxonomyInput): Promise<Taxonomy> {\n\t\tconst id = ulid();\n\n\t\t// Empty-string parentId is coerced to null defensively. Higher layers\n\t\t// also normalize this — see handleTermCreate / handleTermUpdate.\n\t\t// `parent_id` stores the parent's locale-agnostic translation_group (not a\n\t\t// row id), mirroring content_taxonomies.taxonomy_id, so a child stays\n\t\t// nested in every locale's tree. resolveTranslationGroup accepts either a\n\t\t// row id or an already-resolved group, so this is idempotent.\n\t\tconst parentInput =\n\t\t\tinput.parentId === undefined || input.parentId === \"\" ? null : input.parentId;\n\t\tconst parentId = parentInput ? await this.resolveParentRef(parentInput) : null;\n\n\t\tlet translationGroup = id;\n\t\tif (input.translationOf) {\n\t\t\tconst source = await this.findById(input.translationOf);\n\t\t\tif (source?.translationGroup) translationGroup = source.translationGroup;\n\t\t}\n\n\t\tawait this.db\n\t\t\t.insertInto(\"taxonomies\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\tslug: input.slug,\n\t\t\t\tlabel: input.label,\n\t\t\t\tparent_id: parentId,\n\t\t\t\tdata: input.data ? JSON.stringify(input.data) : null,\n\t\t\t\t// When omitted, the DB DEFAULT 'en' is used — keeps behaviour\n\t\t\t\t// consistent with ContentRepository and lets higher layers\n\t\t\t\t// supply an explicit locale from request context.\n\t\t\t\t...(input.locale !== undefined ? { locale: input.locale } : {}),\n\t\t\t\ttranslation_group: translationGroup,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tinvalidateTaxonomyObjectCache();\n\n\t\tconst taxonomy = await this.findById(id);\n\t\tif (!taxonomy) throw new Error(\"Failed to create taxonomy\");\n\t\treturn taxonomy;\n\t}\n\n\tasync findById(id: string): Promise<Taxonomy | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn row ? this.rowToTaxonomy(row) : null;\n\t}\n\n\t/**\n\t * Find a term by (name, slug). When `locale` is provided, filter by it.\n\t * When omitted, returns the lowest-locale-code match (deterministic across\n\t * calls). Mirrors `ContentRepository.findBySlug`.\n\t */\n\tasync findBySlug(name: string, slug: string, locale?: string): Promise<Taxonomy | null> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.where(\"slug\", \"=\", slug);\n\t\tif (locale !== undefined) query = query.where(\"locale\", \"=\", locale);\n\t\tconst row = await query.orderBy(\"locale\", \"asc\").executeTakeFirst();\n\t\treturn row ? this.rowToTaxonomy(row) : null;\n\t}\n\n\t/**\n\t * Get all terms for a taxonomy (e.g., all categories).\n\t *\n\t * `id asc` is a stable tiebreaker for terms that share a label. Without it\n\t * the SQL ordering is implementation-defined when labels match, which\n\t * breaks keyset pagination over `(label, id)`.\n\t */\n\tasync findByName(name: string, options: FindOptions = {}): Promise<Taxonomy[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.orderBy(\"label\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\");\n\n\t\tif (options.locale !== undefined) query = query.where(\"locale\", \"=\", options.locale);\n\n\t\tif (options.parentId !== undefined) {\n\t\t\tif (options.parentId === null) {\n\t\t\t\tquery = query.where(\"parent_id\", \"is\", null);\n\t\t\t} else {\n\t\t\t\tquery = query.where(\"parent_id\", \"=\", options.parentId);\n\t\t\t}\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\t/**\n\t * Children of a term. Accepts a term id OR a translation_group and resolves\n\t * to the group, since `parent_id` stores the parent's translation_group.\n\t * Pass `locale` to scope to one locale's tree (children share the parent's\n\t * group across locales); omit it to find children in every locale (used to\n\t * block deletes that would orphan a sibling translation's subtree).\n\t */\n\tasync findChildren(parentIdOrGroup: string, locale?: string): Promise<Taxonomy[]> {\n\t\tconst group = await this.resolveTranslationGroup(parentIdOrGroup);\n\t\tif (!group) return [];\n\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"parent_id\", \"=\", group)\n\t\t\t.orderBy(\"label\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\");\n\t\tif (locale !== undefined) query = query.where(\"locale\", \"=\", locale);\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\t/**\n\t * Every translation sibling of a term (including itself), identified by\n\t * their shared `translation_group`.\n\t */\n\tasync findTranslations(translationGroup: string): Promise<Taxonomy[]> {\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"translation_group\", \"=\", translationGroup)\n\t\t\t.orderBy(\"locale\", \"asc\")\n\t\t\t.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\tasync update(id: string, input: UpdateTaxonomyInput): Promise<Taxonomy | null> {\n\t\tconst existing = await this.findById(id);\n\t\tif (!existing) return null;\n\n\t\tconst updates: Record<string, unknown> = {};\n\t\tif (input.slug !== undefined) updates.slug = input.slug;\n\t\tif (input.label !== undefined) updates.label = input.label;\n\t\tif (input.parentId !== undefined) {\n\t\t\t// Defense in depth: empty-string parentId means null (no parent).\n\t\t\t// Otherwise persist the parent's translation_group (locale-agnostic),\n\t\t\t// matching create() — see the note there.\n\t\t\tupdates.parent_id =\n\t\t\t\tinput.parentId === \"\" || input.parentId === null\n\t\t\t\t\t? null\n\t\t\t\t\t: await this.resolveParentRef(input.parentId);\n\t\t}\n\t\tif (input.data !== undefined) updates.data = JSON.stringify(input.data);\n\n\t\tif (Object.keys(updates).length > 0) {\n\t\t\tawait this.db.updateTable(\"taxonomies\").set(updates).where(\"id\", \"=\", id).execute();\n\t\t\tinvalidateTaxonomyObjectCache();\n\t\t}\n\n\t\treturn this.findById(id);\n\t}\n\n\tasync delete(id: string): Promise<boolean> {\n\t\tconst term = await this.findById(id);\n\t\tif (!term) return false;\n\n\t\t// When deleting the last translation of a group the pivot rows that\n\t\t// reference that translation_group become orphaned — purge them.\n\t\tif (term.translationGroup) {\n\t\t\tconst siblings = await this.db\n\t\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t\t.select(\"id\")\n\t\t\t\t.where(\"translation_group\", \"=\", term.translationGroup)\n\t\t\t\t.where(\"id\", \"!=\", id)\n\t\t\t\t.execute();\n\t\t\tif (siblings.length === 0) {\n\t\t\t\tawait this.db\n\t\t\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t\t\t.where(\"taxonomy_id\", \"=\", term.translationGroup)\n\t\t\t\t\t.execute();\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.db.deleteFrom(\"taxonomies\").where(\"id\", \"=\", id).executeTakeFirst();\n\t\tinvalidateTaxonomyObjectCache();\n\t\treturn (result.numDeletedRows ?? 0n) > 0n;\n\t}\n\n\t// --- Content-Taxonomy Junction (taxonomy_id stores the translation_group) ---\n\n\tasync attachToEntry(collection: string, entryId: string, taxonomyId: string): Promise<void> {\n\t\tconst group = await this.resolveTranslationGroup(taxonomyId);\n\t\tif (!group) return;\n\n\t\tconst denorm = await this.fetchEntryDenorm(collection, entryId);\n\t\tawait this.db\n\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t.values({ collection, entry_id: entryId, taxonomy_id: group, ...denorm })\n\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t.execute();\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\tasync detachFromEntry(collection: string, entryId: string, taxonomyId: string): Promise<void> {\n\t\tconst group = await this.resolveTranslationGroup(taxonomyId);\n\t\tif (!group) return;\n\n\t\tawait this.db\n\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", entryId)\n\t\t\t.where(\"taxonomy_id\", \"=\", group)\n\t\t\t.execute();\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\t/**\n\t * Taxonomy terms assigned to a content entry, resolved into a specific locale.\n\t * Terms whose translation_group lacks a row in the requested locale are\n\t * omitted — callers wanting fallback behaviour apply it themselves.\n\t */\n\tasync getTermsForEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyName?: string,\n\t\tlocale?: string,\n\t): Promise<Taxonomy[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.innerJoin(\"taxonomies\", \"taxonomies.translation_group\", \"content_taxonomies.taxonomy_id\")\n\t\t\t.selectAll(\"taxonomies\")\n\t\t\t.where(\"content_taxonomies.collection\", \"=\", collection)\n\t\t\t.where(\"content_taxonomies.entry_id\", \"=\", entryId);\n\n\t\tif (taxonomyName) query = query.where(\"taxonomies.name\", \"=\", taxonomyName);\n\t\tif (locale !== undefined) query = query.where(\"taxonomies.locale\", \"=\", locale);\n\n\t\tconst rows = await query.orderBy(\"taxonomies.locale\", \"asc\").execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\t/**\n\t * Replace all assignments of a given taxonomy for one content entry.\n\t * Term ids OR translation_groups are accepted and normalised to groups.\n\t */\n\tasync setTermsForEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyName: string,\n\t\ttermIds: string[],\n\t): Promise<void> {\n\t\tconst groups: string[] = [];\n\t\tfor (const id of termIds) {\n\t\t\tconst group = await this.resolveTranslationGroup(id);\n\t\t\tif (group) groups.push(group);\n\t\t}\n\t\tconst newGroups = new Set(groups);\n\n\t\tconst current = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.innerJoin(\"taxonomies\", \"taxonomies.translation_group\", \"content_taxonomies.taxonomy_id\")\n\t\t\t.select([\"content_taxonomies.taxonomy_id as group\"])\n\t\t\t.distinct()\n\t\t\t.where(\"content_taxonomies.collection\", \"=\", collection)\n\t\t\t.where(\"content_taxonomies.entry_id\", \"=\", entryId)\n\t\t\t.where(\"taxonomies.name\", \"=\", taxonomyName)\n\t\t\t.execute();\n\t\tconst currentGroups = new Set(current.map((r) => r.group));\n\n\t\tconst toRemove = [...currentGroups].filter((g) => !newGroups.has(g));\n\t\tif (toRemove.length > 0) {\n\t\t\tawait this.db\n\t\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t\t.where(\"entry_id\", \"=\", entryId)\n\t\t\t\t.where(\"taxonomy_id\", \"in\", toRemove)\n\t\t\t\t.execute();\n\t\t}\n\n\t\tconst toAdd = [...newGroups].filter((g) => !currentGroups.has(g));\n\t\tif (toAdd.length > 0) {\n\t\t\tconst denorm = await this.fetchEntryDenorm(collection, entryId);\n\t\t\tawait this.db\n\t\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t\t.values(\n\t\t\t\t\ttoAdd.map((taxonomy_id) => ({\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\tentry_id: entryId,\n\t\t\t\t\t\ttaxonomy_id,\n\t\t\t\t\t\t...denorm,\n\t\t\t\t\t})),\n\t\t\t\t)\n\t\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t\t.execute();\n\t\t}\n\n\t\tif (toRemove.length > 0 || toAdd.length > 0) invalidateTaxonomyObjectCache();\n\t}\n\n\tasync clearEntryTerms(collection: string, entryId: string): Promise<number> {\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", entryId)\n\t\t\t.executeTakeFirst();\n\t\tconst removed = Number(result.numDeletedRows ?? 0);\n\t\tif (removed > 0) invalidateTaxonomyObjectCache();\n\t\treturn removed;\n\t}\n\n\t/**\n\t * Copy every term assignment from one content entry to another. Used when\n\t * creating a translation of a post so the new translation inherits the\n\t * source's term assignments. Safe to call when the source has no terms.\n\t */\n\tasync copyEntryTerms(\n\t\tcollection: string,\n\t\tsourceEntryId: string,\n\t\ttargetEntryId: string,\n\t): Promise<void> {\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.select([\"taxonomy_id\"])\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", sourceEntryId)\n\t\t\t.execute();\n\t\tif (rows.length === 0) return;\n\n\t\t// Stamp the TARGET entry's current values — the copy inherits the source's\n\t\t// term memberships but the target's own status/dates/locale.\n\t\tconst denorm = await this.fetchEntryDenorm(collection, targetEntryId);\n\t\tawait this.db\n\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t.values(\n\t\t\t\trows.map((r) => ({\n\t\t\t\t\tcollection,\n\t\t\t\t\tentry_id: targetEntryId,\n\t\t\t\t\ttaxonomy_id: r.taxonomy_id,\n\t\t\t\t\t...denorm,\n\t\t\t\t})),\n\t\t\t)\n\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t.execute();\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\t/**\n\t * Read the denormalized filter + sort columns from an entry's `ec_*` row so\n\t * they can be stamped onto new pivot rows (migration 051). A missing table or\n\t * missing row yields all-nulls: the pivot columns are advisory, and the\n\t * listing read path re-checks the authoritative `ec_*` row regardless.\n\t */\n\tprivate async fetchEntryDenorm(collection: string, entryId: string): Promise<PivotDenorm> {\n\t\tvalidateIdentifier(collection, \"collection type\");\n\t\tconst tableName = `ec_${collection}`;\n\t\ttry {\n\t\t\tconst result = await sql<PivotDenorm>`\n\t\t\t\tSELECT status, scheduled_at, deleted_at, locale, published_at, created_at\n\t\t\t\tFROM ${sql.ref(tableName)}\n\t\t\t\tWHERE id = ${entryId}\n\t\t\t`.execute(this.db);\n\t\t\treturn result.rows[0] ?? EMPTY_DENORM;\n\t\t} catch (error) {\n\t\t\tif (isMissingTableError(error)) return EMPTY_DENORM;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Count content entries that use any translation of this term. Accepts\n\t * either a term id or a translation_group — we normalise to the group.\n\t *\n\t * Counts raw pivot rows regardless of the entry's status or deletion —\n\t * drafts and trashed entries are included. User-facing counts (admin term\n\t * list/get, public widget and term pages) use `fetchVisibleTermCounts`\n\t * from `taxonomies/term-counts.ts` instead, which counts only publicly\n\t * visible entries.\n\t */\n\tasync countEntriesWithTerm(termIdOrGroup: string): Promise<number> {\n\t\tconst group = await this.resolveTranslationGroup(termIdOrGroup);\n\t\tif (!group) return 0;\n\n\t\tconst result = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.select((eb) => eb.fn.count(\"entry_id\").as(\"count\"))\n\t\t\t.where(\"taxonomy_id\", \"=\", group)\n\t\t\t.executeTakeFirst();\n\t\treturn Number(result?.count ?? 0);\n\t}\n\n\t/**\n\t * Resolve a parent reference (a row id or a translation_group) to the value\n\t * persisted in `parent_id`: the parent's translation_group, which is\n\t * locale-agnostic so the child stays nested in every locale. A\n\t * translation_group normally equals its anchor row's id, which satisfies the\n\t * self-FK on `parent_id`. If that anchor row is missing (a translation whose\n\t * anchor was deleted), fall back to the id we were given so we never write a\n\t * dangling FK value.\n\t */\n\tprivate async resolveParentRef(idOrGroup: string): Promise<string> {\n\t\tconst group = await this.resolveTranslationGroup(idOrGroup);\n\t\tif (!group) return idOrGroup;\n\t\tconst anchor = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"id\", \"=\", group)\n\t\t\t.executeTakeFirst();\n\t\treturn anchor ? group : idOrGroup;\n\t}\n\n\tprivate async resolveTranslationGroup(idOrGroup: string): Promise<string | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select([\"translation_group\"])\n\t\t\t.where((eb) => eb.or([eb(\"id\", \"=\", idOrGroup), eb(\"translation_group\", \"=\", idOrGroup)]))\n\t\t\t.executeTakeFirst();\n\t\treturn row?.translation_group ?? null;\n\t}\n\n\t/**\n\t * Batch count entries for multiple taxonomy translation_groups.\n\t * Chunks the query at SQL_BATCH_SIZE to stay below D1's bind-parameter limit.\n\t * Returns a Map from translation_group to count.\n\t *\n\t * Pass translation_groups (not term ids) — `content_taxonomies.taxonomy_id`\n\t * stores the translation_group so a single assignment spans every locale.\n\t *\n\t * Like `countEntriesWithTerm`, this counts raw pivot rows regardless of\n\t * status/deletion; user-facing counts go through `fetchVisibleTermCounts`.\n\t */\n\tasync countEntriesForTerms(translationGroups: string[]): Promise<Map<string, number>> {\n\t\tif (translationGroups.length === 0) return new Map();\n\n\t\tconst { chunks, SQL_BATCH_SIZE } = await import(\"../../utils/chunks.js\");\n\n\t\tconst counts = new Map<string, number>();\n\t\tfor (const chunk of chunks(translationGroups, SQL_BATCH_SIZE)) {\n\t\t\tconst rows = await this.db\n\t\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t\t.select([\"taxonomy_id\", (eb) => eb.fn.count(\"entry_id\").as(\"count\")])\n\t\t\t\t.where(\"taxonomy_id\", \"in\", chunk)\n\t\t\t\t.groupBy(\"taxonomy_id\")\n\t\t\t\t.execute();\n\n\t\t\tfor (const row of rows) {\n\t\t\t\tcounts.set(row.taxonomy_id, Number(row.count || 0));\n\t\t\t}\n\t\t}\n\t\treturn counts;\n\t}\n\n\tprivate rowToTaxonomy(row: Selectable<TaxonomyTable>): Taxonomy {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tslug: row.slug,\n\t\t\tlabel: row.label,\n\t\t\tparentId: row.parent_id,\n\t\t\tdata: row.data ? JSON.parse(row.data) : null,\n\t\t\tlocale: row.locale,\n\t\t\ttranslationGroup: row.translation_group,\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAM,eAA4B;CACjC,QAAQ;CACR,cAAc;CACd,YAAY;CACZ,QAAQ;CACR,cAAc;CACd,YAAY;CACZ;;;;;;;;;;;;AAiDD,IAAa,qBAAb,MAAgC;CAC/B,YAAY,AAAQ,IAAsB;EAAtB;;;;;;;CAOpB,MAAM,OAAO,OAA+C;EAC3D,MAAM,KAAK,MAAM;EAQjB,MAAM,cACL,MAAM,aAAa,UAAa,MAAM,aAAa,KAAK,OAAO,MAAM;EACtE,MAAM,WAAW,cAAc,MAAM,KAAK,iBAAiB,YAAY,GAAG;EAE1E,IAAI,mBAAmB;AACvB,MAAI,MAAM,eAAe;GACxB,MAAM,SAAS,MAAM,KAAK,SAAS,MAAM,cAAc;AACvD,OAAI,QAAQ,iBAAkB,oBAAmB,OAAO;;AAGzD,QAAM,KAAK,GACT,WAAW,aAAa,CACxB,OAAO;GACP;GACA,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,MAAM;GACb,WAAW;GACX,MAAM,MAAM,OAAO,KAAK,UAAU,MAAM,KAAK,GAAG;GAIhD,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;GAC9D,mBAAmB;GACnB,CAAC,CACD,SAAS;AAEX,iCAA+B;EAE/B,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4BAA4B;AAC3D,SAAO;;CAGR,MAAM,SAAS,IAAsC;EACpD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AACpB,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;;;CAQxC,MAAM,WAAW,MAAc,MAAc,QAA2C;EACvF,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,CACxB,MAAM,QAAQ,KAAK,KAAK;AAC1B,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,OAAO;EACpE,MAAM,MAAM,MAAM,MAAM,QAAQ,UAAU,MAAM,CAAC,kBAAkB;AACnE,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;;;;;CAUxC,MAAM,WAAW,MAAc,UAAuB,EAAE,EAAuB;EAC9E,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,CACxB,QAAQ,SAAS,MAAM,CACvB,QAAQ,MAAM,MAAM;AAEtB,MAAI,QAAQ,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,QAAQ,OAAO;AAEpF,MAAI,QAAQ,aAAa,OACxB,KAAI,QAAQ,aAAa,KACxB,SAAQ,MAAM,MAAM,aAAa,MAAM,KAAK;MAE5C,SAAQ,MAAM,MAAM,aAAa,KAAK,QAAQ,SAAS;AAKzD,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;;;;;CAUlD,MAAM,aAAa,iBAAyB,QAAsC;EACjF,MAAM,QAAQ,MAAM,KAAK,wBAAwB,gBAAgB;AACjE,MAAI,CAAC,MAAO,QAAO,EAAE;EAErB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,QAAQ,SAAS,MAAM,CACvB,QAAQ,MAAM,MAAM;AACtB,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,OAAO;AAGpE,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;;CAOlD,MAAM,iBAAiB,kBAA+C;AAOrE,UANa,MAAM,KAAK,GACtB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,qBAAqB,KAAK,iBAAiB,CACjD,QAAQ,UAAU,MAAM,CACxB,SAAS,EACC,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;CAGlD,MAAM,OAAO,IAAY,OAAsD;AAE9E,MAAI,CADa,MAAM,KAAK,SAAS,GAAG,CACzB,QAAO;EAEtB,MAAM,UAAmC,EAAE;AAC3C,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,MAAM;AACnD,MAAI,MAAM,UAAU,OAAW,SAAQ,QAAQ,MAAM;AACrD,MAAI,MAAM,aAAa,OAItB,SAAQ,YACP,MAAM,aAAa,MAAM,MAAM,aAAa,OACzC,OACA,MAAM,KAAK,iBAAiB,MAAM,SAAS;AAEhD,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,KAAK,UAAU,MAAM,KAAK;AAEvE,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,SAAM,KAAK,GAAG,YAAY,aAAa,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,SAAS;AACnF,kCAA+B;;AAGhC,SAAO,KAAK,SAAS,GAAG;;CAGzB,MAAM,OAAO,IAA8B;EAC1C,MAAM,OAAO,MAAM,KAAK,SAAS,GAAG;AACpC,MAAI,CAAC,KAAM,QAAO;AAIlB,MAAI,KAAK,kBAOR;QANiB,MAAM,KAAK,GAC1B,WAAW,aAAa,CACxB,OAAO,KAAK,CACZ,MAAM,qBAAqB,KAAK,KAAK,iBAAiB,CACtD,MAAM,MAAM,MAAM,GAAG,CACrB,SAAS,EACE,WAAW,EACvB,OAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,eAAe,KAAK,KAAK,iBAAiB,CAChD,SAAS;;EAIb,MAAM,SAAS,MAAM,KAAK,GAAG,WAAW,aAAa,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,kBAAkB;AAC7F,iCAA+B;AAC/B,UAAQ,OAAO,kBAAkB,MAAM;;CAKxC,MAAM,cAAc,YAAoB,SAAiB,YAAmC;EAC3F,MAAM,QAAQ,MAAM,KAAK,wBAAwB,WAAW;AAC5D,MAAI,CAAC,MAAO;EAEZ,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY,QAAQ;AAC/D,QAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,OAAO;GAAE;GAAY,UAAU;GAAS,aAAa;GAAO,GAAG;GAAQ,CAAC,CACxE,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,SAAS;AACX,iCAA+B;;CAGhC,MAAM,gBAAgB,YAAoB,SAAiB,YAAmC;EAC7F,MAAM,QAAQ,MAAM,KAAK,wBAAwB,WAAW;AAC5D,MAAI,CAAC,MAAO;AAEZ,QAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,QAAQ,CAC/B,MAAM,eAAe,KAAK,MAAM,CAChC,SAAS;AACX,iCAA+B;;;;;;;CAQhC,MAAM,iBACL,YACA,SACA,cACA,QACsB;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,qBAAqB,CAChC,UAAU,cAAc,gCAAgC,iCAAiC,CACzF,UAAU,aAAa,CACvB,MAAM,iCAAiC,KAAK,WAAW,CACvD,MAAM,+BAA+B,KAAK,QAAQ;AAEpD,MAAI,aAAc,SAAQ,MAAM,MAAM,mBAAmB,KAAK,aAAa;AAC3E,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,qBAAqB,KAAK,OAAO;AAG/E,UADa,MAAM,MAAM,QAAQ,qBAAqB,MAAM,CAAC,SAAS,EAC1D,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;;CAOlD,MAAM,iBACL,YACA,SACA,cACA,SACgB;EAChB,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,MAAM,SAAS;GACzB,MAAM,QAAQ,MAAM,KAAK,wBAAwB,GAAG;AACpD,OAAI,MAAO,QAAO,KAAK,MAAM;;EAE9B,MAAM,YAAY,IAAI,IAAI,OAAO;EAEjC,MAAM,UAAU,MAAM,KAAK,GACzB,WAAW,qBAAqB,CAChC,UAAU,cAAc,gCAAgC,iCAAiC,CACzF,OAAO,CAAC,0CAA0C,CAAC,CACnD,UAAU,CACV,MAAM,iCAAiC,KAAK,WAAW,CACvD,MAAM,+BAA+B,KAAK,QAAQ,CAClD,MAAM,mBAAmB,KAAK,aAAa,CAC3C,SAAS;EACX,MAAM,gBAAgB,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,MAAM,CAAC;EAE1D,MAAM,WAAW,CAAC,GAAG,cAAc,CAAC,QAAQ,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AACpE,MAAI,SAAS,SAAS,EACrB,OAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,QAAQ,CAC/B,MAAM,eAAe,MAAM,SAAS,CACpC,SAAS;EAGZ,MAAM,QAAQ,CAAC,GAAG,UAAU,CAAC,QAAQ,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;AACjE,MAAI,MAAM,SAAS,GAAG;GACrB,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY,QAAQ;AAC/D,SAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,OACA,MAAM,KAAK,iBAAiB;IAC3B;IACA,UAAU;IACV;IACA,GAAG;IACH,EAAE,CACH,CACA,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,SAAS;;AAGZ,MAAI,SAAS,SAAS,KAAK,MAAM,SAAS,EAAG,gCAA+B;;CAG7E,MAAM,gBAAgB,YAAoB,SAAkC;EAC3E,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,QAAQ,CAC/B,kBAAkB;EACpB,MAAM,UAAU,OAAO,OAAO,kBAAkB,EAAE;AAClD,MAAI,UAAU,EAAG,gCAA+B;AAChD,SAAO;;;;;;;CAQR,MAAM,eACL,YACA,eACA,eACgB;EAChB,MAAM,OAAO,MAAM,KAAK,GACtB,WAAW,qBAAqB,CAChC,OAAO,CAAC,cAAc,CAAC,CACvB,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,cAAc,CACrC,SAAS;AACX,MAAI,KAAK,WAAW,EAAG;EAIvB,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY,cAAc;AACrE,QAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,OACA,KAAK,KAAK,OAAO;GAChB;GACA,UAAU;GACV,aAAa,EAAE;GACf,GAAG;GACH,EAAE,CACH,CACA,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,SAAS;AACX,iCAA+B;;;;;;;;CAShC,MAAc,iBAAiB,YAAoB,SAAuC;AACzF,qBAAmB,YAAY,kBAAkB;EACjD,MAAM,YAAY,MAAM;AACxB,MAAI;AAMH,WALe,MAAM,GAAgB;;WAE7B,IAAI,IAAI,UAAU,CAAC;iBACb,QAAQ;KACpB,QAAQ,KAAK,GAAG,EACJ,KAAK,MAAM;WACjB,OAAO;AACf,OAAI,oBAAoB,MAAM,CAAE,QAAO;AACvC,SAAM;;;;;;;;;;;;;CAcR,MAAM,qBAAqB,eAAwC;EAClE,MAAM,QAAQ,MAAM,KAAK,wBAAwB,cAAc;AAC/D,MAAI,CAAC,MAAO,QAAO;EAEnB,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,qBAAqB,CAChC,QAAQ,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,QAAQ,CAAC,CACnD,MAAM,eAAe,KAAK,MAAM,CAChC,kBAAkB;AACpB,SAAO,OAAO,QAAQ,SAAS,EAAE;;;;;;;;;;;CAYlC,MAAc,iBAAiB,WAAoC;EAClE,MAAM,QAAQ,MAAM,KAAK,wBAAwB,UAAU;AAC3D,MAAI,CAAC,MAAO,QAAO;AAMnB,SALe,MAAM,KAAK,GACxB,WAAW,aAAa,CACxB,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,MAAM,CACvB,kBAAkB,GACJ,QAAQ;;CAGzB,MAAc,wBAAwB,WAA2C;AAMhF,UALY,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,OAAO,CAAC,oBAAoB,CAAC,CAC7B,OAAO,OAAO,GAAG,GAAG,CAAC,GAAG,MAAM,KAAK,UAAU,EAAE,GAAG,qBAAqB,KAAK,UAAU,CAAC,CAAC,CAAC,CACzF,kBAAkB,GACR,qBAAqB;;;;;;;;;;;;;CAclC,MAAM,qBAAqB,mBAA2D;AACrF,MAAI,kBAAkB,WAAW,EAAG,wBAAO,IAAI,KAAK;EAEpD,MAAM,EAAE,QAAQ,mBAAmB,MAAM,OAAO;EAEhD,MAAM,yBAAS,IAAI,KAAqB;AACxC,OAAK,MAAM,SAAS,OAAO,mBAAmB,eAAe,EAAE;GAC9D,MAAM,OAAO,MAAM,KAAK,GACtB,WAAW,qBAAqB,CAChC,OAAO,CAAC,gBAAgB,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CACpE,MAAM,eAAe,MAAM,MAAM,CACjC,QAAQ,cAAc,CACtB,SAAS;AAEX,QAAK,MAAM,OAAO,KACjB,QAAO,IAAI,IAAI,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC;;AAGrD,SAAO;;CAGR,AAAQ,cAAc,KAA0C;AAC/D,SAAO;GACN,IAAI,IAAI;GACR,MAAM,IAAI;GACV,MAAM,IAAI;GACV,OAAO,IAAI;GACX,UAAU,IAAI;GACd,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;GACxC,QAAQ,IAAI;GACZ,kBAAkB,IAAI;GACtB"}

package/dist/{tokens-BGT0TUUo.mjs → tokens-DVltpO2D.mjs}

@@ -1,4 +1,4 @@
-import { i as encodeBase64url, n as decodeBase64url } from "./base64-CmWvODNW.mjs";
+import { a as encodeBase64url, r as decodeBase64url } from "./base64-B-PsqheR.mjs";
 
 //#region src/preview/tokens.ts
 /**
@@ -168,4 +168,4 @@ function parseContentId(contentId) {
 
 //#endregion
 export { parseContentId as n, verifyPreviewToken as r, generatePreviewToken as t };
-//# sourceMappingURL=tokens-BGT0TUUo.mjs.map
+//# sourceMappingURL=tokens-DVltpO2D.mjs.map

package/dist/{tokens-BGT0TUUo.mjs.map → tokens-DVltpO2D.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"tokens-BGT0TUUo.mjs","names":[],"sources":["../src/preview/tokens.ts"],"sourcesContent":["/**\n * Preview token generation and verification\n *\n * Tokens are compact, URL-safe, and HMAC-signed.\n * Format: base64url(JSON payload).base64url(HMAC signature)\n *\n * Payload: { cid: contentId, exp: expiryTimestamp, iat: issuedAt }\n */\n\nimport { encodeBase64url, decodeBase64url } from \"../utils/base64.js\";\n\n// Regex pattern for duration parsing\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\n/**\n * Preview token payload\n */\nexport interface PreviewTokenPayload {\n\t/** Content ID in format \"collection:id\" (e.g., \"posts:abc123\") */\n\tcid: string;\n\t/** Expiry timestamp (seconds since epoch) */\n\texp: number;\n\t/** Issued at timestamp (seconds since epoch) */\n\tiat: number;\n}\n\n/**\n * Options for generating a preview token\n */\nexport interface GeneratePreviewTokenOptions {\n\t/** Content ID in format \"collection:id\" */\n\tcontentId: string;\n\t/** How long the token is valid. Accepts \"1h\", \"30m\", \"1d\", or seconds as number. Default: \"1h\" */\n\texpiresIn?: string | number;\n\t/** Secret key for signing. Should be from environment variable. */\n\tsecret: string;\n}\n\n/**\n * Parse duration string to seconds\n * Supports: \"1h\", \"30m\", \"1d\", \"2w\", or raw seconds\n */\nfunction parseDuration(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\treturn duration;\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use \"1h\", \"30m\", \"1d\", \"2w\", or seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Create HMAC-SHA256 signature using Web Crypto API\n */\nasync function createSignature(data: string, secret: string): Promise<Uint8Array> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"sign\"],\n\t);\n\tconst signature = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data));\n\treturn new Uint8Array(signature);\n}\n\n/**\n * Verify HMAC-SHA256 signature\n */\nasync function verifySignature(\n\tdata: string,\n\tsignature: Uint8Array,\n\tsecret: string,\n): Promise<boolean> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"verify\"],\n\t);\n\t// Create a new ArrayBuffer from the signature to satisfy BufferSource typing\n\t// (Uint8Array.buffer is ArrayBufferLike which includes SharedArrayBuffer)\n\tconst sigBuffer: ArrayBuffer = new ArrayBuffer(signature.byteLength);\n\tnew Uint8Array(sigBuffer).set(signature);\n\treturn crypto.subtle.verify(\"HMAC\", key, sigBuffer, encoder.encode(data));\n}\n\n/**\n * Generate a preview token for content\n *\n * @example\n * ```ts\n * const token = await generatePreviewToken({\n *   contentId: \"posts:abc123\",\n *   expiresIn: \"1h\",\n *   secret: process.env.PREVIEW_SECRET!,\n * });\n * ```\n */\nexport async function generatePreviewToken(options: GeneratePreviewTokenOptions): Promise<string> {\n\tconst { contentId, expiresIn = \"1h\", secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\tif (!contentId || !contentId.includes(\":\")) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\n\tconst now = Math.floor(Date.now() / 1000);\n\tconst duration = parseDuration(expiresIn);\n\n\tconst payload: PreviewTokenPayload = {\n\t\tcid: contentId,\n\t\texp: now + duration,\n\t\tiat: now,\n\t};\n\n\t// Encode payload\n\tconst payloadJson = JSON.stringify(payload);\n\tconst encodedPayload = encodeBase64url(new TextEncoder().encode(payloadJson));\n\n\t// Sign it\n\tconst signature = await createSignature(encodedPayload, secret);\n\tconst encodedSignature = encodeBase64url(signature);\n\n\treturn `${encodedPayload}.${encodedSignature}`;\n}\n\n/**\n * Result of verifying a preview token\n */\nexport type VerifyPreviewTokenResult =\n\t| { valid: true; payload: PreviewTokenPayload }\n\t| { valid: false; error: \"invalid\" | \"expired\" | \"malformed\" | \"none\" };\n\n/**\n * Options for verifyPreviewToken\n */\nexport type VerifyPreviewTokenOptions = {\n\t/** Secret key for verifying tokens */\n\tsecret: string;\n} & (\n\t| { /** URL to extract _preview token from */ url: URL }\n\t| {\n\t\t\t/** Preview token string (can be null) */ token: string | null | undefined;\n\t  }\n);\n\n/**\n * Verify a preview token and return the payload\n *\n * @example\n * ```ts\n * // With URL (extracts _preview query param)\n * const result = await verifyPreviewToken({\n *   url: Astro.url,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * // With token directly\n * const result = await verifyPreviewToken({\n *   token: someToken,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * if (result.valid) {\n *   console.log(result.payload.cid); // \"posts:abc123\"\n * }\n * ```\n */\nexport async function verifyPreviewToken(\n\toptions: VerifyPreviewTokenOptions,\n): Promise<VerifyPreviewTokenResult> {\n\tconst { secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\t// Extract token from URL or use provided token\n\tconst token = \"url\" in options ? options.url.searchParams.get(\"_preview\") : options.token;\n\n\t// Handle null/undefined token\n\tif (!token) {\n\t\treturn { valid: false, error: \"none\" };\n\t}\n\n\t// Split token into payload and signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst [encodedPayload, encodedSignature] = parts;\n\n\t// Verify signature\n\tlet signature: Uint8Array;\n\ttry {\n\t\tsignature = decodeBase64url(encodedSignature);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst isValid = await verifySignature(encodedPayload, signature, secret);\n\tif (!isValid) {\n\t\treturn { valid: false, error: \"invalid\" };\n\t}\n\n\t// Decode and parse payload\n\tlet payload: PreviewTokenPayload;\n\ttry {\n\t\tconst payloadBytes = decodeBase64url(encodedPayload);\n\t\tconst payloadJson = new TextDecoder().decode(payloadBytes);\n\t\tpayload = JSON.parse(payloadJson);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check required fields\n\tif (\n\t\ttypeof payload.cid !== \"string\" ||\n\t\ttypeof payload.exp !== \"number\" ||\n\t\ttypeof payload.iat !== \"number\"\n\t) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check expiry\n\tconst now = Math.floor(Date.now() / 1000);\n\tif (payload.exp < now) {\n\t\treturn { valid: false, error: \"expired\" };\n\t}\n\n\treturn { valid: true, payload };\n}\n\n/**\n * Parse a content ID into collection and id\n */\nexport function parseContentId(contentId: string): {\n\tcollection: string;\n\tid: string;\n} {\n\tconst colonIndex = contentId.indexOf(\":\");\n\tif (colonIndex === -1) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\treturn {\n\t\tcollection: contentId.slice(0, colonIndex),\n\t\tid: contentId.slice(colonIndex + 1),\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,mBAAmB;;;;;AA8BzB,SAAS,cAAc,UAAmC;AACzD,KAAI,OAAO,aAAa,SACvB,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,6CACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;AAOpD,eAAe,gBAAgB,MAAc,QAAqC;CACjF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACR;CACD,MAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,CAAC;AAC7E,QAAO,IAAI,WAAW,UAAU;;;;;AAMjC,eAAe,gBACd,MACA,WACA,QACmB;CACnB,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,SAAS,CACV;CAGD,MAAM,YAAyB,IAAI,YAAY,UAAU,WAAW;AACpE,KAAI,WAAW,UAAU,CAAC,IAAI,UAAU;AACxC,QAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,QAAQ,OAAO,KAAK,CAAC;;;;;;;;;;;;;;AAe1E,eAAsB,qBAAqB,SAAuD;CACjG,MAAM,EAAE,WAAW,YAAY,MAAM,WAAW;AAEhD,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;AAG9C,KAAI,CAAC,aAAa,CAAC,UAAU,SAAS,IAAI,CACzC,OAAM,IAAI,MAAM,iDAA+C;CAGhE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAGzC,MAAM,UAA+B;EACpC,KAAK;EACL,KAAK,MAJW,cAAc,UAAU;EAKxC,KAAK;EACL;CAGD,MAAM,cAAc,KAAK,UAAU,QAAQ;CAC3C,MAAM,iBAAiB,gBAAgB,IAAI,aAAa,CAAC,OAAO,YAAY,CAAC;AAM7E,QAAO,GAAG,eAAe,GAFA,gBADP,MAAM,gBAAgB,gBAAgB,OAAO,CACZ;;;;;;;;;;;;;;;;;;;;;;;;AA+CpD,eAAsB,mBACrB,SACoC;CACpC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;CAI9C,MAAM,QAAQ,SAAS,UAAU,QAAQ,IAAI,aAAa,IAAI,WAAW,GAAG,QAAQ;AAGpF,KAAI,CAAC,MACJ,QAAO;EAAE,OAAO;EAAO,OAAO;EAAQ;CAIvC,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EACpB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAG5C,MAAM,CAAC,gBAAgB,oBAAoB;CAG3C,IAAI;AACJ,KAAI;AACH,cAAY,gBAAgB,iBAAiB;SACtC;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KAAI,CADY,MAAM,gBAAgB,gBAAgB,WAAW,OAAO,CAEvE,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;CAI1C,IAAI;AACJ,KAAI;EACH,MAAM,eAAe,gBAAgB,eAAe;EACpD,MAAM,cAAc,IAAI,aAAa,CAAC,OAAO,aAAa;AAC1D,YAAU,KAAK,MAAM,YAAY;SAC1B;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KACC,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,SAEvB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAI5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,KAAI,QAAQ,MAAM,IACjB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;AAG1C,QAAO;EAAE,OAAO;EAAM;EAAS;;;;;AAMhC,SAAgB,eAAe,WAG7B;CACD,MAAM,aAAa,UAAU,QAAQ,IAAI;AACzC,KAAI,eAAe,GAClB,OAAM,IAAI,MAAM,iDAA+C;AAEhE,QAAO;EACN,YAAY,UAAU,MAAM,GAAG,WAAW;EAC1C,IAAI,UAAU,MAAM,aAAa,EAAE;EACnC"}
+{"version":3,"file":"tokens-DVltpO2D.mjs","names":[],"sources":["../src/preview/tokens.ts"],"sourcesContent":["/**\n * Preview token generation and verification\n *\n * Tokens are compact, URL-safe, and HMAC-signed.\n * Format: base64url(JSON payload).base64url(HMAC signature)\n *\n * Payload: { cid: contentId, exp: expiryTimestamp, iat: issuedAt }\n */\n\nimport { encodeBase64url, decodeBase64url } from \"../utils/base64.js\";\n\n// Regex pattern for duration parsing\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\n/**\n * Preview token payload\n */\nexport interface PreviewTokenPayload {\n\t/** Content ID in format \"collection:id\" (e.g., \"posts:abc123\") */\n\tcid: string;\n\t/** Expiry timestamp (seconds since epoch) */\n\texp: number;\n\t/** Issued at timestamp (seconds since epoch) */\n\tiat: number;\n}\n\n/**\n * Options for generating a preview token\n */\nexport interface GeneratePreviewTokenOptions {\n\t/** Content ID in format \"collection:id\" */\n\tcontentId: string;\n\t/** How long the token is valid. Accepts \"1h\", \"30m\", \"1d\", or seconds as number. Default: \"1h\" */\n\texpiresIn?: string | number;\n\t/** Secret key for signing. Should be from environment variable. */\n\tsecret: string;\n}\n\n/**\n * Parse duration string to seconds\n * Supports: \"1h\", \"30m\", \"1d\", \"2w\", or raw seconds\n */\nfunction parseDuration(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\treturn duration;\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use \"1h\", \"30m\", \"1d\", \"2w\", or seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Create HMAC-SHA256 signature using Web Crypto API\n */\nasync function createSignature(data: string, secret: string): Promise<Uint8Array> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"sign\"],\n\t);\n\tconst signature = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data));\n\treturn new Uint8Array(signature);\n}\n\n/**\n * Verify HMAC-SHA256 signature\n */\nasync function verifySignature(\n\tdata: string,\n\tsignature: Uint8Array,\n\tsecret: string,\n): Promise<boolean> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"verify\"],\n\t);\n\t// Create a new ArrayBuffer from the signature to satisfy BufferSource typing\n\t// (Uint8Array.buffer is ArrayBufferLike which includes SharedArrayBuffer)\n\tconst sigBuffer: ArrayBuffer = new ArrayBuffer(signature.byteLength);\n\tnew Uint8Array(sigBuffer).set(signature);\n\treturn crypto.subtle.verify(\"HMAC\", key, sigBuffer, encoder.encode(data));\n}\n\n/**\n * Generate a preview token for content\n *\n * @example\n * ```ts\n * const token = await generatePreviewToken({\n *   contentId: \"posts:abc123\",\n *   expiresIn: \"1h\",\n *   secret: process.env.PREVIEW_SECRET!,\n * });\n * ```\n */\nexport async function generatePreviewToken(options: GeneratePreviewTokenOptions): Promise<string> {\n\tconst { contentId, expiresIn = \"1h\", secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\tif (!contentId || !contentId.includes(\":\")) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\n\tconst now = Math.floor(Date.now() / 1000);\n\tconst duration = parseDuration(expiresIn);\n\n\tconst payload: PreviewTokenPayload = {\n\t\tcid: contentId,\n\t\texp: now + duration,\n\t\tiat: now,\n\t};\n\n\t// Encode payload\n\tconst payloadJson = JSON.stringify(payload);\n\tconst encodedPayload = encodeBase64url(new TextEncoder().encode(payloadJson));\n\n\t// Sign it\n\tconst signature = await createSignature(encodedPayload, secret);\n\tconst encodedSignature = encodeBase64url(signature);\n\n\treturn `${encodedPayload}.${encodedSignature}`;\n}\n\n/**\n * Result of verifying a preview token\n */\nexport type VerifyPreviewTokenResult =\n\t| { valid: true; payload: PreviewTokenPayload }\n\t| { valid: false; error: \"invalid\" | \"expired\" | \"malformed\" | \"none\" };\n\n/**\n * Options for verifyPreviewToken\n */\nexport type VerifyPreviewTokenOptions = {\n\t/** Secret key for verifying tokens */\n\tsecret: string;\n} & (\n\t| { /** URL to extract _preview token from */ url: URL }\n\t| {\n\t\t\t/** Preview token string (can be null) */ token: string | null | undefined;\n\t  }\n);\n\n/**\n * Verify a preview token and return the payload\n *\n * @example\n * ```ts\n * // With URL (extracts _preview query param)\n * const result = await verifyPreviewToken({\n *   url: Astro.url,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * // With token directly\n * const result = await verifyPreviewToken({\n *   token: someToken,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * if (result.valid) {\n *   console.log(result.payload.cid); // \"posts:abc123\"\n * }\n * ```\n */\nexport async function verifyPreviewToken(\n\toptions: VerifyPreviewTokenOptions,\n): Promise<VerifyPreviewTokenResult> {\n\tconst { secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\t// Extract token from URL or use provided token\n\tconst token = \"url\" in options ? options.url.searchParams.get(\"_preview\") : options.token;\n\n\t// Handle null/undefined token\n\tif (!token) {\n\t\treturn { valid: false, error: \"none\" };\n\t}\n\n\t// Split token into payload and signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst [encodedPayload, encodedSignature] = parts;\n\n\t// Verify signature\n\tlet signature: Uint8Array;\n\ttry {\n\t\tsignature = decodeBase64url(encodedSignature);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst isValid = await verifySignature(encodedPayload, signature, secret);\n\tif (!isValid) {\n\t\treturn { valid: false, error: \"invalid\" };\n\t}\n\n\t// Decode and parse payload\n\tlet payload: PreviewTokenPayload;\n\ttry {\n\t\tconst payloadBytes = decodeBase64url(encodedPayload);\n\t\tconst payloadJson = new TextDecoder().decode(payloadBytes);\n\t\tpayload = JSON.parse(payloadJson);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check required fields\n\tif (\n\t\ttypeof payload.cid !== \"string\" ||\n\t\ttypeof payload.exp !== \"number\" ||\n\t\ttypeof payload.iat !== \"number\"\n\t) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check expiry\n\tconst now = Math.floor(Date.now() / 1000);\n\tif (payload.exp < now) {\n\t\treturn { valid: false, error: \"expired\" };\n\t}\n\n\treturn { valid: true, payload };\n}\n\n/**\n * Parse a content ID into collection and id\n */\nexport function parseContentId(contentId: string): {\n\tcollection: string;\n\tid: string;\n} {\n\tconst colonIndex = contentId.indexOf(\":\");\n\tif (colonIndex === -1) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\treturn {\n\t\tcollection: contentId.slice(0, colonIndex),\n\t\tid: contentId.slice(colonIndex + 1),\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,mBAAmB;;;;;AA8BzB,SAAS,cAAc,UAAmC;AACzD,KAAI,OAAO,aAAa,SACvB,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,6CACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;AAOpD,eAAe,gBAAgB,MAAc,QAAqC;CACjF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACR;CACD,MAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,CAAC;AAC7E,QAAO,IAAI,WAAW,UAAU;;;;;AAMjC,eAAe,gBACd,MACA,WACA,QACmB;CACnB,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,SAAS,CACV;CAGD,MAAM,YAAyB,IAAI,YAAY,UAAU,WAAW;AACpE,KAAI,WAAW,UAAU,CAAC,IAAI,UAAU;AACxC,QAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,QAAQ,OAAO,KAAK,CAAC;;;;;;;;;;;;;;AAe1E,eAAsB,qBAAqB,SAAuD;CACjG,MAAM,EAAE,WAAW,YAAY,MAAM,WAAW;AAEhD,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;AAG9C,KAAI,CAAC,aAAa,CAAC,UAAU,SAAS,IAAI,CACzC,OAAM,IAAI,MAAM,iDAA+C;CAGhE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAGzC,MAAM,UAA+B;EACpC,KAAK;EACL,KAAK,MAJW,cAAc,UAAU;EAKxC,KAAK;EACL;CAGD,MAAM,cAAc,KAAK,UAAU,QAAQ;CAC3C,MAAM,iBAAiB,gBAAgB,IAAI,aAAa,CAAC,OAAO,YAAY,CAAC;AAM7E,QAAO,GAAG,eAAe,GAFA,gBADP,MAAM,gBAAgB,gBAAgB,OAAO,CACZ;;;;;;;;;;;;;;;;;;;;;;;;AA+CpD,eAAsB,mBACrB,SACoC;CACpC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;CAI9C,MAAM,QAAQ,SAAS,UAAU,QAAQ,IAAI,aAAa,IAAI,WAAW,GAAG,QAAQ;AAGpF,KAAI,CAAC,MACJ,QAAO;EAAE,OAAO;EAAO,OAAO;EAAQ;CAIvC,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EACpB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAG5C,MAAM,CAAC,gBAAgB,oBAAoB;CAG3C,IAAI;AACJ,KAAI;AACH,cAAY,gBAAgB,iBAAiB;SACtC;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KAAI,CADY,MAAM,gBAAgB,gBAAgB,WAAW,OAAO,CAEvE,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;CAI1C,IAAI;AACJ,KAAI;EACH,MAAM,eAAe,gBAAgB,eAAe;EACpD,MAAM,cAAc,IAAI,aAAa,CAAC,OAAO,aAAa;AAC1D,YAAU,KAAK,MAAM,YAAY;SAC1B;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KACC,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,SAEvB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAI5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,KAAI,QAAQ,MAAM,IACjB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;AAG1C,QAAO;EAAE,OAAO;EAAM;EAAS;;;;;AAMhC,SAAgB,eAAe,WAG7B;CACD,MAAM,aAAa,UAAU,QAAQ,IAAI;AACzC,KAAI,eAAe,GAClB,OAAM,IAAI,MAAM,iDAA+C;AAEhE,QAAO;EACN,YAAY,UAAU,MAAM,GAAG,WAAW;EAC1C,IAAI,UAAU,MAAM,aAAa,EAAE;EACnC"}

package/dist/{transaction-qfqpPVpu.mjs → transaction-D0FOsb3X.mjs}

@@ -25,4 +25,4 @@ async function withTransaction(db, fn) {
 
 //#endregion
 export { withTransaction as t };
-//# sourceMappingURL=transaction-qfqpPVpu.mjs.map
+//# sourceMappingURL=transaction-D0FOsb3X.mjs.map

package/dist/{transaction-qfqpPVpu.mjs.map → transaction-D0FOsb3X.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"transaction-qfqpPVpu.mjs","names":[],"sources":["../src/database/transaction.ts"],"sourcesContent":["/**\n * Transaction utility for D1 compatibility\n *\n * D1 (via kysely-d1) does not support transactions. On workerd, the error\n * from beginTransaction() crosses request contexts and can hang the worker.\n *\n * This utility provides a drop-in replacement that runs the callback directly\n * against the db instance when transactions are unavailable. D1 is single-writer\n * so atomicity is not a concern for individual statements — multi-statement\n * atomicity is lost, but that's a known D1 limitation.\n *\n * Usage:\n *   import { withTransaction } from \"../database/transaction.js\";\n *   const result = await withTransaction(db, async (trx) => { ... });\n */\n\nimport type { Kysely, Transaction } from \"kysely\";\n\n/**\n * Run a callback inside a transaction if supported, or directly if not.\n *\n * Probes the database once on first call to determine if transactions work.\n * The result is cached for the lifetime of the process/worker.\n */\nlet transactionsSupported: boolean | null = null;\nconst TRANSACTIONS_NOT_SUPPORTED_RE = /transactions are not supported/i;\n\nexport async function withTransaction<DB, T>(\n\tdb: Kysely<DB>,\n\tfn: (trx: Kysely<DB> | Transaction<DB>) => Promise<T>,\n): Promise<T> {\n\t// Fast path: we already know transactions work\n\tif (transactionsSupported === true) {\n\t\treturn db.transaction().execute(fn);\n\t}\n\n\t// Fast path: we already know they don't\n\tif (transactionsSupported === false) {\n\t\treturn fn(db);\n\t}\n\n\t// First call: probe\n\ttry {\n\t\tconst result = await db.transaction().execute(fn);\n\t\ttransactionsSupported = true;\n\t\treturn result;\n\t} catch (error) {\n\t\tif (error instanceof Error && TRANSACTIONS_NOT_SUPPORTED_RE.test(error.message)) {\n\t\t\ttransactionsSupported = false;\n\t\t\treturn fn(db);\n\t\t}\n\t\tthrow error;\n\t}\n}\n"],"mappings":";;;;;;;AAwBA,IAAI,wBAAwC;AAC5C,MAAM,gCAAgC;AAEtC,eAAsB,gBACrB,IACA,IACa;AAEb,KAAI,0BAA0B,KAC7B,QAAO,GAAG,aAAa,CAAC,QAAQ,GAAG;AAIpC,KAAI,0BAA0B,MAC7B,QAAO,GAAG,GAAG;AAId,KAAI;EACH,MAAM,SAAS,MAAM,GAAG,aAAa,CAAC,QAAQ,GAAG;AACjD,0BAAwB;AACxB,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,SAAS,8BAA8B,KAAK,MAAM,QAAQ,EAAE;AAChF,2BAAwB;AACxB,UAAO,GAAG,GAAG;;AAEd,QAAM"}
+{"version":3,"file":"transaction-D0FOsb3X.mjs","names":[],"sources":["../src/database/transaction.ts"],"sourcesContent":["/**\n * Transaction utility for D1 compatibility\n *\n * D1 (via kysely-d1) does not support transactions. On workerd, the error\n * from beginTransaction() crosses request contexts and can hang the worker.\n *\n * This utility provides a drop-in replacement that runs the callback directly\n * against the db instance when transactions are unavailable. D1 is single-writer\n * so atomicity is not a concern for individual statements — multi-statement\n * atomicity is lost, but that's a known D1 limitation.\n *\n * Usage:\n *   import { withTransaction } from \"../database/transaction.js\";\n *   const result = await withTransaction(db, async (trx) => { ... });\n */\n\nimport type { Kysely, Transaction } from \"kysely\";\n\n/**\n * Run a callback inside a transaction if supported, or directly if not.\n *\n * Probes the database once on first call to determine if transactions work.\n * The result is cached for the lifetime of the process/worker.\n */\nlet transactionsSupported: boolean | null = null;\nconst TRANSACTIONS_NOT_SUPPORTED_RE = /transactions are not supported/i;\n\nexport async function withTransaction<DB, T>(\n\tdb: Kysely<DB>,\n\tfn: (trx: Kysely<DB> | Transaction<DB>) => Promise<T>,\n): Promise<T> {\n\t// Fast path: we already know transactions work\n\tif (transactionsSupported === true) {\n\t\treturn db.transaction().execute(fn);\n\t}\n\n\t// Fast path: we already know they don't\n\tif (transactionsSupported === false) {\n\t\treturn fn(db);\n\t}\n\n\t// First call: probe\n\ttry {\n\t\tconst result = await db.transaction().execute(fn);\n\t\ttransactionsSupported = true;\n\t\treturn result;\n\t} catch (error) {\n\t\tif (error instanceof Error && TRANSACTIONS_NOT_SUPPORTED_RE.test(error.message)) {\n\t\t\ttransactionsSupported = false;\n\t\t\treturn fn(db);\n\t\t}\n\t\tthrow error;\n\t}\n}\n"],"mappings":";;;;;;;AAwBA,IAAI,wBAAwC;AAC5C,MAAM,gCAAgC;AAEtC,eAAsB,gBACrB,IACA,IACa;AAEb,KAAI,0BAA0B,KAC7B,QAAO,GAAG,aAAa,CAAC,QAAQ,GAAG;AAIpC,KAAI,0BAA0B,MAC7B,QAAO,GAAG,GAAG;AAId,KAAI;EACH,MAAM,SAAS,MAAM,GAAG,aAAa,CAAC,QAAQ,GAAG;AACjD,0BAAwB;AACxB,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,SAAS,8BAA8B,KAAK,MAAM,QAAQ,EAAE;AAChF,2BAAwB;AACxB,UAAO,GAAG,GAAG;;AAEd,QAAM"}

package/dist/{transport-DPefPMcz.mjs → transport-CKrlqSpD.mjs}

@@ -132,4 +132,4 @@ function refreshInterceptor(options) {
 
 //#endregion
 export { tokenInterceptor as a, refreshInterceptor as i, csrfInterceptor as n, devBypassInterceptor as r, createTransport as t };
-//# sourceMappingURL=transport-DPefPMcz.mjs.map
+//# sourceMappingURL=transport-CKrlqSpD.mjs.map

package/dist/{transport-DPefPMcz.mjs.map → transport-CKrlqSpD.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"transport-DPefPMcz.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n}): Interceptor {\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await globalThis.fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t}),\n\t\t});\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(request.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(request, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAInB;CACf,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,WAAW,MAAM,QAAQ,eAAe;GACzD,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAC/B,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;AAIhD,SAAO"}
+{"version":3,"file":"transport-CKrlqSpD.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n}): Interceptor {\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await globalThis.fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t}),\n\t\t});\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { success, data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(request.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(request, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAInB;CACf,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,WAAW,MAAM,QAAQ,eAAe;GACzD,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAC/B,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;AAIhD,SAAO"}

package/dist/{transport-BMDWHSgZ.d.mts → transport-Vd7VdqHv.d.mts}

@@ -39,4 +39,4 @@ declare function tokenInterceptor(token: string): Interceptor;
 declare function devBypassInterceptor(baseUrl: string): Interceptor;
 //#endregion
 export { tokenInterceptor as a, devBypassInterceptor as i, createTransport as n, csrfInterceptor as r, Interceptor as t };
-//# sourceMappingURL=transport-BMDWHSgZ.d.mts.map
+//# sourceMappingURL=transport-Vd7VdqHv.d.mts.map

package/dist/{transport-BMDWHSgZ.d.mts.map → transport-Vd7VdqHv.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"transport-BMDWHSgZ.d.mts","names":[],"sources":["../src/client/transport.ts"],"mappings":";;AAeA;;;;;;;;;;KAAY,WAAA,IACX,OAAA,EAAS,OAAA,EACT,IAAA,GAAO,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA,MAChC,OAAA,CAAQ,QAAA;AAAA,UAEI,gBAAA;EAChB,YAAA,GAAe,WAAA;AAAA;;;;iBAUA,eAAA,CAAgB,OAAA,GAAS,gBAAA;EACxC,KAAA,GAAQ,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;AAAA;;;AAZtC;;;;iBAqCgB,eAAA,CAAA,GAAmB,WAAA;AA1BnC;;;AAAA,iBA8CgB,gBAAA,CAAiB,KAAA,WAAgB,WAAA;;;;;;iBAajC,oBAAA,CAAqB,OAAA,WAAkB,WAAA"}
+{"version":3,"file":"transport-Vd7VdqHv.d.mts","names":[],"sources":["../src/client/transport.ts"],"mappings":";;AAeA;;;;;;;;;;KAAY,WAAA,IACX,OAAA,EAAS,OAAA,EACT,IAAA,GAAO,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA,MAChC,OAAA,CAAQ,QAAA;AAAA,UAEI,gBAAA;EAChB,YAAA,GAAe,WAAA;AAAA;;;;iBAUA,eAAA,CAAgB,OAAA,GAAS,gBAAA;EACxC,KAAA,GAAQ,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;AAAA;;;AAZtC;;;;iBAqCgB,eAAA,CAAA,GAAmB,WAAA;AA1BnC;;;AAAA,iBA8CgB,gBAAA,CAAiB,KAAA,WAAgB,WAAA;;;;;;iBAajC,oBAAA,CAAqB,OAAA,WAAkB,WAAA"}

package/dist/{trusted-proxy-VTPRiX2s.mjs → trusted-proxy-CwjQj0YG.mjs}

@@ -48,4 +48,4 @@ function getTrustedProxyHeaders(config) {
 
 //#endregion
 export { normalizeTrustedHeaders as n, getTrustedProxyHeaders as t };
-//# sourceMappingURL=trusted-proxy-VTPRiX2s.mjs.map
+//# sourceMappingURL=trusted-proxy-CwjQj0YG.mjs.map

package/dist/{trusted-proxy-VTPRiX2s.mjs.map → trusted-proxy-CwjQj0YG.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"trusted-proxy-VTPRiX2s.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}
+{"version":3,"file":"trusted-proxy-CwjQj0YG.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}

package/dist/{types-CgvhU-hF.d.mts → types-B4vm81VH.d.mts}

@@ -195,4 +195,4 @@ interface ExternalAuthConfig {
 }
 //#endregion
 export { AuthResult as a, AuthProviderModule as i, AuthProviderAdminExports as n, AuthRouteDescriptor as o, AuthProviderDescriptor as r, ExternalAuthConfig as s, AuthDescriptor as t };
-//# sourceMappingURL=types-CgvhU-hF.d.mts.map
+//# sourceMappingURL=types-B4vm81VH.d.mts.map

package/dist/{types-CgvhU-hF.d.mts.map → types-B4vm81VH.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-CgvhU-hF.d.mts","names":[],"sources":["../src/auth/types.ts"],"mappings":";;;;;;AAgBA;;;;;;;;;;;;UAAiB,UAAA;EAmBc;EAjB9B,KAAA;EAiB8B;EAf9B,IAAA;EA2BA;EAzBA,IAAA;EA8BM;EA5BN,OAAA;EAqCgB;EAnChB,QAAA,GAAW,MAAA;AAAA;;;;;;;UASK,cAAA;EAkCH;;;;EA7Bb,IAAA;EA6BmE;AAwBpE;;;;EA9CC,UAAA;EAsFuD;;;EAjFvD,MAAA;AAAA;;;;;;;UASgB,kBAAA;EAsEN;;;;;;;EA9DV,YAAA,CAAa,OAAA,EAAS,OAAA,EAAS,MAAA,YAAkB,OAAA,CAAQ,UAAA;AAAA;;;;AAoF1D;;;;;;;;;;;;;;UA5DiB,sBAAA;EAgFsC;EA9EtD,EAAA;EAoFgB;EAjFhB,KAAA;;EAGA,MAAA;EAmFA;;;;;;EA3EA,UAAA;;;;;EAMA,MAAA,GAAS,mBAAA;;;;;;EAOT,YAAA;;;;;;;;EASA,OAAA,GAAU,MAAA;IAEP,OAAA,GAAU,KAAA;IAA0B,aAAA,GAAgB,KAAA;EAAA;AAAA;;;;UAOvC,mBAAA;;EAEhB,OAAA;;EAEA,UAAA;AAAA;;;;;;;UASgB,wBAAA;;;;;;EAMhB,WAAA,GANwC,KAAA,CAMV,aAAA;;;;;;EAO9B,SAAA,GAP2C,KAAA,CAOf,aAAA;;;;;;EAO5B,SAAA,GAPyC,KAAA,CAOb,aAAA;IAAgB,UAAA;EAAA;AAAA;;;;UAM5B,kBAAA;;;;;EAKhB,aAAA;;;;;EAMA,WAAA;;;;;;EAOA,SAAA;;;;;;;;;;;;;;EAeA,WAAA,GAAc,MAAA;AAAA"}
+{"version":3,"file":"types-B4vm81VH.d.mts","names":[],"sources":["../src/auth/types.ts"],"mappings":";;;;;;AAgBA;;;;;;;;;;;;UAAiB,UAAA;EAmBc;EAjB9B,KAAA;EAiB8B;EAf9B,IAAA;EA2BA;EAzBA,IAAA;EA8BM;EA5BN,OAAA;EAqCgB;EAnChB,QAAA,GAAW,MAAA;AAAA;;;;;;;UASK,cAAA;EAkCH;;;;EA7Bb,IAAA;EA6BmE;AAwBpE;;;;EA9CC,UAAA;EAsFuD;;;EAjFvD,MAAA;AAAA;;;;;;;UASgB,kBAAA;EAsEN;;;;;;;EA9DV,YAAA,CAAa,OAAA,EAAS,OAAA,EAAS,MAAA,YAAkB,OAAA,CAAQ,UAAA;AAAA;;;;AAoF1D;;;;;;;;;;;;;;UA5DiB,sBAAA;EAgFsC;EA9EtD,EAAA;EAoFgB;EAjFhB,KAAA;;EAGA,MAAA;EAmFA;;;;;;EA3EA,UAAA;;;;;EAMA,MAAA,GAAS,mBAAA;;;;;;EAOT,YAAA;;;;;;;;EASA,OAAA,GAAU,MAAA;IAEP,OAAA,GAAU,KAAA;IAA0B,aAAA,GAAgB,KAAA;EAAA;AAAA;;;;UAOvC,mBAAA;;EAEhB,OAAA;;EAEA,UAAA;AAAA;;;;;;;UASgB,wBAAA;;;;;;EAMhB,WAAA,GANwC,KAAA,CAMV,aAAA;;;;;;EAO9B,SAAA,GAP2C,KAAA,CAOf,aAAA;;;;;;EAO5B,SAAA,GAPyC,KAAA,CAOb,aAAA;IAAgB,UAAA;EAAA;AAAA;;;;UAM5B,kBAAA;;;;;EAKhB,aAAA;;;;;EAMA,WAAA;;;;;;EAOA,SAAA;;;;;;;;;;;;;;EAeA,WAAA,GAAc,MAAA;AAAA"}

package/dist/{types-ea9sAPck.d.mts → types-B97jg3aW.d.mts}

@@ -178,6 +178,11 @@ interface Storage {
    * Get public URL for a file
    */
   getPublicUrl(key: string): string;
+  /**
+   * Get the origin the browser connects to for direct client uploads.
+   * Used by the admin CSP when the storage descriptor has no static endpoint.
+   */
+  getClientUploadOrigin?(): string;
 }
 /**
  * Storage error with additional context
@@ -189,4 +194,4 @@ declare class EmDashStorageError extends Error {
 }
 //#endregion
 export { ListOptions as a, S3StorageConfig as c, Storage as d, StorageDescriptor as f, FileInfo as i, SignedUploadOptions as l, DownloadResult as n, ListResult as o, UploadResult as p, EmDashStorageError as r, LocalStorageConfig as s, CreateStorageFn as t, SignedUploadUrl as u };
-//# sourceMappingURL=types-ea9sAPck.d.mts.map
+//# sourceMappingURL=types-B97jg3aW.d.mts.map

package/dist/{types-ea9sAPck.d.mts.map → types-B97jg3aW.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-ea9sAPck.d.mts","names":[],"sources":["../src/storage/types.ts"],"mappings":";;AAUA;;;;;;;;UAAiB,eAAA;EAoBhB;EAlBA,QAAA;EAkBS;EAhBT,MAAA;EAsBkC;;;;AAUnC;EA1BC,WAAA;;;;;;EAMA,eAAA;EAwBc;EAtBd,MAAA;EAiC0B;EA/B1B,SAAA;AAAA;;;;UAMgB,kBAAA;EAyByD;EAvBzE,SAAA;EA4B4B;EA1B5B,OAAA;AAAA;;;;UAMgB,iBAAA;EA0BZ;EAxBJ,UAAA;EA8B8B;EA5B9B,MAAA,EAAQ,MAAA;AAAA;;;;;;;;AAwCT;KA7BY,eAAA,IAAmB,MAAA,EAAQ,MAAA,sBAA4B,OAAA;;;;UAKlD,YAAA;EA8BhB;EA5BA,GAAA;EA8BA;EA5BA,GAAA;EA4BS;EA1BT,IAAA;AAAA;;;;UAMgB,cAAA;EAgChB;EA9BA,IAAA,EAAM,cAAA,CAAe,UAAA;EAgCZ;EA9BT,WAAA;EAoCgB;EAlChB,IAAA;AAAA;;;;UAMgB,eAAA;EAgCN;EA9BV,GAAA;EAoCgB;EAlChB,MAAA;;EAEA,OAAA,EAAS,MAAA;EAkCT;EAhCA,SAAA;AAAA;;;;UAMgB,mBAAA;EAsCA;EApChB,GAAA;;EAEA,WAAA;EAoCA;EAlCA,IAAA;EAsCA;EApCA,SAAA;AAAA;AA4CD;;;AAAA,UAtCiB,UAAA;EA4CA;EA1ChB,KAAA,EAAO,QAAA;EA0CsB;EAxC7B,UAAA;AAAA;;;;UAMgB,QAAA;EAyDD;EAvDf,GAAA;EAuD6B;EArD7B,IAAA;EA2D0D;EAzD1D,YAAA,EAAc,IAAA;EAyD2C;EAvDzD,IAAA;AAAA;;;;UAMgB,WAAA;EAoBa;EAlB7B,MAAA;EAmBC;EAjBD,KAAA;EAkBI;EAhBJ,MAAA;AAAA;;;;;;UAQgB,OAAA;EAwBhB;;;EApBA,MAAA,CAAO,OAAA;IACN,GAAA;IACA,IAAA,EAAM,MAAA,GAAS,UAAA,GAAa,cAAA,CAAe,UAAA;IAC3C,WAAA;EAAA,IACG,OAAA,CAAQ,YAAA;EA2BZ;;;EAtBA,QAAA,CAAS,GAAA,WAAc,OAAA,CAAQ,cAAA;EAsB2B;;;;EAhB1D,MAAA,CAAO,GAAA,WAAc,OAAA;EA2BT;;;EAtBZ,MAAA,CAAO,GAAA,WAAc,OAAA;EAsBkB;;;EAjBvC,IAAA,CAAK,OAAA,GAAU,WAAA,GAAc,OAAA,CAAQ,UAAA;EAmBpC;;;;EAbD,kBAAA,CAAmB,OAAA,EAAS,mBAAA,GAAsB,OAAA,CAAQ,eAAA;;;;EAK1D,YAAA,CAAa,GAAA;AAAA;;;;cAMD,kBAAA,SAA2B,KAAA;EAG/B,IAAA;EACS,KAAA;cAFhB,OAAA,UACO,IAAA,UACS,KAAA;AAAA"}
+{"version":3,"file":"types-B97jg3aW.d.mts","names":[],"sources":["../src/storage/types.ts"],"mappings":";;AAUA;;;;;;;;UAAiB,eAAA;EAoBhB;EAlBA,QAAA;EAkBS;EAhBT,MAAA;EAsBkC;;;;AAUnC;EA1BC,WAAA;;;;;;EAMA,eAAA;EAwBc;EAtBd,MAAA;EAiC0B;EA/B1B,SAAA;AAAA;;;;UAMgB,kBAAA;EAyByD;EAvBzE,SAAA;EA4B4B;EA1B5B,OAAA;AAAA;;;;UAMgB,iBAAA;EA0BZ;EAxBJ,UAAA;EA8B8B;EA5B9B,MAAA,EAAQ,MAAA;AAAA;;;;;;;;AAwCT;KA7BY,eAAA,IAAmB,MAAA,EAAQ,MAAA,sBAA4B,OAAA;;;;UAKlD,YAAA;EA8BhB;EA5BA,GAAA;EA8BA;EA5BA,GAAA;EA4BS;EA1BT,IAAA;AAAA;;;;UAMgB,cAAA;EAgChB;EA9BA,IAAA,EAAM,cAAA,CAAe,UAAA;EAgCZ;EA9BT,WAAA;EAoCgB;EAlChB,IAAA;AAAA;;;;UAMgB,eAAA;EAgCN;EA9BV,GAAA;EAoCgB;EAlChB,MAAA;;EAEA,OAAA,EAAS,MAAA;EAkCT;EAhCA,SAAA;AAAA;;;;UAMgB,mBAAA;EAsCA;EApChB,GAAA;;EAEA,WAAA;EAoCA;EAlCA,IAAA;EAsCA;EApCA,SAAA;AAAA;AA4CD;;;AAAA,UAtCiB,UAAA;EA4CA;EA1ChB,KAAA,EAAO,QAAA;EA0CsB;EAxC7B,UAAA;AAAA;;;;UAMgB,QAAA;EAyDD;EAvDf,GAAA;EAuD6B;EArD7B,IAAA;EA2D0D;EAzD1D,YAAA,EAAc,IAAA;EAyD2C;EAvDzD,IAAA;AAAA;;;;UAMgB,WAAA;EAoBa;EAlB7B,MAAA;EAmBC;EAjBD,KAAA;EAkBI;EAhBJ,MAAA;AAAA;;;;;;UAQgB,OAAA;EAwBhB;;;EApBA,MAAA,CAAO,OAAA;IACN,GAAA;IACA,IAAA,EAAM,MAAA,GAAS,UAAA,GAAa,cAAA,CAAe,UAAA;IAC3C,WAAA;EAAA,IACG,OAAA,CAAQ,YAAA;EA2BZ;;;EAtBA,QAAA,CAAS,GAAA,WAAc,OAAA,CAAQ,cAAA;EAsB2B;;;;EAhB1D,MAAA,CAAO,GAAA,WAAc,OAAA;EA2BA;AAMtB;;EA5BC,MAAA,CAAO,GAAA,WAAc,OAAA;EA4BuB;;;EAvB5C,IAAA,CAAK,OAAA,GAAU,WAAA,GAAc,OAAA,CAAQ,UAAA;;;;;EAMrC,kBAAA,CAAmB,OAAA,EAAS,mBAAA,GAAsB,OAAA,CAAQ,eAAA;EAqB1B;;;EAhBhC,YAAA,CAAa,GAAA;;;;;EAMb,qBAAA;AAAA;;;;cAMY,kBAAA,SAA2B,KAAA;EAG/B,IAAA;EACS,KAAA;cAFhB,OAAA,UACO,IAAA,UACS,KAAA;AAAA"}

package/dist/{types-Jo3UYd6b.mjs → types-BD40g7zz.mjs}

@@ -13,4 +13,4 @@ var EmDashStorageError = class extends Error {
 
 //#endregion
 export { EmDashStorageError as t };
-//# sourceMappingURL=types-Jo3UYd6b.mjs.map
+//# sourceMappingURL=types-BD40g7zz.mjs.map

package/dist/{types-Jo3UYd6b.mjs.map → types-BD40g7zz.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"types-Jo3UYd6b.mjs","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage Layer Types\n *\n * Defines the interface for S3-compatible storage backends.\n * Works with R2, AWS S3, Minio, and other S3-compatible services.\n */\n\n/**\n * Storage configuration for S3-compatible backends\n */\nexport interface S3StorageConfig {\n\t/** S3 endpoint URL (e.g., \"https://xxx.r2.cloudflarestorage.com\") */\n\tendpoint: string;\n\t/** Bucket name */\n\tbucket: string;\n\t/**\n\t * AWS access key ID.\n\t * May be resolved from the `S3_ACCESS_KEY_ID` env var at runtime on Node.\n\t * Must be provided together with `secretAccessKey`, or both omitted.\n\t */\n\taccessKeyId?: string;\n\t/**\n\t * AWS secret access key.\n\t * May be resolved from the `S3_SECRET_ACCESS_KEY` env var at runtime on Node.\n\t * Must be provided together with `accessKeyId`, or both omitted.\n\t */\n\tsecretAccessKey?: string;\n\t/** Optional region (defaults to \"auto\") */\n\tregion?: string;\n\t/** Optional public URL prefix for generated URLs (e.g., CDN URL) */\n\tpublicUrl?: string;\n}\n\n/**\n * Local filesystem storage for development\n */\nexport interface LocalStorageConfig {\n\t/** Directory path for storing files */\n\tdirectory: string;\n\t/** Base URL for serving files */\n\tbaseUrl: string;\n}\n\n/**\n * Storage adapter descriptor (serializable config)\n */\nexport interface StorageDescriptor {\n\t/** Module path exporting createStorage function */\n\tentrypoint: string;\n\t/** Serializable config passed to createStorage at runtime */\n\tconfig: Record<string, unknown>;\n}\n\n/**\n * Factory function signature for storage adapters\n *\n * Each adapter accesses its own bindings directly:\n * - R2: imports from cloudflare:workers\n * - S3: uses credentials from config\n * - Local: uses filesystem path from config\n */\nexport type CreateStorageFn = (config: Record<string, unknown>) => Storage;\n\n/**\n * Upload result\n */\nexport interface UploadResult {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** Public URL to access the file */\n\turl: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Download result\n */\nexport interface DownloadResult {\n\t/** File content as readable stream */\n\tbody: ReadableStream<Uint8Array>;\n\t/** MIME type */\n\tcontentType: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Signed URL for direct upload\n */\nexport interface SignedUploadUrl {\n\t/** Signed URL for PUT request */\n\turl: string;\n\t/** HTTP method (always PUT) */\n\tmethod: \"PUT\";\n\t/** Headers to include in the upload request */\n\theaders: Record<string, string>;\n\t/** URL expiration time (ISO string) */\n\texpiresAt: string;\n}\n\n/**\n * Options for generating signed upload URL\n */\nexport interface SignedUploadOptions {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** MIME type of the file */\n\tcontentType: string;\n\t/** File size in bytes (for content-length validation) */\n\tsize?: number;\n\t/** URL expiration in seconds (default: 3600) */\n\texpiresIn?: number;\n}\n\n/**\n * File listing result\n */\nexport interface ListResult {\n\t/** List of files */\n\tfiles: FileInfo[];\n\t/** Cursor for next page (if more results) */\n\tnextCursor?: string;\n}\n\n/**\n * File info from listing\n */\nexport interface FileInfo {\n\t/** Storage key */\n\tkey: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Last modified date */\n\tlastModified: Date;\n\t/** ETag (content hash) */\n\tetag?: string;\n}\n\n/**\n * Options for listing files\n */\nexport interface ListOptions {\n\t/** Filter by key prefix */\n\tprefix?: string;\n\t/** Maximum results per page */\n\tlimit?: number;\n\t/** Cursor from previous list call */\n\tcursor?: string;\n}\n\n/**\n * Storage interface\n *\n * All storage backends must implement this interface.\n */\nexport interface Storage {\n\t/**\n\t * Upload a file to storage\n\t */\n\tupload(options: {\n\t\tkey: string;\n\t\tbody: Buffer | Uint8Array | ReadableStream<Uint8Array>;\n\t\tcontentType: string;\n\t}): Promise<UploadResult>;\n\n\t/**\n\t * Download a file from storage\n\t */\n\tdownload(key: string): Promise<DownloadResult>;\n\n\t/**\n\t * Delete a file from storage\n\t * Idempotent - does not throw if file doesn't exist\n\t */\n\tdelete(key: string): Promise<void>;\n\n\t/**\n\t * Check if a file exists\n\t */\n\texists(key: string): Promise<boolean>;\n\n\t/**\n\t * List files in storage\n\t */\n\tlist(options?: ListOptions): Promise<ListResult>;\n\n\t/**\n\t * Generate a signed URL for direct upload\n\t * Client uploads directly to storage, bypassing the server\n\t */\n\tgetSignedUploadUrl(options: SignedUploadOptions): Promise<SignedUploadUrl>;\n\n\t/**\n\t * Get public URL for a file\n\t */\n\tgetPublicUrl(key: string): string;\n}\n\n/**\n * Storage error with additional context\n */\nexport class EmDashStorageError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic code: string,\n\t\tpublic override cause?: unknown,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"EmDashStorageError\";\n\t}\n}\n"],"mappings":";;;;AA0MA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,YACC,SACA,AAAO,MACP,AAAgB,OACf;AACD,QAAM,QAAQ;EAHP;EACS;AAGhB,OAAK,OAAO"}
+{"version":3,"file":"types-BD40g7zz.mjs","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage Layer Types\n *\n * Defines the interface for S3-compatible storage backends.\n * Works with R2, AWS S3, Minio, and other S3-compatible services.\n */\n\n/**\n * Storage configuration for S3-compatible backends\n */\nexport interface S3StorageConfig {\n\t/** S3 endpoint URL (e.g., \"https://xxx.r2.cloudflarestorage.com\") */\n\tendpoint: string;\n\t/** Bucket name */\n\tbucket: string;\n\t/**\n\t * AWS access key ID.\n\t * May be resolved from the `S3_ACCESS_KEY_ID` env var at runtime on Node.\n\t * Must be provided together with `secretAccessKey`, or both omitted.\n\t */\n\taccessKeyId?: string;\n\t/**\n\t * AWS secret access key.\n\t * May be resolved from the `S3_SECRET_ACCESS_KEY` env var at runtime on Node.\n\t * Must be provided together with `accessKeyId`, or both omitted.\n\t */\n\tsecretAccessKey?: string;\n\t/** Optional region (defaults to \"auto\") */\n\tregion?: string;\n\t/** Optional public URL prefix for generated URLs (e.g., CDN URL) */\n\tpublicUrl?: string;\n}\n\n/**\n * Local filesystem storage for development\n */\nexport interface LocalStorageConfig {\n\t/** Directory path for storing files */\n\tdirectory: string;\n\t/** Base URL for serving files */\n\tbaseUrl: string;\n}\n\n/**\n * Storage adapter descriptor (serializable config)\n */\nexport interface StorageDescriptor {\n\t/** Module path exporting createStorage function */\n\tentrypoint: string;\n\t/** Serializable config passed to createStorage at runtime */\n\tconfig: Record<string, unknown>;\n}\n\n/**\n * Factory function signature for storage adapters\n *\n * Each adapter accesses its own bindings directly:\n * - R2: imports from cloudflare:workers\n * - S3: uses credentials from config\n * - Local: uses filesystem path from config\n */\nexport type CreateStorageFn = (config: Record<string, unknown>) => Storage;\n\n/**\n * Upload result\n */\nexport interface UploadResult {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** Public URL to access the file */\n\turl: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Download result\n */\nexport interface DownloadResult {\n\t/** File content as readable stream */\n\tbody: ReadableStream<Uint8Array>;\n\t/** MIME type */\n\tcontentType: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Signed URL for direct upload\n */\nexport interface SignedUploadUrl {\n\t/** Signed URL for PUT request */\n\turl: string;\n\t/** HTTP method (always PUT) */\n\tmethod: \"PUT\";\n\t/** Headers to include in the upload request */\n\theaders: Record<string, string>;\n\t/** URL expiration time (ISO string) */\n\texpiresAt: string;\n}\n\n/**\n * Options for generating signed upload URL\n */\nexport interface SignedUploadOptions {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** MIME type of the file */\n\tcontentType: string;\n\t/** File size in bytes (for content-length validation) */\n\tsize?: number;\n\t/** URL expiration in seconds (default: 3600) */\n\texpiresIn?: number;\n}\n\n/**\n * File listing result\n */\nexport interface ListResult {\n\t/** List of files */\n\tfiles: FileInfo[];\n\t/** Cursor for next page (if more results) */\n\tnextCursor?: string;\n}\n\n/**\n * File info from listing\n */\nexport interface FileInfo {\n\t/** Storage key */\n\tkey: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Last modified date */\n\tlastModified: Date;\n\t/** ETag (content hash) */\n\tetag?: string;\n}\n\n/**\n * Options for listing files\n */\nexport interface ListOptions {\n\t/** Filter by key prefix */\n\tprefix?: string;\n\t/** Maximum results per page */\n\tlimit?: number;\n\t/** Cursor from previous list call */\n\tcursor?: string;\n}\n\n/**\n * Storage interface\n *\n * All storage backends must implement this interface.\n */\nexport interface Storage {\n\t/**\n\t * Upload a file to storage\n\t */\n\tupload(options: {\n\t\tkey: string;\n\t\tbody: Buffer | Uint8Array | ReadableStream<Uint8Array>;\n\t\tcontentType: string;\n\t}): Promise<UploadResult>;\n\n\t/**\n\t * Download a file from storage\n\t */\n\tdownload(key: string): Promise<DownloadResult>;\n\n\t/**\n\t * Delete a file from storage\n\t * Idempotent - does not throw if file doesn't exist\n\t */\n\tdelete(key: string): Promise<void>;\n\n\t/**\n\t * Check if a file exists\n\t */\n\texists(key: string): Promise<boolean>;\n\n\t/**\n\t * List files in storage\n\t */\n\tlist(options?: ListOptions): Promise<ListResult>;\n\n\t/**\n\t * Generate a signed URL for direct upload\n\t * Client uploads directly to storage, bypassing the server\n\t */\n\tgetSignedUploadUrl(options: SignedUploadOptions): Promise<SignedUploadUrl>;\n\n\t/**\n\t * Get public URL for a file\n\t */\n\tgetPublicUrl(key: string): string;\n\n\t/**\n\t * Get the origin the browser connects to for direct client uploads.\n\t * Used by the admin CSP when the storage descriptor has no static endpoint.\n\t */\n\tgetClientUploadOrigin?(): string;\n}\n\n/**\n * Storage error with additional context\n */\nexport class EmDashStorageError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic code: string,\n\t\tpublic override cause?: unknown,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"EmDashStorageError\";\n\t}\n}\n"],"mappings":";;;;AAgNA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,YACC,SACA,AAAO,MACP,AAAgB,OACf;AACD,QAAM,QAAQ;EAHP;EACS;AAGhB,OAAK,OAAO"}

package/dist/{types-DmHk7vAt.d.mts → types-BNfPHfay.d.mts}

@@ -72,4 +72,4 @@ interface SiteSettings {
 type SiteSettingKey = keyof SiteSettings;
 //#endregion
 export { SiteSettings as i, SeoSettings as n, SiteSettingKey as r, MediaReference as t };
-//# sourceMappingURL=types-DmHk7vAt.d.mts.map
+//# sourceMappingURL=types-BNfPHfay.d.mts.map

package/dist/{types-DmHk7vAt.d.mts.map → types-BNfPHfay.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-DmHk7vAt.d.mts","names":[],"sources":["../src/settings/types.ts"],"mappings":";;AAyBA;;;;;;;;;;;;AAcA;;;;;;;;;;;UAdiB,cAAA;EAChB,OAAA;EACA,GAAA;;EAEA,GAAA;EA6BU;EA3BV,WAAA;EAgDiB;EA9CjB,KAAA;EAsBA;EApBA,MAAA;AAAA;;UAIgB,WAAA;EAmBN;EAjBV,cAAA;EAuBA;EArBA,cAAA,GAAiB,cAAA;EAuBjB;EArBA,SAAA;EAyBC;EAvBD,kBAAA;EAyBC;EAvBD,gBAAA;AAAA;;UAIgB,YAAA;EAEhB,KAAA;EACA,OAAA;EACA,IAAA,GAAO,cAAA;EACP,OAAA,GAAU,cAAA;EAGV,GAAA;EAGA,YAAA;EACA,UAAA;EACA,QAAA;EAGA,MAAA;IACC,OAAA;IACA,MAAA;IACA,QAAA;IACA,SAAA;IACA,QAAA;IACA,OAAA;EAAA;EAID,GAAA,GAAM,WAAA;AAAA;;KAIK,cAAA,SAAuB,YAAA"}
+{"version":3,"file":"types-BNfPHfay.d.mts","names":[],"sources":["../src/settings/types.ts"],"mappings":";;AAyBA;;;;;;;;;;;;AAcA;;;;;;;;;;;UAdiB,cAAA;EAChB,OAAA;EACA,GAAA;;EAEA,GAAA;EA6BU;EA3BV,WAAA;EAgDiB;EA9CjB,KAAA;EAsBA;EApBA,MAAA;AAAA;;UAIgB,WAAA;EAmBN;EAjBV,cAAA;EAuBA;EArBA,cAAA,GAAiB,cAAA;EAuBjB;EArBA,SAAA;EAyBC;EAvBD,kBAAA;EAyBC;EAvBD,gBAAA;AAAA;;UAIgB,YAAA;EAEhB,KAAA;EACA,OAAA;EACA,IAAA,GAAO,cAAA;EACP,OAAA,GAAU,cAAA;EAGV,GAAA;EAGA,YAAA;EACA,UAAA;EACA,QAAA;EAGA,MAAA;IACC,OAAA;IACA,MAAA;IACA,QAAA;IACA,SAAA;IACA,QAAA;IACA,OAAA;EAAA;EAID,GAAA,GAAM,WAAA;AAAA;;KAIK,cAAA,SAAuB,YAAA"}

package/dist/{types-BcLUUbbR.d.mts → types-BfYUPJdP.d.mts}

@@ -1,4 +1,4 @@
-import { c as CustomFieldValue } from "./types-g_aFIdW0.mjs";
+import { c as CustomFieldValue } from "./types-Kmaxdarz.mjs";
 
 //#region src/database/repositories/types.d.ts
 interface CreateContentInput {
@@ -138,7 +138,15 @@ interface FindManyOptions {
      * Resolved by the handler from the collection's display fields so the
      * repository stays generic. Each name is validated as a SQL identifier.
      */
-    searchColumns?: string[]; /** Inclusive date range over a whitelisted timestamp column. */
+    searchColumns?: string[];
+    /**
+     * Serve `q` from the collection's FTS5 index (`_emdash_fts_<slug>`)
+     * instead of an unindexable substring LIKE. Set by the handler only
+     * when the collection has search enabled and the index exists
+     * (SQLite only). The repository combines a token-prefix MATCH with
+     * an index-served slug prefix so slug lookups keep working.
+     */
+    useFts?: boolean; /** Inclusive date range over a whitelisted timestamp column. */
     dateFilter?: ContentDateFilter;
   };
   orderBy?: {
@@ -208,4 +216,4 @@ declare class EmDashValidationError extends Error {
 }
 //#endregion
 export { ContentSeo as a, EmDashValidationError as c, InvalidCursorError as d, UpdateContentInput as f, ContentItem as i, FindManyOptions as l, ContentBylineCredit as n, ContentSeoInput as o, ContentDateField as r, CreateContentInput as s, BylineSummary as t, FindManyResult as u };
-//# sourceMappingURL=types-BcLUUbbR.d.mts.map
+//# sourceMappingURL=types-BfYUPJdP.d.mts.map

package/dist/{types-BcLUUbbR.d.mts.map → types-BfYUPJdP.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-BcLUUbbR.d.mts","names":[],"sources":["../src/database/repositories/types.ts"],"mappings":";;;UAaiB,kBAAA;EAChB,IAAA;EACA,IAAA;EACA,IAAA,EAAM,MAAA;EACN,MAAA;EACA,QAAA;EACA,eAAA;EACA,MAAA;EACA,aAAA;EACA,WAAA;EALA;EAOA,SAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,IAAA,GAAO,MAAA;EACP,MAAA;EACA,IAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA;EACA,eAAA;AAAA;;UAIgB,UAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;;UAIgB,eAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,EAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;EACA,aAAA;EAbgB;;;;;;;;;;;AAQjB;;;;;EAsBC,gBAAA;EAnBA;EAqBA,SAAA;EAnBA;;;;;;;EA2BA,cAAA;EASA;;;;EAJA,mBAAA;EACA,UAAA;EACA,MAAA;EACA,OAAA;EACA,SAAA;EACA,SAAA;EA0BmC;;;;EArBnC,MAAA;EAuBA;;;;;AAOD;;EAtBC,gBAAA;EAsB2B;;AAS5B;;;;;;;EArBC,YAAA,GAAe,MAAA,SAAe,gBAAA;AAAA;AAAA,UAGd,mBAAA;EAChB,MAAA,EAAQ,aAAA;EACR,SAAA;EACA,SAAA;EAmC+B;EAjC/B,MAAA;AAAA;;KAIW,gBAAA;;;;;;;;UASK,iBAAA;EAChB,KAAA,EAAO,gBAAA;EACP,IAAA;EACA,EAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,KAAA;IACC,MAAA;IACA,QAAA;IACA,MAAA,WAqBM;IAnBN,CAAA;IA0BD;;;AAgBD;;IApCE,aAAA,aAoC2C;IAlC3C,UAAA,GAAa,iBAAA;EAAA;EAEd,OAAA;IACC,KAAA;IACA,SAAA;EAAA;EAED,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,KAAA,EAAO,CAAA;EACP,UAAA;EAsFW;;;;;EAhFX,KAAA;AAAA;;;;;;;;;cAgBY,kBAAA,SAA2B,KAAA;cAC3B,MAAA;AAAA;AAAA,UAgCI,WAAA;EAChB,EAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,IAAA,EAAM,MAAA;EACN,QAAA;EACA,eAAA;EACA,MAAA,GAAS,aAAA;EACT,OAAA,GAAU,mBAAA;EACV,SAAA;EACA,SAAA;EACA,WAAA;EACA,WAAA;EACA,cAAA;EACA,eAAA;EACA,OAAA;EACA,MAAA;EACA,gBAAA;;EAEA,GAAA,GAAM,UAAA;;;;;;;;;;;EAWN,QAAA,GAAW,MAAA;AAAA;AAAA,cAGC,qBAAA,SAA8B,KAAA;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA"}
+{"version":3,"file":"types-BfYUPJdP.d.mts","names":[],"sources":["../src/database/repositories/types.ts"],"mappings":";;;UAaiB,kBAAA;EAChB,IAAA;EACA,IAAA;EACA,IAAA,EAAM,MAAA;EACN,MAAA;EACA,QAAA;EACA,eAAA;EACA,MAAA;EACA,aAAA;EACA,WAAA;EALA;EAOA,SAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,IAAA,GAAO,MAAA;EACP,MAAA;EACA,IAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA;EACA,eAAA;AAAA;;UAIgB,UAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;;UAIgB,eAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,EAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;EACA,aAAA;EAbgB;;;;;;;;;;;AAQjB;;;;;EAsBC,gBAAA;EAnBA;EAqBA,SAAA;EAnBA;;;;;;;EA2BA,cAAA;EASA;;;;EAJA,mBAAA;EACA,UAAA;EACA,MAAA;EACA,OAAA;EACA,SAAA;EACA,SAAA;EA0BmC;;;;EArBnC,MAAA;EAuBA;;;;;AAOD;;EAtBC,gBAAA;EAsB2B;;AAS5B;;;;;;;EArBC,YAAA,GAAe,MAAA,SAAe,gBAAA;AAAA;AAAA,UAGd,mBAAA;EAChB,MAAA,EAAQ,aAAA;EACR,SAAA;EACA,SAAA;EA2C+B;EAzC/B,MAAA;AAAA;;KAIW,gBAAA;;;;;;;;UASK,iBAAA;EAChB,KAAA,EAAO,gBAAA;EACP,IAAA;EACA,EAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,KAAA;IACC,MAAA;IACA,QAAA;IACA,MAAA,WA6BD;IA3BC,CAAA;IA4BD;;;;AAsBD;IA5CE,aAAA;IA4CsC;;;;;;;IApCtC,MAAA,YAqE0B;IAnE1B,UAAA,GAAa,iBAAA;EAAA;EAEd,OAAA;IACC,KAAA;IACA,SAAA;EAAA;EAED,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,KAAA,EAAO,CAAA;EACP,UAAA;EA4DA;;;;;EAtDA,KAAA;AAAA;;;;;;;;;cAgBY,kBAAA,SAA2B,KAAA;cAC3B,MAAA;AAAA;AAAA,UAgCI,WAAA;EAChB,EAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,IAAA,EAAM,MAAA;EACN,QAAA;EACA,eAAA;EACA,MAAA,GAAS,aAAA;EACT,OAAA,GAAU,mBAAA;EACV,SAAA;EACA,SAAA;EACA,WAAA;EACA,WAAA;EACA,cAAA;EACA,eAAA;EACA,OAAA;EACA,MAAA;EACA,gBAAA;;EAEA,GAAA,GAAM,UAAA;;;;;;;;;;;EAWN,QAAA,GAAW,MAAA;AAAA;AAAA,cAGC,qBAAA,SAA8B,KAAA;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA"}