emdash 0.31.1 → 0.33.0

package/dist/{taxonomy-0mCI25HN.mjs → taxonomy-pOrB2kZe.mjs}

@@ -1,7 +1,8 @@
-import { o as __exportAll } from "./runner-BdeLEgad.mjs";
-import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { d as invalidateTaxonomyObjectCache } from "./object-cache-Bok5j2ae.mjs";
+import { o as __exportAll } from "./runner-BFTrkYhu.mjs";
+import { t as validateIdentifier } from "./validate-BpwoDOgt.mjs";
+import { p as invalidateTaxonomyObjectCache } from "./object-cache-71tPfV4A.mjs";
 import { n as isMissingTableError } from "./db-errors-CcWLaRiR.mjs";
+import { t as withTransaction } from "./transaction-NQj4VJ7Z.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
@@ -16,6 +17,43 @@ const EMPTY_DENORM = {
 	created_at: null
 };
 /**
+* Translation groups per reorder `UPDATE`. Each costs three bound parameters —
+* a CASE `WHEN`/`THEN` pair plus one slot in the `IN` list — which keeps a
+* statement inside D1's 100-parameter ceiling.
+*/
+const GROUPS_PER_UPDATE = 32;
+/** Deal the listed groups back out over the slots they hold, in the order given. */
+function permuteWithinSlots(listed, occupied) {
+	const slots = occupied.toSorted((a, b) => a - b);
+	const target = /* @__PURE__ */ new Map();
+	listed.forEach((group, index) => {
+		const position = slots[index];
+		if (position !== void 0) target.set(group, position);
+	});
+	return target;
+}
+/**
+* Renumber a whole sibling group 0..n-1, with the listed groups in the order
+* given and every other member left in the place it already held.
+*
+* Works off each member's index in the sequence rather than its stored value,
+* which is what lets it resolve positions that tie. The sort is stable, so
+* tied members keep the order `siblings` arrives in — deterministic, but a
+* listing that mixes locales breaks a tie on whichever locale's label sorts
+* first, not on the order any one caller rendered.
+*/
+function renumberSiblings(listed, siblings) {
+	const sequence = siblings.toSorted((a, b) => a.position - b.position);
+	const wanted = new Set(listed);
+	const target = /* @__PURE__ */ new Map();
+	let next = 0;
+	sequence.forEach(({ group }, index) => {
+		const replacement = wanted.has(group) ? listed[next++] : void 0;
+		target.set(replacement ?? group, index);
+	});
+	return target;
+}
+/**
 * Taxonomy repository for categories, tags, and other classification.
 *
 * Terms are per-locale. Translations of the same term share a `translation_group`
@@ -25,6 +63,12 @@ const EMPTY_DENORM = {
 * The repository does not resolve locale fallbacks on its own — callers supply
 * the locale they want. Runtime helpers and handlers use `getFallbackChain()`
 * from `i18n/config` when they need fallback behaviour.
+*
+* `sort_order` is per translation_group, not per row: every row sharing a
+* translation_group carries the same value, so a term holds one position across
+* all its locales. Sibling groups are keyed on the raw `parent_id` column, which
+* is locale-agnostic for the same reason (it stores the parent's
+* translation_group). Writes must preserve both invariants.
 */
 var TaxonomyRepository = class {
 	constructor(db) {
@@ -40,10 +84,13 @@ var TaxonomyRepository = class {
 		const parentInput = input.parentId === void 0 || input.parentId === "" ? null : input.parentId;
 		const parentId = parentInput ? await this.resolveParentRef(parentInput) : null;
 		let translationGroup = id;
+		let sortOrder = null;
 		if (input.translationOf) {
 			const source = await this.findById(input.translationOf);
 			if (source?.translationGroup) translationGroup = source.translationGroup;
+			if (source && source.parentId === parentId) sortOrder = source.sortOrder;
 		}
+		sortOrder ??= await this.nextSortOrder(input.name, parentId);
 		await this.db.insertInto("taxonomies").values({
 			id,
 			name: input.name,
@@ -51,6 +98,7 @@ var TaxonomyRepository = class {
 			label: input.label,
 			parent_id: parentId,
 			data: input.data ? JSON.stringify(input.data) : null,
+			sort_order: sortOrder,
 			...input.locale !== void 0 ? { locale: input.locale } : {},
 			translation_group: translationGroup
 		}).execute();
@@ -77,12 +125,14 @@ var TaxonomyRepository = class {
 	/**
 	* Get all terms for a taxonomy (e.g., all categories).
 	*
-	* `id asc` is a stable tiebreaker for terms that share a label. Without it
-	* the SQL ordering is implementation-defined when labels match, which
-	* breaks keyset pagination over `(label, id)`.
+	* `sort_order` carries the manual order set from the admin; it is 0 for
+	* terms nobody has reordered, so an untouched taxonomy still comes back
+	* alphabetically. `id asc` is a stable tiebreaker for terms that share both
+	* — without it the SQL ordering is implementation-defined when they match,
+	* which breaks keyset pagination over `(label, id)`.
 	*/
 	async findByName(name, options = {}) {
-		let query = this.db.selectFrom("taxonomies").selectAll().where("name", "=", name).orderBy("label", "asc").orderBy("id", "asc");
+		let query = this.db.selectFrom("taxonomies").selectAll().where("name", "=", name).orderBy("sort_order", "asc").orderBy("label", "asc").orderBy("id", "asc");
 		if (options.locale !== void 0) query = query.where("locale", "=", options.locale);
 		if (options.parentId !== void 0) if (options.parentId === null) query = query.where("parent_id", "is", null);
 		else query = query.where("parent_id", "=", options.parentId);
@@ -98,7 +148,7 @@ var TaxonomyRepository = class {
 	async findChildren(parentIdOrGroup, locale) {
 		const group = await this.resolveTranslationGroup(parentIdOrGroup);
 		if (!group) return [];
-		let query = this.db.selectFrom("taxonomies").selectAll().where("parent_id", "=", group).orderBy("label", "asc").orderBy("id", "asc");
+		let query = this.db.selectFrom("taxonomies").selectAll().where("parent_id", "=", group).orderBy("sort_order", "asc").orderBy("label", "asc").orderBy("id", "asc");
 		if (locale !== void 0) query = query.where("locale", "=", locale);
 		return (await query.execute()).map((row) => this.rowToTaxonomy(row));
 	}
@@ -110,18 +160,94 @@ var TaxonomyRepository = class {
 		return (await this.db.selectFrom("taxonomies").selectAll().where("translation_group", "=", translationGroup).orderBy("locale", "asc").execute()).map((row) => this.rowToTaxonomy(row));
 	}
 	async update(id, input) {
-		if (!await this.findById(id)) return null;
+		const existing = await this.findById(id);
+		if (!existing) return null;
 		const updates = {};
 		if (input.slug !== void 0) updates.slug = input.slug;
 		if (input.label !== void 0) updates.label = input.label;
-		if (input.parentId !== void 0) updates.parent_id = input.parentId === "" || input.parentId === null ? null : await this.resolveParentRef(input.parentId);
 		if (input.data !== void 0) updates.data = JSON.stringify(input.data);
-		if (Object.keys(updates).length > 0) {
-			await this.db.updateTable("taxonomies").set(updates).where("id", "=", id).execute();
+		const group = {};
+		if (input.parentId !== void 0) {
+			const parentId = input.parentId === "" || input.parentId === null ? null : await this.resolveParentRef(input.parentId);
+			if (parentId !== existing.parentId) {
+				group.parent_id = parentId;
+				group.sort_order = await this.nextSortOrder(existing.name, parentId);
+			}
+		}
+		const hasRowUpdates = Object.keys(updates).length > 0;
+		const hasGroupUpdates = Object.keys(group).length > 0;
+		if (hasRowUpdates || hasGroupUpdates) {
+			await withTransaction(this.db, async (trx) => {
+				if (hasRowUpdates) await trx.updateTable("taxonomies").set(updates).where("id", "=", id).execute();
+				if (hasGroupUpdates) await trx.updateTable("taxonomies").set(group).where("translation_group", "=", existing.translationGroup ?? existing.id).execute();
+			});
 			invalidateTaxonomyObjectCache();
 		}
 		return this.findById(id);
 	}
+	/**
+	* Move `groups` (translation_groups, in the desired order) into the positions
+	* those same groups already occupy, leaving every other member of the sibling
+	* group where it is.
+	*
+	* `groups` may be a subset: a locale renders only the terms translated into
+	* it, so an admin in `fr` often cannot name every member. A group left out
+	* keeps its place, which is also what makes a stale list harmless.
+	*
+	* `siblings` is every member of the group with the position it holds, in a
+	* listing's order — tied positions are resolved by that order, so pass it as
+	* read. Groups already at their target are skipped, so one swap rewrites two
+	* groups rather than the whole list.
+	*/
+	async reorder(groups, siblings) {
+		const current = new Map(siblings.map(({ group, position }) => [group, position]));
+		const listed = [];
+		const occupied = [];
+		for (const group of groups) {
+			const position = current.get(group);
+			if (position === void 0) continue;
+			listed.push(group);
+			occupied.push(position);
+		}
+		if (listed.length === 0) return;
+		const changed = [...new Set(occupied).size === occupied.length ? permuteWithinSlots(listed, occupied) : renumberSiblings(listed, siblings)].filter(([group, position]) => current.get(group) !== position);
+		if (changed.length === 0) return;
+		await this.applyPositions(changed);
+		invalidateTaxonomyObjectCache();
+	}
+	/**
+	* Write one position per translation_group, GROUPS_PER_UPDATE at a time so
+	* each statement stays inside D1's parameter ceiling.
+	*
+	* D1 has no transactions — `withTransaction` runs its callback bare there —
+	* so a chunk is the unit that can't tear. A reorder spanning several chunks
+	* can, and leaves ties, which the next reorder renumbers away.
+	*/
+	async applyPositions(positions) {
+		for (let index = 0; index < positions.length; index += GROUPS_PER_UPDATE) {
+			const chunk = positions.slice(index, index + GROUPS_PER_UPDATE);
+			await sql`
+				UPDATE taxonomies
+				SET sort_order = CASE translation_group ${sql.join(chunk.map(([group, position]) => sql`WHEN ${group} THEN CAST(${position} AS INTEGER)`), sql` `)} END
+				WHERE translation_group IN (${sql.join(chunk.map(([group]) => sql`${group}`))})
+			`.execute(this.db);
+		}
+	}
+	/**
+	* Position for a term joining a sibling group: one past the last member, or
+	* 0 when the group is empty.
+	*
+	* Bounds are taken across every locale because a position belongs to the
+	* translation_group, not to a row — a term translated into only one locale
+	* still occupies its slot for all of them.
+	*/
+	async nextSortOrder(name, parentId) {
+		let query = this.db.selectFrom("taxonomies").select((eb) => eb.fn.max("sort_order").as("max")).where("name", "=", name);
+		query = parentId === null ? query.where("parent_id", "is", null) : query.where("parent_id", "=", parentId);
+		const bounds = await query.executeTakeFirst();
+		if (!bounds || bounds.max === null) return 0;
+		return bounds.max + 1;
+	}
 	async delete(id) {
 		const term = await this.findById(id);
 		if (!term) return false;
@@ -277,7 +403,7 @@ var TaxonomyRepository = class {
 	*/
 	async countEntriesForTerms(translationGroups) {
 		if (translationGroups.length === 0) return /* @__PURE__ */ new Map();
-		const { chunks, SQL_BATCH_SIZE } = await import("./chunks-Bq-5DPrD.mjs").then((n) => n.r);
+		const { chunks, SQL_BATCH_SIZE } = await import("./chunks-DbYzib_k.mjs").then((n) => n.r);
 		const counts = /* @__PURE__ */ new Map();
 		for (const chunk of chunks(translationGroups, SQL_BATCH_SIZE)) {
 			const rows = await this.db.selectFrom("content_taxonomies").select(["taxonomy_id", (eb) => eb.fn.count("entry_id").as("count")]).where("taxonomy_id", "in", chunk).groupBy("taxonomy_id").execute();
@@ -294,11 +420,12 @@ var TaxonomyRepository = class {
 			parentId: row.parent_id,
 			data: row.data ? JSON.parse(row.data) : null,
 			locale: row.locale,
-			translationGroup: row.translation_group
+			translationGroup: row.translation_group,
+			sortOrder: row.sort_order
 		};
 	}
 };
 
 //#endregion
 export { taxonomy_exports as n, TaxonomyRepository as t };
-//# sourceMappingURL=taxonomy-0mCI25HN.mjs.map
+//# sourceMappingURL=taxonomy-pOrB2kZe.mjs.map

package/dist/taxonomy-pOrB2kZe.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy-pOrB2kZe.mjs","names":[],"sources":["../src/database/repositories/taxonomy.ts"],"sourcesContent":["import { sql, type Kysely, type Selectable } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { invalidateTaxonomyObjectCache } from \"../../object-cache/index.js\";\nimport { isMissingTableError } from \"../../utils/db-errors.js\";\nimport { withTransaction } from \"../transaction.js\";\nimport type { Database, TaxonomyTable } from \"../types.js\";\nimport { validateIdentifier } from \"../validate.js\";\n\n/**\n * Filter + sort columns denormalized from an entry's `ec_*` row onto its\n * `content_taxonomies` pivot rows (migration 051). Stamped at insert time so a\n * newly-tagged entry is immediately seekable by a taxonomy-filtered listing.\n */\ninterface PivotDenorm {\n\tstatus: string | null;\n\tscheduled_at: string | null;\n\tdeleted_at: string | null;\n\tlocale: string | null;\n\tpublished_at: string | null;\n\tcreated_at: string | null;\n}\n\nconst EMPTY_DENORM: PivotDenorm = {\n\tstatus: null,\n\tscheduled_at: null,\n\tdeleted_at: null,\n\tlocale: null,\n\tpublished_at: null,\n\tcreated_at: null,\n};\n\n/** A member of one sibling group and the position it currently holds. */\nexport interface SiblingPosition {\n\tgroup: string;\n\tposition: number;\n}\n\n/**\n * Translation groups per reorder `UPDATE`. Each costs three bound parameters —\n * a CASE `WHEN`/`THEN` pair plus one slot in the `IN` list — which keeps a\n * statement inside D1's 100-parameter ceiling.\n */\nconst GROUPS_PER_UPDATE = 32;\n\n/** Deal the listed groups back out over the slots they hold, in the order given. */\nfunction permuteWithinSlots(\n\tlisted: readonly string[],\n\toccupied: readonly number[],\n): Map<string, number> {\n\tconst slots = occupied.toSorted((a, b) => a - b);\n\tconst target = new Map<string, number>();\n\tlisted.forEach((group, index) => {\n\t\tconst position = slots[index];\n\t\tif (position !== undefined) target.set(group, position);\n\t});\n\treturn target;\n}\n\n/**\n * Renumber a whole sibling group 0..n-1, with the listed groups in the order\n * given and every other member left in the place it already held.\n *\n * Works off each member's index in the sequence rather than its stored value,\n * which is what lets it resolve positions that tie. The sort is stable, so\n * tied members keep the order `siblings` arrives in — deterministic, but a\n * listing that mixes locales breaks a tie on whichever locale's label sorts\n * first, not on the order any one caller rendered.\n */\nfunction renumberSiblings(\n\tlisted: readonly string[],\n\tsiblings: readonly SiblingPosition[],\n): Map<string, number> {\n\tconst sequence = siblings.toSorted((a, b) => a.position - b.position);\n\tconst wanted = new Set(listed);\n\tconst target = new Map<string, number>();\n\tlet next = 0;\n\tsequence.forEach(({ group }, index) => {\n\t\tconst replacement = wanted.has(group) ? listed[next++] : undefined;\n\t\ttarget.set(replacement ?? group, index);\n\t});\n\treturn target;\n}\n\nexport interface Taxonomy {\n\tid: string;\n\tname: string;\n\tslug: string;\n\tlabel: string;\n\tparentId: string | null;\n\tdata: Record<string, unknown> | null;\n\tlocale: string;\n\ttranslationGroup: string | null;\n\t/**\n\t * Position among siblings. Shared by every row of a `translation_group` —\n\t * a term sits in the same place in every locale it is translated into.\n\t */\n\tsortOrder: number;\n}\n\nexport interface CreateTaxonomyInput {\n\tname: string;\n\tslug: string;\n\tlabel: string;\n\tparentId?: string;\n\tdata?: Record<string, unknown>;\n\t/** Omit to let the DB default (current value: 'en') apply. Higher layers\n\t * resolve the locale from the request context / i18n config. */\n\tlocale?: string;\n\t/** When set, links the new term into the source term's translation_group. */\n\ttranslationOf?: string;\n}\n\nexport interface UpdateTaxonomyInput {\n\tslug?: string;\n\tlabel?: string;\n\tparentId?: string | null;\n\tdata?: Record<string, unknown>;\n}\n\nexport interface FindOptions {\n\tparentId?: string | null;\n\tlocale?: string;\n}\n\n/**\n * Taxonomy repository for categories, tags, and other classification.\n *\n * Terms are per-locale. Translations of the same term share a `translation_group`\n * ULID. `content_taxonomies.taxonomy_id` stores the translation_group so a single\n * association spans every locale of a post.\n *\n * The repository does not resolve locale fallbacks on its own — callers supply\n * the locale they want. Runtime helpers and handlers use `getFallbackChain()`\n * from `i18n/config` when they need fallback behaviour.\n *\n * `sort_order` is per translation_group, not per row: every row sharing a\n * translation_group carries the same value, so a term holds one position across\n * all its locales. Sibling groups are keyed on the raw `parent_id` column, which\n * is locale-agnostic for the same reason (it stores the parent's\n * translation_group). Writes must preserve both invariants.\n */\nexport class TaxonomyRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\t/**\n\t * Create a new taxonomy term. When `translationOf` is set the new row joins\n\t * the source term's translation_group; otherwise a fresh group is minted\n\t * (matching the migration backfill pattern `translation_group = id`).\n\t */\n\tasync create(input: CreateTaxonomyInput): Promise<Taxonomy> {\n\t\tconst id = ulid();\n\n\t\t// Empty-string parentId is coerced to null defensively. Higher layers\n\t\t// also normalize this — see handleTermCreate / handleTermUpdate.\n\t\t// `parent_id` stores the parent's locale-agnostic translation_group (not a\n\t\t// row id), mirroring content_taxonomies.taxonomy_id, so a child stays\n\t\t// nested in every locale's tree. resolveTranslationGroup accepts either a\n\t\t// row id or an already-resolved group, so this is idempotent.\n\t\tconst parentInput =\n\t\t\tinput.parentId === undefined || input.parentId === \"\" ? null : input.parentId;\n\t\tconst parentId = parentInput ? await this.resolveParentRef(parentInput) : null;\n\n\t\tlet translationGroup = id;\n\t\tlet sortOrder: number | null = null;\n\t\tif (input.translationOf) {\n\t\t\tconst source = await this.findById(input.translationOf);\n\t\t\tif (source?.translationGroup) translationGroup = source.translationGroup;\n\t\t\t// A translation is the same term in another locale, so it takes the\n\t\t\t// group's position — but only while it stays in the group that position\n\t\t\t// belongs to. Landing under a different parent makes it a new member of\n\t\t\t// that sibling group, and the source's position means nothing there.\n\t\t\tif (source && source.parentId === parentId) sortOrder = source.sortOrder;\n\t\t}\n\t\tsortOrder ??= await this.nextSortOrder(input.name, parentId);\n\n\t\tawait this.db\n\t\t\t.insertInto(\"taxonomies\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\tslug: input.slug,\n\t\t\t\tlabel: input.label,\n\t\t\t\tparent_id: parentId,\n\t\t\t\tdata: input.data ? JSON.stringify(input.data) : null,\n\t\t\t\tsort_order: sortOrder,\n\t\t\t\t// When omitted, the DB DEFAULT 'en' is used — keeps behaviour\n\t\t\t\t// consistent with ContentRepository and lets higher layers\n\t\t\t\t// supply an explicit locale from request context.\n\t\t\t\t...(input.locale !== undefined ? { locale: input.locale } : {}),\n\t\t\t\ttranslation_group: translationGroup,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tinvalidateTaxonomyObjectCache();\n\n\t\tconst taxonomy = await this.findById(id);\n\t\tif (!taxonomy) throw new Error(\"Failed to create taxonomy\");\n\t\treturn taxonomy;\n\t}\n\n\tasync findById(id: string): Promise<Taxonomy | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn row ? this.rowToTaxonomy(row) : null;\n\t}\n\n\t/**\n\t * Find a term by (name, slug). When `locale` is provided, filter by it.\n\t * When omitted, returns the lowest-locale-code match (deterministic across\n\t * calls). Mirrors `ContentRepository.findBySlug`.\n\t */\n\tasync findBySlug(name: string, slug: string, locale?: string): Promise<Taxonomy | null> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.where(\"slug\", \"=\", slug);\n\t\tif (locale !== undefined) query = query.where(\"locale\", \"=\", locale);\n\t\tconst row = await query.orderBy(\"locale\", \"asc\").executeTakeFirst();\n\t\treturn row ? this.rowToTaxonomy(row) : null;\n\t}\n\n\t/**\n\t * Get all terms for a taxonomy (e.g., all categories).\n\t *\n\t * `sort_order` carries the manual order set from the admin; it is 0 for\n\t * terms nobody has reordered, so an untouched taxonomy still comes back\n\t * alphabetically. `id asc` is a stable tiebreaker for terms that share both\n\t * — without it the SQL ordering is implementation-defined when they match,\n\t * which breaks keyset pagination over `(label, id)`.\n\t */\n\tasync findByName(name: string, options: FindOptions = {}): Promise<Taxonomy[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.orderBy(\"sort_order\", \"asc\")\n\t\t\t.orderBy(\"label\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\");\n\n\t\tif (options.locale !== undefined) query = query.where(\"locale\", \"=\", options.locale);\n\n\t\tif (options.parentId !== undefined) {\n\t\t\tif (options.parentId === null) {\n\t\t\t\tquery = query.where(\"parent_id\", \"is\", null);\n\t\t\t} else {\n\t\t\t\tquery = query.where(\"parent_id\", \"=\", options.parentId);\n\t\t\t}\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\t/**\n\t * Children of a term. Accepts a term id OR a translation_group and resolves\n\t * to the group, since `parent_id` stores the parent's translation_group.\n\t * Pass `locale` to scope to one locale's tree (children share the parent's\n\t * group across locales); omit it to find children in every locale (used to\n\t * block deletes that would orphan a sibling translation's subtree).\n\t */\n\tasync findChildren(parentIdOrGroup: string, locale?: string): Promise<Taxonomy[]> {\n\t\tconst group = await this.resolveTranslationGroup(parentIdOrGroup);\n\t\tif (!group) return [];\n\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"parent_id\", \"=\", group)\n\t\t\t.orderBy(\"sort_order\", \"asc\")\n\t\t\t.orderBy(\"label\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\");\n\t\tif (locale !== undefined) query = query.where(\"locale\", \"=\", locale);\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\t/**\n\t * Every translation sibling of a term (including itself), identified by\n\t * their shared `translation_group`.\n\t */\n\tasync findTranslations(translationGroup: string): Promise<Taxonomy[]> {\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"translation_group\", \"=\", translationGroup)\n\t\t\t.orderBy(\"locale\", \"asc\")\n\t\t\t.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\tasync update(id: string, input: UpdateTaxonomyInput): Promise<Taxonomy | null> {\n\t\tconst existing = await this.findById(id);\n\t\tif (!existing) return null;\n\n\t\t// Per-row display fields. `parent_id` and `sort_order` are not here: both\n\t\t// belong to the translation_group and are written across it below.\n\t\tconst updates: Record<string, unknown> = {};\n\t\tif (input.slug !== undefined) updates.slug = input.slug;\n\t\tif (input.label !== undefined) updates.label = input.label;\n\t\tif (input.data !== undefined) updates.data = JSON.stringify(input.data);\n\n\t\tconst group: { parent_id?: string | null; sort_order?: number } = {};\n\t\tif (input.parentId !== undefined) {\n\t\t\t// Defense in depth: empty-string parentId means null (no parent).\n\t\t\t// Otherwise persist the parent's translation_group (locale-agnostic),\n\t\t\t// matching create() — see the note there.\n\t\t\tconst parentId =\n\t\t\t\tinput.parentId === \"\" || input.parentId === null\n\t\t\t\t\t? null\n\t\t\t\t\t: await this.resolveParentRef(input.parentId);\n\n\t\t\tif (parentId !== existing.parentId) {\n\t\t\t\tgroup.parent_id = parentId;\n\t\t\t\t// A position only means anything within one sibling group, so a term\n\t\t\t\t// that changes parent is appended to the group it lands in.\n\t\t\t\tgroup.sort_order = await this.nextSortOrder(existing.name, parentId);\n\t\t\t}\n\t\t}\n\n\t\tconst hasRowUpdates = Object.keys(updates).length > 0;\n\t\tconst hasGroupUpdates = Object.keys(group).length > 0;\n\t\tif (hasRowUpdates || hasGroupUpdates) {\n\t\t\tawait withTransaction(this.db, async (trx) => {\n\t\t\t\tif (hasRowUpdates) {\n\t\t\t\t\tawait trx.updateTable(\"taxonomies\").set(updates).where(\"id\", \"=\", id).execute();\n\t\t\t\t}\n\t\t\t\tif (hasGroupUpdates) {\n\t\t\t\t\tawait trx\n\t\t\t\t\t\t.updateTable(\"taxonomies\")\n\t\t\t\t\t\t.set(group)\n\t\t\t\t\t\t.where(\"translation_group\", \"=\", existing.translationGroup ?? existing.id)\n\t\t\t\t\t\t.execute();\n\t\t\t\t}\n\t\t\t});\n\t\t\tinvalidateTaxonomyObjectCache();\n\t\t}\n\n\t\treturn this.findById(id);\n\t}\n\n\t/**\n\t * Move `groups` (translation_groups, in the desired order) into the positions\n\t * those same groups already occupy, leaving every other member of the sibling\n\t * group where it is.\n\t *\n\t * `groups` may be a subset: a locale renders only the terms translated into\n\t * it, so an admin in `fr` often cannot name every member. A group left out\n\t * keeps its place, which is also what makes a stale list harmless.\n\t *\n\t * `siblings` is every member of the group with the position it holds, in a\n\t * listing's order — tied positions are resolved by that order, so pass it as\n\t * read. Groups already at their target are skipped, so one swap rewrites two\n\t * groups rather than the whole list.\n\t */\n\tasync reorder(groups: string[], siblings: readonly SiblingPosition[]): Promise<void> {\n\t\tconst current = new Map(siblings.map(({ group, position }) => [group, position]));\n\n\t\tconst listed: string[] = [];\n\t\tconst occupied: number[] = [];\n\t\tfor (const group of groups) {\n\t\t\tconst position = current.get(group);\n\t\t\tif (position === undefined) continue;\n\t\t\tlisted.push(group);\n\t\t\toccupied.push(position);\n\t\t}\n\t\tif (listed.length === 0) return;\n\n\t\t// Tied positions have no distinct order to permute into, so the requested\n\t\t// one would be dropped without a word. Renumbering is the only way to\n\t\t// honour it, and it repairs the tie on the way through.\n\t\tconst target =\n\t\t\tnew Set(occupied).size === occupied.length\n\t\t\t\t? permuteWithinSlots(listed, occupied)\n\t\t\t\t: renumberSiblings(listed, siblings);\n\n\t\tconst changed = [...target].filter(([group, position]) => current.get(group) !== position);\n\t\tif (changed.length === 0) return;\n\n\t\tawait this.applyPositions(changed);\n\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\t/**\n\t * Write one position per translation_group, GROUPS_PER_UPDATE at a time so\n\t * each statement stays inside D1's parameter ceiling.\n\t *\n\t * D1 has no transactions — `withTransaction` runs its callback bare there —\n\t * so a chunk is the unit that can't tear. A reorder spanning several chunks\n\t * can, and leaves ties, which the next reorder renumbers away.\n\t */\n\tprivate async applyPositions(positions: readonly (readonly [string, number])[]): Promise<void> {\n\t\tfor (let index = 0; index < positions.length; index += GROUPS_PER_UPDATE) {\n\t\t\tconst chunk = positions.slice(index, index + GROUPS_PER_UPDATE);\n\t\t\t// The CAST types the bound position. Postgres resolves a CASE whose THEN\n\t\t\t// arms are all untyped parameters to text, then refuses to assign text to\n\t\t\t// an integer column.\n\t\t\tconst arms = sql.join(\n\t\t\t\tchunk.map(([group, position]) => sql`WHEN ${group} THEN CAST(${position} AS INTEGER)`),\n\t\t\t\tsql` `,\n\t\t\t);\n\t\t\tconst keys = sql.join(chunk.map(([group]) => sql`${group}`));\n\t\t\tawait sql`\n\t\t\t\tUPDATE taxonomies\n\t\t\t\tSET sort_order = CASE translation_group ${arms} END\n\t\t\t\tWHERE translation_group IN (${keys})\n\t\t\t`.execute(this.db);\n\t\t}\n\t}\n\n\t/**\n\t * Position for a term joining a sibling group: one past the last member, or\n\t * 0 when the group is empty.\n\t *\n\t * Bounds are taken across every locale because a position belongs to the\n\t * translation_group, not to a row — a term translated into only one locale\n\t * still occupies its slot for all of them.\n\t */\n\tprivate async nextSortOrder(name: string, parentId: string | null): Promise<number> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select((eb) => eb.fn.max(\"sort_order\").as(\"max\"))\n\t\t\t.where(\"name\", \"=\", name);\n\t\tquery =\n\t\t\tparentId === null\n\t\t\t\t? query.where(\"parent_id\", \"is\", null)\n\t\t\t\t: query.where(\"parent_id\", \"=\", parentId);\n\n\t\tconst bounds = await query.executeTakeFirst();\n\t\t// Null only when the group is empty.\n\t\tif (!bounds || bounds.max === null) return 0;\n\t\treturn bounds.max + 1;\n\t}\n\n\tasync delete(id: string): Promise<boolean> {\n\t\tconst term = await this.findById(id);\n\t\tif (!term) return false;\n\n\t\t// When deleting the last translation of a group the pivot rows that\n\t\t// reference that translation_group become orphaned — purge them.\n\t\tif (term.translationGroup) {\n\t\t\tconst siblings = await this.db\n\t\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t\t.select(\"id\")\n\t\t\t\t.where(\"translation_group\", \"=\", term.translationGroup)\n\t\t\t\t.where(\"id\", \"!=\", id)\n\t\t\t\t.execute();\n\t\t\tif (siblings.length === 0) {\n\t\t\t\tawait this.db\n\t\t\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t\t\t.where(\"taxonomy_id\", \"=\", term.translationGroup)\n\t\t\t\t\t.execute();\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.db.deleteFrom(\"taxonomies\").where(\"id\", \"=\", id).executeTakeFirst();\n\t\tinvalidateTaxonomyObjectCache();\n\t\treturn (result.numDeletedRows ?? 0n) > 0n;\n\t}\n\n\t// --- Content-Taxonomy Junction (taxonomy_id stores the translation_group) ---\n\n\tasync attachToEntry(collection: string, entryId: string, taxonomyId: string): Promise<void> {\n\t\tconst group = await this.resolveTranslationGroup(taxonomyId);\n\t\tif (!group) return;\n\n\t\tconst denorm = await this.fetchEntryDenorm(collection, entryId);\n\t\tawait this.db\n\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t.values({ collection, entry_id: entryId, taxonomy_id: group, ...denorm })\n\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t.execute();\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\tasync detachFromEntry(collection: string, entryId: string, taxonomyId: string): Promise<void> {\n\t\tconst group = await this.resolveTranslationGroup(taxonomyId);\n\t\tif (!group) return;\n\n\t\tawait this.db\n\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", entryId)\n\t\t\t.where(\"taxonomy_id\", \"=\", group)\n\t\t\t.execute();\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\t/**\n\t * Taxonomy terms assigned to a content entry, resolved into a specific locale.\n\t * Terms whose translation_group lacks a row in the requested locale are\n\t * omitted — callers wanting fallback behaviour apply it themselves.\n\t */\n\tasync getTermsForEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyName?: string,\n\t\tlocale?: string,\n\t): Promise<Taxonomy[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.innerJoin(\"taxonomies\", \"taxonomies.translation_group\", \"content_taxonomies.taxonomy_id\")\n\t\t\t.selectAll(\"taxonomies\")\n\t\t\t.where(\"content_taxonomies.collection\", \"=\", collection)\n\t\t\t.where(\"content_taxonomies.entry_id\", \"=\", entryId);\n\n\t\tif (taxonomyName) query = query.where(\"taxonomies.name\", \"=\", taxonomyName);\n\t\tif (locale !== undefined) query = query.where(\"taxonomies.locale\", \"=\", locale);\n\n\t\tconst rows = await query.orderBy(\"taxonomies.locale\", \"asc\").execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\t/**\n\t * Replace all assignments of a given taxonomy for one content entry.\n\t * Term ids OR translation_groups are accepted and normalised to groups.\n\t */\n\tasync setTermsForEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyName: string,\n\t\ttermIds: string[],\n\t): Promise<void> {\n\t\tconst groups: string[] = [];\n\t\tfor (const id of termIds) {\n\t\t\tconst group = await this.resolveTranslationGroup(id);\n\t\t\tif (group) groups.push(group);\n\t\t}\n\t\tconst newGroups = new Set(groups);\n\n\t\tconst current = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.innerJoin(\"taxonomies\", \"taxonomies.translation_group\", \"content_taxonomies.taxonomy_id\")\n\t\t\t.select([\"content_taxonomies.taxonomy_id as group\"])\n\t\t\t.distinct()\n\t\t\t.where(\"content_taxonomies.collection\", \"=\", collection)\n\t\t\t.where(\"content_taxonomies.entry_id\", \"=\", entryId)\n\t\t\t.where(\"taxonomies.name\", \"=\", taxonomyName)\n\t\t\t.execute();\n\t\tconst currentGroups = new Set(current.map((r) => r.group));\n\n\t\tconst toRemove = [...currentGroups].filter((g) => !newGroups.has(g));\n\t\tif (toRemove.length > 0) {\n\t\t\tawait this.db\n\t\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t\t.where(\"entry_id\", \"=\", entryId)\n\t\t\t\t.where(\"taxonomy_id\", \"in\", toRemove)\n\t\t\t\t.execute();\n\t\t}\n\n\t\tconst toAdd = [...newGroups].filter((g) => !currentGroups.has(g));\n\t\tif (toAdd.length > 0) {\n\t\t\tconst denorm = await this.fetchEntryDenorm(collection, entryId);\n\t\t\tawait this.db\n\t\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t\t.values(\n\t\t\t\t\ttoAdd.map((taxonomy_id) => ({\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\tentry_id: entryId,\n\t\t\t\t\t\ttaxonomy_id,\n\t\t\t\t\t\t...denorm,\n\t\t\t\t\t})),\n\t\t\t\t)\n\t\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t\t.execute();\n\t\t}\n\n\t\tif (toRemove.length > 0 || toAdd.length > 0) invalidateTaxonomyObjectCache();\n\t}\n\n\tasync clearEntryTerms(collection: string, entryId: string): Promise<number> {\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", entryId)\n\t\t\t.executeTakeFirst();\n\t\tconst removed = Number(result.numDeletedRows ?? 0);\n\t\tif (removed > 0) invalidateTaxonomyObjectCache();\n\t\treturn removed;\n\t}\n\n\t/**\n\t * Copy every term assignment from one content entry to another. Used when\n\t * creating a translation of a post so the new translation inherits the\n\t * source's term assignments. Safe to call when the source has no terms.\n\t */\n\tasync copyEntryTerms(\n\t\tcollection: string,\n\t\tsourceEntryId: string,\n\t\ttargetEntryId: string,\n\t): Promise<void> {\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.select([\"taxonomy_id\"])\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", sourceEntryId)\n\t\t\t.execute();\n\t\tif (rows.length === 0) return;\n\n\t\t// Stamp the TARGET entry's current values — the copy inherits the source's\n\t\t// term memberships but the target's own status/dates/locale.\n\t\tconst denorm = await this.fetchEntryDenorm(collection, targetEntryId);\n\t\tawait this.db\n\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t.values(\n\t\t\t\trows.map((r) => ({\n\t\t\t\t\tcollection,\n\t\t\t\t\tentry_id: targetEntryId,\n\t\t\t\t\ttaxonomy_id: r.taxonomy_id,\n\t\t\t\t\t...denorm,\n\t\t\t\t})),\n\t\t\t)\n\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t.execute();\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\t/**\n\t * Read the denormalized filter + sort columns from an entry's `ec_*` row so\n\t * they can be stamped onto new pivot rows (migration 051). A missing table or\n\t * missing row yields all-nulls: the pivot columns are advisory, and the\n\t * listing read path re-checks the authoritative `ec_*` row regardless.\n\t */\n\tprivate async fetchEntryDenorm(collection: string, entryId: string): Promise<PivotDenorm> {\n\t\tvalidateIdentifier(collection, \"collection type\");\n\t\tconst tableName = `ec_${collection}`;\n\t\ttry {\n\t\t\tconst result = await sql<PivotDenorm>`\n\t\t\t\tSELECT status, scheduled_at, deleted_at, locale, published_at, created_at\n\t\t\t\tFROM ${sql.ref(tableName)}\n\t\t\t\tWHERE id = ${entryId}\n\t\t\t`.execute(this.db);\n\t\t\treturn result.rows[0] ?? EMPTY_DENORM;\n\t\t} catch (error) {\n\t\t\tif (isMissingTableError(error)) return EMPTY_DENORM;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Count content entries that use any translation of this term. Accepts\n\t * either a term id or a translation_group — we normalise to the group.\n\t *\n\t * Counts raw pivot rows regardless of the entry's status or deletion —\n\t * drafts and trashed entries are included. User-facing counts (admin term\n\t * list/get, public widget and term pages) use `fetchVisibleTermCounts`\n\t * from `taxonomies/term-counts.ts` instead, which counts only publicly\n\t * visible entries.\n\t */\n\tasync countEntriesWithTerm(termIdOrGroup: string): Promise<number> {\n\t\tconst group = await this.resolveTranslationGroup(termIdOrGroup);\n\t\tif (!group) return 0;\n\n\t\tconst result = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.select((eb) => eb.fn.count(\"entry_id\").as(\"count\"))\n\t\t\t.where(\"taxonomy_id\", \"=\", group)\n\t\t\t.executeTakeFirst();\n\t\treturn Number(result?.count ?? 0);\n\t}\n\n\t/**\n\t * Resolve a parent reference (a row id or a translation_group) to the value\n\t * persisted in `parent_id`: the parent's translation_group, which is\n\t * locale-agnostic so the child stays nested in every locale. A\n\t * translation_group normally equals its anchor row's id, which satisfies the\n\t * self-FK on `parent_id`. If that anchor row is missing (a translation whose\n\t * anchor was deleted), fall back to the id we were given so we never write a\n\t * dangling FK value.\n\t */\n\tprivate async resolveParentRef(idOrGroup: string): Promise<string> {\n\t\tconst group = await this.resolveTranslationGroup(idOrGroup);\n\t\tif (!group) return idOrGroup;\n\t\tconst anchor = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"id\", \"=\", group)\n\t\t\t.executeTakeFirst();\n\t\treturn anchor ? group : idOrGroup;\n\t}\n\n\tprivate async resolveTranslationGroup(idOrGroup: string): Promise<string | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select([\"translation_group\"])\n\t\t\t.where((eb) => eb.or([eb(\"id\", \"=\", idOrGroup), eb(\"translation_group\", \"=\", idOrGroup)]))\n\t\t\t.executeTakeFirst();\n\t\treturn row?.translation_group ?? null;\n\t}\n\n\t/**\n\t * Batch count entries for multiple taxonomy translation_groups.\n\t * Chunks the query at SQL_BATCH_SIZE to stay below D1's bind-parameter limit.\n\t * Returns a Map from translation_group to count.\n\t *\n\t * Pass translation_groups (not term ids) — `content_taxonomies.taxonomy_id`\n\t * stores the translation_group so a single assignment spans every locale.\n\t *\n\t * Like `countEntriesWithTerm`, this counts raw pivot rows regardless of\n\t * status/deletion; user-facing counts go through `fetchVisibleTermCounts`.\n\t */\n\tasync countEntriesForTerms(translationGroups: string[]): Promise<Map<string, number>> {\n\t\tif (translationGroups.length === 0) return new Map();\n\n\t\tconst { chunks, SQL_BATCH_SIZE } = await import(\"../../utils/chunks.js\");\n\n\t\tconst counts = new Map<string, number>();\n\t\tfor (const chunk of chunks(translationGroups, SQL_BATCH_SIZE)) {\n\t\t\tconst rows = await this.db\n\t\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t\t.select([\"taxonomy_id\", (eb) => eb.fn.count(\"entry_id\").as(\"count\")])\n\t\t\t\t.where(\"taxonomy_id\", \"in\", chunk)\n\t\t\t\t.groupBy(\"taxonomy_id\")\n\t\t\t\t.execute();\n\n\t\t\tfor (const row of rows) {\n\t\t\t\tcounts.set(row.taxonomy_id, Number(row.count || 0));\n\t\t\t}\n\t\t}\n\t\treturn counts;\n\t}\n\n\tprivate rowToTaxonomy(row: Selectable<TaxonomyTable>): Taxonomy {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tslug: row.slug,\n\t\t\tlabel: row.label,\n\t\t\tparentId: row.parent_id,\n\t\t\tdata: row.data ? JSON.parse(row.data) : null,\n\t\t\tlocale: row.locale,\n\t\t\ttranslationGroup: row.translation_group,\n\t\t\tsortOrder: row.sort_order,\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;AAuBA,MAAM,eAA4B;CACjC,QAAQ;CACR,cAAc;CACd,YAAY;CACZ,QAAQ;CACR,cAAc;CACd,YAAY;CACZ;;;;;;AAaD,MAAM,oBAAoB;;AAG1B,SAAS,mBACR,QACA,UACsB;CACtB,MAAM,QAAQ,SAAS,UAAU,GAAG,MAAM,IAAI,EAAE;CAChD,MAAM,yBAAS,IAAI,KAAqB;AACxC,QAAO,SAAS,OAAO,UAAU;EAChC,MAAM,WAAW,MAAM;AACvB,MAAI,aAAa,OAAW,QAAO,IAAI,OAAO,SAAS;GACtD;AACF,QAAO;;;;;;;;;;;;AAaR,SAAS,iBACR,QACA,UACsB;CACtB,MAAM,WAAW,SAAS,UAAU,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS;CACrE,MAAM,SAAS,IAAI,IAAI,OAAO;CAC9B,MAAM,yBAAS,IAAI,KAAqB;CACxC,IAAI,OAAO;AACX,UAAS,SAAS,EAAE,SAAS,UAAU;EACtC,MAAM,cAAc,OAAO,IAAI,MAAM,GAAG,OAAO,UAAU;AACzD,SAAO,IAAI,eAAe,OAAO,MAAM;GACtC;AACF,QAAO;;;;;;;;;;;;;;;;;;;AA6DR,IAAa,qBAAb,MAAgC;CAC/B,YAAY,AAAQ,IAAsB;EAAtB;;;;;;;CAOpB,MAAM,OAAO,OAA+C;EAC3D,MAAM,KAAK,MAAM;EAQjB,MAAM,cACL,MAAM,aAAa,UAAa,MAAM,aAAa,KAAK,OAAO,MAAM;EACtE,MAAM,WAAW,cAAc,MAAM,KAAK,iBAAiB,YAAY,GAAG;EAE1E,IAAI,mBAAmB;EACvB,IAAI,YAA2B;AAC/B,MAAI,MAAM,eAAe;GACxB,MAAM,SAAS,MAAM,KAAK,SAAS,MAAM,cAAc;AACvD,OAAI,QAAQ,iBAAkB,oBAAmB,OAAO;AAKxD,OAAI,UAAU,OAAO,aAAa,SAAU,aAAY,OAAO;;AAEhE,gBAAc,MAAM,KAAK,cAAc,MAAM,MAAM,SAAS;AAE5D,QAAM,KAAK,GACT,WAAW,aAAa,CACxB,OAAO;GACP;GACA,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,MAAM;GACb,WAAW;GACX,MAAM,MAAM,OAAO,KAAK,UAAU,MAAM,KAAK,GAAG;GAChD,YAAY;GAIZ,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;GAC9D,mBAAmB;GACnB,CAAC,CACD,SAAS;AAEX,iCAA+B;EAE/B,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4BAA4B;AAC3D,SAAO;;CAGR,MAAM,SAAS,IAAsC;EACpD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AACpB,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;;;CAQxC,MAAM,WAAW,MAAc,MAAc,QAA2C;EACvF,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,CACxB,MAAM,QAAQ,KAAK,KAAK;AAC1B,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,OAAO;EACpE,MAAM,MAAM,MAAM,MAAM,QAAQ,UAAU,MAAM,CAAC,kBAAkB;AACnE,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;;;;;;;CAYxC,MAAM,WAAW,MAAc,UAAuB,EAAE,EAAuB;EAC9E,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,CACxB,QAAQ,cAAc,MAAM,CAC5B,QAAQ,SAAS,MAAM,CACvB,QAAQ,MAAM,MAAM;AAEtB,MAAI,QAAQ,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,QAAQ,OAAO;AAEpF,MAAI,QAAQ,aAAa,OACxB,KAAI,QAAQ,aAAa,KACxB,SAAQ,MAAM,MAAM,aAAa,MAAM,KAAK;MAE5C,SAAQ,MAAM,MAAM,aAAa,KAAK,QAAQ,SAAS;AAKzD,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;;;;;CAUlD,MAAM,aAAa,iBAAyB,QAAsC;EACjF,MAAM,QAAQ,MAAM,KAAK,wBAAwB,gBAAgB;AACjE,MAAI,CAAC,MAAO,QAAO,EAAE;EAErB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,QAAQ,cAAc,MAAM,CAC5B,QAAQ,SAAS,MAAM,CACvB,QAAQ,MAAM,MAAM;AACtB,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,OAAO;AAGpE,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;;CAOlD,MAAM,iBAAiB,kBAA+C;AAOrE,UANa,MAAM,KAAK,GACtB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,qBAAqB,KAAK,iBAAiB,CACjD,QAAQ,UAAU,MAAM,CACxB,SAAS,EACC,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;CAGlD,MAAM,OAAO,IAAY,OAAsD;EAC9E,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SAAU,QAAO;EAItB,MAAM,UAAmC,EAAE;AAC3C,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,MAAM;AACnD,MAAI,MAAM,UAAU,OAAW,SAAQ,QAAQ,MAAM;AACrD,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,KAAK,UAAU,MAAM,KAAK;EAEvE,MAAM,QAA4D,EAAE;AACpE,MAAI,MAAM,aAAa,QAAW;GAIjC,MAAM,WACL,MAAM,aAAa,MAAM,MAAM,aAAa,OACzC,OACA,MAAM,KAAK,iBAAiB,MAAM,SAAS;AAE/C,OAAI,aAAa,SAAS,UAAU;AACnC,UAAM,YAAY;AAGlB,UAAM,aAAa,MAAM,KAAK,cAAc,SAAS,MAAM,SAAS;;;EAItE,MAAM,gBAAgB,OAAO,KAAK,QAAQ,CAAC,SAAS;EACpD,MAAM,kBAAkB,OAAO,KAAK,MAAM,CAAC,SAAS;AACpD,MAAI,iBAAiB,iBAAiB;AACrC,SAAM,gBAAgB,KAAK,IAAI,OAAO,QAAQ;AAC7C,QAAI,cACH,OAAM,IAAI,YAAY,aAAa,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,SAAS;AAEhF,QAAI,gBACH,OAAM,IACJ,YAAY,aAAa,CACzB,IAAI,MAAM,CACV,MAAM,qBAAqB,KAAK,SAAS,oBAAoB,SAAS,GAAG,CACzE,SAAS;KAEX;AACF,kCAA+B;;AAGhC,SAAO,KAAK,SAAS,GAAG;;;;;;;;;;;;;;;;CAiBzB,MAAM,QAAQ,QAAkB,UAAqD;EACpF,MAAM,UAAU,IAAI,IAAI,SAAS,KAAK,EAAE,OAAO,eAAe,CAAC,OAAO,SAAS,CAAC,CAAC;EAEjF,MAAM,SAAmB,EAAE;EAC3B,MAAM,WAAqB,EAAE;AAC7B,OAAK,MAAM,SAAS,QAAQ;GAC3B,MAAM,WAAW,QAAQ,IAAI,MAAM;AACnC,OAAI,aAAa,OAAW;AAC5B,UAAO,KAAK,MAAM;AAClB,YAAS,KAAK,SAAS;;AAExB,MAAI,OAAO,WAAW,EAAG;EAUzB,MAAM,UAAU,CAAC,GAJhB,IAAI,IAAI,SAAS,CAAC,SAAS,SAAS,SACjC,mBAAmB,QAAQ,SAAS,GACpC,iBAAiB,QAAQ,SAAS,CAEX,CAAC,QAAQ,CAAC,OAAO,cAAc,QAAQ,IAAI,MAAM,KAAK,SAAS;AAC1F,MAAI,QAAQ,WAAW,EAAG;AAE1B,QAAM,KAAK,eAAe,QAAQ;AAElC,iCAA+B;;;;;;;;;;CAWhC,MAAc,eAAe,WAAkE;AAC9F,OAAK,IAAI,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS,mBAAmB;GACzE,MAAM,QAAQ,UAAU,MAAM,OAAO,QAAQ,kBAAkB;AAS/D,SAAM,GAAG;;8CALI,IAAI,KAChB,MAAM,KAAK,CAAC,OAAO,cAAc,GAAG,QAAQ,MAAM,aAAa,SAAS,cAAc,EACtF,GAAG,IACH,CAI+C;kCAHnC,IAAI,KAAK,MAAM,KAAK,CAAC,WAAW,GAAG,GAAG,QAAQ,CAAC,CAIxB;KAClC,QAAQ,KAAK,GAAG;;;;;;;;;;;CAYpB,MAAc,cAAc,MAAc,UAA0C;EACnF,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,QAAQ,OAAO,GAAG,GAAG,IAAI,aAAa,CAAC,GAAG,MAAM,CAAC,CACjD,MAAM,QAAQ,KAAK,KAAK;AAC1B,UACC,aAAa,OACV,MAAM,MAAM,aAAa,MAAM,KAAK,GACpC,MAAM,MAAM,aAAa,KAAK,SAAS;EAE3C,MAAM,SAAS,MAAM,MAAM,kBAAkB;AAE7C,MAAI,CAAC,UAAU,OAAO,QAAQ,KAAM,QAAO;AAC3C,SAAO,OAAO,MAAM;;CAGrB,MAAM,OAAO,IAA8B;EAC1C,MAAM,OAAO,MAAM,KAAK,SAAS,GAAG;AACpC,MAAI,CAAC,KAAM,QAAO;AAIlB,MAAI,KAAK,kBAOR;QANiB,MAAM,KAAK,GAC1B,WAAW,aAAa,CACxB,OAAO,KAAK,CACZ,MAAM,qBAAqB,KAAK,KAAK,iBAAiB,CACtD,MAAM,MAAM,MAAM,GAAG,CACrB,SAAS,EACE,WAAW,EACvB,OAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,eAAe,KAAK,KAAK,iBAAiB,CAChD,SAAS;;EAIb,MAAM,SAAS,MAAM,KAAK,GAAG,WAAW,aAAa,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,kBAAkB;AAC7F,iCAA+B;AAC/B,UAAQ,OAAO,kBAAkB,MAAM;;CAKxC,MAAM,cAAc,YAAoB,SAAiB,YAAmC;EAC3F,MAAM,QAAQ,MAAM,KAAK,wBAAwB,WAAW;AAC5D,MAAI,CAAC,MAAO;EAEZ,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY,QAAQ;AAC/D,QAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,OAAO;GAAE;GAAY,UAAU;GAAS,aAAa;GAAO,GAAG;GAAQ,CAAC,CACxE,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,SAAS;AACX,iCAA+B;;CAGhC,MAAM,gBAAgB,YAAoB,SAAiB,YAAmC;EAC7F,MAAM,QAAQ,MAAM,KAAK,wBAAwB,WAAW;AAC5D,MAAI,CAAC,MAAO;AAEZ,QAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,QAAQ,CAC/B,MAAM,eAAe,KAAK,MAAM,CAChC,SAAS;AACX,iCAA+B;;;;;;;CAQhC,MAAM,iBACL,YACA,SACA,cACA,QACsB;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,qBAAqB,CAChC,UAAU,cAAc,gCAAgC,iCAAiC,CACzF,UAAU,aAAa,CACvB,MAAM,iCAAiC,KAAK,WAAW,CACvD,MAAM,+BAA+B,KAAK,QAAQ;AAEpD,MAAI,aAAc,SAAQ,MAAM,MAAM,mBAAmB,KAAK,aAAa;AAC3E,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,qBAAqB,KAAK,OAAO;AAG/E,UADa,MAAM,MAAM,QAAQ,qBAAqB,MAAM,CAAC,SAAS,EAC1D,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;;CAOlD,MAAM,iBACL,YACA,SACA,cACA,SACgB;EAChB,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,MAAM,SAAS;GACzB,MAAM,QAAQ,MAAM,KAAK,wBAAwB,GAAG;AACpD,OAAI,MAAO,QAAO,KAAK,MAAM;;EAE9B,MAAM,YAAY,IAAI,IAAI,OAAO;EAEjC,MAAM,UAAU,MAAM,KAAK,GACzB,WAAW,qBAAqB,CAChC,UAAU,cAAc,gCAAgC,iCAAiC,CACzF,OAAO,CAAC,0CAA0C,CAAC,CACnD,UAAU,CACV,MAAM,iCAAiC,KAAK,WAAW,CACvD,MAAM,+BAA+B,KAAK,QAAQ,CAClD,MAAM,mBAAmB,KAAK,aAAa,CAC3C,SAAS;EACX,MAAM,gBAAgB,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,MAAM,CAAC;EAE1D,MAAM,WAAW,CAAC,GAAG,cAAc,CAAC,QAAQ,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AACpE,MAAI,SAAS,SAAS,EACrB,OAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,QAAQ,CAC/B,MAAM,eAAe,MAAM,SAAS,CACpC,SAAS;EAGZ,MAAM,QAAQ,CAAC,GAAG,UAAU,CAAC,QAAQ,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;AACjE,MAAI,MAAM,SAAS,GAAG;GACrB,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY,QAAQ;AAC/D,SAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,OACA,MAAM,KAAK,iBAAiB;IAC3B;IACA,UAAU;IACV;IACA,GAAG;IACH,EAAE,CACH,CACA,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,SAAS;;AAGZ,MAAI,SAAS,SAAS,KAAK,MAAM,SAAS,EAAG,gCAA+B;;CAG7E,MAAM,gBAAgB,YAAoB,SAAkC;EAC3E,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,QAAQ,CAC/B,kBAAkB;EACpB,MAAM,UAAU,OAAO,OAAO,kBAAkB,EAAE;AAClD,MAAI,UAAU,EAAG,gCAA+B;AAChD,SAAO;;;;;;;CAQR,MAAM,eACL,YACA,eACA,eACgB;EAChB,MAAM,OAAO,MAAM,KAAK,GACtB,WAAW,qBAAqB,CAChC,OAAO,CAAC,cAAc,CAAC,CACvB,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,cAAc,CACrC,SAAS;AACX,MAAI,KAAK,WAAW,EAAG;EAIvB,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY,cAAc;AACrE,QAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,OACA,KAAK,KAAK,OAAO;GAChB;GACA,UAAU;GACV,aAAa,EAAE;GACf,GAAG;GACH,EAAE,CACH,CACA,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,SAAS;AACX,iCAA+B;;;;;;;;CAShC,MAAc,iBAAiB,YAAoB,SAAuC;AACzF,qBAAmB,YAAY,kBAAkB;EACjD,MAAM,YAAY,MAAM;AACxB,MAAI;AAMH,WALe,MAAM,GAAgB;;WAE7B,IAAI,IAAI,UAAU,CAAC;iBACb,QAAQ;KACpB,QAAQ,KAAK,GAAG,EACJ,KAAK,MAAM;WACjB,OAAO;AACf,OAAI,oBAAoB,MAAM,CAAE,QAAO;AACvC,SAAM;;;;;;;;;;;;;CAcR,MAAM,qBAAqB,eAAwC;EAClE,MAAM,QAAQ,MAAM,KAAK,wBAAwB,cAAc;AAC/D,MAAI,CAAC,MAAO,QAAO;EAEnB,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,qBAAqB,CAChC,QAAQ,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,QAAQ,CAAC,CACnD,MAAM,eAAe,KAAK,MAAM,CAChC,kBAAkB;AACpB,SAAO,OAAO,QAAQ,SAAS,EAAE;;;;;;;;;;;CAYlC,MAAc,iBAAiB,WAAoC;EAClE,MAAM,QAAQ,MAAM,KAAK,wBAAwB,UAAU;AAC3D,MAAI,CAAC,MAAO,QAAO;AAMnB,SALe,MAAM,KAAK,GACxB,WAAW,aAAa,CACxB,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,MAAM,CACvB,kBAAkB,GACJ,QAAQ;;CAGzB,MAAc,wBAAwB,WAA2C;AAMhF,UALY,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,OAAO,CAAC,oBAAoB,CAAC,CAC7B,OAAO,OAAO,GAAG,GAAG,CAAC,GAAG,MAAM,KAAK,UAAU,EAAE,GAAG,qBAAqB,KAAK,UAAU,CAAC,CAAC,CAAC,CACzF,kBAAkB,GACR,qBAAqB;;;;;;;;;;;;;CAclC,MAAM,qBAAqB,mBAA2D;AACrF,MAAI,kBAAkB,WAAW,EAAG,wBAAO,IAAI,KAAK;EAEpD,MAAM,EAAE,QAAQ,mBAAmB,MAAM,OAAO;EAEhD,MAAM,yBAAS,IAAI,KAAqB;AACxC,OAAK,MAAM,SAAS,OAAO,mBAAmB,eAAe,EAAE;GAC9D,MAAM,OAAO,MAAM,KAAK,GACtB,WAAW,qBAAqB,CAChC,OAAO,CAAC,gBAAgB,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CACpE,MAAM,eAAe,MAAM,MAAM,CACjC,QAAQ,cAAc,CACtB,SAAS;AAEX,QAAK,MAAM,OAAO,KACjB,QAAO,IAAI,IAAI,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC;;AAGrD,SAAO;;CAGR,AAAQ,cAAc,KAA0C;AAC/D,SAAO;GACN,IAAI,IAAI;GACR,MAAM,IAAI;GACV,MAAM,IAAI;GACV,OAAO,IAAI;GACX,UAAU,IAAI;GACd,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;GACxC,QAAQ,IAAI;GACZ,kBAAkB,IAAI;GACtB,WAAW,IAAI;GACf"}

package/dist/{tokens-DVltpO2D.mjs → tokens-DagaJGK8.mjs}

@@ -168,4 +168,4 @@ function parseContentId(contentId) {
 
 //#endregion
 export { parseContentId as n, verifyPreviewToken as r, generatePreviewToken as t };
-//# sourceMappingURL=tokens-DVltpO2D.mjs.map
+//# sourceMappingURL=tokens-DagaJGK8.mjs.map

package/dist/{tokens-DVltpO2D.mjs.map → tokens-DagaJGK8.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"tokens-DVltpO2D.mjs","names":[],"sources":["../src/preview/tokens.ts"],"sourcesContent":["/**\n * Preview token generation and verification\n *\n * Tokens are compact, URL-safe, and HMAC-signed.\n * Format: base64url(JSON payload).base64url(HMAC signature)\n *\n * Payload: { cid: contentId, exp: expiryTimestamp, iat: issuedAt }\n */\n\nimport { encodeBase64url, decodeBase64url } from \"../utils/base64.js\";\n\n// Regex pattern for duration parsing\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\n/**\n * Preview token payload\n */\nexport interface PreviewTokenPayload {\n\t/** Content ID in format \"collection:id\" (e.g., \"posts:abc123\") */\n\tcid: string;\n\t/** Expiry timestamp (seconds since epoch) */\n\texp: number;\n\t/** Issued at timestamp (seconds since epoch) */\n\tiat: number;\n}\n\n/**\n * Options for generating a preview token\n */\nexport interface GeneratePreviewTokenOptions {\n\t/** Content ID in format \"collection:id\" */\n\tcontentId: string;\n\t/** How long the token is valid. Accepts \"1h\", \"30m\", \"1d\", or seconds as number. Default: \"1h\" */\n\texpiresIn?: string | number;\n\t/** Secret key for signing. Should be from environment variable. */\n\tsecret: string;\n}\n\n/**\n * Parse duration string to seconds\n * Supports: \"1h\", \"30m\", \"1d\", \"2w\", or raw seconds\n */\nfunction parseDuration(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\treturn duration;\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use \"1h\", \"30m\", \"1d\", \"2w\", or seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Create HMAC-SHA256 signature using Web Crypto API\n */\nasync function createSignature(data: string, secret: string): Promise<Uint8Array> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"sign\"],\n\t);\n\tconst signature = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data));\n\treturn new Uint8Array(signature);\n}\n\n/**\n * Verify HMAC-SHA256 signature\n */\nasync function verifySignature(\n\tdata: string,\n\tsignature: Uint8Array,\n\tsecret: string,\n): Promise<boolean> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"verify\"],\n\t);\n\t// Create a new ArrayBuffer from the signature to satisfy BufferSource typing\n\t// (Uint8Array.buffer is ArrayBufferLike which includes SharedArrayBuffer)\n\tconst sigBuffer: ArrayBuffer = new ArrayBuffer(signature.byteLength);\n\tnew Uint8Array(sigBuffer).set(signature);\n\treturn crypto.subtle.verify(\"HMAC\", key, sigBuffer, encoder.encode(data));\n}\n\n/**\n * Generate a preview token for content\n *\n * @example\n * ```ts\n * const token = await generatePreviewToken({\n *   contentId: \"posts:abc123\",\n *   expiresIn: \"1h\",\n *   secret: process.env.PREVIEW_SECRET!,\n * });\n * ```\n */\nexport async function generatePreviewToken(options: GeneratePreviewTokenOptions): Promise<string> {\n\tconst { contentId, expiresIn = \"1h\", secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\tif (!contentId || !contentId.includes(\":\")) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\n\tconst now = Math.floor(Date.now() / 1000);\n\tconst duration = parseDuration(expiresIn);\n\n\tconst payload: PreviewTokenPayload = {\n\t\tcid: contentId,\n\t\texp: now + duration,\n\t\tiat: now,\n\t};\n\n\t// Encode payload\n\tconst payloadJson = JSON.stringify(payload);\n\tconst encodedPayload = encodeBase64url(new TextEncoder().encode(payloadJson));\n\n\t// Sign it\n\tconst signature = await createSignature(encodedPayload, secret);\n\tconst encodedSignature = encodeBase64url(signature);\n\n\treturn `${encodedPayload}.${encodedSignature}`;\n}\n\n/**\n * Result of verifying a preview token\n */\nexport type VerifyPreviewTokenResult =\n\t| { valid: true; payload: PreviewTokenPayload }\n\t| { valid: false; error: \"invalid\" | \"expired\" | \"malformed\" | \"none\" };\n\n/**\n * Options for verifyPreviewToken\n */\nexport type VerifyPreviewTokenOptions = {\n\t/** Secret key for verifying tokens */\n\tsecret: string;\n} & (\n\t| { /** URL to extract _preview token from */ url: URL }\n\t| {\n\t\t\t/** Preview token string (can be null) */ token: string | null | undefined;\n\t  }\n);\n\n/**\n * Verify a preview token and return the payload\n *\n * @example\n * ```ts\n * // With URL (extracts _preview query param)\n * const result = await verifyPreviewToken({\n *   url: Astro.url,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * // With token directly\n * const result = await verifyPreviewToken({\n *   token: someToken,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * if (result.valid) {\n *   console.log(result.payload.cid); // \"posts:abc123\"\n * }\n * ```\n */\nexport async function verifyPreviewToken(\n\toptions: VerifyPreviewTokenOptions,\n): Promise<VerifyPreviewTokenResult> {\n\tconst { secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\t// Extract token from URL or use provided token\n\tconst token = \"url\" in options ? options.url.searchParams.get(\"_preview\") : options.token;\n\n\t// Handle null/undefined token\n\tif (!token) {\n\t\treturn { valid: false, error: \"none\" };\n\t}\n\n\t// Split token into payload and signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst [encodedPayload, encodedSignature] = parts;\n\n\t// Verify signature\n\tlet signature: Uint8Array;\n\ttry {\n\t\tsignature = decodeBase64url(encodedSignature);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst isValid = await verifySignature(encodedPayload, signature, secret);\n\tif (!isValid) {\n\t\treturn { valid: false, error: \"invalid\" };\n\t}\n\n\t// Decode and parse payload\n\tlet payload: PreviewTokenPayload;\n\ttry {\n\t\tconst payloadBytes = decodeBase64url(encodedPayload);\n\t\tconst payloadJson = new TextDecoder().decode(payloadBytes);\n\t\tpayload = JSON.parse(payloadJson);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check required fields\n\tif (\n\t\ttypeof payload.cid !== \"string\" ||\n\t\ttypeof payload.exp !== \"number\" ||\n\t\ttypeof payload.iat !== \"number\"\n\t) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check expiry\n\tconst now = Math.floor(Date.now() / 1000);\n\tif (payload.exp < now) {\n\t\treturn { valid: false, error: \"expired\" };\n\t}\n\n\treturn { valid: true, payload };\n}\n\n/**\n * Parse a content ID into collection and id\n */\nexport function parseContentId(contentId: string): {\n\tcollection: string;\n\tid: string;\n} {\n\tconst colonIndex = contentId.indexOf(\":\");\n\tif (colonIndex === -1) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\treturn {\n\t\tcollection: contentId.slice(0, colonIndex),\n\t\tid: contentId.slice(colonIndex + 1),\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,mBAAmB;;;;;AA8BzB,SAAS,cAAc,UAAmC;AACzD,KAAI,OAAO,aAAa,SACvB,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,6CACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;AAOpD,eAAe,gBAAgB,MAAc,QAAqC;CACjF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACR;CACD,MAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,CAAC;AAC7E,QAAO,IAAI,WAAW,UAAU;;;;;AAMjC,eAAe,gBACd,MACA,WACA,QACmB;CACnB,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,SAAS,CACV;CAGD,MAAM,YAAyB,IAAI,YAAY,UAAU,WAAW;AACpE,KAAI,WAAW,UAAU,CAAC,IAAI,UAAU;AACxC,QAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,QAAQ,OAAO,KAAK,CAAC;;;;;;;;;;;;;;AAe1E,eAAsB,qBAAqB,SAAuD;CACjG,MAAM,EAAE,WAAW,YAAY,MAAM,WAAW;AAEhD,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;AAG9C,KAAI,CAAC,aAAa,CAAC,UAAU,SAAS,IAAI,CACzC,OAAM,IAAI,MAAM,iDAA+C;CAGhE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAGzC,MAAM,UAA+B;EACpC,KAAK;EACL,KAAK,MAJW,cAAc,UAAU;EAKxC,KAAK;EACL;CAGD,MAAM,cAAc,KAAK,UAAU,QAAQ;CAC3C,MAAM,iBAAiB,gBAAgB,IAAI,aAAa,CAAC,OAAO,YAAY,CAAC;AAM7E,QAAO,GAAG,eAAe,GAFA,gBADP,MAAM,gBAAgB,gBAAgB,OAAO,CACZ;;;;;;;;;;;;;;;;;;;;;;;;AA+CpD,eAAsB,mBACrB,SACoC;CACpC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;CAI9C,MAAM,QAAQ,SAAS,UAAU,QAAQ,IAAI,aAAa,IAAI,WAAW,GAAG,QAAQ;AAGpF,KAAI,CAAC,MACJ,QAAO;EAAE,OAAO;EAAO,OAAO;EAAQ;CAIvC,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EACpB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAG5C,MAAM,CAAC,gBAAgB,oBAAoB;CAG3C,IAAI;AACJ,KAAI;AACH,cAAY,gBAAgB,iBAAiB;SACtC;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KAAI,CADY,MAAM,gBAAgB,gBAAgB,WAAW,OAAO,CAEvE,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;CAI1C,IAAI;AACJ,KAAI;EACH,MAAM,eAAe,gBAAgB,eAAe;EACpD,MAAM,cAAc,IAAI,aAAa,CAAC,OAAO,aAAa;AAC1D,YAAU,KAAK,MAAM,YAAY;SAC1B;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KACC,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,SAEvB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAI5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,KAAI,QAAQ,MAAM,IACjB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;AAG1C,QAAO;EAAE,OAAO;EAAM;EAAS;;;;;AAMhC,SAAgB,eAAe,WAG7B;CACD,MAAM,aAAa,UAAU,QAAQ,IAAI;AACzC,KAAI,eAAe,GAClB,OAAM,IAAI,MAAM,iDAA+C;AAEhE,QAAO;EACN,YAAY,UAAU,MAAM,GAAG,WAAW;EAC1C,IAAI,UAAU,MAAM,aAAa,EAAE;EACnC"}
+{"version":3,"file":"tokens-DagaJGK8.mjs","names":[],"sources":["../src/preview/tokens.ts"],"sourcesContent":["/**\n * Preview token generation and verification\n *\n * Tokens are compact, URL-safe, and HMAC-signed.\n * Format: base64url(JSON payload).base64url(HMAC signature)\n *\n * Payload: { cid: contentId, exp: expiryTimestamp, iat: issuedAt }\n */\n\nimport { encodeBase64url, decodeBase64url } from \"../utils/base64.js\";\n\n// Regex pattern for duration parsing\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\n/**\n * Preview token payload\n */\nexport interface PreviewTokenPayload {\n\t/** Content ID in format \"collection:id\" (e.g., \"posts:abc123\") */\n\tcid: string;\n\t/** Expiry timestamp (seconds since epoch) */\n\texp: number;\n\t/** Issued at timestamp (seconds since epoch) */\n\tiat: number;\n}\n\n/**\n * Options for generating a preview token\n */\nexport interface GeneratePreviewTokenOptions {\n\t/** Content ID in format \"collection:id\" */\n\tcontentId: string;\n\t/** How long the token is valid. Accepts \"1h\", \"30m\", \"1d\", or seconds as number. Default: \"1h\" */\n\texpiresIn?: string | number;\n\t/** Secret key for signing. Should be from environment variable. */\n\tsecret: string;\n}\n\n/**\n * Parse duration string to seconds\n * Supports: \"1h\", \"30m\", \"1d\", \"2w\", or raw seconds\n */\nfunction parseDuration(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\treturn duration;\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use \"1h\", \"30m\", \"1d\", \"2w\", or seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Create HMAC-SHA256 signature using Web Crypto API\n */\nasync function createSignature(data: string, secret: string): Promise<Uint8Array> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"sign\"],\n\t);\n\tconst signature = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data));\n\treturn new Uint8Array(signature);\n}\n\n/**\n * Verify HMAC-SHA256 signature\n */\nasync function verifySignature(\n\tdata: string,\n\tsignature: Uint8Array,\n\tsecret: string,\n): Promise<boolean> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"verify\"],\n\t);\n\t// Create a new ArrayBuffer from the signature to satisfy BufferSource typing\n\t// (Uint8Array.buffer is ArrayBufferLike which includes SharedArrayBuffer)\n\tconst sigBuffer: ArrayBuffer = new ArrayBuffer(signature.byteLength);\n\tnew Uint8Array(sigBuffer).set(signature);\n\treturn crypto.subtle.verify(\"HMAC\", key, sigBuffer, encoder.encode(data));\n}\n\n/**\n * Generate a preview token for content\n *\n * @example\n * ```ts\n * const token = await generatePreviewToken({\n *   contentId: \"posts:abc123\",\n *   expiresIn: \"1h\",\n *   secret: process.env.PREVIEW_SECRET!,\n * });\n * ```\n */\nexport async function generatePreviewToken(options: GeneratePreviewTokenOptions): Promise<string> {\n\tconst { contentId, expiresIn = \"1h\", secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\tif (!contentId || !contentId.includes(\":\")) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\n\tconst now = Math.floor(Date.now() / 1000);\n\tconst duration = parseDuration(expiresIn);\n\n\tconst payload: PreviewTokenPayload = {\n\t\tcid: contentId,\n\t\texp: now + duration,\n\t\tiat: now,\n\t};\n\n\t// Encode payload\n\tconst payloadJson = JSON.stringify(payload);\n\tconst encodedPayload = encodeBase64url(new TextEncoder().encode(payloadJson));\n\n\t// Sign it\n\tconst signature = await createSignature(encodedPayload, secret);\n\tconst encodedSignature = encodeBase64url(signature);\n\n\treturn `${encodedPayload}.${encodedSignature}`;\n}\n\n/**\n * Result of verifying a preview token\n */\nexport type VerifyPreviewTokenResult =\n\t| { valid: true; payload: PreviewTokenPayload }\n\t| { valid: false; error: \"invalid\" | \"expired\" | \"malformed\" | \"none\" };\n\n/**\n * Options for verifyPreviewToken\n */\nexport type VerifyPreviewTokenOptions = {\n\t/** Secret key for verifying tokens */\n\tsecret: string;\n} & (\n\t| { /** URL to extract _preview token from */ url: URL }\n\t| {\n\t\t\t/** Preview token string (can be null) */ token: string | null | undefined;\n\t  }\n);\n\n/**\n * Verify a preview token and return the payload\n *\n * @example\n * ```ts\n * // With URL (extracts _preview query param)\n * const result = await verifyPreviewToken({\n *   url: Astro.url,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * // With token directly\n * const result = await verifyPreviewToken({\n *   token: someToken,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * if (result.valid) {\n *   console.log(result.payload.cid); // \"posts:abc123\"\n * }\n * ```\n */\nexport async function verifyPreviewToken(\n\toptions: VerifyPreviewTokenOptions,\n): Promise<VerifyPreviewTokenResult> {\n\tconst { secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\t// Extract token from URL or use provided token\n\tconst token = \"url\" in options ? options.url.searchParams.get(\"_preview\") : options.token;\n\n\t// Handle null/undefined token\n\tif (!token) {\n\t\treturn { valid: false, error: \"none\" };\n\t}\n\n\t// Split token into payload and signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst [encodedPayload, encodedSignature] = parts;\n\n\t// Verify signature\n\tlet signature: Uint8Array;\n\ttry {\n\t\tsignature = decodeBase64url(encodedSignature);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst isValid = await verifySignature(encodedPayload, signature, secret);\n\tif (!isValid) {\n\t\treturn { valid: false, error: \"invalid\" };\n\t}\n\n\t// Decode and parse payload\n\tlet payload: PreviewTokenPayload;\n\ttry {\n\t\tconst payloadBytes = decodeBase64url(encodedPayload);\n\t\tconst payloadJson = new TextDecoder().decode(payloadBytes);\n\t\tpayload = JSON.parse(payloadJson);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check required fields\n\tif (\n\t\ttypeof payload.cid !== \"string\" ||\n\t\ttypeof payload.exp !== \"number\" ||\n\t\ttypeof payload.iat !== \"number\"\n\t) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check expiry\n\tconst now = Math.floor(Date.now() / 1000);\n\tif (payload.exp < now) {\n\t\treturn { valid: false, error: \"expired\" };\n\t}\n\n\treturn { valid: true, payload };\n}\n\n/**\n * Parse a content ID into collection and id\n */\nexport function parseContentId(contentId: string): {\n\tcollection: string;\n\tid: string;\n} {\n\tconst colonIndex = contentId.indexOf(\":\");\n\tif (colonIndex === -1) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\treturn {\n\t\tcollection: contentId.slice(0, colonIndex),\n\t\tid: contentId.slice(colonIndex + 1),\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,mBAAmB;;;;;AA8BzB,SAAS,cAAc,UAAmC;AACzD,KAAI,OAAO,aAAa,SACvB,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,6CACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;AAOpD,eAAe,gBAAgB,MAAc,QAAqC;CACjF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACR;CACD,MAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,CAAC;AAC7E,QAAO,IAAI,WAAW,UAAU;;;;;AAMjC,eAAe,gBACd,MACA,WACA,QACmB;CACnB,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,SAAS,CACV;CAGD,MAAM,YAAyB,IAAI,YAAY,UAAU,WAAW;AACpE,KAAI,WAAW,UAAU,CAAC,IAAI,UAAU;AACxC,QAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,QAAQ,OAAO,KAAK,CAAC;;;;;;;;;;;;;;AAe1E,eAAsB,qBAAqB,SAAuD;CACjG,MAAM,EAAE,WAAW,YAAY,MAAM,WAAW;AAEhD,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;AAG9C,KAAI,CAAC,aAAa,CAAC,UAAU,SAAS,IAAI,CACzC,OAAM,IAAI,MAAM,iDAA+C;CAGhE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAGzC,MAAM,UAA+B;EACpC,KAAK;EACL,KAAK,MAJW,cAAc,UAAU;EAKxC,KAAK;EACL;CAGD,MAAM,cAAc,KAAK,UAAU,QAAQ;CAC3C,MAAM,iBAAiB,gBAAgB,IAAI,aAAa,CAAC,OAAO,YAAY,CAAC;AAM7E,QAAO,GAAG,eAAe,GAFA,gBADP,MAAM,gBAAgB,gBAAgB,OAAO,CACZ;;;;;;;;;;;;;;;;;;;;;;;;AA+CpD,eAAsB,mBACrB,SACoC;CACpC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;CAI9C,MAAM,QAAQ,SAAS,UAAU,QAAQ,IAAI,aAAa,IAAI,WAAW,GAAG,QAAQ;AAGpF,KAAI,CAAC,MACJ,QAAO;EAAE,OAAO;EAAO,OAAO;EAAQ;CAIvC,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EACpB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAG5C,MAAM,CAAC,gBAAgB,oBAAoB;CAG3C,IAAI;AACJ,KAAI;AACH,cAAY,gBAAgB,iBAAiB;SACtC;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KAAI,CADY,MAAM,gBAAgB,gBAAgB,WAAW,OAAO,CAEvE,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;CAI1C,IAAI;AACJ,KAAI;EACH,MAAM,eAAe,gBAAgB,eAAe;EACpD,MAAM,cAAc,IAAI,aAAa,CAAC,OAAO,aAAa;AAC1D,YAAU,KAAK,MAAM,YAAY;SAC1B;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KACC,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,SAEvB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAI5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,KAAI,QAAQ,MAAM,IACjB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;AAG1C,QAAO;EAAE,OAAO;EAAM;EAAS;;;;;AAMhC,SAAgB,eAAe,WAG7B;CACD,MAAM,aAAa,UAAU,QAAQ,IAAI;AACzC,KAAI,eAAe,GAClB,OAAM,IAAI,MAAM,iDAA+C;AAEhE,QAAO;EACN,YAAY,UAAU,MAAM,GAAG,WAAW;EAC1C,IAAI,UAAU,MAAM,aAAa,EAAE;EACnC"}

package/dist/{transaction-D0FOsb3X.mjs → transaction-NQj4VJ7Z.mjs}

@@ -25,4 +25,4 @@ async function withTransaction(db, fn) {
 
 //#endregion
 export { withTransaction as t };
-//# sourceMappingURL=transaction-D0FOsb3X.mjs.map
+//# sourceMappingURL=transaction-NQj4VJ7Z.mjs.map

package/dist/{transaction-D0FOsb3X.mjs.map → transaction-NQj4VJ7Z.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"transaction-D0FOsb3X.mjs","names":[],"sources":["../src/database/transaction.ts"],"sourcesContent":["/**\n * Transaction utility for D1 compatibility\n *\n * D1 (via kysely-d1) does not support transactions. On workerd, the error\n * from beginTransaction() crosses request contexts and can hang the worker.\n *\n * This utility provides a drop-in replacement that runs the callback directly\n * against the db instance when transactions are unavailable. D1 is single-writer\n * so atomicity is not a concern for individual statements — multi-statement\n * atomicity is lost, but that's a known D1 limitation.\n *\n * Usage:\n *   import { withTransaction } from \"../database/transaction.js\";\n *   const result = await withTransaction(db, async (trx) => { ... });\n */\n\nimport type { Kysely, Transaction } from \"kysely\";\n\n/**\n * Run a callback inside a transaction if supported, or directly if not.\n *\n * Probes the database once on first call to determine if transactions work.\n * The result is cached for the lifetime of the process/worker.\n */\nlet transactionsSupported: boolean | null = null;\nconst TRANSACTIONS_NOT_SUPPORTED_RE = /transactions are not supported/i;\n\nexport async function withTransaction<DB, T>(\n\tdb: Kysely<DB>,\n\tfn: (trx: Kysely<DB> | Transaction<DB>) => Promise<T>,\n): Promise<T> {\n\t// Fast path: we already know transactions work\n\tif (transactionsSupported === true) {\n\t\treturn db.transaction().execute(fn);\n\t}\n\n\t// Fast path: we already know they don't\n\tif (transactionsSupported === false) {\n\t\treturn fn(db);\n\t}\n\n\t// First call: probe\n\ttry {\n\t\tconst result = await db.transaction().execute(fn);\n\t\ttransactionsSupported = true;\n\t\treturn result;\n\t} catch (error) {\n\t\tif (error instanceof Error && TRANSACTIONS_NOT_SUPPORTED_RE.test(error.message)) {\n\t\t\ttransactionsSupported = false;\n\t\t\treturn fn(db);\n\t\t}\n\t\tthrow error;\n\t}\n}\n"],"mappings":";;;;;;;AAwBA,IAAI,wBAAwC;AAC5C,MAAM,gCAAgC;AAEtC,eAAsB,gBACrB,IACA,IACa;AAEb,KAAI,0BAA0B,KAC7B,QAAO,GAAG,aAAa,CAAC,QAAQ,GAAG;AAIpC,KAAI,0BAA0B,MAC7B,QAAO,GAAG,GAAG;AAId,KAAI;EACH,MAAM,SAAS,MAAM,GAAG,aAAa,CAAC,QAAQ,GAAG;AACjD,0BAAwB;AACxB,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,SAAS,8BAA8B,KAAK,MAAM,QAAQ,EAAE;AAChF,2BAAwB;AACxB,UAAO,GAAG,GAAG;;AAEd,QAAM"}
+{"version":3,"file":"transaction-NQj4VJ7Z.mjs","names":[],"sources":["../src/database/transaction.ts"],"sourcesContent":["/**\n * Transaction utility for D1 compatibility\n *\n * D1 (via kysely-d1) does not support transactions. On workerd, the error\n * from beginTransaction() crosses request contexts and can hang the worker.\n *\n * This utility provides a drop-in replacement that runs the callback directly\n * against the db instance when transactions are unavailable. D1 is single-writer\n * so atomicity is not a concern for individual statements — multi-statement\n * atomicity is lost, but that's a known D1 limitation.\n *\n * Usage:\n *   import { withTransaction } from \"../database/transaction.js\";\n *   const result = await withTransaction(db, async (trx) => { ... });\n */\n\nimport type { Kysely, Transaction } from \"kysely\";\n\n/**\n * Run a callback inside a transaction if supported, or directly if not.\n *\n * Probes the database once on first call to determine if transactions work.\n * The result is cached for the lifetime of the process/worker.\n */\nlet transactionsSupported: boolean | null = null;\nconst TRANSACTIONS_NOT_SUPPORTED_RE = /transactions are not supported/i;\n\nexport async function withTransaction<DB, T>(\n\tdb: Kysely<DB>,\n\tfn: (trx: Kysely<DB> | Transaction<DB>) => Promise<T>,\n): Promise<T> {\n\t// Fast path: we already know transactions work\n\tif (transactionsSupported === true) {\n\t\treturn db.transaction().execute(fn);\n\t}\n\n\t// Fast path: we already know they don't\n\tif (transactionsSupported === false) {\n\t\treturn fn(db);\n\t}\n\n\t// First call: probe\n\ttry {\n\t\tconst result = await db.transaction().execute(fn);\n\t\ttransactionsSupported = true;\n\t\treturn result;\n\t} catch (error) {\n\t\tif (error instanceof Error && TRANSACTIONS_NOT_SUPPORTED_RE.test(error.message)) {\n\t\t\ttransactionsSupported = false;\n\t\t\treturn fn(db);\n\t\t}\n\t\tthrow error;\n\t}\n}\n"],"mappings":";;;;;;;AAwBA,IAAI,wBAAwC;AAC5C,MAAM,gCAAgC;AAEtC,eAAsB,gBACrB,IACA,IACa;AAEb,KAAI,0BAA0B,KAC7B,QAAO,GAAG,aAAa,CAAC,QAAQ,GAAG;AAIpC,KAAI,0BAA0B,MAC7B,QAAO,GAAG,GAAG;AAId,KAAI;EACH,MAAM,SAAS,MAAM,GAAG,aAAa,CAAC,QAAQ,GAAG;AACjD,0BAAwB;AACxB,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,SAAS,8BAA8B,KAAK,MAAM,QAAQ,EAAE;AAChF,2BAAwB;AACxB,UAAO,GAAG,GAAG;;AAEd,QAAM"}

package/dist/{transport-Vd7VdqHv.d.mts → transport-CAwTaTp_.d.mts}

@@ -39,4 +39,4 @@ declare function tokenInterceptor(token: string): Interceptor;
 declare function devBypassInterceptor(baseUrl: string): Interceptor;
 //#endregion
 export { tokenInterceptor as a, devBypassInterceptor as i, createTransport as n, csrfInterceptor as r, Interceptor as t };
-//# sourceMappingURL=transport-Vd7VdqHv.d.mts.map
+//# sourceMappingURL=transport-CAwTaTp_.d.mts.map

package/dist/{transport-Vd7VdqHv.d.mts.map → transport-CAwTaTp_.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"transport-Vd7VdqHv.d.mts","names":[],"sources":["../src/client/transport.ts"],"mappings":";;AAeA;;;;;;;;;;KAAY,WAAA,IACX,OAAA,EAAS,OAAA,EACT,IAAA,GAAO,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA,MAChC,OAAA,CAAQ,QAAA;AAAA,UAEI,gBAAA;EAChB,YAAA,GAAe,WAAA;AAAA;;;;iBAUA,eAAA,CAAgB,OAAA,GAAS,gBAAA;EACxC,KAAA,GAAQ,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;AAAA;;;AAZtC;;;;iBAqCgB,eAAA,CAAA,GAAmB,WAAA;AA1BnC;;;AAAA,iBA8CgB,gBAAA,CAAiB,KAAA,WAAgB,WAAA;;;;;;iBAajC,oBAAA,CAAqB,OAAA,WAAkB,WAAA"}
+{"version":3,"file":"transport-CAwTaTp_.d.mts","names":[],"sources":["../src/client/transport.ts"],"mappings":";;AAeA;;;;;;;;;;KAAY,WAAA,IACX,OAAA,EAAS,OAAA,EACT,IAAA,GAAO,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA,MAChC,OAAA,CAAQ,QAAA;AAAA,UAEI,gBAAA;EAChB,YAAA,GAAe,WAAA;AAAA;;;;iBAUA,eAAA,CAAgB,OAAA,GAAS,gBAAA;EACxC,KAAA,GAAQ,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;AAAA;;;AAZtC;;;;iBAqCgB,eAAA,CAAA,GAAmB,WAAA;AA1BnC;;;AAAA,iBA8CgB,gBAAA,CAAiB,KAAA,WAAgB,WAAA;;;;;;iBAajC,oBAAA,CAAqB,OAAA,WAAkB,WAAA"}

package/dist/{transport-CKrlqSpD.mjs → transport-DVsa5YYo.mjs}

@@ -132,4 +132,4 @@ function refreshInterceptor(options) {
 
 //#endregion
 export { tokenInterceptor as a, refreshInterceptor as i, csrfInterceptor as n, devBypassInterceptor as r, createTransport as t };
-//# sourceMappingURL=transport-CKrlqSpD.mjs.map
+//# sourceMappingURL=transport-DVsa5YYo.mjs.map

package/dist/{transport-CKrlqSpD.mjs.map → transport-DVsa5YYo.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"transport-CKrlqSpD.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n}): Interceptor {\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await globalThis.fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t}),\n\t\t});\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { success, data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(request.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(request, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAInB;CACf,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,WAAW,MAAM,QAAQ,eAAe;GACzD,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAC/B,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;AAIhD,SAAO"}
+{"version":3,"file":"transport-DVsa5YYo.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n}): Interceptor {\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await globalThis.fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t}),\n\t\t});\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { success, data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(request.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(request, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAInB;CACf,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,WAAW,MAAM,QAAQ,eAAe;GACzD,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAC/B,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;AAIhD,SAAO"}

package/dist/{trusted-proxy-CwjQj0YG.mjs → trusted-proxy-D20_7fyX.mjs}

@@ -48,4 +48,4 @@ function getTrustedProxyHeaders(config) {
 
 //#endregion
 export { normalizeTrustedHeaders as n, getTrustedProxyHeaders as t };
-//# sourceMappingURL=trusted-proxy-CwjQj0YG.mjs.map
+//# sourceMappingURL=trusted-proxy-D20_7fyX.mjs.map

package/dist/{trusted-proxy-CwjQj0YG.mjs.map → trusted-proxy-D20_7fyX.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"trusted-proxy-CwjQj0YG.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}
+{"version":3,"file":"trusted-proxy-D20_7fyX.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}

package/dist/{types-BfYUPJdP.d.mts → types-BGWPMiBO.d.mts}

@@ -1,4 +1,4 @@
-import { c as CustomFieldValue } from "./types-Kmaxdarz.mjs";
+import { c as CustomFieldValue } from "./types-BnFP1M3J.mjs";
 
 //#region src/database/repositories/types.d.ts
 interface CreateContentInput {
@@ -216,4 +216,4 @@ declare class EmDashValidationError extends Error {
 }
 //#endregion
 export { ContentSeo as a, EmDashValidationError as c, InvalidCursorError as d, UpdateContentInput as f, ContentItem as i, FindManyOptions as l, ContentBylineCredit as n, ContentSeoInput as o, ContentDateField as r, CreateContentInput as s, BylineSummary as t, FindManyResult as u };
-//# sourceMappingURL=types-BfYUPJdP.d.mts.map
+//# sourceMappingURL=types-BGWPMiBO.d.mts.map

package/dist/{types-BfYUPJdP.d.mts.map → types-BGWPMiBO.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-BfYUPJdP.d.mts","names":[],"sources":["../src/database/repositories/types.ts"],"mappings":";;;UAaiB,kBAAA;EAChB,IAAA;EACA,IAAA;EACA,IAAA,EAAM,MAAA;EACN,MAAA;EACA,QAAA;EACA,eAAA;EACA,MAAA;EACA,aAAA;EACA,WAAA;EALA;EAOA,SAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,IAAA,GAAO,MAAA;EACP,MAAA;EACA,IAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA;EACA,eAAA;AAAA;;UAIgB,UAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;;UAIgB,eAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,EAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;EACA,aAAA;EAbgB;;;;;;;;;;;AAQjB;;;;;EAsBC,gBAAA;EAnBA;EAqBA,SAAA;EAnBA;;;;;;;EA2BA,cAAA;EASA;;;;EAJA,mBAAA;EACA,UAAA;EACA,MAAA;EACA,OAAA;EACA,SAAA;EACA,SAAA;EA0BmC;;;;EArBnC,MAAA;EAuBA;;;;;AAOD;;EAtBC,gBAAA;EAsB2B;;AAS5B;;;;;;;EArBC,YAAA,GAAe,MAAA,SAAe,gBAAA;AAAA;AAAA,UAGd,mBAAA;EAChB,MAAA,EAAQ,aAAA;EACR,SAAA;EACA,SAAA;EA2C+B;EAzC/B,MAAA;AAAA;;KAIW,gBAAA;;;;;;;;UASK,iBAAA;EAChB,KAAA,EAAO,gBAAA;EACP,IAAA;EACA,EAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,KAAA;IACC,MAAA;IACA,QAAA;IACA,MAAA,WA6BD;IA3BC,CAAA;IA4BD;;;;AAsBD;IA5CE,aAAA;IA4CsC;;;;;;;IApCtC,MAAA,YAqE0B;IAnE1B,UAAA,GAAa,iBAAA;EAAA;EAEd,OAAA;IACC,KAAA;IACA,SAAA;EAAA;EAED,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,KAAA,EAAO,CAAA;EACP,UAAA;EA4DA;;;;;EAtDA,KAAA;AAAA;;;;;;;;;cAgBY,kBAAA,SAA2B,KAAA;cAC3B,MAAA;AAAA;AAAA,UAgCI,WAAA;EAChB,EAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,IAAA,EAAM,MAAA;EACN,QAAA;EACA,eAAA;EACA,MAAA,GAAS,aAAA;EACT,OAAA,GAAU,mBAAA;EACV,SAAA;EACA,SAAA;EACA,WAAA;EACA,WAAA;EACA,cAAA;EACA,eAAA;EACA,OAAA;EACA,MAAA;EACA,gBAAA;;EAEA,GAAA,GAAM,UAAA;;;;;;;;;;;EAWN,QAAA,GAAW,MAAA;AAAA;AAAA,cAGC,qBAAA,SAA8B,KAAA;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA"}
+{"version":3,"file":"types-BGWPMiBO.d.mts","names":[],"sources":["../src/database/repositories/types.ts"],"mappings":";;;UAaiB,kBAAA;EAChB,IAAA;EACA,IAAA;EACA,IAAA,EAAM,MAAA;EACN,MAAA;EACA,QAAA;EACA,eAAA;EACA,MAAA;EACA,aAAA;EACA,WAAA;EALA;EAOA,SAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,IAAA,GAAO,MAAA;EACP,MAAA;EACA,IAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA;EACA,eAAA;AAAA;;UAIgB,UAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;;UAIgB,eAAA;EAChB,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,OAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,EAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;EACA,aAAA;EAbgB;;;;;;;;;;;AAQjB;;;;;EAsBC,gBAAA;EAnBA;EAqBA,SAAA;EAnBA;;;;;;;EA2BA,cAAA;EASA;;;;EAJA,mBAAA;EACA,UAAA;EACA,MAAA;EACA,OAAA;EACA,SAAA;EACA,SAAA;EA0BmC;;;;EArBnC,MAAA;EAuBA;;;;;AAOD;;EAtBC,gBAAA;EAsB2B;;AAS5B;;;;;;;EArBC,YAAA,GAAe,MAAA,SAAe,gBAAA;AAAA;AAAA,UAGd,mBAAA;EAChB,MAAA,EAAQ,aAAA;EACR,SAAA;EACA,SAAA;EA2C+B;EAzC/B,MAAA;AAAA;;KAIW,gBAAA;;;;;;;;UASK,iBAAA;EAChB,KAAA,EAAO,gBAAA;EACP,IAAA;EACA,EAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,KAAA;IACC,MAAA;IACA,QAAA;IACA,MAAA,WA6BD;IA3BC,CAAA;IA4BD;;;;AAsBD;IA5CE,aAAA;IA4CsC;;;;;;;IApCtC,MAAA,YAqE0B;IAnE1B,UAAA,GAAa,iBAAA;EAAA;EAEd,OAAA;IACC,KAAA;IACA,SAAA;EAAA;EAED,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,KAAA,EAAO,CAAA;EACP,UAAA;EA4DA;;;;;EAtDA,KAAA;AAAA;;;;;;;;;cAgBY,kBAAA,SAA2B,KAAA;cAC3B,MAAA;AAAA;AAAA,UAgCI,WAAA;EAChB,EAAA;EACA,IAAA;EACA,IAAA;EACA,MAAA;EACA,IAAA,EAAM,MAAA;EACN,QAAA;EACA,eAAA;EACA,MAAA,GAAS,aAAA;EACT,OAAA,GAAU,mBAAA;EACV,SAAA;EACA,SAAA;EACA,WAAA;EACA,WAAA;EACA,cAAA;EACA,eAAA;EACA,OAAA;EACA,MAAA;EACA,gBAAA;;EAEA,GAAA,GAAM,UAAA;;;;;;;;;;;EAWN,QAAA,GAAW,MAAA;AAAA;AAAA,cAGC,qBAAA,SAA8B,KAAA;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA"}

package/dist/{types-iVeZ5g6N.d.mts → types-BK6U01Ro.d.mts}

@@ -121,4 +121,4 @@ interface ObjectCacheRuntimeConfig {
 type CreateObjectCacheBackendFn = (config: ObjectCacheRuntimeConfig) => ObjectCacheBackend;
 //#endregion
 export { ObjectCacheRuntimeConfig as i, ObjectCacheBackend as n, ObjectCacheDescriptor as r, CreateObjectCacheBackendFn as t };
-//# sourceMappingURL=types-iVeZ5g6N.d.mts.map
+//# sourceMappingURL=types-BK6U01Ro.d.mts.map

package/dist/{types-iVeZ5g6N.d.mts.map → types-BK6U01Ro.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-iVeZ5g6N.d.mts","names":[],"sources":["../src/object-cache/types.ts"],"mappings":";;AAuBA;;;;;;;;;;;;;;;;;;;;;UAAiB,kBAAA;EAuBqB;EArBrC,GAAA,CAAI,GAAA,WAAc,OAAA;EAyBc;;;;;;AAUjC;EA3BC,GAAA,CAAI,GAAA,UAAa,KAAA,UAAe,UAAA,YAAsB,OAAA;;EAEtD,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA;;;;;;;AAwFtB;;UA7EiB,qBAAA;EA6EgF;EA3EhG,UAAA;EA2EyC;EAzEzC,MAAA,EAAQ,wBAAA;AAAA;;;;;;;;UAUQ,wBAAA;;;;;;;;;;;EAWhB,UAAA;;;;;;;;;;;;;;;;;;EAkBA,UAAA;;;;;;;EAOA,SAAA;;;;;;;;;;;;;;;EAeA,OAAA;;GAEC,GAAA;AAAA;;;;;;;;KAUU,0BAAA,IAA8B,MAAA,EAAQ,wBAAA,KAA6B,kBAAA"}
+{"version":3,"file":"types-BK6U01Ro.d.mts","names":[],"sources":["../src/object-cache/types.ts"],"mappings":";;AAuBA;;;;;;;;;;;;;;;;;;;;;UAAiB,kBAAA;EAuBqB;EArBrC,GAAA,CAAI,GAAA,WAAc,OAAA;EAyBc;;;;;;AAUjC;EA3BC,GAAA,CAAI,GAAA,UAAa,KAAA,UAAe,UAAA,YAAsB,OAAA;;EAEtD,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA;;;;;;;AAwFtB;;UA7EiB,qBAAA;EA6EgF;EA3EhG,UAAA;EA2EyC;EAzEzC,MAAA,EAAQ,wBAAA;AAAA;;;;;;;;UAUQ,wBAAA;;;;;;;;;;;EAWhB,UAAA;;;;;;;;;;;;;;;;;;EAkBA,UAAA;;;;;;;EAOA,SAAA;;;;;;;;;;;;;;;EAeA,OAAA;;GAEC,GAAA;AAAA;;;;;;;;KAUU,0BAAA,IAA8B,MAAA,EAAQ,wBAAA,KAA6B,kBAAA"}

package/dist/{types-BD40g7zz.mjs → types-BjxTKxrZ.mjs}

@@ -13,4 +13,4 @@ var EmDashStorageError = class extends Error {
 
 //#endregion
 export { EmDashStorageError as t };
-//# sourceMappingURL=types-BD40g7zz.mjs.map
+//# sourceMappingURL=types-BjxTKxrZ.mjs.map

package/dist/{types-BD40g7zz.mjs.map → types-BjxTKxrZ.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"types-BD40g7zz.mjs","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage Layer Types\n *\n * Defines the interface for S3-compatible storage backends.\n * Works with R2, AWS S3, Minio, and other S3-compatible services.\n */\n\n/**\n * Storage configuration for S3-compatible backends\n */\nexport interface S3StorageConfig {\n\t/** S3 endpoint URL (e.g., \"https://xxx.r2.cloudflarestorage.com\") */\n\tendpoint: string;\n\t/** Bucket name */\n\tbucket: string;\n\t/**\n\t * AWS access key ID.\n\t * May be resolved from the `S3_ACCESS_KEY_ID` env var at runtime on Node.\n\t * Must be provided together with `secretAccessKey`, or both omitted.\n\t */\n\taccessKeyId?: string;\n\t/**\n\t * AWS secret access key.\n\t * May be resolved from the `S3_SECRET_ACCESS_KEY` env var at runtime on Node.\n\t * Must be provided together with `accessKeyId`, or both omitted.\n\t */\n\tsecretAccessKey?: string;\n\t/** Optional region (defaults to \"auto\") */\n\tregion?: string;\n\t/** Optional public URL prefix for generated URLs (e.g., CDN URL) */\n\tpublicUrl?: string;\n}\n\n/**\n * Local filesystem storage for development\n */\nexport interface LocalStorageConfig {\n\t/** Directory path for storing files */\n\tdirectory: string;\n\t/** Base URL for serving files */\n\tbaseUrl: string;\n}\n\n/**\n * Storage adapter descriptor (serializable config)\n */\nexport interface StorageDescriptor {\n\t/** Module path exporting createStorage function */\n\tentrypoint: string;\n\t/** Serializable config passed to createStorage at runtime */\n\tconfig: Record<string, unknown>;\n}\n\n/**\n * Factory function signature for storage adapters\n *\n * Each adapter accesses its own bindings directly:\n * - R2: imports from cloudflare:workers\n * - S3: uses credentials from config\n * - Local: uses filesystem path from config\n */\nexport type CreateStorageFn = (config: Record<string, unknown>) => Storage;\n\n/**\n * Upload result\n */\nexport interface UploadResult {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** Public URL to access the file */\n\turl: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Download result\n */\nexport interface DownloadResult {\n\t/** File content as readable stream */\n\tbody: ReadableStream<Uint8Array>;\n\t/** MIME type */\n\tcontentType: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Signed URL for direct upload\n */\nexport interface SignedUploadUrl {\n\t/** Signed URL for PUT request */\n\turl: string;\n\t/** HTTP method (always PUT) */\n\tmethod: \"PUT\";\n\t/** Headers to include in the upload request */\n\theaders: Record<string, string>;\n\t/** URL expiration time (ISO string) */\n\texpiresAt: string;\n}\n\n/**\n * Options for generating signed upload URL\n */\nexport interface SignedUploadOptions {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** MIME type of the file */\n\tcontentType: string;\n\t/** File size in bytes (for content-length validation) */\n\tsize?: number;\n\t/** URL expiration in seconds (default: 3600) */\n\texpiresIn?: number;\n}\n\n/**\n * File listing result\n */\nexport interface ListResult {\n\t/** List of files */\n\tfiles: FileInfo[];\n\t/** Cursor for next page (if more results) */\n\tnextCursor?: string;\n}\n\n/**\n * File info from listing\n */\nexport interface FileInfo {\n\t/** Storage key */\n\tkey: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Last modified date */\n\tlastModified: Date;\n\t/** ETag (content hash) */\n\tetag?: string;\n}\n\n/**\n * Options for listing files\n */\nexport interface ListOptions {\n\t/** Filter by key prefix */\n\tprefix?: string;\n\t/** Maximum results per page */\n\tlimit?: number;\n\t/** Cursor from previous list call */\n\tcursor?: string;\n}\n\n/**\n * Storage interface\n *\n * All storage backends must implement this interface.\n */\nexport interface Storage {\n\t/**\n\t * Upload a file to storage\n\t */\n\tupload(options: {\n\t\tkey: string;\n\t\tbody: Buffer | Uint8Array | ReadableStream<Uint8Array>;\n\t\tcontentType: string;\n\t}): Promise<UploadResult>;\n\n\t/**\n\t * Download a file from storage\n\t */\n\tdownload(key: string): Promise<DownloadResult>;\n\n\t/**\n\t * Delete a file from storage\n\t * Idempotent - does not throw if file doesn't exist\n\t */\n\tdelete(key: string): Promise<void>;\n\n\t/**\n\t * Check if a file exists\n\t */\n\texists(key: string): Promise<boolean>;\n\n\t/**\n\t * List files in storage\n\t */\n\tlist(options?: ListOptions): Promise<ListResult>;\n\n\t/**\n\t * Generate a signed URL for direct upload\n\t * Client uploads directly to storage, bypassing the server\n\t */\n\tgetSignedUploadUrl(options: SignedUploadOptions): Promise<SignedUploadUrl>;\n\n\t/**\n\t * Get public URL for a file\n\t */\n\tgetPublicUrl(key: string): string;\n\n\t/**\n\t * Get the origin the browser connects to for direct client uploads.\n\t * Used by the admin CSP when the storage descriptor has no static endpoint.\n\t */\n\tgetClientUploadOrigin?(): string;\n}\n\n/**\n * Storage error with additional context\n */\nexport class EmDashStorageError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic code: string,\n\t\tpublic override cause?: unknown,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"EmDashStorageError\";\n\t}\n}\n"],"mappings":";;;;AAgNA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,YACC,SACA,AAAO,MACP,AAAgB,OACf;AACD,QAAM,QAAQ;EAHP;EACS;AAGhB,OAAK,OAAO"}
+{"version":3,"file":"types-BjxTKxrZ.mjs","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage Layer Types\n *\n * Defines the interface for S3-compatible storage backends.\n * Works with R2, AWS S3, Minio, and other S3-compatible services.\n */\n\n/**\n * Storage configuration for S3-compatible backends\n */\nexport interface S3StorageConfig {\n\t/** S3 endpoint URL (e.g., \"https://xxx.r2.cloudflarestorage.com\") */\n\tendpoint: string;\n\t/** Bucket name */\n\tbucket: string;\n\t/**\n\t * AWS access key ID.\n\t * May be resolved from the `S3_ACCESS_KEY_ID` env var at runtime on Node.\n\t * Must be provided together with `secretAccessKey`, or both omitted.\n\t */\n\taccessKeyId?: string;\n\t/**\n\t * AWS secret access key.\n\t * May be resolved from the `S3_SECRET_ACCESS_KEY` env var at runtime on Node.\n\t * Must be provided together with `accessKeyId`, or both omitted.\n\t */\n\tsecretAccessKey?: string;\n\t/** Optional region (defaults to \"auto\") */\n\tregion?: string;\n\t/** Optional public URL prefix for generated URLs (e.g., CDN URL) */\n\tpublicUrl?: string;\n}\n\n/**\n * Local filesystem storage for development\n */\nexport interface LocalStorageConfig {\n\t/** Directory path for storing files */\n\tdirectory: string;\n\t/** Base URL for serving files */\n\tbaseUrl: string;\n}\n\n/**\n * Storage adapter descriptor (serializable config)\n */\nexport interface StorageDescriptor {\n\t/** Module path exporting createStorage function */\n\tentrypoint: string;\n\t/** Serializable config passed to createStorage at runtime */\n\tconfig: Record<string, unknown>;\n}\n\n/**\n * Factory function signature for storage adapters\n *\n * Each adapter accesses its own bindings directly:\n * - R2: imports from cloudflare:workers\n * - S3: uses credentials from config\n * - Local: uses filesystem path from config\n */\nexport type CreateStorageFn = (config: Record<string, unknown>) => Storage;\n\n/**\n * Upload result\n */\nexport interface UploadResult {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** Public URL to access the file */\n\turl: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Download result\n */\nexport interface DownloadResult {\n\t/** File content as readable stream */\n\tbody: ReadableStream<Uint8Array>;\n\t/** MIME type */\n\tcontentType: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Signed URL for direct upload\n */\nexport interface SignedUploadUrl {\n\t/** Signed URL for PUT request */\n\turl: string;\n\t/** HTTP method (always PUT) */\n\tmethod: \"PUT\";\n\t/** Headers to include in the upload request */\n\theaders: Record<string, string>;\n\t/** URL expiration time (ISO string) */\n\texpiresAt: string;\n}\n\n/**\n * Options for generating signed upload URL\n */\nexport interface SignedUploadOptions {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** MIME type of the file */\n\tcontentType: string;\n\t/** File size in bytes (for content-length validation) */\n\tsize?: number;\n\t/** URL expiration in seconds (default: 3600) */\n\texpiresIn?: number;\n}\n\n/**\n * File listing result\n */\nexport interface ListResult {\n\t/** List of files */\n\tfiles: FileInfo[];\n\t/** Cursor for next page (if more results) */\n\tnextCursor?: string;\n}\n\n/**\n * File info from listing\n */\nexport interface FileInfo {\n\t/** Storage key */\n\tkey: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Last modified date */\n\tlastModified: Date;\n\t/** ETag (content hash) */\n\tetag?: string;\n}\n\n/**\n * Options for listing files\n */\nexport interface ListOptions {\n\t/** Filter by key prefix */\n\tprefix?: string;\n\t/** Maximum results per page */\n\tlimit?: number;\n\t/** Cursor from previous list call */\n\tcursor?: string;\n}\n\n/**\n * Storage interface\n *\n * All storage backends must implement this interface.\n */\nexport interface Storage {\n\t/**\n\t * Upload a file to storage\n\t */\n\tupload(options: {\n\t\tkey: string;\n\t\tbody: Buffer | Uint8Array | ReadableStream<Uint8Array>;\n\t\tcontentType: string;\n\t}): Promise<UploadResult>;\n\n\t/**\n\t * Download a file from storage\n\t */\n\tdownload(key: string): Promise<DownloadResult>;\n\n\t/**\n\t * Delete a file from storage\n\t * Idempotent - does not throw if file doesn't exist\n\t */\n\tdelete(key: string): Promise<void>;\n\n\t/**\n\t * Check if a file exists\n\t */\n\texists(key: string): Promise<boolean>;\n\n\t/**\n\t * List files in storage\n\t */\n\tlist(options?: ListOptions): Promise<ListResult>;\n\n\t/**\n\t * Generate a signed URL for direct upload\n\t * Client uploads directly to storage, bypassing the server\n\t */\n\tgetSignedUploadUrl(options: SignedUploadOptions): Promise<SignedUploadUrl>;\n\n\t/**\n\t * Get public URL for a file\n\t */\n\tgetPublicUrl(key: string): string;\n\n\t/**\n\t * Get the origin the browser connects to for direct client uploads.\n\t * Used by the admin CSP when the storage descriptor has no static endpoint.\n\t */\n\tgetClientUploadOrigin?(): string;\n}\n\n/**\n * Storage error with additional context\n */\nexport class EmDashStorageError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic code: string,\n\t\tpublic override cause?: unknown,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"EmDashStorageError\";\n\t}\n}\n"],"mappings":";;;;AAgNA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,YACC,SACA,AAAO,MACP,AAAgB,OACf;AACD,QAAM,QAAQ;EAHP;EACS;AAGhB,OAAK,OAAO"}