emdash 0.32.0 → 0.34.0

package/dist/taxonomy-CPeM8d2o.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy-CPeM8d2o.mjs","names":[],"sources":["../src/database/repositories/taxonomy.ts"],"sourcesContent":["import { sql, type Kysely, type Selectable } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { invalidateTaxonomyObjectCache } from \"../../object-cache/index.js\";\nimport { slugify } from \"../../utils/slugify.js\";\nimport { withTransaction } from \"../transaction.js\";\nimport type { Database, TaxonomyTable } from \"../types.js\";\nimport { validateIdentifier } from \"../validate.js\";\n\n/** A member of one sibling group and the position it currently holds. */\nexport interface SiblingPosition {\n\tgroup: string;\n\tposition: number;\n}\n\n/**\n * Translation groups per reorder `UPDATE`. Each costs three bound parameters —\n * a CASE `WHEN`/`THEN` pair plus one slot in the `IN` list — which keeps a\n * statement inside D1's 100-parameter ceiling.\n */\nconst GROUPS_PER_UPDATE = 32;\nconst NUMERIC_SUFFIX_PATTERN = /^\\d+$/;\n\n/** Deal the listed groups back out over the slots they hold, in the order given. */\nfunction permuteWithinSlots(\n\tlisted: readonly string[],\n\toccupied: readonly number[],\n): Map<string, number> {\n\tconst slots = occupied.toSorted((a, b) => a - b);\n\tconst target = new Map<string, number>();\n\tlisted.forEach((group, index) => {\n\t\tconst position = slots[index];\n\t\tif (position !== undefined) target.set(group, position);\n\t});\n\treturn target;\n}\n\n/**\n * Renumber a whole sibling group 0..n-1, with the listed groups in the order\n * given and every other member left in the place it already held.\n *\n * Works off each member's index in the sequence rather than its stored value,\n * which is what lets it resolve positions that tie. The sort is stable, so\n * tied members keep the order `siblings` arrives in — deterministic, but a\n * listing that mixes locales breaks a tie on whichever locale's label sorts\n * first, not on the order any one caller rendered.\n */\nfunction renumberSiblings(\n\tlisted: readonly string[],\n\tsiblings: readonly SiblingPosition[],\n): Map<string, number> {\n\tconst sequence = siblings.toSorted((a, b) => a.position - b.position);\n\tconst wanted = new Set(listed);\n\tconst target = new Map<string, number>();\n\tlet next = 0;\n\tsequence.forEach(({ group }, index) => {\n\t\tconst replacement = wanted.has(group) ? listed[next++] : undefined;\n\t\ttarget.set(replacement ?? group, index);\n\t});\n\treturn target;\n}\n\nexport interface Taxonomy {\n\tid: string;\n\tname: string;\n\tslug: string;\n\tlabel: string;\n\tparentId: string | null;\n\tdata: Record<string, unknown> | null;\n\tlocale: string;\n\ttranslationGroup: string | null;\n\t/**\n\t * Position among siblings. Shared by every row of a `translation_group` —\n\t * a term sits in the same place in every locale it is translated into.\n\t */\n\tsortOrder: number;\n}\n\nexport interface CreateTaxonomyInput {\n\tname: string;\n\tslug: string;\n\tlabel: string;\n\tparentId?: string;\n\tdata?: Record<string, unknown>;\n\t/** Omit to let the DB default (current value: 'en') apply. Higher layers\n\t * resolve the locale from the request context / i18n config. */\n\tlocale?: string;\n\t/** When set, links the new term into the source term's translation_group. */\n\ttranslationOf?: string;\n}\n\nexport interface UpdateTaxonomyInput {\n\tslug?: string;\n\tlabel?: string;\n\tparentId?: string | null;\n\tdata?: Record<string, unknown>;\n}\n\nexport interface FindOptions {\n\tparentId?: string | null;\n\tlocale?: string;\n}\n\nexport interface TaxonomyManualPageCursor {\n\tsortOrder: number;\n\tlabel: string;\n\tid: string;\n}\n\nexport interface TaxonomyPageOptions extends FindOptions {\n\tcursor?: TaxonomyManualPageCursor;\n\tlimit?: number;\n}\n\nexport interface TaxonomyPage {\n\titems: Taxonomy[];\n\thasMore: boolean;\n}\n\nexport interface TaxonomyAssignmentTranslation {\n\tid: string;\n\tslug: string;\n\tlocale: string;\n}\n\nexport interface TaxonomyAssignmentResolution {\n\ttranslationGroup: string;\n\tterm: Taxonomy | null;\n\tavailableLocales: string[];\n\ttranslations: TaxonomyAssignmentTranslation[];\n}\n\n/**\n * Taxonomy repository for categories, tags, and other classification.\n *\n * Terms are per-locale. Translations of the same term share a `translation_group`\n * ULID. `content_taxonomies` stores translation_groups on both sides so a single\n * association spans every locale of a post and term.\n *\n * Strict lookup methods use only the locale callers supply. The explicitly\n * resolved methods accept both the preferred and default locales so their\n * fallback policy stays visible at the call site.\n *\n * `sort_order` is per translation_group, not per row: every row sharing a\n * translation_group carries the same value, so a term holds one position across\n * all its locales. Sibling groups are keyed on the raw `parent_id` column, which\n * is locale-agnostic for the same reason (it stores the parent's\n * translation_group). Writes must preserve both invariants.\n */\nexport class TaxonomyRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\t/**\n\t * Create a new taxonomy term. When `translationOf` is set the new row joins\n\t * the source term's translation_group; otherwise a fresh group is minted\n\t * (matching the migration backfill pattern `translation_group = id`).\n\t */\n\tasync create(input: CreateTaxonomyInput): Promise<Taxonomy> {\n\t\tconst id = ulid();\n\n\t\t// Empty-string parentId is coerced to null defensively. Higher layers\n\t\t// also normalize this — see handleTermCreate / handleTermUpdate.\n\t\t// `parent_id` stores the parent's locale-agnostic translation_group (not a\n\t\t// row id), mirroring content_taxonomies.taxonomy_id, so a child stays\n\t\t// nested in every locale's tree. resolveTranslationGroup accepts either a\n\t\t// row id or an already-resolved group, so this is idempotent.\n\t\tconst parentInput =\n\t\t\tinput.parentId === undefined || input.parentId === \"\" ? null : input.parentId;\n\t\tconst parentId = parentInput ? await this.resolveParentRef(parentInput) : null;\n\n\t\tlet translationGroup = id;\n\t\tlet sortOrder: number | null = null;\n\t\tif (input.translationOf) {\n\t\t\tconst source = await this.findById(input.translationOf);\n\t\t\tif (source?.translationGroup) translationGroup = source.translationGroup;\n\t\t\t// A translation is the same term in another locale, so it takes the\n\t\t\t// group's position — but only while it stays in the group that position\n\t\t\t// belongs to. Landing under a different parent makes it a new member of\n\t\t\t// that sibling group, and the source's position means nothing there.\n\t\t\tif (source && source.parentId === parentId) sortOrder = source.sortOrder;\n\t\t}\n\t\tsortOrder ??= await this.nextSortOrder(input.name, parentId);\n\n\t\tawait this.db\n\t\t\t.insertInto(\"taxonomies\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\tslug: input.slug,\n\t\t\t\tlabel: input.label,\n\t\t\t\tparent_id: parentId,\n\t\t\t\tdata: input.data ? JSON.stringify(input.data) : null,\n\t\t\t\tsort_order: sortOrder,\n\t\t\t\t// When omitted, the DB DEFAULT 'en' is used — keeps behaviour\n\t\t\t\t// consistent with ContentRepository and lets higher layers\n\t\t\t\t// supply an explicit locale from request context.\n\t\t\t\t...(input.locale !== undefined ? { locale: input.locale } : {}),\n\t\t\t\ttranslation_group: translationGroup,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tinvalidateTaxonomyObjectCache();\n\n\t\tconst taxonomy = await this.findById(id);\n\t\tif (!taxonomy) throw new Error(\"Failed to create taxonomy\");\n\t\treturn taxonomy;\n\t}\n\n\tasync findById(id: string): Promise<Taxonomy | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn row ? this.rowToTaxonomy(row) : null;\n\t}\n\n\t/**\n\t * Find a term by (name, slug). When `locale` is provided, filter by it.\n\t * When omitted, returns the lowest-locale-code match (deterministic across\n\t * calls). Mirrors `ContentRepository.findBySlug`.\n\t */\n\tasync findBySlug(name: string, slug: string, locale?: string): Promise<Taxonomy | null> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.where(\"slug\", \"=\", slug);\n\t\tif (locale !== undefined) query = query.where(\"locale\", \"=\", locale);\n\t\tconst row = await query.orderBy(\"locale\", \"asc\").executeTakeFirst();\n\t\treturn row ? this.rowToTaxonomy(row) : null;\n\t}\n\n\t/** Generate a locale-scoped term slug, adding a numeric suffix when needed. */\n\tasync generateUniqueSlug(name: string, text: string, locale?: string): Promise<string> {\n\t\tconst baseSlug = slugify(text);\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select(\"slug\")\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.where((eb) => eb.or([eb(\"slug\", \"=\", baseSlug), eb(\"slug\", \"like\", `${baseSlug}-%`)]));\n\t\tif (locale !== undefined) query = query.where(\"locale\", \"=\", locale);\n\t\tconst candidates = await query.execute();\n\t\tif (!candidates.some((candidate) => candidate.slug === baseSlug)) return baseSlug;\n\n\t\tlet maxSuffix = 0;\n\t\tconst prefix = `${baseSlug}-`;\n\t\tfor (const candidate of candidates) {\n\t\t\tif (!candidate.slug.startsWith(prefix)) continue;\n\t\t\tconst suffix = candidate.slug.slice(prefix.length);\n\t\t\tif (!NUMERIC_SUFFIX_PATTERN.test(suffix)) continue;\n\t\t\tmaxSuffix = Math.max(maxSuffix, Number.parseInt(suffix, 10));\n\t\t}\n\t\treturn `${baseSlug}-${maxSuffix + 1}`;\n\t}\n\n\t/**\n\t * Get all terms for a taxonomy (e.g., all categories).\n\t *\n\t * `sort_order` carries the manual order set from the admin; it is 0 for\n\t * terms nobody has reordered, so an untouched taxonomy still comes back\n\t * alphabetically. `id asc` is a stable tiebreaker for terms that share both\n\t * values. Without it the SQL ordering is implementation-defined when they match.\n\t */\n\tasync findByName(name: string, options: FindOptions = {}): Promise<Taxonomy[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.orderBy(\"sort_order\", \"asc\")\n\t\t\t.orderBy(\"label\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\");\n\n\t\tif (options.locale !== undefined) query = query.where(\"locale\", \"=\", options.locale);\n\n\t\tif (options.parentId !== undefined) {\n\t\t\tif (options.parentId === null) {\n\t\t\t\tquery = query.where(\"parent_id\", \"is\", null);\n\t\t\t} else {\n\t\t\t\tquery = query.where(\"parent_id\", \"=\", options.parentId);\n\t\t\t}\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\tasync findByNameResolved(\n\t\tname: string,\n\t\tlocale: string,\n\t\tdefaultLocale: string,\n\t): Promise<Taxonomy[]> {\n\t\tconst locales = [...new Set([locale, defaultLocale])];\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.where(\"locale\", \"in\", locales)\n\t\t\t.orderBy(\"sort_order\", \"asc\")\n\t\t\t.orderBy(\"label\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\")\n\t\t\t.execute();\n\n\t\tconst selected = new Map<string, Taxonomy>();\n\t\tfor (const row of rows) {\n\t\t\tconst term = this.rowToTaxonomy(row);\n\t\t\tconst group = term.translationGroup ?? term.id;\n\t\t\tconst current = selected.get(group);\n\t\t\tif (!current || term.locale === locale) selected.set(group, term);\n\t\t}\n\t\treturn [...selected.values()].toSorted(\n\t\t\t(a, b) =>\n\t\t\t\ta.sortOrder - b.sortOrder || a.label.localeCompare(b.label) || a.id.localeCompare(b.id),\n\t\t);\n\t}\n\n\tasync findPageByName(name: string, options: TaxonomyPageOptions = {}): Promise<TaxonomyPage> {\n\t\tconst limit = Math.max(1, Math.min(options.limit ?? 50, 100));\n\t\tlet query = this.db.selectFrom(\"taxonomies\").selectAll().where(\"name\", \"=\", name);\n\n\t\tif (options.locale !== undefined) query = query.where(\"locale\", \"=\", options.locale);\n\n\t\tif (options.parentId !== undefined) {\n\t\t\tquery =\n\t\t\t\toptions.parentId === null\n\t\t\t\t\t? query.where(\"parent_id\", \"is\", null)\n\t\t\t\t\t: query.where(\"parent_id\", \"=\", options.parentId);\n\t\t}\n\n\t\tif (options.cursor) {\n\t\t\tconst cursor = options.cursor;\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"sort_order\", \">\", cursor.sortOrder),\n\t\t\t\t\teb.and([eb(\"sort_order\", \"=\", cursor.sortOrder), eb(\"label\", \">\", cursor.label)]),\n\t\t\t\t\teb.and([\n\t\t\t\t\t\teb(\"sort_order\", \"=\", cursor.sortOrder),\n\t\t\t\t\t\teb(\"label\", \"=\", cursor.label),\n\t\t\t\t\t\teb(\"id\", \">\", cursor.id),\n\t\t\t\t\t]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\t\tquery = query.orderBy(\"sort_order\", \"asc\").orderBy(\"label\", \"asc\").orderBy(\"id\", \"asc\");\n\n\t\tconst rows = await query.limit(limit + 1).execute();\n\t\treturn {\n\t\t\titems: rows.slice(0, limit).map((row) => this.rowToTaxonomy(row)),\n\t\t\thasMore: rows.length > limit,\n\t\t};\n\t}\n\n\t/**\n\t * Children of a term. Accepts a term id OR a translation_group and resolves\n\t * to the group, since `parent_id` stores the parent's translation_group.\n\t * Pass `locale` to scope to one locale's tree (children share the parent's\n\t * group across locales); omit it to find children in every locale (used to\n\t * block deletes that would orphan a sibling translation's subtree).\n\t */\n\tasync findChildren(parentIdOrGroup: string, locale?: string): Promise<Taxonomy[]> {\n\t\tconst group = await this.resolveTranslationGroup(parentIdOrGroup);\n\t\tif (!group) return [];\n\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"parent_id\", \"=\", group)\n\t\t\t.orderBy(\"sort_order\", \"asc\")\n\t\t\t.orderBy(\"label\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\");\n\t\tif (locale !== undefined) query = query.where(\"locale\", \"=\", locale);\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\t/**\n\t * Every translation sibling of a term (including itself), identified by\n\t * their shared `translation_group`.\n\t */\n\tasync findTranslations(translationGroup: string): Promise<Taxonomy[]> {\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.selectAll()\n\t\t\t.where(\"translation_group\", \"=\", translationGroup)\n\t\t\t.orderBy(\"locale\", \"asc\")\n\t\t\t.execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\tasync update(id: string, input: UpdateTaxonomyInput): Promise<Taxonomy | null> {\n\t\tconst existing = await this.findById(id);\n\t\tif (!existing) return null;\n\n\t\t// Per-row display fields. `parent_id` and `sort_order` are not here: both\n\t\t// belong to the translation_group and are written across it below.\n\t\tconst updates: Record<string, unknown> = {};\n\t\tif (input.slug !== undefined) updates.slug = input.slug;\n\t\tif (input.label !== undefined) updates.label = input.label;\n\t\tif (input.data !== undefined) updates.data = JSON.stringify(input.data);\n\n\t\tconst group: { parent_id?: string | null; sort_order?: number } = {};\n\t\tif (input.parentId !== undefined) {\n\t\t\t// Defense in depth: empty-string parentId means null (no parent).\n\t\t\t// Otherwise persist the parent's translation_group (locale-agnostic),\n\t\t\t// matching create() — see the note there.\n\t\t\tconst parentId =\n\t\t\t\tinput.parentId === \"\" || input.parentId === null\n\t\t\t\t\t? null\n\t\t\t\t\t: await this.resolveParentRef(input.parentId);\n\n\t\t\tif (parentId !== existing.parentId) {\n\t\t\t\tgroup.parent_id = parentId;\n\t\t\t\t// A position only means anything within one sibling group, so a term\n\t\t\t\t// that changes parent is appended to the group it lands in.\n\t\t\t\tgroup.sort_order = await this.nextSortOrder(existing.name, parentId);\n\t\t\t}\n\t\t}\n\n\t\tconst hasRowUpdates = Object.keys(updates).length > 0;\n\t\tconst hasGroupUpdates = Object.keys(group).length > 0;\n\t\tif (hasRowUpdates || hasGroupUpdates) {\n\t\t\tawait withTransaction(this.db, async (trx) => {\n\t\t\t\tif (hasRowUpdates) {\n\t\t\t\t\tawait trx.updateTable(\"taxonomies\").set(updates).where(\"id\", \"=\", id).execute();\n\t\t\t\t}\n\t\t\t\tif (hasGroupUpdates) {\n\t\t\t\t\tawait trx\n\t\t\t\t\t\t.updateTable(\"taxonomies\")\n\t\t\t\t\t\t.set(group)\n\t\t\t\t\t\t.where(\"translation_group\", \"=\", existing.translationGroup ?? existing.id)\n\t\t\t\t\t\t.execute();\n\t\t\t\t}\n\t\t\t});\n\t\t\tinvalidateTaxonomyObjectCache();\n\t\t}\n\n\t\treturn this.findById(id);\n\t}\n\n\t/**\n\t * Move `groups` (translation_groups, in the desired order) into the positions\n\t * those same groups already occupy, leaving every other member of the sibling\n\t * group where it is.\n\t *\n\t * `groups` may be a subset: a locale renders only the terms translated into\n\t * it, so an admin in `fr` often cannot name every member. A group left out\n\t * keeps its place, which is also what makes a stale list harmless.\n\t *\n\t * `siblings` is every member of the group with the position it holds, in a\n\t * listing's order — tied positions are resolved by that order, so pass it as\n\t * read. Groups already at their target are skipped, so one swap rewrites two\n\t * groups rather than the whole list.\n\t */\n\tasync reorder(groups: string[], siblings: readonly SiblingPosition[]): Promise<void> {\n\t\tconst current = new Map(siblings.map(({ group, position }) => [group, position]));\n\n\t\tconst listed: string[] = [];\n\t\tconst occupied: number[] = [];\n\t\tfor (const group of groups) {\n\t\t\tconst position = current.get(group);\n\t\t\tif (position === undefined) continue;\n\t\t\tlisted.push(group);\n\t\t\toccupied.push(position);\n\t\t}\n\t\tif (listed.length === 0) return;\n\n\t\t// Tied positions have no distinct order to permute into, so the requested\n\t\t// one would be dropped without a word. Renumbering is the only way to\n\t\t// honour it, and it repairs the tie on the way through.\n\t\tconst target =\n\t\t\tnew Set(occupied).size === occupied.length\n\t\t\t\t? permuteWithinSlots(listed, occupied)\n\t\t\t\t: renumberSiblings(listed, siblings);\n\n\t\tconst changed = [...target].filter(([group, position]) => current.get(group) !== position);\n\t\tif (changed.length === 0) return;\n\n\t\tawait this.applyPositions(changed);\n\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\t/**\n\t * Write one position per translation_group, GROUPS_PER_UPDATE at a time so\n\t * each statement stays inside D1's parameter ceiling.\n\t *\n\t * D1 has no transactions — `withTransaction` runs its callback bare there —\n\t * so a chunk is the unit that can't tear. A reorder spanning several chunks\n\t * can, and leaves ties, which the next reorder renumbers away.\n\t */\n\tprivate async applyPositions(positions: readonly (readonly [string, number])[]): Promise<void> {\n\t\tfor (let index = 0; index < positions.length; index += GROUPS_PER_UPDATE) {\n\t\t\tconst chunk = positions.slice(index, index + GROUPS_PER_UPDATE);\n\t\t\t// The CAST types the bound position. Postgres resolves a CASE whose THEN\n\t\t\t// arms are all untyped parameters to text, then refuses to assign text to\n\t\t\t// an integer column.\n\t\t\tconst arms = sql.join(\n\t\t\t\tchunk.map(([group, position]) => sql`WHEN ${group} THEN CAST(${position} AS INTEGER)`),\n\t\t\t\tsql` `,\n\t\t\t);\n\t\t\tconst keys = sql.join(chunk.map(([group]) => sql`${group}`));\n\t\t\tawait sql`\n\t\t\t\tUPDATE taxonomies\n\t\t\t\tSET sort_order = CASE translation_group ${arms} END\n\t\t\t\tWHERE translation_group IN (${keys})\n\t\t\t`.execute(this.db);\n\t\t}\n\t}\n\n\t/**\n\t * Position for a term joining a sibling group: one past the last member, or\n\t * 0 when the group is empty.\n\t *\n\t * Bounds are taken across every locale because a position belongs to the\n\t * translation_group, not to a row — a term translated into only one locale\n\t * still occupies its slot for all of them.\n\t */\n\tprivate async nextSortOrder(name: string, parentId: string | null): Promise<number> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select((eb) => eb.fn.max(\"sort_order\").as(\"max\"))\n\t\t\t.where(\"name\", \"=\", name);\n\t\tquery =\n\t\t\tparentId === null\n\t\t\t\t? query.where(\"parent_id\", \"is\", null)\n\t\t\t\t: query.where(\"parent_id\", \"=\", parentId);\n\n\t\tconst bounds = await query.executeTakeFirst();\n\t\t// Null only when the group is empty.\n\t\tif (!bounds || bounds.max === null) return 0;\n\t\treturn bounds.max + 1;\n\t}\n\n\tasync delete(id: string): Promise<boolean> {\n\t\tconst term = await this.findById(id);\n\t\tif (!term) return false;\n\n\t\t// When deleting the last translation of a group the pivot rows that\n\t\t// reference that translation_group become orphaned — purge them.\n\t\tif (term.translationGroup) {\n\t\t\tconst siblings = await this.db\n\t\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t\t.select(\"id\")\n\t\t\t\t.where(\"translation_group\", \"=\", term.translationGroup)\n\t\t\t\t.where(\"id\", \"!=\", id)\n\t\t\t\t.execute();\n\t\t\tif (siblings.length === 0) {\n\t\t\t\tawait this.db\n\t\t\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t\t\t.where(\"taxonomy_id\", \"=\", term.translationGroup)\n\t\t\t\t\t.execute();\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.db.deleteFrom(\"taxonomies\").where(\"id\", \"=\", id).executeTakeFirst();\n\t\tinvalidateTaxonomyObjectCache();\n\t\treturn (result.numDeletedRows ?? 0n) > 0n;\n\t}\n\n\t// --- Content-Taxonomy Junction (both ids store translation_groups) ---\n\n\tasync attachToEntry(collection: string, entryId: string, taxonomyId: string): Promise<void> {\n\t\tconst taxonomyGroup = await this.resolveTranslationGroup(taxonomyId);\n\t\tif (!taxonomyGroup) return;\n\t\tawait this.attachGroupsToEntry(collection, entryId, [taxonomyGroup]);\n\t}\n\n\t/**\n\t * Attach already-resolved term translation groups in one insert and return\n\t * the number of assignments that did not already exist.\n\t */\n\tasync attachGroupsToEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyGroups: string[],\n\t): Promise<number> {\n\t\tconst uniqueGroups = [...new Set(taxonomyGroups)];\n\t\tif (uniqueGroups.length === 0) return 0;\n\t\tconst entryGroup = await this.resolveEntryTranslationGroup(collection, entryId);\n\t\tif (!entryGroup) return 0;\n\n\t\tconst result = await this.db\n\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t.values(\n\t\t\t\tuniqueGroups.map((taxonomy_id) => ({\n\t\t\t\t\tcollection,\n\t\t\t\t\tentry_id: entryGroup,\n\t\t\t\t\ttaxonomy_id,\n\t\t\t\t})),\n\t\t\t)\n\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t.executeTakeFirst();\n\t\tconst inserted = Number(result.numInsertedOrUpdatedRows ?? 0n);\n\t\tif (inserted > 0) invalidateTaxonomyObjectCache();\n\t\treturn inserted;\n\t}\n\n\tasync detachFromEntry(collection: string, entryId: string, taxonomyId: string): Promise<void> {\n\t\tconst [entryGroup, taxonomyGroup] = await Promise.all([\n\t\t\tthis.resolveEntryTranslationGroup(collection, entryId),\n\t\t\tthis.resolveTranslationGroup(taxonomyId),\n\t\t]);\n\t\tif (!entryGroup || !taxonomyGroup) return;\n\n\t\tawait this.db\n\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", entryGroup)\n\t\t\t.where(\"taxonomy_id\", \"=\", taxonomyGroup)\n\t\t\t.execute();\n\t\tinvalidateTaxonomyObjectCache();\n\t}\n\n\t/**\n\t * Taxonomy terms assigned to a content entry, resolved into a specific locale.\n\t * Terms whose translation_group lacks a row in the requested locale are\n\t * omitted — callers wanting fallback behaviour apply it themselves.\n\t */\n\tasync getTermsForEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyName?: string,\n\t\tlocale?: string,\n\t): Promise<Taxonomy[]> {\n\t\tconst entryGroup = await this.resolveEntryTranslationGroup(collection, entryId);\n\t\tif (!entryGroup) return [];\n\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.innerJoin(\"taxonomies\", \"taxonomies.translation_group\", \"content_taxonomies.taxonomy_id\")\n\t\t\t.selectAll(\"taxonomies\")\n\t\t\t.where(\"content_taxonomies.collection\", \"=\", collection)\n\t\t\t.where(\"content_taxonomies.entry_id\", \"=\", entryGroup);\n\n\t\tif (taxonomyName) query = query.where(\"taxonomies.name\", \"=\", taxonomyName);\n\t\tif (locale !== undefined) query = query.where(\"taxonomies.locale\", \"=\", locale);\n\n\t\tconst rows = await query.orderBy(\"taxonomies.locale\", \"asc\").execute();\n\t\treturn rows.map((row) => this.rowToTaxonomy(row));\n\t}\n\n\tasync getTermAssignmentsForEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyName: string,\n\t\tlocale: string,\n\t\tdefaultLocale: string,\n\t): Promise<TaxonomyAssignmentResolution[]> {\n\t\tconst entryGroup = await this.resolveEntryTranslationGroup(collection, entryId);\n\t\tif (!entryGroup) return [];\n\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.innerJoin(\"taxonomies\", \"taxonomies.translation_group\", \"content_taxonomies.taxonomy_id\")\n\t\t\t.selectAll(\"taxonomies\")\n\t\t\t.select(\"content_taxonomies.taxonomy_id as assignment_group\")\n\t\t\t.where(\"content_taxonomies.collection\", \"=\", collection)\n\t\t\t.where(\"content_taxonomies.entry_id\", \"=\", entryGroup)\n\t\t\t.where(\"taxonomies.name\", \"=\", taxonomyName)\n\t\t\t.orderBy(\"content_taxonomies.taxonomy_id\", \"asc\")\n\t\t\t.orderBy(\"taxonomies.locale\", \"asc\")\n\t\t\t.execute();\n\n\t\tconst byGroup = new Map<string, Taxonomy[]>();\n\t\tfor (const row of rows) {\n\t\t\tconst variants = byGroup.get(row.assignment_group) ?? [];\n\t\t\tvariants.push(this.rowToTaxonomy(row));\n\t\t\tbyGroup.set(row.assignment_group, variants);\n\t\t}\n\n\t\treturn Array.from(byGroup, ([translationGroup, variants]) => {\n\t\t\tconst term =\n\t\t\t\tvariants.find((variant) => variant.locale === locale) ??\n\t\t\t\tvariants.find((variant) => variant.locale === defaultLocale) ??\n\t\t\t\tnull;\n\t\t\treturn {\n\t\t\t\ttranslationGroup,\n\t\t\t\tterm,\n\t\t\t\tavailableLocales: variants.map((variant) => variant.locale),\n\t\t\t\ttranslations: variants.map((variant) => ({\n\t\t\t\t\tid: variant.id,\n\t\t\t\t\tslug: variant.slug,\n\t\t\t\t\tlocale: variant.locale,\n\t\t\t\t})),\n\t\t\t};\n\t\t});\n\t}\n\n\t/**\n\t * Replace all assignments of a given taxonomy for one content entry.\n\t * Term ids OR translation_groups are accepted and normalised to groups.\n\t */\n\tasync setTermsForEntry(\n\t\tcollection: string,\n\t\tentryId: string,\n\t\ttaxonomyName: string,\n\t\ttermIds: string[],\n\t): Promise<void> {\n\t\tconst entryGroup = await this.resolveEntryTranslationGroup(collection, entryId);\n\t\tif (!entryGroup) return;\n\n\t\tconst groups: string[] = [];\n\t\tfor (const id of termIds) {\n\t\t\tconst group = await this.resolveTranslationGroup(id);\n\t\t\tif (group) groups.push(group);\n\t\t}\n\t\tconst newGroups = new Set(groups);\n\n\t\tconst current = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.innerJoin(\"taxonomies\", \"taxonomies.translation_group\", \"content_taxonomies.taxonomy_id\")\n\t\t\t.select([\"content_taxonomies.taxonomy_id as group\"])\n\t\t\t.distinct()\n\t\t\t.where(\"content_taxonomies.collection\", \"=\", collection)\n\t\t\t.where(\"content_taxonomies.entry_id\", \"=\", entryGroup)\n\t\t\t.where(\"taxonomies.name\", \"=\", taxonomyName)\n\t\t\t.execute();\n\t\tconst currentGroups = new Set(current.map((r) => r.group));\n\n\t\tconst toRemove = [...currentGroups].filter((g) => !newGroups.has(g));\n\t\tif (toRemove.length > 0) {\n\t\t\tawait this.db\n\t\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t\t.where(\"entry_id\", \"=\", entryGroup)\n\t\t\t\t.where(\"taxonomy_id\", \"in\", toRemove)\n\t\t\t\t.execute();\n\t\t}\n\n\t\tconst toAdd = [...newGroups].filter((g) => !currentGroups.has(g));\n\t\tif (toAdd.length > 0) {\n\t\t\tawait this.db\n\t\t\t\t.insertInto(\"content_taxonomies\")\n\t\t\t\t.values(\n\t\t\t\t\ttoAdd.map((taxonomy_id) => ({\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\tentry_id: entryGroup,\n\t\t\t\t\t\ttaxonomy_id,\n\t\t\t\t\t})),\n\t\t\t\t)\n\t\t\t\t.onConflict((oc) => oc.doNothing())\n\t\t\t\t.execute();\n\t\t}\n\n\t\tif (toRemove.length > 0 || toAdd.length > 0) invalidateTaxonomyObjectCache();\n\t}\n\n\tasync clearEntryTerms(collection: string, entryId: string): Promise<number> {\n\t\tconst entryGroup = await this.resolveEntryTranslationGroup(collection, entryId);\n\t\tif (!entryGroup) return 0;\n\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"content_taxonomies\")\n\t\t\t.where(\"collection\", \"=\", collection)\n\t\t\t.where(\"entry_id\", \"=\", entryGroup)\n\t\t\t.executeTakeFirst();\n\t\tconst removed = Number(result.numDeletedRows ?? 0);\n\t\tif (removed > 0) invalidateTaxonomyObjectCache();\n\t\treturn removed;\n\t}\n\n\tprivate async resolveEntryTranslationGroup(\n\t\tcollection: string,\n\t\tentryIdOrGroup: string,\n\t): Promise<string | null> {\n\t\tvalidateIdentifier(collection, \"collection type\");\n\t\tconst tableName = `ec_${collection}`;\n\t\tconst result = await sql<{ translation_group: string }>`\n\t\t\tSELECT translation_group\n\t\t\tFROM ${sql.ref(tableName)}\n\t\t\tWHERE id = ${entryIdOrGroup} OR translation_group = ${entryIdOrGroup}\n\t\t\tLIMIT 1\n\t\t`.execute(this.db);\n\t\treturn result.rows[0]?.translation_group ?? null;\n\t}\n\n\t/**\n\t * Count content entries that use any translation of this term. Accepts\n\t * either a term id or a translation_group — we normalise to the group.\n\t *\n\t * Counts raw pivot rows regardless of the entry's status or deletion —\n\t * drafts and trashed entries are included. User-facing counts (admin term\n\t * list/get, public widget and term pages) use `fetchVisibleTermCounts`\n\t * from `taxonomies/term-counts.ts` instead, which counts only publicly\n\t * visible entries.\n\t */\n\tasync countEntriesWithTerm(termIdOrGroup: string): Promise<number> {\n\t\tconst group = await this.resolveTranslationGroup(termIdOrGroup);\n\t\tif (!group) return 0;\n\n\t\tconst result = await this.db\n\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t.select((eb) => eb.fn.count(\"entry_id\").as(\"count\"))\n\t\t\t.where(\"taxonomy_id\", \"=\", group)\n\t\t\t.executeTakeFirst();\n\t\treturn Number(result?.count ?? 0);\n\t}\n\n\t/**\n\t * Resolve a parent reference (a row id or a translation_group) to the value\n\t * persisted in `parent_id`: the parent's translation_group, which is\n\t * locale-agnostic so the child stays nested in every locale. A\n\t * translation_group normally equals its anchor row's id, which satisfies the\n\t * self-FK on `parent_id`. If that anchor row is missing (a translation whose\n\t * anchor was deleted), fall back to the id we were given so we never write a\n\t * dangling FK value.\n\t */\n\tprivate async resolveParentRef(idOrGroup: string): Promise<string> {\n\t\tconst group = await this.resolveTranslationGroup(idOrGroup);\n\t\tif (!group) return idOrGroup;\n\t\tconst anchor = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"id\", \"=\", group)\n\t\t\t.executeTakeFirst();\n\t\treturn anchor ? group : idOrGroup;\n\t}\n\n\tprivate async resolveTranslationGroup(idOrGroup: string): Promise<string | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"taxonomies\")\n\t\t\t.select([\"translation_group\"])\n\t\t\t.where((eb) => eb.or([eb(\"id\", \"=\", idOrGroup), eb(\"translation_group\", \"=\", idOrGroup)]))\n\t\t\t.executeTakeFirst();\n\t\treturn row?.translation_group ?? null;\n\t}\n\n\t/**\n\t * Batch count entries for multiple taxonomy translation_groups.\n\t * Chunks the query at SQL_BATCH_SIZE to stay below D1's bind-parameter limit.\n\t * Returns a Map from translation_group to count.\n\t *\n\t * Pass translation_groups (not term ids) — `content_taxonomies.taxonomy_id`\n\t * stores the translation_group so a single assignment spans every locale.\n\t *\n\t * Like `countEntriesWithTerm`, this counts raw pivot rows regardless of\n\t * status/deletion; user-facing counts go through `fetchVisibleTermCounts`.\n\t */\n\tasync countEntriesForTerms(translationGroups: string[]): Promise<Map<string, number>> {\n\t\tif (translationGroups.length === 0) return new Map();\n\n\t\tconst { chunks, SQL_BATCH_SIZE } = await import(\"../../utils/chunks.js\");\n\n\t\tconst counts = new Map<string, number>();\n\t\tfor (const chunk of chunks(translationGroups, SQL_BATCH_SIZE)) {\n\t\t\tconst rows = await this.db\n\t\t\t\t.selectFrom(\"content_taxonomies\")\n\t\t\t\t.select([\"taxonomy_id\", (eb) => eb.fn.count(\"entry_id\").as(\"count\")])\n\t\t\t\t.where(\"taxonomy_id\", \"in\", chunk)\n\t\t\t\t.groupBy(\"taxonomy_id\")\n\t\t\t\t.execute();\n\n\t\t\tfor (const row of rows) {\n\t\t\t\tcounts.set(row.taxonomy_id, Number(row.count || 0));\n\t\t\t}\n\t\t}\n\t\treturn counts;\n\t}\n\n\tprivate rowToTaxonomy(row: Selectable<TaxonomyTable>): Taxonomy {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tslug: row.slug,\n\t\t\tlabel: row.label,\n\t\t\tparentId: row.parent_id,\n\t\t\tdata: row.data ? JSON.parse(row.data) : null,\n\t\t\tlocale: row.locale,\n\t\t\ttranslationGroup: row.translation_group,\n\t\t\tsortOrder: row.sort_order,\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoBA,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;;AAG/B,SAAS,mBACR,QACA,UACsB;CACtB,MAAM,QAAQ,SAAS,UAAU,GAAG,MAAM,IAAI,EAAE;CAChD,MAAM,yBAAS,IAAI,KAAqB;AACxC,QAAO,SAAS,OAAO,UAAU;EAChC,MAAM,WAAW,MAAM;AACvB,MAAI,aAAa,OAAW,QAAO,IAAI,OAAO,SAAS;GACtD;AACF,QAAO;;;;;;;;;;;;AAaR,SAAS,iBACR,QACA,UACsB;CACtB,MAAM,WAAW,SAAS,UAAU,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS;CACrE,MAAM,SAAS,IAAI,IAAI,OAAO;CAC9B,MAAM,yBAAS,IAAI,KAAqB;CACxC,IAAI,OAAO;AACX,UAAS,SAAS,EAAE,SAAS,UAAU;EACtC,MAAM,cAAc,OAAO,IAAI,MAAM,GAAG,OAAO,UAAU;AACzD,SAAO,IAAI,eAAe,OAAO,MAAM;GACtC;AACF,QAAO;;;;;;;;;;;;;;;;;;;AA0FR,IAAa,qBAAb,MAAgC;CAC/B,YAAY,AAAQ,IAAsB;EAAtB;;;;;;;CAOpB,MAAM,OAAO,OAA+C;EAC3D,MAAM,KAAK,MAAM;EAQjB,MAAM,cACL,MAAM,aAAa,UAAa,MAAM,aAAa,KAAK,OAAO,MAAM;EACtE,MAAM,WAAW,cAAc,MAAM,KAAK,iBAAiB,YAAY,GAAG;EAE1E,IAAI,mBAAmB;EACvB,IAAI,YAA2B;AAC/B,MAAI,MAAM,eAAe;GACxB,MAAM,SAAS,MAAM,KAAK,SAAS,MAAM,cAAc;AACvD,OAAI,QAAQ,iBAAkB,oBAAmB,OAAO;AAKxD,OAAI,UAAU,OAAO,aAAa,SAAU,aAAY,OAAO;;AAEhE,gBAAc,MAAM,KAAK,cAAc,MAAM,MAAM,SAAS;AAE5D,QAAM,KAAK,GACT,WAAW,aAAa,CACxB,OAAO;GACP;GACA,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,MAAM;GACb,WAAW;GACX,MAAM,MAAM,OAAO,KAAK,UAAU,MAAM,KAAK,GAAG;GAChD,YAAY;GAIZ,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;GAC9D,mBAAmB;GACnB,CAAC,CACD,SAAS;AAEX,iCAA+B;EAE/B,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4BAA4B;AAC3D,SAAO;;CAGR,MAAM,SAAS,IAAsC;EACpD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AACpB,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;;;CAQxC,MAAM,WAAW,MAAc,MAAc,QAA2C;EACvF,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,CACxB,MAAM,QAAQ,KAAK,KAAK;AAC1B,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,OAAO;EACpE,MAAM,MAAM,MAAM,MAAM,QAAQ,UAAU,MAAM,CAAC,kBAAkB;AACnE,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;CAIxC,MAAM,mBAAmB,MAAc,MAAc,QAAkC;EACtF,MAAM,WAAW,QAAQ,KAAK;EAC9B,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,OAAO,OAAO,CACd,MAAM,QAAQ,KAAK,KAAK,CACxB,OAAO,OAAO,GAAG,GAAG,CAAC,GAAG,QAAQ,KAAK,SAAS,EAAE,GAAG,QAAQ,QAAQ,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC;AACxF,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,OAAO;EACpE,MAAM,aAAa,MAAM,MAAM,SAAS;AACxC,MAAI,CAAC,WAAW,MAAM,cAAc,UAAU,SAAS,SAAS,CAAE,QAAO;EAEzE,IAAI,YAAY;EAChB,MAAM,SAAS,GAAG,SAAS;AAC3B,OAAK,MAAM,aAAa,YAAY;AACnC,OAAI,CAAC,UAAU,KAAK,WAAW,OAAO,CAAE;GACxC,MAAM,SAAS,UAAU,KAAK,MAAM,OAAO,OAAO;AAClD,OAAI,CAAC,uBAAuB,KAAK,OAAO,CAAE;AAC1C,eAAY,KAAK,IAAI,WAAW,OAAO,SAAS,QAAQ,GAAG,CAAC;;AAE7D,SAAO,GAAG,SAAS,GAAG,YAAY;;;;;;;;;;CAWnC,MAAM,WAAW,MAAc,UAAuB,EAAE,EAAuB;EAC9E,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,CACxB,QAAQ,cAAc,MAAM,CAC5B,QAAQ,SAAS,MAAM,CACvB,QAAQ,MAAM,MAAM;AAEtB,MAAI,QAAQ,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,QAAQ,OAAO;AAEpF,MAAI,QAAQ,aAAa,OACxB,KAAI,QAAQ,aAAa,KACxB,SAAQ,MAAM,MAAM,aAAa,MAAM,KAAK;MAE5C,SAAQ,MAAM,MAAM,aAAa,KAAK,QAAQ,SAAS;AAKzD,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;CAGlD,MAAM,mBACL,MACA,QACA,eACsB;EACtB,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC,CAAC;EACrD,MAAM,OAAO,MAAM,KAAK,GACtB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,CACxB,MAAM,UAAU,MAAM,QAAQ,CAC9B,QAAQ,cAAc,MAAM,CAC5B,QAAQ,SAAS,MAAM,CACvB,QAAQ,MAAM,MAAM,CACpB,SAAS;EAEX,MAAM,2BAAW,IAAI,KAAuB;AAC5C,OAAK,MAAM,OAAO,MAAM;GACvB,MAAM,OAAO,KAAK,cAAc,IAAI;GACpC,MAAM,QAAQ,KAAK,oBAAoB,KAAK;AAE5C,OAAI,CADY,SAAS,IAAI,MAAM,IACnB,KAAK,WAAW,OAAQ,UAAS,IAAI,OAAO,KAAK;;AAElE,SAAO,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,UAC5B,GAAG,MACH,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,EAAE,MAAM,IAAI,EAAE,GAAG,cAAc,EAAE,GAAG,CACxF;;CAGF,MAAM,eAAe,MAAc,UAA+B,EAAE,EAAyB;EAC5F,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,QAAQ,SAAS,IAAI,IAAI,CAAC;EAC7D,IAAI,QAAQ,KAAK,GAAG,WAAW,aAAa,CAAC,WAAW,CAAC,MAAM,QAAQ,KAAK,KAAK;AAEjF,MAAI,QAAQ,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,QAAQ,OAAO;AAEpF,MAAI,QAAQ,aAAa,OACxB,SACC,QAAQ,aAAa,OAClB,MAAM,MAAM,aAAa,MAAM,KAAK,GACpC,MAAM,MAAM,aAAa,KAAK,QAAQ,SAAS;AAGpD,MAAI,QAAQ,QAAQ;GACnB,MAAM,SAAS,QAAQ;AACvB,WAAQ,MAAM,OAAO,OACpB,GAAG,GAAG;IACL,GAAG,cAAc,KAAK,OAAO,UAAU;IACvC,GAAG,IAAI,CAAC,GAAG,cAAc,KAAK,OAAO,UAAU,EAAE,GAAG,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;IACjF,GAAG,IAAI;KACN,GAAG,cAAc,KAAK,OAAO,UAAU;KACvC,GAAG,SAAS,KAAK,OAAO,MAAM;KAC9B,GAAG,MAAM,KAAK,OAAO,GAAG;KACxB,CAAC;IACF,CAAC,CACF;;AAEF,UAAQ,MAAM,QAAQ,cAAc,MAAM,CAAC,QAAQ,SAAS,MAAM,CAAC,QAAQ,MAAM,MAAM;EAEvF,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,EAAE,CAAC,SAAS;AACnD,SAAO;GACN,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;GACjE,SAAS,KAAK,SAAS;GACvB;;;;;;;;;CAUF,MAAM,aAAa,iBAAyB,QAAsC;EACjF,MAAM,QAAQ,MAAM,KAAK,wBAAwB,gBAAgB;AACjE,MAAI,CAAC,MAAO,QAAO,EAAE;EAErB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,QAAQ,cAAc,MAAM,CAC5B,QAAQ,SAAS,MAAM,CACvB,QAAQ,MAAM,MAAM;AACtB,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,UAAU,KAAK,OAAO;AAGpE,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;;CAOlD,MAAM,iBAAiB,kBAA+C;AAOrE,UANa,MAAM,KAAK,GACtB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,qBAAqB,KAAK,iBAAiB,CACjD,QAAQ,UAAU,MAAM,CACxB,SAAS,EACC,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;CAGlD,MAAM,OAAO,IAAY,OAAsD;EAC9E,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SAAU,QAAO;EAItB,MAAM,UAAmC,EAAE;AAC3C,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,MAAM;AACnD,MAAI,MAAM,UAAU,OAAW,SAAQ,QAAQ,MAAM;AACrD,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,KAAK,UAAU,MAAM,KAAK;EAEvE,MAAM,QAA4D,EAAE;AACpE,MAAI,MAAM,aAAa,QAAW;GAIjC,MAAM,WACL,MAAM,aAAa,MAAM,MAAM,aAAa,OACzC,OACA,MAAM,KAAK,iBAAiB,MAAM,SAAS;AAE/C,OAAI,aAAa,SAAS,UAAU;AACnC,UAAM,YAAY;AAGlB,UAAM,aAAa,MAAM,KAAK,cAAc,SAAS,MAAM,SAAS;;;EAItE,MAAM,gBAAgB,OAAO,KAAK,QAAQ,CAAC,SAAS;EACpD,MAAM,kBAAkB,OAAO,KAAK,MAAM,CAAC,SAAS;AACpD,MAAI,iBAAiB,iBAAiB;AACrC,SAAM,gBAAgB,KAAK,IAAI,OAAO,QAAQ;AAC7C,QAAI,cACH,OAAM,IAAI,YAAY,aAAa,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,SAAS;AAEhF,QAAI,gBACH,OAAM,IACJ,YAAY,aAAa,CACzB,IAAI,MAAM,CACV,MAAM,qBAAqB,KAAK,SAAS,oBAAoB,SAAS,GAAG,CACzE,SAAS;KAEX;AACF,kCAA+B;;AAGhC,SAAO,KAAK,SAAS,GAAG;;;;;;;;;;;;;;;;CAiBzB,MAAM,QAAQ,QAAkB,UAAqD;EACpF,MAAM,UAAU,IAAI,IAAI,SAAS,KAAK,EAAE,OAAO,eAAe,CAAC,OAAO,SAAS,CAAC,CAAC;EAEjF,MAAM,SAAmB,EAAE;EAC3B,MAAM,WAAqB,EAAE;AAC7B,OAAK,MAAM,SAAS,QAAQ;GAC3B,MAAM,WAAW,QAAQ,IAAI,MAAM;AACnC,OAAI,aAAa,OAAW;AAC5B,UAAO,KAAK,MAAM;AAClB,YAAS,KAAK,SAAS;;AAExB,MAAI,OAAO,WAAW,EAAG;EAUzB,MAAM,UAAU,CAAC,GAJhB,IAAI,IAAI,SAAS,CAAC,SAAS,SAAS,SACjC,mBAAmB,QAAQ,SAAS,GACpC,iBAAiB,QAAQ,SAAS,CAEX,CAAC,QAAQ,CAAC,OAAO,cAAc,QAAQ,IAAI,MAAM,KAAK,SAAS;AAC1F,MAAI,QAAQ,WAAW,EAAG;AAE1B,QAAM,KAAK,eAAe,QAAQ;AAElC,iCAA+B;;;;;;;;;;CAWhC,MAAc,eAAe,WAAkE;AAC9F,OAAK,IAAI,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS,mBAAmB;GACzE,MAAM,QAAQ,UAAU,MAAM,OAAO,QAAQ,kBAAkB;AAS/D,SAAM,GAAG;;8CALI,IAAI,KAChB,MAAM,KAAK,CAAC,OAAO,cAAc,GAAG,QAAQ,MAAM,aAAa,SAAS,cAAc,EACtF,GAAG,IACH,CAI+C;kCAHnC,IAAI,KAAK,MAAM,KAAK,CAAC,WAAW,GAAG,GAAG,QAAQ,CAAC,CAIxB;KAClC,QAAQ,KAAK,GAAG;;;;;;;;;;;CAYpB,MAAc,cAAc,MAAc,UAA0C;EACnF,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,QAAQ,OAAO,GAAG,GAAG,IAAI,aAAa,CAAC,GAAG,MAAM,CAAC,CACjD,MAAM,QAAQ,KAAK,KAAK;AAC1B,UACC,aAAa,OACV,MAAM,MAAM,aAAa,MAAM,KAAK,GACpC,MAAM,MAAM,aAAa,KAAK,SAAS;EAE3C,MAAM,SAAS,MAAM,MAAM,kBAAkB;AAE7C,MAAI,CAAC,UAAU,OAAO,QAAQ,KAAM,QAAO;AAC3C,SAAO,OAAO,MAAM;;CAGrB,MAAM,OAAO,IAA8B;EAC1C,MAAM,OAAO,MAAM,KAAK,SAAS,GAAG;AACpC,MAAI,CAAC,KAAM,QAAO;AAIlB,MAAI,KAAK,kBAOR;QANiB,MAAM,KAAK,GAC1B,WAAW,aAAa,CACxB,OAAO,KAAK,CACZ,MAAM,qBAAqB,KAAK,KAAK,iBAAiB,CACtD,MAAM,MAAM,MAAM,GAAG,CACrB,SAAS,EACE,WAAW,EACvB,OAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,eAAe,KAAK,KAAK,iBAAiB,CAChD,SAAS;;EAIb,MAAM,SAAS,MAAM,KAAK,GAAG,WAAW,aAAa,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,kBAAkB;AAC7F,iCAA+B;AAC/B,UAAQ,OAAO,kBAAkB,MAAM;;CAKxC,MAAM,cAAc,YAAoB,SAAiB,YAAmC;EAC3F,MAAM,gBAAgB,MAAM,KAAK,wBAAwB,WAAW;AACpE,MAAI,CAAC,cAAe;AACpB,QAAM,KAAK,oBAAoB,YAAY,SAAS,CAAC,cAAc,CAAC;;;;;;CAOrE,MAAM,oBACL,YACA,SACA,gBACkB;EAClB,MAAM,eAAe,CAAC,GAAG,IAAI,IAAI,eAAe,CAAC;AACjD,MAAI,aAAa,WAAW,EAAG,QAAO;EACtC,MAAM,aAAa,MAAM,KAAK,6BAA6B,YAAY,QAAQ;AAC/E,MAAI,CAAC,WAAY,QAAO;EAExB,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,qBAAqB,CAChC,OACA,aAAa,KAAK,iBAAiB;GAClC;GACA,UAAU;GACV;GACA,EAAE,CACH,CACA,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,kBAAkB;EACpB,MAAM,WAAW,OAAO,OAAO,4BAA4B,GAAG;AAC9D,MAAI,WAAW,EAAG,gCAA+B;AACjD,SAAO;;CAGR,MAAM,gBAAgB,YAAoB,SAAiB,YAAmC;EAC7F,MAAM,CAAC,YAAY,iBAAiB,MAAM,QAAQ,IAAI,CACrD,KAAK,6BAA6B,YAAY,QAAQ,EACtD,KAAK,wBAAwB,WAAW,CACxC,CAAC;AACF,MAAI,CAAC,cAAc,CAAC,cAAe;AAEnC,QAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,WAAW,CAClC,MAAM,eAAe,KAAK,cAAc,CACxC,SAAS;AACX,iCAA+B;;;;;;;CAQhC,MAAM,iBACL,YACA,SACA,cACA,QACsB;EACtB,MAAM,aAAa,MAAM,KAAK,6BAA6B,YAAY,QAAQ;AAC/E,MAAI,CAAC,WAAY,QAAO,EAAE;EAE1B,IAAI,QAAQ,KAAK,GACf,WAAW,qBAAqB,CAChC,UAAU,cAAc,gCAAgC,iCAAiC,CACzF,UAAU,aAAa,CACvB,MAAM,iCAAiC,KAAK,WAAW,CACvD,MAAM,+BAA+B,KAAK,WAAW;AAEvD,MAAI,aAAc,SAAQ,MAAM,MAAM,mBAAmB,KAAK,aAAa;AAC3E,MAAI,WAAW,OAAW,SAAQ,MAAM,MAAM,qBAAqB,KAAK,OAAO;AAG/E,UADa,MAAM,MAAM,QAAQ,qBAAqB,MAAM,CAAC,SAAS,EAC1D,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;CAGlD,MAAM,2BACL,YACA,SACA,cACA,QACA,eAC0C;EAC1C,MAAM,aAAa,MAAM,KAAK,6BAA6B,YAAY,QAAQ;AAC/E,MAAI,CAAC,WAAY,QAAO,EAAE;EAE1B,MAAM,OAAO,MAAM,KAAK,GACtB,WAAW,qBAAqB,CAChC,UAAU,cAAc,gCAAgC,iCAAiC,CACzF,UAAU,aAAa,CACvB,OAAO,qDAAqD,CAC5D,MAAM,iCAAiC,KAAK,WAAW,CACvD,MAAM,+BAA+B,KAAK,WAAW,CACrD,MAAM,mBAAmB,KAAK,aAAa,CAC3C,QAAQ,kCAAkC,MAAM,CAChD,QAAQ,qBAAqB,MAAM,CACnC,SAAS;EAEX,MAAM,0BAAU,IAAI,KAAyB;AAC7C,OAAK,MAAM,OAAO,MAAM;GACvB,MAAM,WAAW,QAAQ,IAAI,IAAI,iBAAiB,IAAI,EAAE;AACxD,YAAS,KAAK,KAAK,cAAc,IAAI,CAAC;AACtC,WAAQ,IAAI,IAAI,kBAAkB,SAAS;;AAG5C,SAAO,MAAM,KAAK,UAAU,CAAC,kBAAkB,cAAc;AAK5D,UAAO;IACN;IACA,MALA,SAAS,MAAM,YAAY,QAAQ,WAAW,OAAO,IACrD,SAAS,MAAM,YAAY,QAAQ,WAAW,cAAc,IAC5D;IAIA,kBAAkB,SAAS,KAAK,YAAY,QAAQ,OAAO;IAC3D,cAAc,SAAS,KAAK,aAAa;KACxC,IAAI,QAAQ;KACZ,MAAM,QAAQ;KACd,QAAQ,QAAQ;KAChB,EAAE;IACH;IACA;;;;;;CAOH,MAAM,iBACL,YACA,SACA,cACA,SACgB;EAChB,MAAM,aAAa,MAAM,KAAK,6BAA6B,YAAY,QAAQ;AAC/E,MAAI,CAAC,WAAY;EAEjB,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,MAAM,SAAS;GACzB,MAAM,QAAQ,MAAM,KAAK,wBAAwB,GAAG;AACpD,OAAI,MAAO,QAAO,KAAK,MAAM;;EAE9B,MAAM,YAAY,IAAI,IAAI,OAAO;EAEjC,MAAM,UAAU,MAAM,KAAK,GACzB,WAAW,qBAAqB,CAChC,UAAU,cAAc,gCAAgC,iCAAiC,CACzF,OAAO,CAAC,0CAA0C,CAAC,CACnD,UAAU,CACV,MAAM,iCAAiC,KAAK,WAAW,CACvD,MAAM,+BAA+B,KAAK,WAAW,CACrD,MAAM,mBAAmB,KAAK,aAAa,CAC3C,SAAS;EACX,MAAM,gBAAgB,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,MAAM,CAAC;EAE1D,MAAM,WAAW,CAAC,GAAG,cAAc,CAAC,QAAQ,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AACpE,MAAI,SAAS,SAAS,EACrB,OAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,WAAW,CAClC,MAAM,eAAe,MAAM,SAAS,CACpC,SAAS;EAGZ,MAAM,QAAQ,CAAC,GAAG,UAAU,CAAC,QAAQ,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;AACjE,MAAI,MAAM,SAAS,EAClB,OAAM,KAAK,GACT,WAAW,qBAAqB,CAChC,OACA,MAAM,KAAK,iBAAiB;GAC3B;GACA,UAAU;GACV;GACA,EAAE,CACH,CACA,YAAY,OAAO,GAAG,WAAW,CAAC,CAClC,SAAS;AAGZ,MAAI,SAAS,SAAS,KAAK,MAAM,SAAS,EAAG,gCAA+B;;CAG7E,MAAM,gBAAgB,YAAoB,SAAkC;EAC3E,MAAM,aAAa,MAAM,KAAK,6BAA6B,YAAY,QAAQ;AAC/E,MAAI,CAAC,WAAY,QAAO;EAExB,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,qBAAqB,CAChC,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,KAAK,WAAW,CAClC,kBAAkB;EACpB,MAAM,UAAU,OAAO,OAAO,kBAAkB,EAAE;AAClD,MAAI,UAAU,EAAG,gCAA+B;AAChD,SAAO;;CAGR,MAAc,6BACb,YACA,gBACyB;AACzB,qBAAmB,YAAY,kBAAkB;EACjD,MAAM,YAAY,MAAM;AAOxB,UANe,MAAM,GAAkC;;UAE/C,IAAI,IAAI,UAAU,CAAC;gBACb,eAAe,0BAA0B,eAAe;;IAEpE,QAAQ,KAAK,GAAG,EACJ,KAAK,IAAI,qBAAqB;;;;;;;;;;;;CAa7C,MAAM,qBAAqB,eAAwC;EAClE,MAAM,QAAQ,MAAM,KAAK,wBAAwB,cAAc;AAC/D,MAAI,CAAC,MAAO,QAAO;EAEnB,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,qBAAqB,CAChC,QAAQ,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,QAAQ,CAAC,CACnD,MAAM,eAAe,KAAK,MAAM,CAChC,kBAAkB;AACpB,SAAO,OAAO,QAAQ,SAAS,EAAE;;;;;;;;;;;CAYlC,MAAc,iBAAiB,WAAoC;EAClE,MAAM,QAAQ,MAAM,KAAK,wBAAwB,UAAU;AAC3D,MAAI,CAAC,MAAO,QAAO;AAMnB,SALe,MAAM,KAAK,GACxB,WAAW,aAAa,CACxB,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,MAAM,CACvB,kBAAkB,GACJ,QAAQ;;CAGzB,MAAc,wBAAwB,WAA2C;AAMhF,UALY,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,OAAO,CAAC,oBAAoB,CAAC,CAC7B,OAAO,OAAO,GAAG,GAAG,CAAC,GAAG,MAAM,KAAK,UAAU,EAAE,GAAG,qBAAqB,KAAK,UAAU,CAAC,CAAC,CAAC,CACzF,kBAAkB,GACR,qBAAqB;;;;;;;;;;;;;CAclC,MAAM,qBAAqB,mBAA2D;AACrF,MAAI,kBAAkB,WAAW,EAAG,wBAAO,IAAI,KAAK;EAEpD,MAAM,EAAE,QAAQ,mBAAmB,MAAM,OAAO;EAEhD,MAAM,yBAAS,IAAI,KAAqB;AACxC,OAAK,MAAM,SAAS,OAAO,mBAAmB,eAAe,EAAE;GAC9D,MAAM,OAAO,MAAM,KAAK,GACtB,WAAW,qBAAqB,CAChC,OAAO,CAAC,gBAAgB,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CACpE,MAAM,eAAe,MAAM,MAAM,CACjC,QAAQ,cAAc,CACtB,SAAS;AAEX,QAAK,MAAM,OAAO,KACjB,QAAO,IAAI,IAAI,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC;;AAGrD,SAAO;;CAGR,AAAQ,cAAc,KAA0C;AAC/D,SAAO;GACN,IAAI,IAAI;GACR,MAAM,IAAI;GACV,MAAM,IAAI;GACV,OAAO,IAAI;GACX,UAAU,IAAI;GACd,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;GACxC,QAAQ,IAAI;GACZ,kBAAkB,IAAI;GACtB,WAAW,IAAI;GACf"}

package/dist/{tokens-DVltpO2D.mjs → tokens-C39klX8R.mjs}

@@ -1,4 +1,4 @@
-import { a as encodeBase64url, r as decodeBase64url } from "./base64-B-PsqheR.mjs";
+import { a as encodeBase64url, r as decodeBase64url } from "./base64-CvLhUKQv.mjs";
 
 //#region src/preview/tokens.ts
 /**
@@ -168,4 +168,4 @@ function parseContentId(contentId) {
 
 //#endregion
 export { parseContentId as n, verifyPreviewToken as r, generatePreviewToken as t };
-//# sourceMappingURL=tokens-DVltpO2D.mjs.map
+//# sourceMappingURL=tokens-C39klX8R.mjs.map

package/dist/{tokens-DVltpO2D.mjs.map → tokens-C39klX8R.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"tokens-DVltpO2D.mjs","names":[],"sources":["../src/preview/tokens.ts"],"sourcesContent":["/**\n * Preview token generation and verification\n *\n * Tokens are compact, URL-safe, and HMAC-signed.\n * Format: base64url(JSON payload).base64url(HMAC signature)\n *\n * Payload: { cid: contentId, exp: expiryTimestamp, iat: issuedAt }\n */\n\nimport { encodeBase64url, decodeBase64url } from \"../utils/base64.js\";\n\n// Regex pattern for duration parsing\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\n/**\n * Preview token payload\n */\nexport interface PreviewTokenPayload {\n\t/** Content ID in format \"collection:id\" (e.g., \"posts:abc123\") */\n\tcid: string;\n\t/** Expiry timestamp (seconds since epoch) */\n\texp: number;\n\t/** Issued at timestamp (seconds since epoch) */\n\tiat: number;\n}\n\n/**\n * Options for generating a preview token\n */\nexport interface GeneratePreviewTokenOptions {\n\t/** Content ID in format \"collection:id\" */\n\tcontentId: string;\n\t/** How long the token is valid. Accepts \"1h\", \"30m\", \"1d\", or seconds as number. Default: \"1h\" */\n\texpiresIn?: string | number;\n\t/** Secret key for signing. Should be from environment variable. */\n\tsecret: string;\n}\n\n/**\n * Parse duration string to seconds\n * Supports: \"1h\", \"30m\", \"1d\", \"2w\", or raw seconds\n */\nfunction parseDuration(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\treturn duration;\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use \"1h\", \"30m\", \"1d\", \"2w\", or seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Create HMAC-SHA256 signature using Web Crypto API\n */\nasync function createSignature(data: string, secret: string): Promise<Uint8Array> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"sign\"],\n\t);\n\tconst signature = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data));\n\treturn new Uint8Array(signature);\n}\n\n/**\n * Verify HMAC-SHA256 signature\n */\nasync function verifySignature(\n\tdata: string,\n\tsignature: Uint8Array,\n\tsecret: string,\n): Promise<boolean> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"verify\"],\n\t);\n\t// Create a new ArrayBuffer from the signature to satisfy BufferSource typing\n\t// (Uint8Array.buffer is ArrayBufferLike which includes SharedArrayBuffer)\n\tconst sigBuffer: ArrayBuffer = new ArrayBuffer(signature.byteLength);\n\tnew Uint8Array(sigBuffer).set(signature);\n\treturn crypto.subtle.verify(\"HMAC\", key, sigBuffer, encoder.encode(data));\n}\n\n/**\n * Generate a preview token for content\n *\n * @example\n * ```ts\n * const token = await generatePreviewToken({\n *   contentId: \"posts:abc123\",\n *   expiresIn: \"1h\",\n *   secret: process.env.PREVIEW_SECRET!,\n * });\n * ```\n */\nexport async function generatePreviewToken(options: GeneratePreviewTokenOptions): Promise<string> {\n\tconst { contentId, expiresIn = \"1h\", secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\tif (!contentId || !contentId.includes(\":\")) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\n\tconst now = Math.floor(Date.now() / 1000);\n\tconst duration = parseDuration(expiresIn);\n\n\tconst payload: PreviewTokenPayload = {\n\t\tcid: contentId,\n\t\texp: now + duration,\n\t\tiat: now,\n\t};\n\n\t// Encode payload\n\tconst payloadJson = JSON.stringify(payload);\n\tconst encodedPayload = encodeBase64url(new TextEncoder().encode(payloadJson));\n\n\t// Sign it\n\tconst signature = await createSignature(encodedPayload, secret);\n\tconst encodedSignature = encodeBase64url(signature);\n\n\treturn `${encodedPayload}.${encodedSignature}`;\n}\n\n/**\n * Result of verifying a preview token\n */\nexport type VerifyPreviewTokenResult =\n\t| { valid: true; payload: PreviewTokenPayload }\n\t| { valid: false; error: \"invalid\" | \"expired\" | \"malformed\" | \"none\" };\n\n/**\n * Options for verifyPreviewToken\n */\nexport type VerifyPreviewTokenOptions = {\n\t/** Secret key for verifying tokens */\n\tsecret: string;\n} & (\n\t| { /** URL to extract _preview token from */ url: URL }\n\t| {\n\t\t\t/** Preview token string (can be null) */ token: string | null | undefined;\n\t  }\n);\n\n/**\n * Verify a preview token and return the payload\n *\n * @example\n * ```ts\n * // With URL (extracts _preview query param)\n * const result = await verifyPreviewToken({\n *   url: Astro.url,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * // With token directly\n * const result = await verifyPreviewToken({\n *   token: someToken,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * if (result.valid) {\n *   console.log(result.payload.cid); // \"posts:abc123\"\n * }\n * ```\n */\nexport async function verifyPreviewToken(\n\toptions: VerifyPreviewTokenOptions,\n): Promise<VerifyPreviewTokenResult> {\n\tconst { secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\t// Extract token from URL or use provided token\n\tconst token = \"url\" in options ? options.url.searchParams.get(\"_preview\") : options.token;\n\n\t// Handle null/undefined token\n\tif (!token) {\n\t\treturn { valid: false, error: \"none\" };\n\t}\n\n\t// Split token into payload and signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst [encodedPayload, encodedSignature] = parts;\n\n\t// Verify signature\n\tlet signature: Uint8Array;\n\ttry {\n\t\tsignature = decodeBase64url(encodedSignature);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst isValid = await verifySignature(encodedPayload, signature, secret);\n\tif (!isValid) {\n\t\treturn { valid: false, error: \"invalid\" };\n\t}\n\n\t// Decode and parse payload\n\tlet payload: PreviewTokenPayload;\n\ttry {\n\t\tconst payloadBytes = decodeBase64url(encodedPayload);\n\t\tconst payloadJson = new TextDecoder().decode(payloadBytes);\n\t\tpayload = JSON.parse(payloadJson);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check required fields\n\tif (\n\t\ttypeof payload.cid !== \"string\" ||\n\t\ttypeof payload.exp !== \"number\" ||\n\t\ttypeof payload.iat !== \"number\"\n\t) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check expiry\n\tconst now = Math.floor(Date.now() / 1000);\n\tif (payload.exp < now) {\n\t\treturn { valid: false, error: \"expired\" };\n\t}\n\n\treturn { valid: true, payload };\n}\n\n/**\n * Parse a content ID into collection and id\n */\nexport function parseContentId(contentId: string): {\n\tcollection: string;\n\tid: string;\n} {\n\tconst colonIndex = contentId.indexOf(\":\");\n\tif (colonIndex === -1) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\treturn {\n\t\tcollection: contentId.slice(0, colonIndex),\n\t\tid: contentId.slice(colonIndex + 1),\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,mBAAmB;;;;;AA8BzB,SAAS,cAAc,UAAmC;AACzD,KAAI,OAAO,aAAa,SACvB,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,6CACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;AAOpD,eAAe,gBAAgB,MAAc,QAAqC;CACjF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACR;CACD,MAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,CAAC;AAC7E,QAAO,IAAI,WAAW,UAAU;;;;;AAMjC,eAAe,gBACd,MACA,WACA,QACmB;CACnB,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,SAAS,CACV;CAGD,MAAM,YAAyB,IAAI,YAAY,UAAU,WAAW;AACpE,KAAI,WAAW,UAAU,CAAC,IAAI,UAAU;AACxC,QAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,QAAQ,OAAO,KAAK,CAAC;;;;;;;;;;;;;;AAe1E,eAAsB,qBAAqB,SAAuD;CACjG,MAAM,EAAE,WAAW,YAAY,MAAM,WAAW;AAEhD,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;AAG9C,KAAI,CAAC,aAAa,CAAC,UAAU,SAAS,IAAI,CACzC,OAAM,IAAI,MAAM,iDAA+C;CAGhE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAGzC,MAAM,UAA+B;EACpC,KAAK;EACL,KAAK,MAJW,cAAc,UAAU;EAKxC,KAAK;EACL;CAGD,MAAM,cAAc,KAAK,UAAU,QAAQ;CAC3C,MAAM,iBAAiB,gBAAgB,IAAI,aAAa,CAAC,OAAO,YAAY,CAAC;AAM7E,QAAO,GAAG,eAAe,GAFA,gBADP,MAAM,gBAAgB,gBAAgB,OAAO,CACZ;;;;;;;;;;;;;;;;;;;;;;;;AA+CpD,eAAsB,mBACrB,SACoC;CACpC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;CAI9C,MAAM,QAAQ,SAAS,UAAU,QAAQ,IAAI,aAAa,IAAI,WAAW,GAAG,QAAQ;AAGpF,KAAI,CAAC,MACJ,QAAO;EAAE,OAAO;EAAO,OAAO;EAAQ;CAIvC,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EACpB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAG5C,MAAM,CAAC,gBAAgB,oBAAoB;CAG3C,IAAI;AACJ,KAAI;AACH,cAAY,gBAAgB,iBAAiB;SACtC;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KAAI,CADY,MAAM,gBAAgB,gBAAgB,WAAW,OAAO,CAEvE,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;CAI1C,IAAI;AACJ,KAAI;EACH,MAAM,eAAe,gBAAgB,eAAe;EACpD,MAAM,cAAc,IAAI,aAAa,CAAC,OAAO,aAAa;AAC1D,YAAU,KAAK,MAAM,YAAY;SAC1B;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KACC,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,SAEvB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAI5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,KAAI,QAAQ,MAAM,IACjB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;AAG1C,QAAO;EAAE,OAAO;EAAM;EAAS;;;;;AAMhC,SAAgB,eAAe,WAG7B;CACD,MAAM,aAAa,UAAU,QAAQ,IAAI;AACzC,KAAI,eAAe,GAClB,OAAM,IAAI,MAAM,iDAA+C;AAEhE,QAAO;EACN,YAAY,UAAU,MAAM,GAAG,WAAW;EAC1C,IAAI,UAAU,MAAM,aAAa,EAAE;EACnC"}
+{"version":3,"file":"tokens-C39klX8R.mjs","names":[],"sources":["../src/preview/tokens.ts"],"sourcesContent":["/**\n * Preview token generation and verification\n *\n * Tokens are compact, URL-safe, and HMAC-signed.\n * Format: base64url(JSON payload).base64url(HMAC signature)\n *\n * Payload: { cid: contentId, exp: expiryTimestamp, iat: issuedAt }\n */\n\nimport { encodeBase64url, decodeBase64url } from \"../utils/base64.js\";\n\n// Regex pattern for duration parsing\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\n/**\n * Preview token payload\n */\nexport interface PreviewTokenPayload {\n\t/** Content ID in format \"collection:id\" (e.g., \"posts:abc123\") */\n\tcid: string;\n\t/** Expiry timestamp (seconds since epoch) */\n\texp: number;\n\t/** Issued at timestamp (seconds since epoch) */\n\tiat: number;\n}\n\n/**\n * Options for generating a preview token\n */\nexport interface GeneratePreviewTokenOptions {\n\t/** Content ID in format \"collection:id\" */\n\tcontentId: string;\n\t/** How long the token is valid. Accepts \"1h\", \"30m\", \"1d\", or seconds as number. Default: \"1h\" */\n\texpiresIn?: string | number;\n\t/** Secret key for signing. Should be from environment variable. */\n\tsecret: string;\n}\n\n/**\n * Parse duration string to seconds\n * Supports: \"1h\", \"30m\", \"1d\", \"2w\", or raw seconds\n */\nfunction parseDuration(duration: string | number): number {\n\tif (typeof duration === \"number\") {\n\t\treturn duration;\n\t}\n\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t`Invalid duration format: \"${duration}\". Use \"1h\", \"30m\", \"1d\", \"2w\", or seconds.`,\n\t\t);\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown duration unit: ${unit}`);\n\t}\n}\n\n/**\n * Create HMAC-SHA256 signature using Web Crypto API\n */\nasync function createSignature(data: string, secret: string): Promise<Uint8Array> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"sign\"],\n\t);\n\tconst signature = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data));\n\treturn new Uint8Array(signature);\n}\n\n/**\n * Verify HMAC-SHA256 signature\n */\nasync function verifySignature(\n\tdata: string,\n\tsignature: Uint8Array,\n\tsecret: string,\n): Promise<boolean> {\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"verify\"],\n\t);\n\t// Create a new ArrayBuffer from the signature to satisfy BufferSource typing\n\t// (Uint8Array.buffer is ArrayBufferLike which includes SharedArrayBuffer)\n\tconst sigBuffer: ArrayBuffer = new ArrayBuffer(signature.byteLength);\n\tnew Uint8Array(sigBuffer).set(signature);\n\treturn crypto.subtle.verify(\"HMAC\", key, sigBuffer, encoder.encode(data));\n}\n\n/**\n * Generate a preview token for content\n *\n * @example\n * ```ts\n * const token = await generatePreviewToken({\n *   contentId: \"posts:abc123\",\n *   expiresIn: \"1h\",\n *   secret: process.env.PREVIEW_SECRET!,\n * });\n * ```\n */\nexport async function generatePreviewToken(options: GeneratePreviewTokenOptions): Promise<string> {\n\tconst { contentId, expiresIn = \"1h\", secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\tif (!contentId || !contentId.includes(\":\")) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\n\tconst now = Math.floor(Date.now() / 1000);\n\tconst duration = parseDuration(expiresIn);\n\n\tconst payload: PreviewTokenPayload = {\n\t\tcid: contentId,\n\t\texp: now + duration,\n\t\tiat: now,\n\t};\n\n\t// Encode payload\n\tconst payloadJson = JSON.stringify(payload);\n\tconst encodedPayload = encodeBase64url(new TextEncoder().encode(payloadJson));\n\n\t// Sign it\n\tconst signature = await createSignature(encodedPayload, secret);\n\tconst encodedSignature = encodeBase64url(signature);\n\n\treturn `${encodedPayload}.${encodedSignature}`;\n}\n\n/**\n * Result of verifying a preview token\n */\nexport type VerifyPreviewTokenResult =\n\t| { valid: true; payload: PreviewTokenPayload }\n\t| { valid: false; error: \"invalid\" | \"expired\" | \"malformed\" | \"none\" };\n\n/**\n * Options for verifyPreviewToken\n */\nexport type VerifyPreviewTokenOptions = {\n\t/** Secret key for verifying tokens */\n\tsecret: string;\n} & (\n\t| { /** URL to extract _preview token from */ url: URL }\n\t| {\n\t\t\t/** Preview token string (can be null) */ token: string | null | undefined;\n\t  }\n);\n\n/**\n * Verify a preview token and return the payload\n *\n * @example\n * ```ts\n * // With URL (extracts _preview query param)\n * const result = await verifyPreviewToken({\n *   url: Astro.url,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * // With token directly\n * const result = await verifyPreviewToken({\n *   token: someToken,\n *   secret: import.meta.env.PREVIEW_SECRET,\n * });\n *\n * if (result.valid) {\n *   console.log(result.payload.cid); // \"posts:abc123\"\n * }\n * ```\n */\nexport async function verifyPreviewToken(\n\toptions: VerifyPreviewTokenOptions,\n): Promise<VerifyPreviewTokenResult> {\n\tconst { secret } = options;\n\n\tif (!secret) {\n\t\tthrow new Error(\"Preview secret is required\");\n\t}\n\n\t// Extract token from URL or use provided token\n\tconst token = \"url\" in options ? options.url.searchParams.get(\"_preview\") : options.token;\n\n\t// Handle null/undefined token\n\tif (!token) {\n\t\treturn { valid: false, error: \"none\" };\n\t}\n\n\t// Split token into payload and signature\n\tconst parts = token.split(\".\");\n\tif (parts.length !== 2) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst [encodedPayload, encodedSignature] = parts;\n\n\t// Verify signature\n\tlet signature: Uint8Array;\n\ttry {\n\t\tsignature = decodeBase64url(encodedSignature);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\tconst isValid = await verifySignature(encodedPayload, signature, secret);\n\tif (!isValid) {\n\t\treturn { valid: false, error: \"invalid\" };\n\t}\n\n\t// Decode and parse payload\n\tlet payload: PreviewTokenPayload;\n\ttry {\n\t\tconst payloadBytes = decodeBase64url(encodedPayload);\n\t\tconst payloadJson = new TextDecoder().decode(payloadBytes);\n\t\tpayload = JSON.parse(payloadJson);\n\t} catch {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check required fields\n\tif (\n\t\ttypeof payload.cid !== \"string\" ||\n\t\ttypeof payload.exp !== \"number\" ||\n\t\ttypeof payload.iat !== \"number\"\n\t) {\n\t\treturn { valid: false, error: \"malformed\" };\n\t}\n\n\t// Check expiry\n\tconst now = Math.floor(Date.now() / 1000);\n\tif (payload.exp < now) {\n\t\treturn { valid: false, error: \"expired\" };\n\t}\n\n\treturn { valid: true, payload };\n}\n\n/**\n * Parse a content ID into collection and id\n */\nexport function parseContentId(contentId: string): {\n\tcollection: string;\n\tid: string;\n} {\n\tconst colonIndex = contentId.indexOf(\":\");\n\tif (colonIndex === -1) {\n\t\tthrow new Error('Content ID must be in format \"collection:id\"');\n\t}\n\treturn {\n\t\tcollection: contentId.slice(0, colonIndex),\n\t\tid: contentId.slice(colonIndex + 1),\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,mBAAmB;;;;;AA8BzB,SAAS,cAAc,UAAmC;AACzD,KAAI,OAAO,aAAa,SACvB,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,OAAM,IAAI,MACT,6BAA6B,SAAS,6CACtC;CAGF,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM;AAEnB,SAAQ,MAAR;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;AAOpD,eAAe,gBAAgB,MAAc,QAAqC;CACjF,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACR;CACD,MAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,CAAC;AAC7E,QAAO,IAAI,WAAW,UAAU;;;;;AAMjC,eAAe,gBACd,MACA,WACA,QACmB;CACnB,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,SAAS,CACV;CAGD,MAAM,YAAyB,IAAI,YAAY,UAAU,WAAW;AACpE,KAAI,WAAW,UAAU,CAAC,IAAI,UAAU;AACxC,QAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,QAAQ,OAAO,KAAK,CAAC;;;;;;;;;;;;;;AAe1E,eAAsB,qBAAqB,SAAuD;CACjG,MAAM,EAAE,WAAW,YAAY,MAAM,WAAW;AAEhD,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;AAG9C,KAAI,CAAC,aAAa,CAAC,UAAU,SAAS,IAAI,CACzC,OAAM,IAAI,MAAM,iDAA+C;CAGhE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAGzC,MAAM,UAA+B;EACpC,KAAK;EACL,KAAK,MAJW,cAAc,UAAU;EAKxC,KAAK;EACL;CAGD,MAAM,cAAc,KAAK,UAAU,QAAQ;CAC3C,MAAM,iBAAiB,gBAAgB,IAAI,aAAa,CAAC,OAAO,YAAY,CAAC;AAM7E,QAAO,GAAG,eAAe,GAFA,gBADP,MAAM,gBAAgB,gBAAgB,OAAO,CACZ;;;;;;;;;;;;;;;;;;;;;;;;AA+CpD,eAAsB,mBACrB,SACoC;CACpC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,OACJ,OAAM,IAAI,MAAM,6BAA6B;CAI9C,MAAM,QAAQ,SAAS,UAAU,QAAQ,IAAI,aAAa,IAAI,WAAW,GAAG,QAAQ;AAGpF,KAAI,CAAC,MACJ,QAAO;EAAE,OAAO;EAAO,OAAO;EAAQ;CAIvC,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EACpB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAG5C,MAAM,CAAC,gBAAgB,oBAAoB;CAG3C,IAAI;AACJ,KAAI;AACH,cAAY,gBAAgB,iBAAiB;SACtC;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KAAI,CADY,MAAM,gBAAgB,gBAAgB,WAAW,OAAO,CAEvE,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;CAI1C,IAAI;AACJ,KAAI;EACH,MAAM,eAAe,gBAAgB,eAAe;EACpD,MAAM,cAAc,IAAI,aAAa,CAAC,OAAO,aAAa;AAC1D,YAAU,KAAK,MAAM,YAAY;SAC1B;AACP,SAAO;GAAE,OAAO;GAAO,OAAO;GAAa;;AAI5C,KACC,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,SAEvB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAa;CAI5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,KAAI,QAAQ,MAAM,IACjB,QAAO;EAAE,OAAO;EAAO,OAAO;EAAW;AAG1C,QAAO;EAAE,OAAO;EAAM;EAAS;;;;;AAMhC,SAAgB,eAAe,WAG7B;CACD,MAAM,aAAa,UAAU,QAAQ,IAAI;AACzC,KAAI,eAAe,GAClB,OAAM,IAAI,MAAM,iDAA+C;AAEhE,QAAO;EACN,YAAY,UAAU,MAAM,GAAG,WAAW;EAC1C,IAAI,UAAU,MAAM,aAAa,EAAE;EACnC"}

package/dist/{transaction-D0FOsb3X.mjs → transaction-NQj4VJ7Z.mjs}

@@ -25,4 +25,4 @@ async function withTransaction(db, fn) {
 
 //#endregion
 export { withTransaction as t };
-//# sourceMappingURL=transaction-D0FOsb3X.mjs.map
+//# sourceMappingURL=transaction-NQj4VJ7Z.mjs.map

package/dist/{transaction-D0FOsb3X.mjs.map → transaction-NQj4VJ7Z.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"transaction-D0FOsb3X.mjs","names":[],"sources":["../src/database/transaction.ts"],"sourcesContent":["/**\n * Transaction utility for D1 compatibility\n *\n * D1 (via kysely-d1) does not support transactions. On workerd, the error\n * from beginTransaction() crosses request contexts and can hang the worker.\n *\n * This utility provides a drop-in replacement that runs the callback directly\n * against the db instance when transactions are unavailable. D1 is single-writer\n * so atomicity is not a concern for individual statements — multi-statement\n * atomicity is lost, but that's a known D1 limitation.\n *\n * Usage:\n *   import { withTransaction } from \"../database/transaction.js\";\n *   const result = await withTransaction(db, async (trx) => { ... });\n */\n\nimport type { Kysely, Transaction } from \"kysely\";\n\n/**\n * Run a callback inside a transaction if supported, or directly if not.\n *\n * Probes the database once on first call to determine if transactions work.\n * The result is cached for the lifetime of the process/worker.\n */\nlet transactionsSupported: boolean | null = null;\nconst TRANSACTIONS_NOT_SUPPORTED_RE = /transactions are not supported/i;\n\nexport async function withTransaction<DB, T>(\n\tdb: Kysely<DB>,\n\tfn: (trx: Kysely<DB> | Transaction<DB>) => Promise<T>,\n): Promise<T> {\n\t// Fast path: we already know transactions work\n\tif (transactionsSupported === true) {\n\t\treturn db.transaction().execute(fn);\n\t}\n\n\t// Fast path: we already know they don't\n\tif (transactionsSupported === false) {\n\t\treturn fn(db);\n\t}\n\n\t// First call: probe\n\ttry {\n\t\tconst result = await db.transaction().execute(fn);\n\t\ttransactionsSupported = true;\n\t\treturn result;\n\t} catch (error) {\n\t\tif (error instanceof Error && TRANSACTIONS_NOT_SUPPORTED_RE.test(error.message)) {\n\t\t\ttransactionsSupported = false;\n\t\t\treturn fn(db);\n\t\t}\n\t\tthrow error;\n\t}\n}\n"],"mappings":";;;;;;;AAwBA,IAAI,wBAAwC;AAC5C,MAAM,gCAAgC;AAEtC,eAAsB,gBACrB,IACA,IACa;AAEb,KAAI,0BAA0B,KAC7B,QAAO,GAAG,aAAa,CAAC,QAAQ,GAAG;AAIpC,KAAI,0BAA0B,MAC7B,QAAO,GAAG,GAAG;AAId,KAAI;EACH,MAAM,SAAS,MAAM,GAAG,aAAa,CAAC,QAAQ,GAAG;AACjD,0BAAwB;AACxB,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,SAAS,8BAA8B,KAAK,MAAM,QAAQ,EAAE;AAChF,2BAAwB;AACxB,UAAO,GAAG,GAAG;;AAEd,QAAM"}
+{"version":3,"file":"transaction-NQj4VJ7Z.mjs","names":[],"sources":["../src/database/transaction.ts"],"sourcesContent":["/**\n * Transaction utility for D1 compatibility\n *\n * D1 (via kysely-d1) does not support transactions. On workerd, the error\n * from beginTransaction() crosses request contexts and can hang the worker.\n *\n * This utility provides a drop-in replacement that runs the callback directly\n * against the db instance when transactions are unavailable. D1 is single-writer\n * so atomicity is not a concern for individual statements — multi-statement\n * atomicity is lost, but that's a known D1 limitation.\n *\n * Usage:\n *   import { withTransaction } from \"../database/transaction.js\";\n *   const result = await withTransaction(db, async (trx) => { ... });\n */\n\nimport type { Kysely, Transaction } from \"kysely\";\n\n/**\n * Run a callback inside a transaction if supported, or directly if not.\n *\n * Probes the database once on first call to determine if transactions work.\n * The result is cached for the lifetime of the process/worker.\n */\nlet transactionsSupported: boolean | null = null;\nconst TRANSACTIONS_NOT_SUPPORTED_RE = /transactions are not supported/i;\n\nexport async function withTransaction<DB, T>(\n\tdb: Kysely<DB>,\n\tfn: (trx: Kysely<DB> | Transaction<DB>) => Promise<T>,\n): Promise<T> {\n\t// Fast path: we already know transactions work\n\tif (transactionsSupported === true) {\n\t\treturn db.transaction().execute(fn);\n\t}\n\n\t// Fast path: we already know they don't\n\tif (transactionsSupported === false) {\n\t\treturn fn(db);\n\t}\n\n\t// First call: probe\n\ttry {\n\t\tconst result = await db.transaction().execute(fn);\n\t\ttransactionsSupported = true;\n\t\treturn result;\n\t} catch (error) {\n\t\tif (error instanceof Error && TRANSACTIONS_NOT_SUPPORTED_RE.test(error.message)) {\n\t\t\ttransactionsSupported = false;\n\t\t\treturn fn(db);\n\t\t}\n\t\tthrow error;\n\t}\n}\n"],"mappings":";;;;;;;AAwBA,IAAI,wBAAwC;AAC5C,MAAM,gCAAgC;AAEtC,eAAsB,gBACrB,IACA,IACa;AAEb,KAAI,0BAA0B,KAC7B,QAAO,GAAG,aAAa,CAAC,QAAQ,GAAG;AAIpC,KAAI,0BAA0B,MAC7B,QAAO,GAAG,GAAG;AAId,KAAI;EACH,MAAM,SAAS,MAAM,GAAG,aAAa,CAAC,QAAQ,GAAG;AACjD,0BAAwB;AACxB,SAAO;UACC,OAAO;AACf,MAAI,iBAAiB,SAAS,8BAA8B,KAAK,MAAM,QAAQ,EAAE;AAChF,2BAAwB;AACxB,UAAO,GAAG,GAAG;;AAEd,QAAM"}

package/dist/{transport-BWQo0Foy.mjs → transport--CfOflrp.mjs}

@@ -132,4 +132,4 @@ function refreshInterceptor(options) {
 
 //#endregion
 export { tokenInterceptor as a, refreshInterceptor as i, csrfInterceptor as n, devBypassInterceptor as r, createTransport as t };
-//# sourceMappingURL=transport-BWQo0Foy.mjs.map
+//# sourceMappingURL=transport--CfOflrp.mjs.map

package/dist/{transport-BWQo0Foy.mjs.map → transport--CfOflrp.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"transport-BWQo0Foy.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n}): Interceptor {\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await globalThis.fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t}),\n\t\t});\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { success, data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(request.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(request, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAInB;CACf,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,WAAW,MAAM,QAAQ,eAAe;GACzD,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAC/B,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;AAIhD,SAAO"}
+{"version":3,"file":"transport--CfOflrp.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n}): Interceptor {\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await globalThis.fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t}),\n\t\t});\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { success, data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(request.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(request, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAInB;CACf,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,WAAW,MAAM,QAAQ,eAAe;GACzD,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAC/B,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;AAIhD,SAAO"}

package/dist/{transport-DokJOScS.d.mts → transport-B_rfeU-a.d.mts}

@@ -39,4 +39,4 @@ declare function tokenInterceptor(token: string): Interceptor;
 declare function devBypassInterceptor(baseUrl: string): Interceptor;
 //#endregion
 export { tokenInterceptor as a, devBypassInterceptor as i, createTransport as n, csrfInterceptor as r, Interceptor as t };
-//# sourceMappingURL=transport-DokJOScS.d.mts.map
+//# sourceMappingURL=transport-B_rfeU-a.d.mts.map

package/dist/{transport-DokJOScS.d.mts.map → transport-B_rfeU-a.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"transport-DokJOScS.d.mts","names":[],"sources":["../src/client/transport.ts"],"mappings":";;AAeA;;;;;;;;;;KAAY,WAAA,IACX,OAAA,EAAS,OAAA,EACT,IAAA,GAAO,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA,MAChC,OAAA,CAAQ,QAAA;AAAA,UAEI,gBAAA;EAChB,YAAA,GAAe,WAAA;AAAA;;;;iBAUA,eAAA,CAAgB,OAAA,GAAS,gBAAA;EACxC,KAAA,GAAQ,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;AAAA;;;AAZtC;;;;iBAqCgB,eAAA,CAAA,GAAmB,WAAA;AA1BnC;;;AAAA,iBA8CgB,gBAAA,CAAiB,KAAA,WAAgB,WAAA;;;;;;iBAajC,oBAAA,CAAqB,OAAA,WAAkB,WAAA"}
+{"version":3,"file":"transport-B_rfeU-a.d.mts","names":[],"sources":["../src/client/transport.ts"],"mappings":";;AAeA;;;;;;;;;;KAAY,WAAA,IACX,OAAA,EAAS,OAAA,EACT,IAAA,GAAO,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA,MAChC,OAAA,CAAQ,QAAA;AAAA,UAEI,gBAAA;EAChB,YAAA,GAAe,WAAA;AAAA;;;;iBAUA,eAAA,CAAgB,OAAA,GAAS,gBAAA;EACxC,KAAA,GAAQ,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;AAAA;;;AAZtC;;;;iBAqCgB,eAAA,CAAA,GAAmB,WAAA;AA1BnC;;;AAAA,iBA8CgB,gBAAA,CAAiB,KAAA,WAAgB,WAAA;;;;;;iBAajC,oBAAA,CAAqB,OAAA,WAAkB,WAAA"}

package/dist/{trusted-proxy-CwjQj0YG.mjs → trusted-proxy-CEVekpby.mjs}

@@ -48,4 +48,4 @@ function getTrustedProxyHeaders(config) {
 
 //#endregion
 export { normalizeTrustedHeaders as n, getTrustedProxyHeaders as t };
-//# sourceMappingURL=trusted-proxy-CwjQj0YG.mjs.map
+//# sourceMappingURL=trusted-proxy-CEVekpby.mjs.map

package/dist/{trusted-proxy-CwjQj0YG.mjs.map → trusted-proxy-CEVekpby.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"trusted-proxy-CwjQj0YG.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}
+{"version":3,"file":"trusted-proxy-CEVekpby.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}

package/dist/{types-o7xo7VgH.mjs → types-75KIqzL9.mjs}

@@ -20,6 +20,21 @@ const FIELD_TYPES = [
 	"slug",
 	"repeater"
 ];
+/** Scalar field types that can be backed by a content-list query index. */
+const INDEXABLE_FIELD_TYPES = new Set([
+	"string",
+	"url",
+	"number",
+	"integer",
+	"boolean",
+	"datetime",
+	"select",
+	"reference",
+	"slug"
+]);
+function isIndexableFieldType(type) {
+	return INDEXABLE_FIELD_TYPES.has(type);
+}
 /**
 * Map field types to their SQLite column types
 */
@@ -41,6 +56,7 @@ const FIELD_TYPE_TO_COLUMN = {
 	url: "TEXT",
 	repeater: "JSON"
 };
+const MAX_COLLECTION_LIST_COLUMNS = 4;
 /**
 * Reserved field slugs that cannot be used.
 *
@@ -75,7 +91,8 @@ const RESERVED_COLLECTION_SLUGS = [
 	"revisions",
 	"taxonomies",
 	"options",
-	"audit_logs"
+	"audit_logs",
+	"reorder"
 ];
 const BYLINE_FIELD_TYPES = [
 	"string",
@@ -121,5 +138,5 @@ const RESERVED_BYLINE_FIELD_SLUGS = [
 ];
 
 //#endregion
-export { RESERVED_COLLECTION_SLUGS as a, RESERVED_BYLINE_FIELD_SLUGS as i, FIELD_TYPES as n, RESERVED_FIELD_SLUGS as o, FIELD_TYPE_TO_COLUMN as r, BYLINE_FIELD_TYPES as t };
-//# sourceMappingURL=types-o7xo7VgH.mjs.map
+export { RESERVED_BYLINE_FIELD_SLUGS as a, isIndexableFieldType as c, MAX_COLLECTION_LIST_COLUMNS as i, FIELD_TYPES as n, RESERVED_COLLECTION_SLUGS as o, FIELD_TYPE_TO_COLUMN as r, RESERVED_FIELD_SLUGS as s, BYLINE_FIELD_TYPES as t };
+//# sourceMappingURL=types-75KIqzL9.mjs.map

package/dist/types-75KIqzL9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-75KIqzL9.mjs","names":[],"sources":["../src/schema/types.ts"],"sourcesContent":["/**\n * Schema Registry Types\n *\n * These types represent the schema definitions stored in D1.\n * They are the source of truth for all collections and fields.\n */\n\n/**\n * Supported field types\n */\nexport type FieldType =\n\t| \"string\"\n\t| \"text\"\n\t| \"url\"\n\t| \"number\"\n\t| \"integer\"\n\t| \"boolean\"\n\t| \"datetime\"\n\t| \"select\"\n\t| \"multiSelect\"\n\t| \"portableText\"\n\t| \"image\"\n\t| \"file\"\n\t| \"reference\"\n\t| \"json\"\n\t| \"slug\"\n\t| \"repeater\";\n\n/**\n * Array of all field types for validation\n */\nexport const FIELD_TYPES: readonly FieldType[] = [\n\t\"string\",\n\t\"text\",\n\t\"url\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"multiSelect\",\n\t\"portableText\",\n\t\"image\",\n\t\"file\",\n\t\"reference\",\n\t\"json\",\n\t\"slug\",\n\t\"repeater\",\n] as const;\n\n/** Scalar field types that can be backed by a content-list query index. */\nexport const INDEXABLE_FIELD_TYPES: ReadonlySet<FieldType> = new Set([\n\t\"string\",\n\t\"url\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"reference\",\n\t\"slug\",\n]);\n\nexport function isIndexableFieldType(type: FieldType): boolean {\n\treturn INDEXABLE_FIELD_TYPES.has(type);\n}\n\n/**\n * SQLite column types that map from field types\n */\nexport type ColumnType = \"TEXT\" | \"REAL\" | \"INTEGER\" | \"JSON\";\n\n/**\n * Map field types to their SQLite column types\n */\nexport const FIELD_TYPE_TO_COLUMN: Record<FieldType, ColumnType> = {\n\tstring: \"TEXT\",\n\ttext: \"TEXT\",\n\tnumber: \"REAL\",\n\tinteger: \"INTEGER\",\n\tboolean: \"INTEGER\",\n\tdatetime: \"TEXT\",\n\tselect: \"TEXT\",\n\tmultiSelect: \"JSON\",\n\tportableText: \"JSON\",\n\timage: \"TEXT\",\n\tfile: \"TEXT\",\n\treference: \"TEXT\",\n\tjson: \"JSON\",\n\tslug: \"TEXT\",\n\turl: \"TEXT\",\n\trepeater: \"JSON\",\n};\n\n/**\n * Features a collection can support\n */\nexport type CollectionSupport =\n\t| \"drafts\"\n\t| \"revisions\"\n\t| \"preview\"\n\t| \"scheduling\"\n\t| \"search\"\n\t| \"seo\";\n\n/**\n * Sources for how a collection was created\n */\nexport type CollectionSource =\n\t| `template:${string}`\n\t| `import:${string}`\n\t| \"manual\"\n\t| \"discovered\"\n\t| \"seed\";\n\n/**\n * Validation rules for a field\n */\n/** Sub-field definition for repeater fields */\nexport interface RepeaterSubField {\n\tslug: string;\n\ttype:\n\t\t| \"string\"\n\t\t| \"text\"\n\t\t| \"url\"\n\t\t| \"number\"\n\t\t| \"integer\"\n\t\t| \"boolean\"\n\t\t| \"datetime\"\n\t\t| \"select\"\n\t\t| \"image\";\n\tlabel: string;\n\trequired?: boolean;\n\toptions?: string[]; // For select sub-fields\n}\n\n/** Allowed types for repeater sub-fields (no nesting, no complex types) */\nexport const REPEATER_SUB_FIELD_TYPES = [\n\t\"string\",\n\t\"text\",\n\t\"url\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"image\",\n] as const;\n\nexport interface FieldValidation {\n\trequired?: boolean;\n\tmin?: number;\n\tmax?: number;\n\tminLength?: number;\n\tmaxLength?: number;\n\tpattern?: string;\n\toptions?: string[]; // For select/multiSelect\n\tsubFields?: RepeaterSubField[]; // For repeater fields\n\tminItems?: number; // For repeater fields\n\tmaxItems?: number; // For repeater fields\n\tallowedMimeTypes?: string[];\n}\n\n/**\n * Widget options for field rendering\n */\nexport interface FieldWidgetOptions {\n\trows?: number; // For textarea\n\tshowPreview?: boolean; // For image/file\n\tcollection?: string; // For reference - which collection to reference\n\tallowMultiple?: boolean; // For reference\n\t[key: string]: unknown;\n}\n\nexport const MAX_COLLECTION_LIST_COLUMNS = 4;\n\n/** Collection-level admin presentation options. */\nexport interface CollectionAdminConfig {\n\t/** Custom field slugs to show in the content list. */\n\tlistColumns?: string[];\n}\n\n/**\n * A collection definition\n */\nexport interface Collection {\n\tid: string;\n\tslug: string;\n\tlabel: string;\n\tlabelSingular?: string;\n\tdescription?: string;\n\ticon?: string;\n\tadmin?: CollectionAdminConfig;\n\tsupports: CollectionSupport[];\n\tsource?: CollectionSource;\n\t/** Whether this collection has SEO metadata fields enabled */\n\thasSeo: boolean;\n\t/** Field slug powering the admin list Title column. Defaults to the standard title display. */\n\ttitleField?: string;\n\t/** Field slug powering the admin list Date column. Must be a `datetime` field. Defaults to last-updated. */\n\tdateField?: string;\n\t/** URL pattern with {slug} placeholder (e.g. \"/{slug}\", \"/blog/{slug}\") */\n\turlPattern?: string;\n\t/** Whether published entries require a public slug. Defaults to true. */\n\troutable?: boolean;\n\t/**\n\t * Omit this collection's auto-generated entry from the admin sidebar.\n\t * The collection stays fully functional everywhere else (API, MCP, hooks,\n\t * direct `/content/:collection` URLs) — this only hides the nav link, so a\n\t * plugin that owns the collection can point editors at its own admin UI.\n\t */\n\thidden: boolean;\n\t/**\n\t * Explicit position in the admin sidebar. Collections with a `sortOrder`\n\t * come first, in ascending order; the rest keep the alphabetical-by-slug\n\t * order and follow. `undefined` means \"no explicit position\".\n\t */\n\tsortOrder?: number;\n\t/** Whether comments are enabled for this collection */\n\tcommentsEnabled: boolean;\n\t/** Moderation strategy: \"all\" | \"first_time\" | \"none\" */\n\tcommentsModeration: \"all\" | \"first_time\" | \"none\";\n\t/** Auto-close comments after N days. 0 = never close. */\n\tcommentsClosedAfterDays: number;\n\t/** Auto-approve comments from authenticated CMS users */\n\tcommentsAutoApproveUsers: boolean;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\n/**\n * A field definition\n */\nexport interface Field {\n\tid: string;\n\tcollectionId: string;\n\tslug: string;\n\tlabel: string;\n\ttype: FieldType;\n\tcolumnType: ColumnType;\n\trequired: boolean;\n\tunique: boolean;\n\tdefaultValue?: unknown;\n\tvalidation?: FieldValidation;\n\twidget?: string;\n\toptions?: FieldWidgetOptions;\n\tsortOrder: number;\n\tsearchable: boolean;\n\t/** Whether this field has a physical index for structured list queries. */\n\tindexed: boolean;\n\t/** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */\n\ttranslatable: boolean;\n\tcreatedAt: string;\n}\n\n/**\n * Input for creating a collection\n */\nexport interface CreateCollectionInput {\n\tslug: string;\n\tlabel: string;\n\tlabelSingular?: string;\n\tdescription?: string;\n\ticon?: string;\n\tadmin?: CollectionAdminConfig;\n\tsupports?: CollectionSupport[];\n\tsource?: CollectionSource;\n\turlPattern?: string;\n\troutable?: boolean;\n\thasSeo?: boolean;\n\t/** Omit the auto-generated admin sidebar entry (defaults to false) */\n\thidden?: boolean;\n\t/** Explicit admin sidebar position (omit for the alphabetical fallback) */\n\tsortOrder?: number | null;\n\tcommentsEnabled?: boolean;\n}\n\n/**\n * Input for updating a collection\n */\nexport interface UpdateCollectionInput {\n\tlabel?: string;\n\tlabelSingular?: string;\n\tdescription?: string;\n\ticon?: string;\n\tadmin?: CollectionAdminConfig;\n\tsupports?: CollectionSupport[];\n\turlPattern?: string | null;\n\troutable?: boolean;\n\thasSeo?: boolean;\n\t/** Omit the auto-generated admin sidebar entry */\n\thidden?: boolean;\n\t/** Explicit admin sidebar position; `null` clears it back to alphabetical */\n\tsortOrder?: number | null;\n\tcommentsEnabled?: boolean;\n\tcommentsModeration?: \"all\" | \"first_time\" | \"none\";\n\tcommentsClosedAfterDays?: number;\n\tcommentsAutoApproveUsers?: boolean;\n\t/** Field slug for the Title column; `null`/`\"\"` clears back to the default. */\n\ttitleField?: string | null;\n\t/** Datetime field slug for the Date column; `null`/`\"\"` clears back to the default. */\n\tdateField?: string | null;\n}\n\n/**\n * Input for creating a field\n */\nexport interface CreateFieldInput {\n\tslug: string;\n\tlabel: string;\n\ttype: FieldType;\n\trequired?: boolean;\n\tunique?: boolean;\n\tdefaultValue?: unknown;\n\tvalidation?: FieldValidation | null;\n\twidget?: string;\n\toptions?: FieldWidgetOptions;\n\tsortOrder?: number;\n\t/** Whether this field should be indexed for search */\n\tsearchable?: boolean;\n\t/** Create a physical index for structured sorting. */\n\tindexed?: boolean;\n\t/** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */\n\ttranslatable?: boolean;\n}\n\n/**\n * Input for updating a field\n */\nexport interface UpdateFieldInput {\n\tlabel?: string;\n\t/**\n\t * Change the field's type. Only storage-compatible text aliases (`string`,\n\t * `text`, and `slug`) can be changed in place. Other changes require an\n\t * explicit content migration. Omit to keep the current type.\n\t */\n\ttype?: FieldType;\n\trequired?: boolean;\n\tunique?: boolean;\n\tdefaultValue?: unknown;\n\tvalidation?: FieldValidation | null;\n\twidget?: string;\n\toptions?: FieldWidgetOptions;\n\tsortOrder?: number;\n\t/** Whether this field should be indexed for search */\n\tsearchable?: boolean;\n\t/** Create or remove the physical index used by structured sorting. */\n\tindexed?: boolean;\n\t/** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */\n\ttranslatable?: boolean;\n}\n\n/**\n * A collection with its fields\n */\nexport interface CollectionWithFields extends Collection {\n\tfields: Field[];\n}\n\n/**\n * Reserved field slugs that cannot be used.\n *\n * Includes names reserved for runtime hydration (`terms`, `bylines`, `byline`)\n * so user-defined fields never shadow the auto-hydrated values on entry.data.\n */\nexport const RESERVED_FIELD_SLUGS = [\n\t\"id\",\n\t\"slug\",\n\t\"status\",\n\t\"author_id\",\n\t\"primary_byline_id\",\n\t\"created_at\",\n\t\"updated_at\",\n\t\"published_at\",\n\t\"scheduled_at\",\n\t\"deleted_at\",\n\t\"version\",\n\t\"live_revision_id\",\n\t\"draft_revision_id\",\n\t// Runtime-hydrated fields\n\t\"terms\",\n\t\"bylines\",\n\t\"byline\",\n];\n\n/**\n * Reserved collection slugs that cannot be used\n */\nexport const RESERVED_COLLECTION_SLUGS = [\n\t\"content\",\n\t\"media\",\n\t\"users\",\n\t\"revisions\",\n\t\"taxonomies\",\n\t\"options\",\n\t\"audit_logs\",\n\t// Shadowed by the static POST /schema/collections/reorder route: a\n\t// collection with this slug could never be addressed at its own URL.\n\t\"reorder\",\n];\n\n/**\n * Byline custom fields (Discussion #1174).\n *\n * Sites declare site-specific byline metadata (`job_title`, `pronouns`,\n * `twitter_handle`, `company`, …) without touching emdash core. Definitions\n * live in `_emdash_byline_fields`; values in either\n * `_emdash_byline_field_values` (translatable, keyed by `byline_id`) or\n * `_emdash_byline_field_group_values` (non-translatable, keyed by\n * `translation_group`). The per-field `translatable` flag decides which\n * value table is used. See migration 041.\n */\n\n/**\n * The five v1 field types supported on byline custom fields. Deliberately\n * narrower than the content `FieldType` union — bylines don't need\n * `portableText`, `reference`, `image`, etc. v2 may extend this; v1 keeps\n * the storage and UI surfaces small.\n */\nexport type BylineFieldType = \"string\" | \"text\" | \"url\" | \"boolean\" | \"select\";\n\nexport const BYLINE_FIELD_TYPES: readonly BylineFieldType[] = [\n\t\"string\",\n\t\"text\",\n\t\"url\",\n\t\"boolean\",\n\t\"select\",\n] as const;\n\n/**\n * Validation rules for a byline custom field. v1 only exposes `options`\n * (the choice list for `select` fields). The shape mirrors the content-\n * field convention so the admin UI patterns transfer.\n */\nexport interface BylineFieldValidation {\n\t/** Choices for `select`-type fields. Ignored for other types. */\n\toptions?: string[];\n}\n\n/**\n * Runtime shape of a registered byline custom field. Stored in\n * `_emdash_byline_fields` (see migration 041).\n */\nexport interface BylineFieldDefinition {\n\tid: string;\n\tslug: string;\n\tlabel: string;\n\ttype: BylineFieldType;\n\trequired: boolean;\n\t/**\n\t * Whether values are stored per-locale (`true`, in\n\t * `_emdash_byline_field_values` keyed by `byline_id`) or shared across\n\t * every locale variant of the same byline identity (`false`, in\n\t * `_emdash_byline_field_group_values` keyed by `translation_group`).\n\t * Defaults to `true` at the DB level.\n\t */\n\ttranslatable: boolean;\n\tvalidation: BylineFieldValidation | null;\n\tsortOrder: number;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\n/**\n * Input for creating a byline custom field. `slug` and `type` are not\n * updatable post-create — changing either would invalidate stored values.\n */\nexport interface CreateBylineFieldInput {\n\tslug: string;\n\tlabel: string;\n\ttype: BylineFieldType;\n\trequired?: boolean;\n\ttranslatable?: boolean;\n\tvalidation?: BylineFieldValidation | null;\n\tsortOrder?: number;\n}\n\n/**\n * Input for updating a byline custom field. `slug` and `type` are\n * intentionally not present — see `CreateBylineFieldInput`.\n */\nexport interface UpdateBylineFieldInput {\n\tlabel?: string;\n\trequired?: boolean;\n\ttranslatable?: boolean;\n\tvalidation?: BylineFieldValidation | null;\n\tsortOrder?: number;\n}\n\n/**\n * Runtime value type for a byline custom field. The narrow union mirrors\n * what the five v1 field types can produce: `string`/`text`/`url`/`select`\n * → string, `boolean` → boolean, plus `null` for cleared values.\n */\nexport type CustomFieldValue = string | boolean | null;\n\n/**\n * Reserved byline-field slugs. Two reasons a slug ends up here:\n *\n * 1. **Column collision.** Slugs that match a fixed column on\n *    `_emdash_bylines` (migrations 031 + 040) would shadow that column\n *    on hydration. The first 12 entries cover this.\n * 2. **Route collision.** Static file routes under\n *    `/_emdash/api/admin/byline-fields/` take precedence over the\n *    `[slug].ts` dynamic route in Astro, so a custom field whose slug\n *    matches a sibling static file (e.g. `reorder.ts`) is unreachable\n *    via single-field CRUD — the static route handles only its own\n *    method (POST for `reorder`) and 405s everything else.\n *    `reorder` is the only such sibling today; new sibling routes\n *    (e.g. a hypothetical `import.ts`) must be added here.\n *    `[slug]/usage.ts` lives a level deeper so a slug of `usage` does\n *    not collide — it resolves cleanly to `[slug].ts`.\n *\n * Enforced at the registry layer (Phase 2) and the admin API zod layer\n * (Phase 4) so non-HTTP callers (seeds, scripts) get the same guarantee.\n */\nexport const RESERVED_BYLINE_FIELD_SLUGS = [\n\t// 1. Column-collision slugs (matches `_emdash_bylines` fixed columns).\n\t\"id\",\n\t\"slug\",\n\t\"display_name\",\n\t\"bio\",\n\t\"avatar_media_id\",\n\t\"website_url\",\n\t\"user_id\",\n\t\"is_guest\",\n\t\"locale\",\n\t\"translation_group\",\n\t\"created_at\",\n\t\"updated_at\",\n\t// 2. Route-collision slugs (matches static sibling files of `[slug].ts`).\n\t\"reorder\",\n] as const;\n"],"mappings":";;;;AA+BA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;AAGD,MAAa,wBAAgD,IAAI,IAAI;CACpE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAgB,qBAAqB,MAA0B;AAC9D,QAAO,sBAAsB,IAAI,KAAK;;;;;AAWvC,MAAa,uBAAsD;CAClE,QAAQ;CACR,MAAM;CACN,QAAQ;CACR,SAAS;CACT,SAAS;CACT,UAAU;CACV,QAAQ;CACR,aAAa;CACb,cAAc;CACd,OAAO;CACP,MAAM;CACN,WAAW;CACX,MAAM;CACN,MAAM;CACN,KAAK;CACL,UAAU;CACV;AAkFD,MAAa,8BAA8B;;;;;;;AA+L3C,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;;;;AAKD,MAAa,4BAA4B;CACxC;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;AAsBD,MAAa,qBAAiD;CAC7D;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;;;;;;;;;;;AAyFD,MAAa,8BAA8B;CAE1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA"}

package/dist/{types-C9P3ysxq.d.mts → types-BPuloofb.d.mts}

@@ -195,4 +195,4 @@ interface ExternalAuthConfig {
 }
 //#endregion
 export { AuthResult as a, AuthProviderModule as i, AuthProviderAdminExports as n, AuthRouteDescriptor as o, AuthProviderDescriptor as r, ExternalAuthConfig as s, AuthDescriptor as t };
-//# sourceMappingURL=types-C9P3ysxq.d.mts.map
+//# sourceMappingURL=types-BPuloofb.d.mts.map

package/dist/{types-C9P3ysxq.d.mts.map → types-BPuloofb.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-C9P3ysxq.d.mts","names":[],"sources":["../src/auth/types.ts"],"mappings":";;;;;;AAgBA;;;;;;;;;;;;UAAiB,UAAA;EAmBc;EAjB9B,KAAA;EAiB8B;EAf9B,IAAA;EA2BA;EAzBA,IAAA;EA8BM;EA5BN,OAAA;EAqCgB;EAnChB,QAAA,GAAW,MAAA;AAAA;;;;;;;UASK,cAAA;EAkCH;;;;EA7Bb,IAAA;EA6BmE;AAwBpE;;;;EA9CC,UAAA;EAsFuD;;;EAjFvD,MAAA;AAAA;;;;;;;UASgB,kBAAA;EAsEN;;;;;;;EA9DV,YAAA,CAAa,OAAA,EAAS,OAAA,EAAS,MAAA,YAAkB,OAAA,CAAQ,UAAA;AAAA;;;;AAoF1D;;;;;;;;;;;;;;UA5DiB,sBAAA;EAgFsC;EA9EtD,EAAA;EAoFgB;EAjFhB,KAAA;;EAGA,MAAA;EAmFA;;;;;;EA3EA,UAAA;;;;;EAMA,MAAA,GAAS,mBAAA;;;;;;EAOT,YAAA;;;;;;;;EASA,OAAA,GAAU,MAAA;IAEP,OAAA,GAAU,KAAA;IAA0B,aAAA,GAAgB,KAAA;EAAA;AAAA;;;;UAOvC,mBAAA;;EAEhB,OAAA;;EAEA,UAAA;AAAA;;;;;;;UASgB,wBAAA;;;;;;EAMhB,WAAA,GANwC,KAAA,CAMV,aAAA;;;;;;EAO9B,SAAA,GAP2C,KAAA,CAOf,aAAA;;;;;;EAO5B,SAAA,GAPyC,KAAA,CAOb,aAAA;IAAgB,UAAA;EAAA;AAAA;;;;UAM5B,kBAAA;;;;;EAKhB,aAAA;;;;;EAMA,WAAA;;;;;;EAOA,SAAA;;;;;;;;;;;;;;EAeA,WAAA,GAAc,MAAA;AAAA"}
+{"version":3,"file":"types-BPuloofb.d.mts","names":[],"sources":["../src/auth/types.ts"],"mappings":";;;;;;AAgBA;;;;;;;;;;;;UAAiB,UAAA;EAmBc;EAjB9B,KAAA;EAiB8B;EAf9B,IAAA;EA2BA;EAzBA,IAAA;EA8BM;EA5BN,OAAA;EAqCgB;EAnChB,QAAA,GAAW,MAAA;AAAA;;;;;;;UASK,cAAA;EAkCH;;;;EA7Bb,IAAA;EA6BmE;AAwBpE;;;;EA9CC,UAAA;EAsFuD;;;EAjFvD,MAAA;AAAA;;;;;;;UASgB,kBAAA;EAsEN;;;;;;;EA9DV,YAAA,CAAa,OAAA,EAAS,OAAA,EAAS,MAAA,YAAkB,OAAA,CAAQ,UAAA;AAAA;;;;AAoF1D;;;;;;;;;;;;;;UA5DiB,sBAAA;EAgFsC;EA9EtD,EAAA;EAoFgB;EAjFhB,KAAA;;EAGA,MAAA;EAmFA;;;;;;EA3EA,UAAA;;;;;EAMA,MAAA,GAAS,mBAAA;;;;;;EAOT,YAAA;;;;;;;;EASA,OAAA,GAAU,MAAA;IAEP,OAAA,GAAU,KAAA;IAA0B,aAAA,GAAgB,KAAA;EAAA;AAAA;;;;UAOvC,mBAAA;;EAEhB,OAAA;;EAEA,UAAA;AAAA;;;;;;;UASgB,wBAAA;;;;;;EAMhB,WAAA,GANwC,KAAA,CAMV,aAAA;;;;;;EAO9B,SAAA,GAP2C,KAAA,CAOf,aAAA;;;;;;EAO5B,SAAA,GAPyC,KAAA,CAOb,aAAA;IAAgB,UAAA;EAAA;AAAA;;;;UAM5B,kBAAA;;;;;EAKhB,aAAA;;;;;EAMA,WAAA;;;;;;EAOA,SAAA;;;;;;;;;;;;;;EAeA,WAAA,GAAc,MAAA;AAAA"}

package/dist/{types-BD40g7zz.mjs → types-BW1syrlw.mjs}

@@ -13,4 +13,4 @@ var EmDashStorageError = class extends Error {
 
 //#endregion
 export { EmDashStorageError as t };
-//# sourceMappingURL=types-BD40g7zz.mjs.map
+//# sourceMappingURL=types-BW1syrlw.mjs.map

package/dist/{types-BD40g7zz.mjs.map → types-BW1syrlw.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"types-BD40g7zz.mjs","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage Layer Types\n *\n * Defines the interface for S3-compatible storage backends.\n * Works with R2, AWS S3, Minio, and other S3-compatible services.\n */\n\n/**\n * Storage configuration for S3-compatible backends\n */\nexport interface S3StorageConfig {\n\t/** S3 endpoint URL (e.g., \"https://xxx.r2.cloudflarestorage.com\") */\n\tendpoint: string;\n\t/** Bucket name */\n\tbucket: string;\n\t/**\n\t * AWS access key ID.\n\t * May be resolved from the `S3_ACCESS_KEY_ID` env var at runtime on Node.\n\t * Must be provided together with `secretAccessKey`, or both omitted.\n\t */\n\taccessKeyId?: string;\n\t/**\n\t * AWS secret access key.\n\t * May be resolved from the `S3_SECRET_ACCESS_KEY` env var at runtime on Node.\n\t * Must be provided together with `accessKeyId`, or both omitted.\n\t */\n\tsecretAccessKey?: string;\n\t/** Optional region (defaults to \"auto\") */\n\tregion?: string;\n\t/** Optional public URL prefix for generated URLs (e.g., CDN URL) */\n\tpublicUrl?: string;\n}\n\n/**\n * Local filesystem storage for development\n */\nexport interface LocalStorageConfig {\n\t/** Directory path for storing files */\n\tdirectory: string;\n\t/** Base URL for serving files */\n\tbaseUrl: string;\n}\n\n/**\n * Storage adapter descriptor (serializable config)\n */\nexport interface StorageDescriptor {\n\t/** Module path exporting createStorage function */\n\tentrypoint: string;\n\t/** Serializable config passed to createStorage at runtime */\n\tconfig: Record<string, unknown>;\n}\n\n/**\n * Factory function signature for storage adapters\n *\n * Each adapter accesses its own bindings directly:\n * - R2: imports from cloudflare:workers\n * - S3: uses credentials from config\n * - Local: uses filesystem path from config\n */\nexport type CreateStorageFn = (config: Record<string, unknown>) => Storage;\n\n/**\n * Upload result\n */\nexport interface UploadResult {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** Public URL to access the file */\n\turl: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Download result\n */\nexport interface DownloadResult {\n\t/** File content as readable stream */\n\tbody: ReadableStream<Uint8Array>;\n\t/** MIME type */\n\tcontentType: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Signed URL for direct upload\n */\nexport interface SignedUploadUrl {\n\t/** Signed URL for PUT request */\n\turl: string;\n\t/** HTTP method (always PUT) */\n\tmethod: \"PUT\";\n\t/** Headers to include in the upload request */\n\theaders: Record<string, string>;\n\t/** URL expiration time (ISO string) */\n\texpiresAt: string;\n}\n\n/**\n * Options for generating signed upload URL\n */\nexport interface SignedUploadOptions {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** MIME type of the file */\n\tcontentType: string;\n\t/** File size in bytes (for content-length validation) */\n\tsize?: number;\n\t/** URL expiration in seconds (default: 3600) */\n\texpiresIn?: number;\n}\n\n/**\n * File listing result\n */\nexport interface ListResult {\n\t/** List of files */\n\tfiles: FileInfo[];\n\t/** Cursor for next page (if more results) */\n\tnextCursor?: string;\n}\n\n/**\n * File info from listing\n */\nexport interface FileInfo {\n\t/** Storage key */\n\tkey: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Last modified date */\n\tlastModified: Date;\n\t/** ETag (content hash) */\n\tetag?: string;\n}\n\n/**\n * Options for listing files\n */\nexport interface ListOptions {\n\t/** Filter by key prefix */\n\tprefix?: string;\n\t/** Maximum results per page */\n\tlimit?: number;\n\t/** Cursor from previous list call */\n\tcursor?: string;\n}\n\n/**\n * Storage interface\n *\n * All storage backends must implement this interface.\n */\nexport interface Storage {\n\t/**\n\t * Upload a file to storage\n\t */\n\tupload(options: {\n\t\tkey: string;\n\t\tbody: Buffer | Uint8Array | ReadableStream<Uint8Array>;\n\t\tcontentType: string;\n\t}): Promise<UploadResult>;\n\n\t/**\n\t * Download a file from storage\n\t */\n\tdownload(key: string): Promise<DownloadResult>;\n\n\t/**\n\t * Delete a file from storage\n\t * Idempotent - does not throw if file doesn't exist\n\t */\n\tdelete(key: string): Promise<void>;\n\n\t/**\n\t * Check if a file exists\n\t */\n\texists(key: string): Promise<boolean>;\n\n\t/**\n\t * List files in storage\n\t */\n\tlist(options?: ListOptions): Promise<ListResult>;\n\n\t/**\n\t * Generate a signed URL for direct upload\n\t * Client uploads directly to storage, bypassing the server\n\t */\n\tgetSignedUploadUrl(options: SignedUploadOptions): Promise<SignedUploadUrl>;\n\n\t/**\n\t * Get public URL for a file\n\t */\n\tgetPublicUrl(key: string): string;\n\n\t/**\n\t * Get the origin the browser connects to for direct client uploads.\n\t * Used by the admin CSP when the storage descriptor has no static endpoint.\n\t */\n\tgetClientUploadOrigin?(): string;\n}\n\n/**\n * Storage error with additional context\n */\nexport class EmDashStorageError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic code: string,\n\t\tpublic override cause?: unknown,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"EmDashStorageError\";\n\t}\n}\n"],"mappings":";;;;AAgNA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,YACC,SACA,AAAO,MACP,AAAgB,OACf;AACD,QAAM,QAAQ;EAHP;EACS;AAGhB,OAAK,OAAO"}
+{"version":3,"file":"types-BW1syrlw.mjs","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage Layer Types\n *\n * Defines the interface for S3-compatible storage backends.\n * Works with R2, AWS S3, Minio, and other S3-compatible services.\n */\n\n/**\n * Storage configuration for S3-compatible backends\n */\nexport interface S3StorageConfig {\n\t/** S3 endpoint URL (e.g., \"https://xxx.r2.cloudflarestorage.com\") */\n\tendpoint: string;\n\t/** Bucket name */\n\tbucket: string;\n\t/**\n\t * AWS access key ID.\n\t * May be resolved from the `S3_ACCESS_KEY_ID` env var at runtime on Node.\n\t * Must be provided together with `secretAccessKey`, or both omitted.\n\t */\n\taccessKeyId?: string;\n\t/**\n\t * AWS secret access key.\n\t * May be resolved from the `S3_SECRET_ACCESS_KEY` env var at runtime on Node.\n\t * Must be provided together with `accessKeyId`, or both omitted.\n\t */\n\tsecretAccessKey?: string;\n\t/** Optional region (defaults to \"auto\") */\n\tregion?: string;\n\t/** Optional public URL prefix for generated URLs (e.g., CDN URL) */\n\tpublicUrl?: string;\n}\n\n/**\n * Local filesystem storage for development\n */\nexport interface LocalStorageConfig {\n\t/** Directory path for storing files */\n\tdirectory: string;\n\t/** Base URL for serving files */\n\tbaseUrl: string;\n}\n\n/**\n * Storage adapter descriptor (serializable config)\n */\nexport interface StorageDescriptor {\n\t/** Module path exporting createStorage function */\n\tentrypoint: string;\n\t/** Serializable config passed to createStorage at runtime */\n\tconfig: Record<string, unknown>;\n}\n\n/**\n * Factory function signature for storage adapters\n *\n * Each adapter accesses its own bindings directly:\n * - R2: imports from cloudflare:workers\n * - S3: uses credentials from config\n * - Local: uses filesystem path from config\n */\nexport type CreateStorageFn = (config: Record<string, unknown>) => Storage;\n\n/**\n * Upload result\n */\nexport interface UploadResult {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** Public URL to access the file */\n\turl: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Download result\n */\nexport interface DownloadResult {\n\t/** File content as readable stream */\n\tbody: ReadableStream<Uint8Array>;\n\t/** MIME type */\n\tcontentType: string;\n\t/** File size in bytes */\n\tsize: number;\n}\n\n/**\n * Signed URL for direct upload\n */\nexport interface SignedUploadUrl {\n\t/** Signed URL for PUT request */\n\turl: string;\n\t/** HTTP method (always PUT) */\n\tmethod: \"PUT\";\n\t/** Headers to include in the upload request */\n\theaders: Record<string, string>;\n\t/** URL expiration time (ISO string) */\n\texpiresAt: string;\n}\n\n/**\n * Options for generating signed upload URL\n */\nexport interface SignedUploadOptions {\n\t/** Storage key (path within bucket) */\n\tkey: string;\n\t/** MIME type of the file */\n\tcontentType: string;\n\t/** File size in bytes (for content-length validation) */\n\tsize?: number;\n\t/** URL expiration in seconds (default: 3600) */\n\texpiresIn?: number;\n}\n\n/**\n * File listing result\n */\nexport interface ListResult {\n\t/** List of files */\n\tfiles: FileInfo[];\n\t/** Cursor for next page (if more results) */\n\tnextCursor?: string;\n}\n\n/**\n * File info from listing\n */\nexport interface FileInfo {\n\t/** Storage key */\n\tkey: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Last modified date */\n\tlastModified: Date;\n\t/** ETag (content hash) */\n\tetag?: string;\n}\n\n/**\n * Options for listing files\n */\nexport interface ListOptions {\n\t/** Filter by key prefix */\n\tprefix?: string;\n\t/** Maximum results per page */\n\tlimit?: number;\n\t/** Cursor from previous list call */\n\tcursor?: string;\n}\n\n/**\n * Storage interface\n *\n * All storage backends must implement this interface.\n */\nexport interface Storage {\n\t/**\n\t * Upload a file to storage\n\t */\n\tupload(options: {\n\t\tkey: string;\n\t\tbody: Buffer | Uint8Array | ReadableStream<Uint8Array>;\n\t\tcontentType: string;\n\t}): Promise<UploadResult>;\n\n\t/**\n\t * Download a file from storage\n\t */\n\tdownload(key: string): Promise<DownloadResult>;\n\n\t/**\n\t * Delete a file from storage\n\t * Idempotent - does not throw if file doesn't exist\n\t */\n\tdelete(key: string): Promise<void>;\n\n\t/**\n\t * Check if a file exists\n\t */\n\texists(key: string): Promise<boolean>;\n\n\t/**\n\t * List files in storage\n\t */\n\tlist(options?: ListOptions): Promise<ListResult>;\n\n\t/**\n\t * Generate a signed URL for direct upload\n\t * Client uploads directly to storage, bypassing the server\n\t */\n\tgetSignedUploadUrl(options: SignedUploadOptions): Promise<SignedUploadUrl>;\n\n\t/**\n\t * Get public URL for a file\n\t */\n\tgetPublicUrl(key: string): string;\n\n\t/**\n\t * Get the origin the browser connects to for direct client uploads.\n\t * Used by the admin CSP when the storage descriptor has no static endpoint.\n\t */\n\tgetClientUploadOrigin?(): string;\n}\n\n/**\n * Storage error with additional context\n */\nexport class EmDashStorageError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic code: string,\n\t\tpublic override cause?: unknown,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"EmDashStorageError\";\n\t}\n}\n"],"mappings":";;;;AAgNA,IAAa,qBAAb,cAAwC,MAAM;CAC7C,YACC,SACA,AAAO,MACP,AAAgB,OACf;AACD,QAAM,QAAQ;EAHP;EACS;AAGhB,OAAK,OAAO"}

package/dist/{types-jISEalTX.d.mts → types-C3_AbkDP.d.mts}

@@ -59,6 +59,11 @@ interface FieldWidgetOptions {
   allowMultiple?: boolean;
   [key: string]: unknown;
 }
+/** Collection-level admin presentation options. */
+interface CollectionAdminConfig {
+  /** Custom field slugs to show in the content list. */
+  listColumns?: string[];
+}
 /**
  * A collection definition
  */
@@ -69,12 +74,32 @@ interface Collection {
   labelSingular?: string;
   description?: string;
   icon?: string;
+  admin?: CollectionAdminConfig;
   supports: CollectionSupport[];
   source?: CollectionSource;
   /** Whether this collection has SEO metadata fields enabled */
   hasSeo: boolean;
+  /** Field slug powering the admin list Title column. Defaults to the standard title display. */
+  titleField?: string;
+  /** Field slug powering the admin list Date column. Must be a `datetime` field. Defaults to last-updated. */
+  dateField?: string;
   /** URL pattern with {slug} placeholder (e.g. "/{slug}", "/blog/{slug}") */
   urlPattern?: string;
+  /** Whether published entries require a public slug. Defaults to true. */
+  routable?: boolean;
+  /**
+   * Omit this collection's auto-generated entry from the admin sidebar.
+   * The collection stays fully functional everywhere else (API, MCP, hooks,
+   * direct `/content/:collection` URLs) — this only hides the nav link, so a
+   * plugin that owns the collection can point editors at its own admin UI.
+   */
+  hidden: boolean;
+  /**
+   * Explicit position in the admin sidebar. Collections with a `sortOrder`
+   * come first, in ascending order; the rest keep the alphabetical-by-slug
+   * order and follow. `undefined` means "no explicit position".
+   */
+  sortOrder?: number;
   /** Whether comments are enabled for this collection */
   commentsEnabled: boolean;
   /** Moderation strategy: "all" | "first_time" | "none" */
@@ -104,6 +129,8 @@ interface Field {
   options?: FieldWidgetOptions;
   sortOrder: number;
   searchable: boolean;
+  /** Whether this field has a physical index for structured list queries. */
+  indexed: boolean;
   /** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */
   translatable: boolean;
   createdAt: string;
@@ -117,10 +144,16 @@ interface CreateCollectionInput {
   labelSingular?: string;
   description?: string;
   icon?: string;
+  admin?: CollectionAdminConfig;
   supports?: CollectionSupport[];
   source?: CollectionSource;
   urlPattern?: string;
+  routable?: boolean;
   hasSeo?: boolean;
+  /** Omit the auto-generated admin sidebar entry (defaults to false) */
+  hidden?: boolean;
+  /** Explicit admin sidebar position (omit for the alphabetical fallback) */
+  sortOrder?: number | null;
   commentsEnabled?: boolean;
 }
 /**
@@ -131,13 +164,23 @@ interface UpdateCollectionInput {
   labelSingular?: string;
   description?: string;
   icon?: string;
+  admin?: CollectionAdminConfig;
   supports?: CollectionSupport[];
-  urlPattern?: string;
+  urlPattern?: string | null;
+  routable?: boolean;
   hasSeo?: boolean;
+  /** Omit the auto-generated admin sidebar entry */
+  hidden?: boolean;
+  /** Explicit admin sidebar position; `null` clears it back to alphabetical */
+  sortOrder?: number | null;
   commentsEnabled?: boolean;
   commentsModeration?: "all" | "first_time" | "none";
   commentsClosedAfterDays?: number;
   commentsAutoApproveUsers?: boolean;
+  /** Field slug for the Title column; `null`/`""` clears back to the default. */
+  titleField?: string | null;
+  /** Datetime field slug for the Date column; `null`/`""` clears back to the default. */
+  dateField?: string | null;
 }
 /**
  * Input for creating a field
@@ -155,6 +198,8 @@ interface CreateFieldInput {
   sortOrder?: number;
   /** Whether this field should be indexed for search */
   searchable?: boolean;
+  /** Create a physical index for structured sorting. */
+  indexed?: boolean;
   /** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */
   translatable?: boolean;
 }
@@ -164,13 +209,9 @@ interface CreateFieldInput {
 interface UpdateFieldInput {
   label?: string;
   /**
-   * Change the field's type. Only type changes that keep the same underlying
-   * column type (per `FIELD_TYPE_TO_COLUMN`) are allowed — e.g. `string` to
-   * `slug` (both TEXT). A change that would alter the column affinity (e.g.
-   * `text` TEXT to `portableText` JSON) is rejected, because there is no
-   * in-place column migration and silently rewriting the metadata would
-   * desync `column_type` from the real `ec_*` column. Omit to keep the
-   * current type.
+   * Change the field's type. Only storage-compatible text aliases (`string`,
+   * `text`, and `slug`) can be changed in place. Other changes require an
+   * explicit content migration. Omit to keep the current type.
    */
   type?: FieldType;
   required?: boolean;
@@ -182,6 +223,8 @@ interface UpdateFieldInput {
   sortOrder?: number;
   /** Whether this field should be indexed for search */
   searchable?: boolean;
+  /** Create or remove the physical index used by structured sorting. */
+  indexed?: boolean;
   /** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */
   translatable?: boolean;
 }
@@ -209,5 +252,5 @@ declare const RESERVED_COLLECTION_SLUGS: string[];
  */
 type CustomFieldValue = string | boolean | null;
 //#endregion
-export { UpdateFieldInput as _, ColumnType as a, CustomFieldValue as c, FieldType as d, FieldValidation as f, UpdateCollectionInput as g, RESERVED_FIELD_SLUGS as h, CollectionWithFields as i, FIELD_TYPE_TO_COLUMN as l, RESERVED_COLLECTION_SLUGS as m, CollectionSource as n, CreateCollectionInput as o, FieldWidgetOptions as p, CollectionSupport as r, CreateFieldInput as s, Collection as t, Field as u };
-//# sourceMappingURL=types-jISEalTX.d.mts.map
+export { UpdateCollectionInput as _, CollectionWithFields as a, CreateFieldInput as c, Field as d, FieldType as f, RESERVED_FIELD_SLUGS as g, RESERVED_COLLECTION_SLUGS as h, CollectionSupport as i, CustomFieldValue as l, FieldWidgetOptions as m, CollectionAdminConfig as n, ColumnType as o, FieldValidation as p, CollectionSource as r, CreateCollectionInput as s, Collection as t, FIELD_TYPE_TO_COLUMN as u, UpdateFieldInput as v };
+//# sourceMappingURL=types-C3_AbkDP.d.mts.map

package/dist/types-C3_AbkDP.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-C3_AbkDP.d.mts","names":[],"sources":["../src/schema/types.ts"],"mappings":";;AAUA;;;;;AA4DA;;;AAAA,KA5DY,SAAA;;;;KA4DA,UAAA;;;;cAKC,oBAAA,EAAsB,MAAA,CAAO,SAAA,EAAW,UAAA;;;;KAsBzC,iBAAA;AAWZ;;;AAAA,KAAY,gBAAA;;AAWZ;;;UAAiB,gBAAA;EAChB,IAAA;EACA,IAAA;EAUA,KAAA;EACA,QAAA;EACA,OAAA;AAAA;AAAA,UAgBgB,eAAA;EAChB,QAAA;EACA,GAAA;EACA,GAAA;EACA,SAAA;EACA,SAAA;EACA,OAAA;EACA,OAAA;EACA,SAAA,GAAY,gBAAA;EACZ,QAAA;EACA,QAAA;EACA,gBAAA;AAAA;;;;UAMgB,kBAAA;EAChB,IAAA;EACA,WAAA;EACA,UAAA;EACA,aAAA;EAAA,CACC,GAAA;AAAA;;UAMe,qBAAA;EANJ;EAQZ,WAAA;AAAA;;;;UAMgB,UAAA;EAChB,EAAA;EACA,IAAA;EACA,KAAA;EACA,aAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA,EAAU,iBAAA;EACV,MAAA,GAAS,gBAAA;EAPT;EASA,MAAA;EAPA;EASA,UAAA;EAPA;EASA,SAAA;EARQ;EAUR,UAAA;EATU;EAWV,QAAA;EAVS;;;;;;EAiBT,MAAA;EAMA;;;;;EAAA,SAAA;EAUA;EARA,eAAA;EAQS;EANT,kBAAA;EAYqB;EAVrB,uBAAA;EAeM;EAbN,wBAAA;EACA,SAAA;EACA,SAAA;AAAA;;;;UAMgB,KAAA;EAChB,EAAA;EACA,YAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,SAAA;EACN,UAAA,EAAY,UAAA;EACZ,QAAA;EACA,MAAA;EACA,YAAA;EACA,UAAA,GAAa,eAAA;EACb,MAAA;EACA,OAAA,GAAU,kBAAA;EACV,SAAA;EACA,UAAA;EAAA;EAEA,OAAA;EAEA;EAAA,YAAA;EACA,SAAA;AAAA;AAMD;;;AAAA,UAAiB,qBAAA;EAChB,IAAA;EACA,KAAA;EACA,aAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA,GAAW,iBAAA;EACX,MAAA,GAAS,gBAAA;EACT,UAAA;EACA,QAAA;EACA,MAAA;EAJA;EAMA,MAAA;EALA;EAOA,SAAA;EACA,eAAA;AAAA;;;;UAMgB,qBAAA;EAChB,KAAA;EACA,aAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA,GAAW,iBAAA;EACX,UAAA;EACA,QAAA;EACA,MAAA;EALA;EAOA,MAAA;EANQ;EAQR,SAAA;EACA,eAAA;EACA,kBAAA;EACA,uBAAA;EACA,wBAAA;EANA;EAQA,UAAA;EALA;EAOA,SAAA;AAAA;;;;UAMgB,gBAAA;EAChB,IAAA;EACA,KAAA;EACA,IAAA,EAAM,SAAA;EACN,QAAA;EACA,MAAA;EACA,YAAA;EACA,UAAA,GAAa,eAAA;EACb,MAAA;EACA,OAAA,GAAU,kBAAA;EACV,SAAA;EARA;EAUA,UAAA;EATM;EAWN,OAAA;EATA;EAWA,YAAA;AAAA;;;;UAMgB,gBAAA;EAChB,KAAA;EAXA;;;;;EAiBA,IAAA,GAAO,SAAA;EACP,QAAA;EACA,MAAA;EACA,YAAA;EACA,UAAA,GAAa,eAAA;EACb,MAAA;EACA,OAAA,GAAU,kBAAA;EACV,SAAA;EAbA;EAeA,UAAA;EATO;EAWP,OAAA;EATA;EAWA,YAAA;AAAA;;;;UAMgB,oBAAA,SAA6B,UAAA;EAC7C,MAAA,EAAQ,KAAA;AAAA;;;;;AADT;;cAUa,oBAAA;;;;cAuBA,yBAAA;;;;;;KA0GD,gBAAA"}