emdash 0.37.0 → 0.39.0

package/dist/portable-text-oAwodbPS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable-text-oAwodbPS.mjs","names":[],"sources":["../src/client/portable-text.ts"],"sourcesContent":["/**\n * Portable Text <-> Markdown conversion layer.\n *\n * Three tiers of block handling:\n *   Tier 1: Standard PT blocks <-> standard Markdown (headings, paragraphs, lists, etc.)\n *   Tier 2: EmDash custom blocks <-> Markdown directives (future)\n *   Tier 3: Unknown blocks <-> opaque HTML comment fences (preserved, not editable)\n */\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** Minimal Portable Text block shape */\nexport interface PortableTextBlock {\n\t_type: string;\n\t_key?: string;\n\tstyle?: string;\n\tlevel?: number;\n\tlistItem?: string;\n\tmarkDefs?: MarkDef[];\n\tchildren?: PortableTextSpan[];\n\t[key: string]: unknown;\n}\n\ninterface PortableTextSpan {\n\t_type: string;\n\t_key?: string;\n\ttext?: string;\n\tmarks?: string[];\n\t[key: string]: unknown;\n}\n\ninterface MarkDef {\n\t_key: string;\n\t_type: string;\n\thref?: string;\n\t[key: string]: unknown;\n}\n\ninterface ParsedInline {\n\tspans: PortableTextSpan[];\n\tmarkDefs: MarkDef[];\n}\n\n// ---------------------------------------------------------------------------\n// PT -> Markdown\n// ---------------------------------------------------------------------------\n\n/**\n * Convert Portable Text blocks to Markdown.\n * Unknown block types are serialized as opaque fences.\n */\nexport function portableTextToMarkdown(blocks: PortableTextBlock[]): string {\n\tconst lines: string[] = [];\n\tlet prevWasList = false;\n\n\tfor (let i = 0; i < blocks.length; i++) {\n\t\tconst block = blocks[i];\n\n\t\tif (block._type === \"block\") {\n\t\t\tconst isList = !!block.listItem;\n\n\t\t\t// Blank line between non-contiguous block types\n\t\t\tif (i > 0 && (!isList || !prevWasList)) {\n\t\t\t\tlines.push(\"\");\n\t\t\t}\n\n\t\t\tlines.push(renderStandardBlock(block));\n\t\t\tprevWasList = isList;\n\t\t} else if (block._type === \"code\") {\n\t\t\tif (i > 0) lines.push(\"\");\n\t\t\tconst lang = (block.language as string) || \"\";\n\t\t\tconst code = (block.code as string) || \"\";\n\t\t\tlines.push(\"```\" + lang);\n\t\t\tlines.push(code);\n\t\t\tlines.push(\"```\");\n\t\t\tprevWasList = false;\n\t\t} else if (block._type === \"image\") {\n\t\t\tif (i > 0) lines.push(\"\");\n\t\t\tconst alt = (block.alt as string) || \"\";\n\t\t\tconst url = (block.asset as { url?: string })?.url || \"\";\n\t\t\tlines.push(`![${alt}](${url})`);\n\t\t\tprevWasList = false;\n\t\t} else {\n\t\t\t// Tier 3: Unknown block -> opaque fence\n\t\t\tif (i > 0) lines.push(\"\");\n\t\t\tlines.push(`<!--ec:block ${JSON.stringify(block)} -->`);\n\t\t\tprevWasList = false;\n\t\t}\n\t}\n\n\treturn lines.join(\"\\n\") + \"\\n\";\n}\n\nfunction renderStandardBlock(block: PortableTextBlock): string {\n\tconst text = renderSpans(block.children ?? [], block.markDefs ?? []);\n\n\t// List items\n\tif (block.listItem) {\n\t\tconst indent = \"  \".repeat(Math.max(0, (block.level ?? 1) - 1));\n\t\tconst marker = block.listItem === \"number\" ? \"1.\" : \"-\";\n\t\treturn `${indent}${marker} ${text}`;\n\t}\n\n\t// Headings\n\tif (block.style && block.style.startsWith(\"h\")) {\n\t\tconst level = parseInt(block.style.substring(1), 10);\n\t\tif (level >= 1 && level <= 6) {\n\t\t\treturn `${\"#\".repeat(level)} ${text}`;\n\t\t}\n\t}\n\n\t// Blockquote\n\tif (block.style === \"blockquote\") {\n\t\treturn `> ${text}`;\n\t}\n\n\treturn text;\n}\n\nfunction renderSpans(spans: PortableTextSpan[], markDefs: MarkDef[]): string {\n\tlet result = \"\";\n\n\tfor (const span of spans) {\n\t\tif (span._type !== \"span\") continue;\n\n\t\tlet text = span.text ?? \"\";\n\t\tconst marks = span.marks ?? [];\n\n\t\tfor (const mark of marks) {\n\t\t\tconst def = markDefs.find((d) => d._key === mark);\n\t\t\tif (def) {\n\t\t\t\tif (def._type === \"link\") {\n\t\t\t\t\ttext = `[${text}](${def.href ?? \"\"})`;\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tswitch (mark) {\n\t\t\t\t\tcase \"strong\":\n\t\t\t\t\t\ttext = `**${text}**`;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase \"em\":\n\t\t\t\t\t\ttext = `_${text}_`;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase \"code\":\n\t\t\t\t\t\ttext = `\\`${text}\\``;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase \"strike-through\":\n\t\t\t\t\tcase \"strikethrough\":\n\t\t\t\t\t\ttext = `~~${text}~~`;\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tresult += text;\n\t}\n\n\treturn result;\n}\n\n// ---------------------------------------------------------------------------\n// Markdown -> PT\n// ---------------------------------------------------------------------------\n\n// Regex patterns for markdown parsing\nconst OPAQUE_FENCE_PATTERN = /^<!--ec:block (.+) -->$/;\nconst HEADING_PATTERN = /^(#{1,6})\\s+(.+)$/;\nconst UNORDERED_LIST_PATTERN = /^(\\s*)[-*+]\\s+(.+)$/;\nconst ORDERED_LIST_PATTERN = /^(\\s*)\\d+\\.\\s+(.+)$/;\nconst IMAGE_PATTERN = /^!\\[([^\\]]*)\\]\\(([^)]+)\\)$/;\nconst INLINE_MARKDOWN_PATTERN =\n\t/(\\*\\*(.+?)\\*\\*)|(_(.+?)_)|(`(.+?)`)|(\\[(.+?)\\]\\((.+?)\\))|(~~(.+?)~~)/g;\n\n/**\n * Convert Markdown to Portable Text blocks.\n * Opaque fences (<!--ec:block ... -->) are deserialized and spliced back in.\n */\nexport function markdownToPortableText(markdown: string): PortableTextBlock[] {\n\tconst blocks: PortableTextBlock[] = [];\n\tconst lines = markdown.split(\"\\n\");\n\tlet i = 0;\n\n\twhile (i < lines.length) {\n\t\tconst line = lines[i];\n\n\t\t// Opaque fence\n\t\tconst opaqueMatch = line.match(OPAQUE_FENCE_PATTERN);\n\t\tif (opaqueMatch) {\n\t\t\ttry {\n\t\t\t\tblocks.push(JSON.parse(opaqueMatch[1]) as PortableTextBlock);\n\t\t\t} catch {\n\t\t\t\tblocks.push(makeBlock(line));\n\t\t\t}\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Code fence\n\t\tif (line.startsWith(\"```\")) {\n\t\t\tconst lang = line.slice(3).trim();\n\t\t\tconst codeLines: string[] = [];\n\t\t\ti++;\n\t\t\twhile (i < lines.length && !lines[i].startsWith(\"```\")) {\n\t\t\t\tcodeLines.push(lines[i]);\n\t\t\t\ti++;\n\t\t\t}\n\t\t\tblocks.push({\n\t\t\t\t_type: \"code\",\n\t\t\t\t_key: generateKey(),\n\t\t\t\tlanguage: lang || undefined,\n\t\t\t\tcode: codeLines.join(\"\\n\"),\n\t\t\t});\n\t\t\ti++; // skip closing ```\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Blank line\n\t\tif (line.trim() === \"\") {\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Heading\n\t\tconst headingMatch = line.match(HEADING_PATTERN);\n\t\tif (headingMatch) {\n\t\t\tblocks.push(makeBlock(headingMatch[2], `h${headingMatch[1].length}`));\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Blockquote\n\t\tif (line.startsWith(\"> \")) {\n\t\t\tblocks.push(makeBlock(line.slice(2), \"blockquote\"));\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Unordered list\n\t\tconst ulMatch = line.match(UNORDERED_LIST_PATTERN);\n\t\tif (ulMatch) {\n\t\t\tconst level = Math.floor(ulMatch[1].length / 2) + 1;\n\t\t\tblocks.push(makeListBlock(ulMatch[2], \"bullet\", level));\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Ordered list\n\t\tconst olMatch = line.match(ORDERED_LIST_PATTERN);\n\t\tif (olMatch) {\n\t\t\tconst level = Math.floor(olMatch[1].length / 2) + 1;\n\t\t\tblocks.push(makeListBlock(olMatch[2], \"number\", level));\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Image\n\t\tconst imgMatch = line.match(IMAGE_PATTERN);\n\t\tif (imgMatch) {\n\t\t\tblocks.push({\n\t\t\t\t_type: \"image\",\n\t\t\t\t_key: generateKey(),\n\t\t\t\talt: imgMatch[1],\n\t\t\t\tasset: { url: imgMatch[2] },\n\t\t\t});\n\t\t\ti++;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Paragraph\n\t\tblocks.push(makeBlock(line));\n\t\ti++;\n\t}\n\n\treturn blocks;\n}\n\n// ---------------------------------------------------------------------------\n// Block builders\n// ---------------------------------------------------------------------------\n\nfunction makeBlock(text: string, style: string = \"normal\"): PortableTextBlock {\n\tconst { spans, markDefs } = parseInline(text);\n\treturn { _type: \"block\", _key: generateKey(), style, markDefs, children: spans };\n}\n\nfunction makeListBlock(text: string, listItem: string, level: number): PortableTextBlock {\n\tconst { spans, markDefs } = parseInline(text);\n\treturn {\n\t\t_type: \"block\",\n\t\t_key: generateKey(),\n\t\tstyle: \"normal\",\n\t\tlistItem,\n\t\tlevel,\n\t\tmarkDefs,\n\t\tchildren: spans,\n\t};\n}\n\n/**\n * Parse inline markdown (bold, italic, code, links, strikethrough) into PT spans + markDefs.\n */\nfunction parseInline(text: string): ParsedInline {\n\tconst spans: PortableTextSpan[] = [];\n\tconst markDefs: MarkDef[] = [];\n\tconst regex = INLINE_MARKDOWN_PATTERN;\n\n\tlet lastIndex = 0;\n\tlet match: RegExpExecArray | null;\n\n\twhile ((match = regex.exec(text)) !== null) {\n\t\tif (match.index > lastIndex) {\n\t\t\tspans.push({\n\t\t\t\t_type: \"span\",\n\t\t\t\t_key: generateKey(),\n\t\t\t\ttext: text.slice(lastIndex, match.index),\n\t\t\t\tmarks: [],\n\t\t\t});\n\t\t}\n\n\t\tif (match[2] != null) {\n\t\t\tspans.push({ _type: \"span\", _key: generateKey(), text: match[2], marks: [\"strong\"] });\n\t\t} else if (match[4] != null) {\n\t\t\tspans.push({ _type: \"span\", _key: generateKey(), text: match[4], marks: [\"em\"] });\n\t\t} else if (match[6] != null) {\n\t\t\tspans.push({ _type: \"span\", _key: generateKey(), text: match[6], marks: [\"code\"] });\n\t\t} else if (match[8] != null && match[9] != null) {\n\t\t\tconst key = generateKey();\n\t\t\tmarkDefs.push({ _key: key, _type: \"link\", href: match[9] });\n\t\t\tspans.push({ _type: \"span\", _key: generateKey(), text: match[8], marks: [key] });\n\t\t} else if (match[11] != null) {\n\t\t\tspans.push({\n\t\t\t\t_type: \"span\",\n\t\t\t\t_key: generateKey(),\n\t\t\t\ttext: match[11],\n\t\t\t\tmarks: [\"strike-through\"],\n\t\t\t});\n\t\t}\n\n\t\tlastIndex = match.index + match[0].length;\n\t}\n\n\tif (lastIndex < text.length) {\n\t\tspans.push({ _type: \"span\", _key: generateKey(), text: text.slice(lastIndex), marks: [] });\n\t}\n\n\tif (spans.length === 0) {\n\t\tspans.push({ _type: \"span\", _key: generateKey(), text, marks: [] });\n\t}\n\n\treturn { spans, markDefs };\n}\n\n// ---------------------------------------------------------------------------\n// Key generation\n// ---------------------------------------------------------------------------\n\nlet keyCounter = 0;\n\nfunction generateKey(): string {\n\treturn `k${(keyCounter++).toString(36)}`;\n}\n\n/** Reset key counter (useful for testing) */\nexport function resetKeyCounter(): void {\n\tkeyCounter = 0;\n}\n\n// ---------------------------------------------------------------------------\n// Schema-aware conversion helpers\n// ---------------------------------------------------------------------------\n\nexport interface FieldSchema {\n\tslug: string;\n\ttype: string;\n}\n\n/**\n * Convert content data for reading: PT fields -> markdown strings.\n * Only converts fields with type \"portableText\" that contain arrays.\n */\nexport function convertDataForRead(\n\tdata: Record<string, unknown>,\n\tfields: FieldSchema[],\n\traw: boolean = false,\n): Record<string, unknown> {\n\tif (raw) return data;\n\n\tconst result = { ...data };\n\tfor (const field of fields) {\n\t\tif (field.type === \"portableText\" && Array.isArray(result[field.slug])) {\n\t\t\tresult[field.slug] = portableTextToMarkdown(result[field.slug] as PortableTextBlock[]);\n\t\t}\n\t}\n\treturn result;\n}\n\n/**\n * Convert content data for writing: markdown strings -> PT arrays.\n * Only converts fields with type \"portableText\" that contain strings.\n */\nexport function convertDataForWrite(\n\tdata: Record<string, unknown>,\n\tfields: FieldSchema[],\n): Record<string, unknown> {\n\tconst result = { ...data };\n\tfor (const field of fields) {\n\t\tif (field.type === \"portableText\" && typeof result[field.slug] === \"string\") {\n\t\t\tresult[field.slug] = markdownToPortableText(result[field.slug] as string);\n\t\t}\n\t}\n\treturn result;\n}\n"],"mappings":";;;;;AAqDA,SAAgB,uBAAuB,QAAqC;CAC3E,MAAM,QAAkB,EAAE;CAC1B,IAAI,cAAc;AAElB,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACvC,MAAM,QAAQ,OAAO;AAErB,MAAI,MAAM,UAAU,SAAS;GAC5B,MAAM,SAAS,CAAC,CAAC,MAAM;AAGvB,OAAI,IAAI,MAAM,CAAC,UAAU,CAAC,aACzB,OAAM,KAAK,GAAG;AAGf,SAAM,KAAK,oBAAoB,MAAM,CAAC;AACtC,iBAAc;aACJ,MAAM,UAAU,QAAQ;AAClC,OAAI,IAAI,EAAG,OAAM,KAAK,GAAG;GACzB,MAAM,OAAQ,MAAM,YAAuB;GAC3C,MAAM,OAAQ,MAAM,QAAmB;AACvC,SAAM,KAAK,QAAQ,KAAK;AACxB,SAAM,KAAK,KAAK;AAChB,SAAM,KAAK,MAAM;AACjB,iBAAc;aACJ,MAAM,UAAU,SAAS;AACnC,OAAI,IAAI,EAAG,OAAM,KAAK,GAAG;GACzB,MAAM,MAAO,MAAM,OAAkB;GACrC,MAAM,MAAO,MAAM,OAA4B,OAAO;AACtD,SAAM,KAAK,KAAK,IAAI,IAAI,IAAI,GAAG;AAC/B,iBAAc;SACR;AAEN,OAAI,IAAI,EAAG,OAAM,KAAK,GAAG;AACzB,SAAM,KAAK,gBAAgB,KAAK,UAAU,MAAM,CAAC,MAAM;AACvD,iBAAc;;;AAIhB,QAAO,MAAM,KAAK,KAAK,GAAG;;AAG3B,SAAS,oBAAoB,OAAkC;CAC9D,MAAM,OAAO,YAAY,MAAM,YAAY,EAAE,EAAE,MAAM,YAAY,EAAE,CAAC;AAGpE,KAAI,MAAM,SAGT,QAAO,GAFQ,KAAK,OAAO,KAAK,IAAI,IAAI,MAAM,SAAS,KAAK,EAAE,CAAC,GAChD,MAAM,aAAa,WAAW,OAAO,IAC1B,GAAG;AAI9B,KAAI,MAAM,SAAS,MAAM,MAAM,WAAW,IAAI,EAAE;EAC/C,MAAM,QAAQ,SAAS,MAAM,MAAM,UAAU,EAAE,EAAE,GAAG;AACpD,MAAI,SAAS,KAAK,SAAS,EAC1B,QAAO,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG;;AAKjC,KAAI,MAAM,UAAU,aACnB,QAAO,KAAK;AAGb,QAAO;;AAGR,SAAS,YAAY,OAA2B,UAA6B;CAC5E,IAAI,SAAS;AAEb,MAAK,MAAM,QAAQ,OAAO;AACzB,MAAI,KAAK,UAAU,OAAQ;EAE3B,IAAI,OAAO,KAAK,QAAQ;EACxB,MAAM,QAAQ,KAAK,SAAS,EAAE;AAE9B,OAAK,MAAM,QAAQ,OAAO;GACzB,MAAM,MAAM,SAAS,MAAM,MAAM,EAAE,SAAS,KAAK;AACjD,OAAI,KACH;QAAI,IAAI,UAAU,OACjB,QAAO,IAAI,KAAK,IAAI,IAAI,QAAQ,GAAG;SAGpC,SAAQ,MAAR;IACC,KAAK;AACJ,YAAO,KAAK,KAAK;AACjB;IACD,KAAK;AACJ,YAAO,IAAI,KAAK;AAChB;IACD,KAAK;AACJ,YAAO,KAAK,KAAK;AACjB;IACD,KAAK;IACL,KAAK;AACJ,YAAO,KAAK,KAAK;AACjB;;;AAKJ,YAAU;;AAGX,QAAO;;AAQR,MAAM,uBAAuB;AAC7B,MAAM,kBAAkB;AACxB,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,0BACL;;;;;AAMD,SAAgB,uBAAuB,UAAuC;CAC7E,MAAM,SAA8B,EAAE;CACtC,MAAM,QAAQ,SAAS,MAAM,KAAK;CAClC,IAAI,IAAI;AAER,QAAO,IAAI,MAAM,QAAQ;EACxB,MAAM,OAAO,MAAM;EAGnB,MAAM,cAAc,KAAK,MAAM,qBAAqB;AACpD,MAAI,aAAa;AAChB,OAAI;AACH,WAAO,KAAK,KAAK,MAAM,YAAY,GAAG,CAAsB;WACrD;AACP,WAAO,KAAK,UAAU,KAAK,CAAC;;AAE7B;AACA;;AAID,MAAI,KAAK,WAAW,MAAM,EAAE;GAC3B,MAAM,OAAO,KAAK,MAAM,EAAE,CAAC,MAAM;GACjC,MAAM,YAAsB,EAAE;AAC9B;AACA,UAAO,IAAI,MAAM,UAAU,CAAC,MAAM,GAAG,WAAW,MAAM,EAAE;AACvD,cAAU,KAAK,MAAM,GAAG;AACxB;;AAED,UAAO,KAAK;IACX,OAAO;IACP,MAAM,aAAa;IACnB,UAAU,QAAQ;IAClB,MAAM,UAAU,KAAK,KAAK;IAC1B,CAAC;AACF;AACA;;AAID,MAAI,KAAK,MAAM,KAAK,IAAI;AACvB;AACA;;EAID,MAAM,eAAe,KAAK,MAAM,gBAAgB;AAChD,MAAI,cAAc;AACjB,UAAO,KAAK,UAAU,aAAa,IAAI,IAAI,aAAa,GAAG,SAAS,CAAC;AACrE;AACA;;AAID,MAAI,KAAK,WAAW,KAAK,EAAE;AAC1B,UAAO,KAAK,UAAU,KAAK,MAAM,EAAE,EAAE,aAAa,CAAC;AACnD;AACA;;EAID,MAAM,UAAU,KAAK,MAAM,uBAAuB;AAClD,MAAI,SAAS;GACZ,MAAM,QAAQ,KAAK,MAAM,QAAQ,GAAG,SAAS,EAAE,GAAG;AAClD,UAAO,KAAK,cAAc,QAAQ,IAAI,UAAU,MAAM,CAAC;AACvD;AACA;;EAID,MAAM,UAAU,KAAK,MAAM,qBAAqB;AAChD,MAAI,SAAS;GACZ,MAAM,QAAQ,KAAK,MAAM,QAAQ,GAAG,SAAS,EAAE,GAAG;AAClD,UAAO,KAAK,cAAc,QAAQ,IAAI,UAAU,MAAM,CAAC;AACvD;AACA;;EAID,MAAM,WAAW,KAAK,MAAM,cAAc;AAC1C,MAAI,UAAU;AACb,UAAO,KAAK;IACX,OAAO;IACP,MAAM,aAAa;IACnB,KAAK,SAAS;IACd,OAAO,EAAE,KAAK,SAAS,IAAI;IAC3B,CAAC;AACF;AACA;;AAID,SAAO,KAAK,UAAU,KAAK,CAAC;AAC5B;;AAGD,QAAO;;AAOR,SAAS,UAAU,MAAc,QAAgB,UAA6B;CAC7E,MAAM,EAAE,OAAO,aAAa,YAAY,KAAK;AAC7C,QAAO;EAAE,OAAO;EAAS,MAAM,aAAa;EAAE;EAAO;EAAU,UAAU;EAAO;;AAGjF,SAAS,cAAc,MAAc,UAAkB,OAAkC;CACxF,MAAM,EAAE,OAAO,aAAa,YAAY,KAAK;AAC7C,QAAO;EACN,OAAO;EACP,MAAM,aAAa;EACnB,OAAO;EACP;EACA;EACA;EACA,UAAU;EACV;;;;;AAMF,SAAS,YAAY,MAA4B;CAChD,MAAM,QAA4B,EAAE;CACpC,MAAM,WAAsB,EAAE;CAC9B,MAAM,QAAQ;CAEd,IAAI,YAAY;CAChB,IAAI;AAEJ,SAAQ,QAAQ,MAAM,KAAK,KAAK,MAAM,MAAM;AAC3C,MAAI,MAAM,QAAQ,UACjB,OAAM,KAAK;GACV,OAAO;GACP,MAAM,aAAa;GACnB,MAAM,KAAK,MAAM,WAAW,MAAM,MAAM;GACxC,OAAO,EAAE;GACT,CAAC;AAGH,MAAI,MAAM,MAAM,KACf,OAAM,KAAK;GAAE,OAAO;GAAQ,MAAM,aAAa;GAAE,MAAM,MAAM;GAAI,OAAO,CAAC,SAAS;GAAE,CAAC;WAC3E,MAAM,MAAM,KACtB,OAAM,KAAK;GAAE,OAAO;GAAQ,MAAM,aAAa;GAAE,MAAM,MAAM;GAAI,OAAO,CAAC,KAAK;GAAE,CAAC;WACvE,MAAM,MAAM,KACtB,OAAM,KAAK;GAAE,OAAO;GAAQ,MAAM,aAAa;GAAE,MAAM,MAAM;GAAI,OAAO,CAAC,OAAO;GAAE,CAAC;WACzE,MAAM,MAAM,QAAQ,MAAM,MAAM,MAAM;GAChD,MAAM,MAAM,aAAa;AACzB,YAAS,KAAK;IAAE,MAAM;IAAK,OAAO;IAAQ,MAAM,MAAM;IAAI,CAAC;AAC3D,SAAM,KAAK;IAAE,OAAO;IAAQ,MAAM,aAAa;IAAE,MAAM,MAAM;IAAI,OAAO,CAAC,IAAI;IAAE,CAAC;aACtE,MAAM,OAAO,KACvB,OAAM,KAAK;GACV,OAAO;GACP,MAAM,aAAa;GACnB,MAAM,MAAM;GACZ,OAAO,CAAC,iBAAiB;GACzB,CAAC;AAGH,cAAY,MAAM,QAAQ,MAAM,GAAG;;AAGpC,KAAI,YAAY,KAAK,OACpB,OAAM,KAAK;EAAE,OAAO;EAAQ,MAAM,aAAa;EAAE,MAAM,KAAK,MAAM,UAAU;EAAE,OAAO,EAAE;EAAE,CAAC;AAG3F,KAAI,MAAM,WAAW,EACpB,OAAM,KAAK;EAAE,OAAO;EAAQ,MAAM,aAAa;EAAE;EAAM,OAAO,EAAE;EAAE,CAAC;AAGpE,QAAO;EAAE;EAAO;EAAU;;AAO3B,IAAI,aAAa;AAEjB,SAAS,cAAsB;AAC9B,QAAO,KAAK,cAAc,SAAS,GAAG;;;;;;AAqBvC,SAAgB,mBACf,MACA,QACA,MAAe,OACW;AAC1B,KAAI,IAAK,QAAO;CAEhB,MAAM,SAAS,EAAE,GAAG,MAAM;AAC1B,MAAK,MAAM,SAAS,OACnB,KAAI,MAAM,SAAS,kBAAkB,MAAM,QAAQ,OAAO,MAAM,MAAM,CACrE,QAAO,MAAM,QAAQ,uBAAuB,OAAO,MAAM,MAA6B;AAGxF,QAAO;;;;;;AAOR,SAAgB,oBACf,MACA,QAC0B;CAC1B,MAAM,SAAS,EAAE,GAAG,MAAM;AAC1B,MAAK,MAAM,SAAS,OACnB,KAAI,MAAM,SAAS,kBAAkB,OAAO,OAAO,MAAM,UAAU,SAClE,QAAO,MAAM,QAAQ,uBAAuB,OAAO,MAAM,MAAgB;AAG3E,QAAO"}

package/dist/preview-Cup2bj8c.mjs

@@ -0,0 +1,107 @@
+import { t as generatePreviewToken } from "./tokens-Ns02GAma.mjs";
+
+//#region src/preview/urls.ts
+/**
+* Preview URL generation
+*
+* Creates preview URLs that include a signed token for accessing draft content.
+*/
+const REPEATED_SLASHES = /\/{2,}/g;
+/**
+* Generate a preview URL for content
+*
+* The URL includes a `_preview` query parameter with a signed token.
+*
+* @example
+* ```ts
+* const url = await getPreviewUrl({
+*   collection: "posts",
+*   id: "hello-world",
+*   secret: process.env.PREVIEW_SECRET!,
+* });
+* // Returns: /posts/hello-world?_preview=eyJj...
+*
+* // With base URL:
+* const fullUrl = await getPreviewUrl({
+*   collection: "posts",
+*   id: "hello-world",
+*   secret: process.env.PREVIEW_SECRET!,
+*   baseUrl: "https://example.com",
+* });
+* // Returns: https://example.com/posts/hello-world?_preview=eyJj...
+*
+* // Custom path pattern:
+* const customUrl = await getPreviewUrl({
+*   collection: "posts",
+*   id: "hello-world",
+*   secret: process.env.PREVIEW_SECRET!,
+*   pathPattern: "/blog/{id}",
+* });
+* // Returns: /blog/hello-world?_preview=eyJj...
+* ```
+*/
+async function getPreviewUrl(options) {
+	const { collection, id, secret, expiresIn = "1h", baseUrl, pathPattern = "/{collection}/{id}", locale = "" } = options;
+	const token = await generatePreviewToken({
+		contentId: `${collection}:${id}`,
+		expiresIn,
+		secret
+	});
+	let path = pathPattern.replace("{collection}", collection).replace("{id}", id).replace("{locale}", locale);
+	path = path.replace(REPEATED_SLASHES, "/");
+	if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1);
+	const url = new URL(path, baseUrl || "http://placeholder");
+	url.searchParams.set("_preview", token);
+	if (!baseUrl) return `${url.pathname}${url.search}`;
+	return url.toString();
+}
+/**
+* Build a preview URL from a token (when you already have the token)
+*
+* @example
+* ```ts
+* const url = buildPreviewUrl({
+*   path: "/posts/hello-world",
+*   token: existingToken,
+* });
+* ```
+*/
+function buildPreviewUrl(options) {
+	const { path, token, baseUrl } = options;
+	const url = new URL(path, baseUrl || "http://placeholder");
+	url.searchParams.set("_preview", token);
+	if (!baseUrl) return `${url.pathname}${url.search}`;
+	return url.toString();
+}
+
+//#endregion
+//#region src/preview/helpers.ts
+/**
+* Preview helpers for Astro pages
+*/
+/**
+* Check if a request is a preview request
+*
+* @example
+* ```ts
+* const isPreview = isPreviewRequest(Astro.url);
+* ```
+*/
+function isPreviewRequest(url) {
+	return url.searchParams.has("_preview");
+}
+/**
+* Get the preview token from a URL
+*
+* @example
+* ```ts
+* const token = getPreviewToken(Astro.url);
+* ```
+*/
+function getPreviewToken(url) {
+	return url.searchParams.get("_preview");
+}
+
+//#endregion
+export { getPreviewUrl as i, isPreviewRequest as n, buildPreviewUrl as r, getPreviewToken as t };
+//# sourceMappingURL=preview-Cup2bj8c.mjs.map

package/dist/preview-Cup2bj8c.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-Cup2bj8c.mjs","names":[],"sources":["../src/preview/urls.ts","../src/preview/helpers.ts"],"sourcesContent":["/**\n * Preview URL generation\n *\n * Creates preview URLs that include a signed token for accessing draft content.\n */\n\nimport { generatePreviewToken } from \"./tokens.js\";\n\nconst REPEATED_SLASHES = /\\/{2,}/g;\n\n/**\n * Options for generating a preview URL\n */\nexport interface GetPreviewUrlOptions {\n\t/** Collection slug (e.g., \"posts\") */\n\tcollection: string;\n\t/** Content ID or slug */\n\tid: string;\n\t/** Secret key for signing the token */\n\tsecret: string;\n\t/** How long the preview URL is valid. Default: \"1h\" */\n\texpiresIn?: string | number;\n\t/** Base URL of the site. If not provided, returns a relative URL. */\n\tbaseUrl?: string;\n\t/**\n\t * Custom path pattern. Supports `{collection}`, `{id}` and `{locale}`\n\t * placeholders. Default: `\"/{collection}/{id}\"`.\n\t */\n\tpathPattern?: string;\n\t/**\n\t * Locale segment substituted for the `{locale}` placeholder in `pathPattern`.\n\t * Pass an empty string to omit the locale prefix (e.g. for the default locale\n\t * when `prefixDefaultLocale` is `false`); adjacent slashes left by an empty\n\t * value are collapsed and any trailing slash is trimmed.\n\t */\n\tlocale?: string;\n}\n\n/**\n * Generate a preview URL for content\n *\n * The URL includes a `_preview` query parameter with a signed token.\n *\n * @example\n * ```ts\n * const url = await getPreviewUrl({\n *   collection: \"posts\",\n *   id: \"hello-world\",\n *   secret: process.env.PREVIEW_SECRET!,\n * });\n * // Returns: /posts/hello-world?_preview=eyJj...\n *\n * // With base URL:\n * const fullUrl = await getPreviewUrl({\n *   collection: \"posts\",\n *   id: \"hello-world\",\n *   secret: process.env.PREVIEW_SECRET!,\n *   baseUrl: \"https://example.com\",\n * });\n * // Returns: https://example.com/posts/hello-world?_preview=eyJj...\n *\n * // Custom path pattern:\n * const customUrl = await getPreviewUrl({\n *   collection: \"posts\",\n *   id: \"hello-world\",\n *   secret: process.env.PREVIEW_SECRET!,\n *   pathPattern: \"/blog/{id}\",\n * });\n * // Returns: /blog/hello-world?_preview=eyJj...\n * ```\n */\nexport async function getPreviewUrl(options: GetPreviewUrlOptions): Promise<string> {\n\tconst {\n\t\tcollection,\n\t\tid,\n\t\tsecret,\n\t\texpiresIn = \"1h\",\n\t\tbaseUrl,\n\t\tpathPattern = \"/{collection}/{id}\",\n\t\tlocale = \"\",\n\t} = options;\n\n\t// Generate the signed token\n\tconst token = await generatePreviewToken({\n\t\tcontentId: `${collection}:${id}`,\n\t\texpiresIn,\n\t\tsecret,\n\t});\n\n\t// Build the path. `{locale}` may resolve to an empty string (default locale\n\t// without a prefix); collapse the resulting double slashes and trim a\n\t// trailing slash so the URL stays clean.\n\tlet path = pathPattern\n\t\t.replace(\"{collection}\", collection)\n\t\t.replace(\"{id}\", id)\n\t\t.replace(\"{locale}\", locale);\n\tpath = path.replace(REPEATED_SLASHES, \"/\");\n\tif (path.length > 1 && path.endsWith(\"/\")) path = path.slice(0, -1);\n\n\t// Add token as query parameter\n\tconst url = new URL(path, baseUrl || \"http://placeholder\");\n\turl.searchParams.set(\"_preview\", token);\n\n\t// Return relative URL if no baseUrl provided\n\tif (!baseUrl) {\n\t\treturn `${url.pathname}${url.search}`;\n\t}\n\n\treturn url.toString();\n}\n\n/**\n * Build a preview URL from a token (when you already have the token)\n *\n * @example\n * ```ts\n * const url = buildPreviewUrl({\n *   path: \"/posts/hello-world\",\n *   token: existingToken,\n * });\n * ```\n */\nexport function buildPreviewUrl(options: {\n\tpath: string;\n\ttoken: string;\n\tbaseUrl?: string;\n}): string {\n\tconst { path, token, baseUrl } = options;\n\n\tconst url = new URL(path, baseUrl || \"http://placeholder\");\n\turl.searchParams.set(\"_preview\", token);\n\n\tif (!baseUrl) {\n\t\treturn `${url.pathname}${url.search}`;\n\t}\n\n\treturn url.toString();\n}\n","/**\n * Preview helpers for Astro pages\n */\n\n/**\n * Check if a request is a preview request\n *\n * @example\n * ```ts\n * const isPreview = isPreviewRequest(Astro.url);\n * ```\n */\nexport function isPreviewRequest(url: URL): boolean {\n\treturn url.searchParams.has(\"_preview\");\n}\n\n/**\n * Get the preview token from a URL\n *\n * @example\n * ```ts\n * const token = getPreviewToken(Astro.url);\n * ```\n */\nexport function getPreviewToken(url: URL): string | null {\n\treturn url.searchParams.get(\"_preview\");\n}\n"],"mappings":";;;;;;;;AAQA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DzB,eAAsB,cAAc,SAAgD;CACnF,MAAM,EACL,YACA,IACA,QACA,YAAY,MACZ,SACA,cAAc,sBACd,SAAS,OACN;CAGJ,MAAM,QAAQ,MAAM,qBAAqB;EACxC,WAAW,GAAG,WAAW,GAAG;EAC5B;EACA;EACA,CAAC;CAKF,IAAI,OAAO,YACT,QAAQ,gBAAgB,WAAW,CACnC,QAAQ,QAAQ,GAAG,CACnB,QAAQ,YAAY,OAAO;AAC7B,QAAO,KAAK,QAAQ,kBAAkB,IAAI;AAC1C,KAAI,KAAK,SAAS,KAAK,KAAK,SAAS,IAAI,CAAE,QAAO,KAAK,MAAM,GAAG,GAAG;CAGnE,MAAM,MAAM,IAAI,IAAI,MAAM,WAAW,qBAAqB;AAC1D,KAAI,aAAa,IAAI,YAAY,MAAM;AAGvC,KAAI,CAAC,QACJ,QAAO,GAAG,IAAI,WAAW,IAAI;AAG9B,QAAO,IAAI,UAAU;;;;;;;;;;;;;AActB,SAAgB,gBAAgB,SAIrB;CACV,MAAM,EAAE,MAAM,OAAO,YAAY;CAEjC,MAAM,MAAM,IAAI,IAAI,MAAM,WAAW,qBAAqB;AAC1D,KAAI,aAAa,IAAI,YAAY,MAAM;AAEvC,KAAI,CAAC,QACJ,QAAO,GAAG,IAAI,WAAW,IAAI;AAG9B,QAAO,IAAI,UAAU;;;;;;;;;;;;;;;;AC5HtB,SAAgB,iBAAiB,KAAmB;AACnD,QAAO,IAAI,aAAa,IAAI,WAAW;;;;;;;;;;AAWxC,SAAgB,gBAAgB,KAAyB;AACxD,QAAO,IAAI,aAAa,IAAI,WAAW"}

package/dist/protocol-C1CNiKX4.d.mts

@@ -0,0 +1,61 @@
+import { t as I18nConfig } from "./config-D3HhLON3.mjs";
+
+//#region src/migrations/protocol.d.ts
+type MigrationAction = "check" | "apply" | "release-lock";
+interface MigrationRequest {
+  action: MigrationAction;
+  i18n: I18nConfig | null;
+  artifact: {
+    emdashVersion: string;
+    migrationSetFingerprint: string;
+  };
+  /** For `release-lock`: the lock id a `check` reported. Another lock is left alone. */
+  lockId?: string;
+}
+interface MigrationLockReport {
+  id: string;
+  /** ISO 8601 time the lock was taken. */
+  heldSince: string;
+}
+interface MigrationTarget {
+  kind: string;
+  label: string;
+  fingerprint: string;
+  accountId?: string;
+  environment?: string;
+  resourceId?: string;
+}
+interface MigrationReport {
+  target: MigrationTarget;
+  knownApplied: string[];
+  pending: string[];
+  unknownApplied: string[];
+  executed: string[];
+  /** Present on `check` while a migration lock is held. */
+  lock?: MigrationLockReport;
+}
+interface MigrationExecutor {
+  target: MigrationTarget;
+  execute(request: MigrationRequest): Promise<MigrationReport>;
+  dispose?(): Promise<void>;
+}
+interface MigrationTargetOverrides {
+  database?: string;
+  databaseUrlEnv?: string;
+  d1?: string;
+  accountId?: string;
+  wranglerConfig?: string;
+  wranglerEnv?: string;
+}
+interface MigrationExecutorFactoryContext {
+  projectRoot: string;
+  env: Readonly<Record<string, string | undefined>>;
+  overrides?: Readonly<MigrationTargetOverrides>;
+}
+type MigrationExecutorFactory<ManifestConfig = unknown> = (manifestConfig: ManifestConfig, context: MigrationExecutorFactoryContext) => MigrationExecutor | Promise<MigrationExecutor>;
+interface MigrationExecutorModule<ManifestConfig = unknown> {
+  createMigrationExecutor: MigrationExecutorFactory<ManifestConfig>;
+}
+//#endregion
+export { MigrationExecutorModule as a, MigrationRequest as c, MigrationExecutorFactoryContext as i, MigrationTarget as l, MigrationExecutor as n, MigrationLockReport as o, MigrationExecutorFactory as r, MigrationReport as s, MigrationAction as t, MigrationTargetOverrides as u };
+//# sourceMappingURL=protocol-C1CNiKX4.d.mts.map

package/dist/protocol-C1CNiKX4.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-C1CNiKX4.d.mts","names":[],"sources":["../src/migrations/protocol.ts"],"mappings":";;;KAEY,eAAA;AAAA,UAEK,gBAAA;EAChB,MAAA,EAAQ,eAAA;EACR,IAAA,EAAM,UAAA;EACN,QAAA;IACC,aAAA;IACA,uBAAA;EAAA;EAL+B;EAQhC,MAAA;AAAA;AAAA,UAGgB,mBAAA;EAChB,EAAA;EAVA;EAYA,SAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,IAAA;EACA,KAAA;EACA,WAAA;EACA,SAAA;EACA,WAAA;EACA,UAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,MAAA,EAAQ,eAAA;EACR,YAAA;EACA,OAAA;EACA,cAAA;EACA,QAAA;EAbA;EAeA,IAAA,GAAO,mBAAA;AAAA;AAAA,UAGS,iBAAA;EAChB,MAAA,EAAQ,eAAA;EACR,OAAA,CAAQ,OAAA,EAAS,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAC5C,OAAA,KAAY,OAAA;AAAA;AAAA,UAGI,wBAAA;EAChB,QAAA;EACA,cAAA;EACA,EAAA;EACA,SAAA;EACA,cAAA;EACA,WAAA;AAAA;AAAA,UAGgB,+BAAA;EAChB,WAAA;EACA,GAAA,EAAK,QAAA,CAAS,MAAA;EACd,SAAA,GAAY,QAAA,CAAS,wBAAA;AAAA;AAAA,KAGV,wBAAA,8BACX,cAAA,EAAgB,cAAA,EAChB,OAAA,EAAS,+BAAA,KACL,iBAAA,GAAoB,OAAA,CAAQ,iBAAA;AAAA,UAEhB,uBAAA;EAChB,uBAAA,EAAyB,wBAAA,CAAyB,cAAA;AAAA"}

package/dist/public-submission-Cs-pFMQK.mjs

@@ -0,0 +1,245 @@
+import { t as validateIdentifier } from "./validate-DANX1-Qi.mjs";
+import { a as resolveSecretsCached } from "./secrets-DNgVgz_e.mjs";
+import { t as CommentRepository } from "./comment-DcT8qdPK.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "./error-CCTCskie.mjs";
+import { n as parseBody, t as isParseError } from "./parse-Cr379Av9.mjs";
+import { c as createCommentBody } from "./comments-BVzzt6x5.mjs";
+import { t as extractRequestMeta } from "./request-meta-C8yl_sIs.mjs";
+import { t as getSiteBaseUrl } from "./site-url-DjhYCaep.mjs";
+import { t as escapeHtml } from "./escape-DN4Qmjsl.mjs";
+import { c as hashIp, t as checkRateLimit } from "./comments-B67VRNGw.mjs";
+import { n as createComment } from "./service-Bpy5iTX0.mjs";
+import { sql } from "kysely";
+
+//#region src/comments/notifications.ts
+const NOTIFICATION_SOURCE = "emdash-comments";
+const MAX_EXCERPT_LENGTH = 500;
+const CRLF_RE = /[\r\n]/g;
+/**
+* Build an email notification for a new comment.
+*/
+function buildCommentNotificationEmail(to, data) {
+	const title = data.contentTitle || `${data.collection} item`;
+	const subject = `New comment on "${title}"`.replace(CRLF_RE, " ");
+	const excerpt = data.commentBody.length > MAX_EXCERPT_LENGTH ? data.commentBody.slice(0, MAX_EXCERPT_LENGTH) + "..." : data.commentBody;
+	const adminUrl = `${data.adminBaseUrl}/admin/comments`;
+	return {
+		to,
+		subject,
+		text: [
+			`${data.commentAuthorName} commented on "${title}":`,
+			"",
+			excerpt,
+			"",
+			`View in admin: ${adminUrl}`
+		].join("\n"),
+		html: [
+			`<p><strong>${escapeHtml(data.commentAuthorName)}</strong> commented on &ldquo;${escapeHtml(title)}&rdquo;:</p>`,
+			`<blockquote style="border-left:3px solid #ccc;padding-left:12px;margin:12px 0;color:#555">${escapeHtml(excerpt)}</blockquote>`,
+			`<p><a href="${escapeHtml(adminUrl)}">View in admin</a></p>`
+		].join("\n")
+	};
+}
+/**
+* Send a comment notification to the content author if all conditions are met:
+* 1. Comment status is "approved"
+* 2. Content author exists and has an email
+* 3. Email provider is configured
+* 4. Commenter is not the content author (no self-notifications)
+*
+* Returns true if the email was sent, false if skipped.
+*/
+async function sendCommentNotification(params) {
+	const { email, comment, contentAuthor, adminBaseUrl } = params;
+	if (comment.status !== "approved") return false;
+	if (!contentAuthor?.email) return false;
+	if (!email.isAvailable()) return false;
+	if (comment.authorEmail.toLowerCase() === contentAuthor.email.toLowerCase()) return false;
+	const message = buildCommentNotificationEmail(contentAuthor.email, {
+		commentAuthorName: comment.authorName,
+		commentBody: comment.body,
+		contentTitle: params.contentTitle || "",
+		collection: comment.collection,
+		adminBaseUrl
+	});
+	await email.send(message, NOTIFICATION_SOURCE);
+	return true;
+}
+/**
+* Look up a content item's author from the database.
+*
+* Used by the admin moderation route where content info isn't
+* readily available (only the comment record is at hand).
+*/
+async function lookupContentAuthor(db, collection, contentId) {
+	validateIdentifier(collection, "collection");
+	const contentRow = await db.selectFrom(`ec_${collection}`).select(["slug", "author_id"]).where("id", "=", contentId).executeTakeFirst();
+	if (!contentRow) return null;
+	const typed = contentRow;
+	let author;
+	if (typed.author_id) {
+		const userRow = await db.selectFrom("users").select([
+			"id",
+			"name",
+			"email",
+			"email_verified"
+		]).where("id", "=", typed.author_id).executeTakeFirst();
+		if (userRow && userRow.email_verified) author = {
+			id: userRow.id,
+			email: userRow.email,
+			name: userRow.name
+		};
+	}
+	return {
+		slug: typed.slug,
+		author
+	};
+}
+
+//#endregion
+//#region src/comments/public-submission.ts
+function parseCommentModeration(value) {
+	if (value === "all" || value === "first_time" || value === "none") return value;
+	return "all";
+}
+function isModerationDecision(value) {
+	if (typeof value !== "object" || value === null || !("status" in value)) return false;
+	if (value.status !== "pending" && value.status !== "approved" && value.status !== "spam") return false;
+	return !("reason" in value) || value.reason === void 0 || typeof value.reason === "string";
+}
+async function submitPublicComment(runtime, collection, contentId, request, user) {
+	try {
+		const body = await parseBody(request, createCommentBody);
+		if (isParseError(body)) return body;
+		const collectionRow = await runtime.db.selectFrom("_emdash_collections").select([
+			"comments_enabled",
+			"comments_moderation",
+			"comments_closed_after_days",
+			"comments_auto_approve_users"
+		]).where("slug", "=", collection).executeTakeFirst();
+		if (!collectionRow) return apiError("NOT_FOUND", `Collection '${collection}' not found`, 404);
+		if (!collectionRow.comments_enabled) return apiError("COMMENTS_DISABLED", "Comments are not enabled for this collection", 403);
+		validateIdentifier(collection, "collection");
+		const contentRow = (await sql`
+			SELECT id, slug, author_id, published_at
+			FROM ${sql.ref(`ec_${collection}`)}
+			WHERE id = ${contentId}
+			AND status = 'published'
+			AND deleted_at IS NULL
+		`.execute(runtime.db)).rows[0];
+		if (!contentRow) return apiError("NOT_FOUND", "Content not found", 404);
+		if (collectionRow.comments_closed_after_days > 0) {
+			const publishedAt = contentRow.published_at;
+			if (publishedAt) {
+				const closedDate = new Date(publishedAt);
+				closedDate.setDate(closedDate.getDate() + collectionRow.comments_closed_after_days);
+				if (/* @__PURE__ */ new Date() > closedDate) return apiError("COMMENTS_CLOSED", "Comments are closed for this content", 403);
+			}
+		}
+		if (body.website_url) return apiSuccess({
+			status: "pending",
+			message: "Comment submitted for review"
+		});
+		const meta = extractRequestMeta(request, runtime.config);
+		const { ipSalt } = await resolveSecretsCached(runtime.db);
+		const ipHash = meta.ip ? await hashIp(meta.ip, ipSalt) : "unknown";
+		if (await checkRateLimit(runtime.db, ipHash, ipHash === "unknown" ? 20 : void 0)) return apiError("RATE_LIMITED", "Too many comments. Please try again later.", 429);
+		const { getTurnstileSecretKey, verifyTurnstileToken } = await import("./turnstile-DWCSh_Qc.mjs");
+		const turnstileSecretKey = getTurnstileSecretKey();
+		if (turnstileSecretKey && !await verifyTurnstileToken(body.turnstileToken, turnstileSecretKey, meta.ip)) return apiError("TURNSTILE_FAILED", "CAPTCHA verification failed", 403);
+		const settings = {
+			commentsEnabled: true,
+			commentsModeration: parseCommentModeration(collectionRow.comments_moderation),
+			commentsClosedAfterDays: collectionRow.comments_closed_after_days,
+			commentsAutoApproveUsers: collectionRow.comments_auto_approve_users === 1
+		};
+		const authorName = user?.name || body.authorName;
+		const authorEmail = user?.email ?? body.authorEmail;
+		let resolvedParentId = body.parentId ?? null;
+		if (body.parentId) {
+			const parent = await new CommentRepository(runtime.db).findById(body.parentId);
+			if (!parent) return apiError("VALIDATION_ERROR", "Parent comment not found", 400);
+			if (parent.collection !== collection || parent.contentId !== contentId) return apiError("VALIDATION_ERROR", "Parent comment belongs to different content", 400);
+			resolvedParentId = parent.parentId ?? parent.id;
+		}
+		let contentAuthor;
+		if (contentRow.author_id) {
+			const authorRow = await runtime.db.selectFrom("users").select([
+				"id",
+				"name",
+				"email",
+				"email_verified"
+			]).where("id", "=", contentRow.author_id).executeTakeFirst();
+			if (authorRow?.email_verified) contentAuthor = {
+				id: authorRow.id,
+				name: authorRow.name,
+				email: authorRow.email
+			};
+		}
+		const result = await createComment(runtime.db, {
+			collection,
+			contentId,
+			parentId: resolvedParentId,
+			authorName,
+			authorEmail,
+			authorUserId: user?.id ?? null,
+			body: body.body,
+			ipHash,
+			userAgent: meta.userAgent
+		}, settings, {
+			runBeforeCreate: (event) => runtime.hooks.runCommentBeforeCreate(event),
+			runModerate: async (event) => {
+				const result = await runtime.hooks.invokeExclusiveHook("comment:moderate", event);
+				if (!result) return {
+					status: "pending",
+					reason: "No moderator configured"
+				};
+				if (result.error) {
+					console.error(`[comments] Moderation error (${result.pluginId}):`, result.error.message);
+					return {
+						status: "pending",
+						reason: "Moderation error"
+					};
+				}
+				return isModerationDecision(result.result) ? result.result : {
+					status: "pending",
+					reason: "Invalid moderation result"
+				};
+			},
+			fireAfterCreate: (event) => {
+				runtime.hooks.runCommentAfterCreate(event).catch((error) => console.error("[comments] afterCreate error:", error instanceof Error ? error.message : error));
+			},
+			fireAfterModerate: (event) => {
+				runtime.hooks.runCommentAfterModerate(event).catch((error) => console.error("[comments] afterModerate error:", error instanceof Error ? error.message : error));
+			}
+		}, {
+			id: contentRow.id,
+			collection,
+			slug: contentRow.slug,
+			author: contentAuthor
+		});
+		if (!result) return apiError("COMMENT_REJECTED", "Comment was rejected", 403);
+		if (result.comment.status === "approved" && runtime.email && contentAuthor) try {
+			const adminBaseUrl = await getSiteBaseUrl(runtime.db, request, runtime.config);
+			await sendCommentNotification({
+				email: runtime.email,
+				comment: result.comment,
+				contentAuthor,
+				adminBaseUrl
+			});
+		} catch (error) {
+			console.error("[comments] notification error:", error instanceof Error ? error.message : error);
+		}
+		return apiSuccess({
+			id: result.comment.id,
+			status: result.comment.status,
+			message: result.comment.status === "approved" ? "Comment published" : "Comment submitted for review"
+		}, 201);
+	} catch (error) {
+		return handleError(error, "Failed to submit comment", "COMMENT_CREATE_ERROR");
+	}
+}
+
+//#endregion
+export { lookupContentAuthor as n, sendCommentNotification as r, submitPublicComment as t };
+//# sourceMappingURL=public-submission-Cs-pFMQK.mjs.map

package/dist/public-submission-Cs-pFMQK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-submission-Cs-pFMQK.mjs","names":[],"sources":["../src/comments/notifications.ts","../src/comments/public-submission.ts"],"sourcesContent":["/**\n * Comment Notification Emails\n *\n * Sends email notifications to content authors when comments are\n * approved on their content. Used by:\n *   - Public comment POST route (comment:afterCreate, if auto-approved)\n *   - Admin moderation route (comment:afterModerate, when approving)\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { escapeHtml } from \"../api/escape.js\";\nimport type { Database } from \"../database/types.js\";\nimport { validateIdentifier } from \"../database/validate.js\";\nimport type { EmailPipeline } from \"../plugins/email.js\";\nimport type { EmailMessage } from \"../plugins/types.js\";\n\nconst NOTIFICATION_SOURCE = \"emdash-comments\";\nconst MAX_EXCERPT_LENGTH = 500;\nconst CRLF_RE = /[\\r\\n]/g;\n\nexport interface CommentNotificationData {\n\tcommentAuthorName: string;\n\tcommentBody: string;\n\tcontentTitle: string;\n\tcollection: string;\n\tadminBaseUrl: string;\n}\n\n/**\n * Build an email notification for a new comment.\n */\nexport function buildCommentNotificationEmail(\n\tto: string,\n\tdata: CommentNotificationData,\n): EmailMessage {\n\tconst title = data.contentTitle || `${data.collection} item`;\n\tconst subject = `New comment on \"${title}\"`.replace(CRLF_RE, \" \");\n\n\tconst excerpt =\n\t\tdata.commentBody.length > MAX_EXCERPT_LENGTH\n\t\t\t? data.commentBody.slice(0, MAX_EXCERPT_LENGTH) + \"...\"\n\t\t\t: data.commentBody;\n\n\tconst adminUrl = `${data.adminBaseUrl}/admin/comments`;\n\n\tconst text = [\n\t\t`${data.commentAuthorName} commented on \"${title}\":`,\n\t\t\"\",\n\t\texcerpt,\n\t\t\"\",\n\t\t`View in admin: ${adminUrl}`,\n\t].join(\"\\n\");\n\n\tconst html = [\n\t\t`<p><strong>${escapeHtml(data.commentAuthorName)}</strong> commented on &ldquo;${escapeHtml(title)}&rdquo;:</p>`,\n\t\t`<blockquote style=\"border-left:3px solid #ccc;padding-left:12px;margin:12px 0;color:#555\">${escapeHtml(excerpt)}</blockquote>`,\n\t\t`<p><a href=\"${escapeHtml(adminUrl)}\">View in admin</a></p>`,\n\t].join(\"\\n\");\n\n\treturn { to, subject, text, html };\n}\n\n/**\n * Send a comment notification to the content author if all conditions are met:\n * 1. Comment status is \"approved\"\n * 2. Content author exists and has an email\n * 3. Email provider is configured\n * 4. Commenter is not the content author (no self-notifications)\n *\n * Returns true if the email was sent, false if skipped.\n */\nexport async function sendCommentNotification(params: {\n\temail: EmailPipeline;\n\tcomment: {\n\t\tauthorName: string;\n\t\tauthorEmail: string;\n\t\tbody: string;\n\t\tstatus: string;\n\t\tcollection: string;\n\t};\n\tcontentTitle?: string;\n\tcontentAuthor?: { email: string; name: string | null };\n\tadminBaseUrl: string;\n}): Promise<boolean> {\n\tconst { email, comment, contentAuthor, adminBaseUrl } = params;\n\n\tif (comment.status !== \"approved\") return false;\n\tif (!contentAuthor?.email) return false;\n\tif (!email.isAvailable()) return false;\n\tif (comment.authorEmail.toLowerCase() === contentAuthor.email.toLowerCase()) return false;\n\n\tconst message = buildCommentNotificationEmail(contentAuthor.email, {\n\t\tcommentAuthorName: comment.authorName,\n\t\tcommentBody: comment.body,\n\t\tcontentTitle: params.contentTitle || \"\",\n\t\tcollection: comment.collection,\n\t\tadminBaseUrl,\n\t});\n\n\tawait email.send(message, NOTIFICATION_SOURCE);\n\treturn true;\n}\n\n/**\n * Look up a content item's author from the database.\n *\n * Used by the admin moderation route where content info isn't\n * readily available (only the comment record is at hand).\n */\nexport async function lookupContentAuthor(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tcontentId: string,\n): Promise<{\n\tslug: string;\n\tauthor?: { id: string; email: string; name: string | null };\n} | null> {\n\tvalidateIdentifier(collection, \"collection\");\n\n\tconst contentRow = await db\n\t\t.selectFrom(`ec_${collection}` as never)\n\t\t.select([\"slug\" as never, \"author_id\" as never])\n\t\t.where(\"id\" as never, \"=\", contentId as never)\n\t\t.executeTakeFirst();\n\n\tif (!contentRow) return null;\n\n\tconst typed = contentRow as { slug: string; author_id: string | null };\n\n\tlet author: { id: string; email: string; name: string | null } | undefined;\n\tif (typed.author_id) {\n\t\tconst userRow = await db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.select([\"id\", \"name\", \"email\", \"email_verified\"])\n\t\t\t.where(\"id\", \"=\", typed.author_id)\n\t\t\t.executeTakeFirst();\n\t\tif (userRow && userRow.email_verified) {\n\t\t\tauthor = { id: userRow.id, email: userRow.email, name: userRow.name };\n\t\t}\n\t}\n\n\treturn { slug: typed.slug, author };\n}\n","import { sql, type Kysely } from \"kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"../api/error.js\";\nimport { checkRateLimit, hashIp } from \"../api/handlers/comments.js\";\nimport { isParseError, parseBody } from \"../api/parse.js\";\nimport { createCommentBody } from \"../api/schemas/comments.js\";\nimport { getSiteBaseUrl } from \"../api/site-url.js\";\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\nimport { resolveSecretsCached } from \"../config/secrets.js\";\nimport { CommentRepository } from \"../database/repositories/comment.js\";\nimport type { Database } from \"../database/types.js\";\nimport { validateIdentifier } from \"../database/validate.js\";\nimport type { EmailPipeline } from \"../plugins/email.js\";\nimport type { HookPipeline } from \"../plugins/hooks.js\";\nimport { extractRequestMeta } from \"../plugins/request-meta.js\";\nimport type { CollectionCommentSettings, ModerationDecision, UserInfo } from \"../plugins/types.js\";\nimport { sendCommentNotification } from \"./notifications.js\";\nimport { createComment, type CommentHookRunner } from \"./service.js\";\n\nexport interface PublicCommentSubmissionRuntime {\n\tdb: Kysely<Database>;\n\tconfig: EmDashConfig;\n\temail: EmailPipeline | null;\n\thooks: HookPipeline;\n}\n\ninterface CommentableContentRow {\n\tid: string;\n\tslug: string;\n\tauthor_id: string | null;\n\tpublished_at: string | null;\n}\n\nfunction parseCommentModeration(value: string): CollectionCommentSettings[\"commentsModeration\"] {\n\tif (value === \"all\" || value === \"first_time\" || value === \"none\") return value;\n\treturn \"all\";\n}\n\nfunction isModerationDecision(value: unknown): value is ModerationDecision {\n\tif (typeof value !== \"object\" || value === null || !(\"status\" in value)) return false;\n\tif (value.status !== \"pending\" && value.status !== \"approved\" && value.status !== \"spam\") {\n\t\treturn false;\n\t}\n\treturn !(\"reason\" in value) || value.reason === undefined || typeof value.reason === \"string\";\n}\n\nexport async function submitPublicComment(\n\truntime: PublicCommentSubmissionRuntime,\n\tcollection: string,\n\tcontentId: string,\n\trequest: Request,\n\tuser?: UserInfo,\n): Promise<Response> {\n\ttry {\n\t\tconst body = await parseBody(request, createCommentBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst collectionRow = await runtime.db\n\t\t\t.selectFrom(\"_emdash_collections\")\n\t\t\t.select([\n\t\t\t\t\"comments_enabled\",\n\t\t\t\t\"comments_moderation\",\n\t\t\t\t\"comments_closed_after_days\",\n\t\t\t\t\"comments_auto_approve_users\",\n\t\t\t])\n\t\t\t.where(\"slug\", \"=\", collection)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!collectionRow) {\n\t\t\treturn apiError(\"NOT_FOUND\", `Collection '${collection}' not found`, 404);\n\t\t}\n\t\tif (!collectionRow.comments_enabled) {\n\t\t\treturn apiError(\"COMMENTS_DISABLED\", \"Comments are not enabled for this collection\", 403);\n\t\t}\n\n\t\tvalidateIdentifier(collection, \"collection\");\n\t\tconst contentResult = await sql<CommentableContentRow>`\n\t\t\tSELECT id, slug, author_id, published_at\n\t\t\tFROM ${sql.ref(`ec_${collection}`)}\n\t\t\tWHERE id = ${contentId}\n\t\t\tAND status = 'published'\n\t\t\tAND deleted_at IS NULL\n\t\t`.execute(runtime.db);\n\t\tconst contentRow = contentResult.rows[0];\n\n\t\tif (!contentRow) return apiError(\"NOT_FOUND\", \"Content not found\", 404);\n\n\t\tif (collectionRow.comments_closed_after_days > 0) {\n\t\t\tconst publishedAt = contentRow.published_at;\n\t\t\tif (publishedAt) {\n\t\t\t\tconst closedDate = new Date(publishedAt);\n\t\t\t\tclosedDate.setDate(closedDate.getDate() + collectionRow.comments_closed_after_days);\n\t\t\t\tif (new Date() > closedDate) {\n\t\t\t\t\treturn apiError(\"COMMENTS_CLOSED\", \"Comments are closed for this content\", 403);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (body.website_url) {\n\t\t\treturn apiSuccess({ status: \"pending\", message: \"Comment submitted for review\" });\n\t\t}\n\n\t\tconst meta = extractRequestMeta(request, runtime.config);\n\t\tconst { ipSalt } = await resolveSecretsCached(runtime.db);\n\t\tconst ipHash = meta.ip ? await hashIp(meta.ip, ipSalt) : \"unknown\";\n\t\tconst rateLimited = await checkRateLimit(\n\t\t\truntime.db,\n\t\t\tipHash,\n\t\t\tipHash === \"unknown\" ? 20 : undefined,\n\t\t);\n\t\tif (rateLimited) {\n\t\t\treturn apiError(\"RATE_LIMITED\", \"Too many comments. Please try again later.\", 429);\n\t\t}\n\n\t\tconst { getTurnstileSecretKey, verifyTurnstileToken } = await import(\"./turnstile.js\");\n\t\tconst turnstileSecretKey = getTurnstileSecretKey();\n\t\tif (\n\t\t\tturnstileSecretKey &&\n\t\t\t!(await verifyTurnstileToken(body.turnstileToken, turnstileSecretKey, meta.ip))\n\t\t) {\n\t\t\treturn apiError(\"TURNSTILE_FAILED\", \"CAPTCHA verification failed\", 403);\n\t\t}\n\n\t\tconst settings: CollectionCommentSettings = {\n\t\t\tcommentsEnabled: true,\n\t\t\tcommentsModeration: parseCommentModeration(collectionRow.comments_moderation),\n\t\t\tcommentsClosedAfterDays: collectionRow.comments_closed_after_days,\n\t\t\tcommentsAutoApproveUsers: collectionRow.comments_auto_approve_users === 1,\n\t\t};\n\n\t\tconst authorName = user?.name || body.authorName;\n\t\tconst authorEmail = user?.email ?? body.authorEmail;\n\t\tlet resolvedParentId = body.parentId ?? null;\n\t\tif (body.parentId) {\n\t\t\tconst parent = await new CommentRepository(runtime.db).findById(body.parentId);\n\t\t\tif (!parent) return apiError(\"VALIDATION_ERROR\", \"Parent comment not found\", 400);\n\t\t\tif (parent.collection !== collection || parent.contentId !== contentId) {\n\t\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Parent comment belongs to different content\", 400);\n\t\t\t}\n\t\t\tresolvedParentId = parent.parentId ?? parent.id;\n\t\t}\n\n\t\tlet contentAuthor: { id: string; name: string | null; email: string } | undefined;\n\t\tif (contentRow.author_id) {\n\t\t\tconst authorRow = await runtime.db\n\t\t\t\t.selectFrom(\"users\")\n\t\t\t\t.select([\"id\", \"name\", \"email\", \"email_verified\"])\n\t\t\t\t.where(\"id\", \"=\", contentRow.author_id)\n\t\t\t\t.executeTakeFirst();\n\t\t\tif (authorRow?.email_verified) {\n\t\t\t\tcontentAuthor = { id: authorRow.id, name: authorRow.name, email: authorRow.email };\n\t\t\t}\n\t\t}\n\n\t\tconst hookRunner: CommentHookRunner = {\n\t\t\trunBeforeCreate: (event) => runtime.hooks.runCommentBeforeCreate(event),\n\t\t\trunModerate: async (event) => {\n\t\t\t\tconst result = await runtime.hooks.invokeExclusiveHook(\"comment:moderate\", event);\n\t\t\t\tif (!result) return { status: \"pending\", reason: \"No moderator configured\" };\n\t\t\t\tif (result.error) {\n\t\t\t\t\tconsole.error(`[comments] Moderation error (${result.pluginId}):`, result.error.message);\n\t\t\t\t\treturn { status: \"pending\", reason: \"Moderation error\" };\n\t\t\t\t}\n\t\t\t\treturn isModerationDecision(result.result)\n\t\t\t\t\t? result.result\n\t\t\t\t\t: { status: \"pending\", reason: \"Invalid moderation result\" };\n\t\t\t},\n\t\t\tfireAfterCreate: (event) => {\n\t\t\t\tvoid runtime.hooks\n\t\t\t\t\t.runCommentAfterCreate(event)\n\t\t\t\t\t.catch((error) =>\n\t\t\t\t\t\tconsole.error(\n\t\t\t\t\t\t\t\"[comments] afterCreate error:\",\n\t\t\t\t\t\t\terror instanceof Error ? error.message : error,\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t},\n\t\t\tfireAfterModerate: (event) => {\n\t\t\t\tvoid runtime.hooks\n\t\t\t\t\t.runCommentAfterModerate(event)\n\t\t\t\t\t.catch((error) =>\n\t\t\t\t\t\tconsole.error(\n\t\t\t\t\t\t\t\"[comments] afterModerate error:\",\n\t\t\t\t\t\t\terror instanceof Error ? error.message : error,\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t},\n\t\t};\n\n\t\tconst result = await createComment(\n\t\t\truntime.db,\n\t\t\t{\n\t\t\t\tcollection,\n\t\t\t\tcontentId,\n\t\t\t\tparentId: resolvedParentId,\n\t\t\t\tauthorName,\n\t\t\t\tauthorEmail,\n\t\t\t\tauthorUserId: user?.id ?? null,\n\t\t\t\tbody: body.body,\n\t\t\t\tipHash,\n\t\t\t\tuserAgent: meta.userAgent,\n\t\t\t},\n\t\t\tsettings,\n\t\t\thookRunner,\n\t\t\t{\n\t\t\t\tid: contentRow.id,\n\t\t\t\tcollection,\n\t\t\t\tslug: contentRow.slug,\n\t\t\t\tauthor: contentAuthor,\n\t\t\t},\n\t\t);\n\n\t\tif (!result) return apiError(\"COMMENT_REJECTED\", \"Comment was rejected\", 403);\n\n\t\tif (result.comment.status === \"approved\" && runtime.email && contentAuthor) {\n\t\t\ttry {\n\t\t\t\tconst adminBaseUrl = await getSiteBaseUrl(runtime.db, request, runtime.config);\n\t\t\t\tawait sendCommentNotification({\n\t\t\t\t\temail: runtime.email,\n\t\t\t\t\tcomment: result.comment,\n\t\t\t\t\tcontentAuthor,\n\t\t\t\t\tadminBaseUrl,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\n\t\t\t\t\t\"[comments] notification error:\",\n\t\t\t\t\terror instanceof Error ? error.message : error,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tid: result.comment.id,\n\t\t\t\tstatus: result.comment.status,\n\t\t\t\tmessage:\n\t\t\t\t\tresult.comment.status === \"approved\"\n\t\t\t\t\t\t? \"Comment published\"\n\t\t\t\t\t\t: \"Comment submitted for review\",\n\t\t\t},\n\t\t\t201,\n\t\t);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to submit comment\", \"COMMENT_CREATE_ERROR\");\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,sBAAsB;AAC5B,MAAM,qBAAqB;AAC3B,MAAM,UAAU;;;;AAahB,SAAgB,8BACf,IACA,MACe;CACf,MAAM,QAAQ,KAAK,gBAAgB,GAAG,KAAK,WAAW;CACtD,MAAM,UAAU,mBAAmB,MAAM,GAAG,QAAQ,SAAS,IAAI;CAEjE,MAAM,UACL,KAAK,YAAY,SAAS,qBACvB,KAAK,YAAY,MAAM,GAAG,mBAAmB,GAAG,QAChD,KAAK;CAET,MAAM,WAAW,GAAG,KAAK,aAAa;AAgBtC,QAAO;EAAE;EAAI;EAAS,MAdT;GACZ,GAAG,KAAK,kBAAkB,iBAAiB,MAAM;GACjD;GACA;GACA;GACA,kBAAkB;GAClB,CAAC,KAAK,KAAK;EAQgB,MANf;GACZ,cAAc,WAAW,KAAK,kBAAkB,CAAC,gCAAgC,WAAW,MAAM,CAAC;GACnG,6FAA6F,WAAW,QAAQ,CAAC;GACjH,eAAe,WAAW,SAAS,CAAC;GACpC,CAAC,KAAK,KAAK;EAEsB;;;;;;;;;;;AAYnC,eAAsB,wBAAwB,QAYzB;CACpB,MAAM,EAAE,OAAO,SAAS,eAAe,iBAAiB;AAExD,KAAI,QAAQ,WAAW,WAAY,QAAO;AAC1C,KAAI,CAAC,eAAe,MAAO,QAAO;AAClC,KAAI,CAAC,MAAM,aAAa,CAAE,QAAO;AACjC,KAAI,QAAQ,YAAY,aAAa,KAAK,cAAc,MAAM,aAAa,CAAE,QAAO;CAEpF,MAAM,UAAU,8BAA8B,cAAc,OAAO;EAClE,mBAAmB,QAAQ;EAC3B,aAAa,QAAQ;EACrB,cAAc,OAAO,gBAAgB;EACrC,YAAY,QAAQ;EACpB;EACA,CAAC;AAEF,OAAM,MAAM,KAAK,SAAS,oBAAoB;AAC9C,QAAO;;;;;;;;AASR,eAAsB,oBACrB,IACA,YACA,WAIS;AACT,oBAAmB,YAAY,aAAa;CAE5C,MAAM,aAAa,MAAM,GACvB,WAAW,MAAM,aAAsB,CACvC,OAAO,CAAC,QAAiB,YAAqB,CAAC,CAC/C,MAAM,MAAe,KAAK,UAAmB,CAC7C,kBAAkB;AAEpB,KAAI,CAAC,WAAY,QAAO;CAExB,MAAM,QAAQ;CAEd,IAAI;AACJ,KAAI,MAAM,WAAW;EACpB,MAAM,UAAU,MAAM,GACpB,WAAW,QAAQ,CACnB,OAAO;GAAC;GAAM;GAAQ;GAAS;GAAiB,CAAC,CACjD,MAAM,MAAM,KAAK,MAAM,UAAU,CACjC,kBAAkB;AACpB,MAAI,WAAW,QAAQ,eACtB,UAAS;GAAE,IAAI,QAAQ;GAAI,OAAO,QAAQ;GAAO,MAAM,QAAQ;GAAM;;AAIvE,QAAO;EAAE,MAAM,MAAM;EAAM;EAAQ;;;;;AC7GpC,SAAS,uBAAuB,OAAgE;AAC/F,KAAI,UAAU,SAAS,UAAU,gBAAgB,UAAU,OAAQ,QAAO;AAC1E,QAAO;;AAGR,SAAS,qBAAqB,OAA6C;AAC1E,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,YAAY,OAAQ,QAAO;AAChF,KAAI,MAAM,WAAW,aAAa,MAAM,WAAW,cAAc,MAAM,WAAW,OACjF,QAAO;AAER,QAAO,EAAE,YAAY,UAAU,MAAM,WAAW,UAAa,OAAO,MAAM,WAAW;;AAGtF,eAAsB,oBACrB,SACA,YACA,WACA,SACA,MACoB;AACpB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,gBAAgB,MAAM,QAAQ,GAClC,WAAW,sBAAsB,CACjC,OAAO;GACP;GACA;GACA;GACA;GACA,CAAC,CACD,MAAM,QAAQ,KAAK,WAAW,CAC9B,kBAAkB;AAEpB,MAAI,CAAC,cACJ,QAAO,SAAS,aAAa,eAAe,WAAW,cAAc,IAAI;AAE1E,MAAI,CAAC,cAAc,iBAClB,QAAO,SAAS,qBAAqB,gDAAgD,IAAI;AAG1F,qBAAmB,YAAY,aAAa;EAQ5C,MAAM,cAPgB,MAAM,GAA0B;;UAE9C,IAAI,IAAI,MAAM,aAAa,CAAC;gBACtB,UAAU;;;IAGtB,QAAQ,QAAQ,GAAG,EACY,KAAK;AAEtC,MAAI,CAAC,WAAY,QAAO,SAAS,aAAa,qBAAqB,IAAI;AAEvE,MAAI,cAAc,6BAA6B,GAAG;GACjD,MAAM,cAAc,WAAW;AAC/B,OAAI,aAAa;IAChB,MAAM,aAAa,IAAI,KAAK,YAAY;AACxC,eAAW,QAAQ,WAAW,SAAS,GAAG,cAAc,2BAA2B;AACnF,wBAAI,IAAI,MAAM,GAAG,WAChB,QAAO,SAAS,mBAAmB,wCAAwC,IAAI;;;AAKlF,MAAI,KAAK,YACR,QAAO,WAAW;GAAE,QAAQ;GAAW,SAAS;GAAgC,CAAC;EAGlF,MAAM,OAAO,mBAAmB,SAAS,QAAQ,OAAO;EACxD,MAAM,EAAE,WAAW,MAAM,qBAAqB,QAAQ,GAAG;EACzD,MAAM,SAAS,KAAK,KAAK,MAAM,OAAO,KAAK,IAAI,OAAO,GAAG;AAMzD,MALoB,MAAM,eACzB,QAAQ,IACR,QACA,WAAW,YAAY,KAAK,OAC5B,CAEA,QAAO,SAAS,gBAAgB,8CAA8C,IAAI;EAGnF,MAAM,EAAE,uBAAuB,yBAAyB,MAAM,OAAO;EACrE,MAAM,qBAAqB,uBAAuB;AAClD,MACC,sBACA,CAAE,MAAM,qBAAqB,KAAK,gBAAgB,oBAAoB,KAAK,GAAG,CAE9E,QAAO,SAAS,oBAAoB,+BAA+B,IAAI;EAGxE,MAAM,WAAsC;GAC3C,iBAAiB;GACjB,oBAAoB,uBAAuB,cAAc,oBAAoB;GAC7E,yBAAyB,cAAc;GACvC,0BAA0B,cAAc,gCAAgC;GACxE;EAED,MAAM,aAAa,MAAM,QAAQ,KAAK;EACtC,MAAM,cAAc,MAAM,SAAS,KAAK;EACxC,IAAI,mBAAmB,KAAK,YAAY;AACxC,MAAI,KAAK,UAAU;GAClB,MAAM,SAAS,MAAM,IAAI,kBAAkB,QAAQ,GAAG,CAAC,SAAS,KAAK,SAAS;AAC9E,OAAI,CAAC,OAAQ,QAAO,SAAS,oBAAoB,4BAA4B,IAAI;AACjF,OAAI,OAAO,eAAe,cAAc,OAAO,cAAc,UAC5D,QAAO,SAAS,oBAAoB,+CAA+C,IAAI;AAExF,sBAAmB,OAAO,YAAY,OAAO;;EAG9C,IAAI;AACJ,MAAI,WAAW,WAAW;GACzB,MAAM,YAAY,MAAM,QAAQ,GAC9B,WAAW,QAAQ,CACnB,OAAO;IAAC;IAAM;IAAQ;IAAS;IAAiB,CAAC,CACjD,MAAM,MAAM,KAAK,WAAW,UAAU,CACtC,kBAAkB;AACpB,OAAI,WAAW,eACd,iBAAgB;IAAE,IAAI,UAAU;IAAI,MAAM,UAAU;IAAM,OAAO,UAAU;IAAO;;EAuCpF,MAAM,SAAS,MAAM,cACpB,QAAQ,IACR;GACC;GACA;GACA,UAAU;GACV;GACA;GACA,cAAc,MAAM,MAAM;GAC1B,MAAM,KAAK;GACX;GACA,WAAW,KAAK;GAChB,EACD,UAhDqC;GACrC,kBAAkB,UAAU,QAAQ,MAAM,uBAAuB,MAAM;GACvE,aAAa,OAAO,UAAU;IAC7B,MAAM,SAAS,MAAM,QAAQ,MAAM,oBAAoB,oBAAoB,MAAM;AACjF,QAAI,CAAC,OAAQ,QAAO;KAAE,QAAQ;KAAW,QAAQ;KAA2B;AAC5E,QAAI,OAAO,OAAO;AACjB,aAAQ,MAAM,gCAAgC,OAAO,SAAS,KAAK,OAAO,MAAM,QAAQ;AACxF,YAAO;MAAE,QAAQ;MAAW,QAAQ;MAAoB;;AAEzD,WAAO,qBAAqB,OAAO,OAAO,GACvC,OAAO,SACP;KAAE,QAAQ;KAAW,QAAQ;KAA6B;;GAE9D,kBAAkB,UAAU;AAC3B,IAAK,QAAQ,MACX,sBAAsB,MAAM,CAC5B,OAAO,UACP,QAAQ,MACP,iCACA,iBAAiB,QAAQ,MAAM,UAAU,MACzC,CACD;;GAEH,oBAAoB,UAAU;AAC7B,IAAK,QAAQ,MACX,wBAAwB,MAAM,CAC9B,OAAO,UACP,QAAQ,MACP,mCACA,iBAAiB,QAAQ,MAAM,UAAU,MACzC,CACD;;GAEH,EAiBA;GACC,IAAI,WAAW;GACf;GACA,MAAM,WAAW;GACjB,QAAQ;GACR,CACD;AAED,MAAI,CAAC,OAAQ,QAAO,SAAS,oBAAoB,wBAAwB,IAAI;AAE7E,MAAI,OAAO,QAAQ,WAAW,cAAc,QAAQ,SAAS,cAC5D,KAAI;GACH,MAAM,eAAe,MAAM,eAAe,QAAQ,IAAI,SAAS,QAAQ,OAAO;AAC9E,SAAM,wBAAwB;IAC7B,OAAO,QAAQ;IACf,SAAS,OAAO;IAChB;IACA;IACA,CAAC;WACM,OAAO;AACf,WAAQ,MACP,kCACA,iBAAiB,QAAQ,MAAM,UAAU,MACzC;;AAIH,SAAO,WACN;GACC,IAAI,OAAO,QAAQ;GACnB,QAAQ,OAAO,QAAQ;GACvB,SACC,OAAO,QAAQ,WAAW,aACvB,sBACA;GACJ,EACD,IACA;UACO,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}

package/dist/public-url-BWVHsfQv.mjs

@@ -0,0 +1,101 @@
+//#region src/api/public-url.ts
+/**
+* Resolve siteUrl from runtime environment variables.
+*
+* Uses process.env (not import.meta.env) because Vite statically replaces
+* import.meta.env at build time, baking out any env vars not present during
+* the build. Container deployments set env vars at runtime, so we must read
+* process.env which Vite leaves untouched.
+*
+* On Cloudflare Workers process.env is empty by default, so the fallback
+* chain continues to url.origin — unless the Worker enables the
+* `nodejs_compat_populate_process_env` compatibility flag, in which case
+* `vars`/secrets (e.g. EMDASH_SITE_URL) are readable here too.
+*
+* Caches after first call.
+*/
+let _envSiteUrl = null;
+function getEnvSiteUrl() {
+	if (_envSiteUrl !== null) return _envSiteUrl || void 0;
+	try {
+		const value = typeof process !== "undefined" && process.env?.EMDASH_SITE_URL || typeof process !== "undefined" && process.env?.SITE_URL || "";
+		if (value) {
+			const parsed = new URL(value);
+			if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+				_envSiteUrl = "";
+				return;
+			}
+			_envSiteUrl = parsed.origin;
+		} else _envSiteUrl = "";
+	} catch {
+		_envSiteUrl = "";
+	}
+	return _envSiteUrl || void 0;
+}
+/**
+* Return the public-facing origin for the site.
+*
+* Resolution order:
+*   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
+*   2. `EMDASH_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)
+*   3. `url.origin` (internal request URL — correct when no proxy)
+*
+* @param url  The request URL (`new URL(request.url)` or `Astro.url`)
+* @param config  The EmDash config (from `locals.emdash?.config`)
+* @returns Origin string, e.g. `"https://mysite.example.com"`
+*/
+function getPublicOrigin(url, config) {
+	return getConfiguredOrigin(config) || url.origin;
+}
+/**
+* Return the operator-configured public origin, if any.
+*
+* The first two steps of {@link getPublicOrigin}'s resolution —
+* `config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars — without
+* the request-URL fallback. For callers that have a more trustworthy fallback
+* than the request (e.g. the stored setup origin used for outbound emails).
+*/
+function getConfiguredOrigin(config) {
+	return config?.siteUrl || getEnvSiteUrl() || void 0;
+}
+/**
+* Resolve additional accepted passkey origins from runtime environment.
+*
+* Reads `EMDASH_ALLOWED_ORIGINS` (comma-separated list of origins) for
+* multi-origin deployments where the same RP is reachable under several
+* hostnames sharing the registrable parent domain (e.g. apex + preview).
+*
+* Each entry is parsed via `new URL()` and reduced to its `origin`. Unlike
+* `getEnvSiteUrl` (which silently falls back to `url.origin` on bad input),
+* this throws on any unparseable or non-http(s) entry — `EMDASH_ALLOWED_ORIGINS`
+* is an allowlist for passkey verification, so silently dropping a typo would
+* surface as "I can't authenticate on this origin" with no diagnostic. Fail
+* loud at first read.
+*
+* Uses `process.env` (Vite leaves it untouched at runtime). Result is cached
+* on success.
+*/
+let _envAllowedOrigins = null;
+function getEnvAllowedOrigins() {
+	if (_envAllowedOrigins !== null) return _envAllowedOrigins;
+	const raw = typeof process !== "undefined" ? process.env?.EMDASH_ALLOWED_ORIGINS || "" : "";
+	const parsed = [];
+	for (const entry of raw.split(",")) {
+		const trimmed = entry.trim();
+		if (!trimmed) continue;
+		let u;
+		try {
+			u = new URL(trimmed);
+		} catch (e) {
+			throw new Error(`EmDash config error in EMDASH_ALLOWED_ORIGINS: invalid URL: "${trimmed}"`, { cause: e });
+		}
+		if (u.protocol !== "http:" && u.protocol !== "https:") throw new Error(`EmDash config error in EMDASH_ALLOWED_ORIGINS: origin must be http or https: "${trimmed}" (got ${u.protocol})`);
+		parsed.push(u.origin);
+	}
+	_envAllowedOrigins = parsed;
+	return parsed;
+}
+
+//#endregion
+export { getEnvAllowedOrigins as n, getPublicOrigin as r, getConfiguredOrigin as t };
+//# sourceMappingURL=public-url-BWVHsfQv.mjs.map

package/dist/public-url-BWVHsfQv.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-url-BWVHsfQv.mjs","names":[],"sources":["../src/api/public-url.ts"],"sourcesContent":["/**\n * Public URL helpers for reverse-proxy deployments.\n *\n * Behind a TLS-terminating proxy the internal request URL\n * (`http://localhost:4321`) differs from the browser-facing origin\n * (`https://mysite.example.com`). These pure helpers resolve the\n * correct public origin from config, falling back to the request URL.\n *\n * Workers-safe: no Node.js imports.\n */\n\n/** Minimal config shape — avoids importing the full EmDashConfig type tree. */\nexport interface SiteUrlConfig {\n\tsiteUrl?: string;\n}\n\n/**\n * Resolve siteUrl from runtime environment variables.\n *\n * Uses process.env (not import.meta.env) because Vite statically replaces\n * import.meta.env at build time, baking out any env vars not present during\n * the build. Container deployments set env vars at runtime, so we must read\n * process.env which Vite leaves untouched.\n *\n * On Cloudflare Workers process.env is empty by default, so the fallback\n * chain continues to url.origin — unless the Worker enables the\n * `nodejs_compat_populate_process_env` compatibility flag, in which case\n * `vars`/secrets (e.g. EMDASH_SITE_URL) are readable here too.\n *\n * Caches after first call.\n */\nlet _envSiteUrl: string | undefined | null = null;\n\n/** @internal Reset cached env values — test-only. */\nexport function _resetEnvCache(): void {\n\t_envSiteUrl = null;\n\t_envAllowedOrigins = null;\n}\n\nfunction getEnvSiteUrl(): string | undefined {\n\tif (_envSiteUrl !== null) return _envSiteUrl || undefined;\n\ttry {\n\t\t// process.env is available on Node.js; undefined on Workers\n\t\tconst value =\n\t\t\t(typeof process !== \"undefined\" && process.env?.EMDASH_SITE_URL) ||\n\t\t\t(typeof process !== \"undefined\" && process.env?.SITE_URL) ||\n\t\t\t\"\";\n\t\tif (value) {\n\t\t\tconst parsed = new URL(value);\n\t\t\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\t\t\t_envSiteUrl = \"\";\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t_envSiteUrl = parsed.origin;\n\t\t} else {\n\t\t\t_envSiteUrl = \"\";\n\t\t}\n\t} catch {\n\t\t_envSiteUrl = \"\";\n\t}\n\treturn _envSiteUrl || undefined;\n}\n\n/**\n * Return the public-facing origin for the site.\n *\n * Resolution order:\n *   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)\n *   2. `EMDASH_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)\n *   3. `url.origin` (internal request URL — correct when no proxy)\n *\n * @param url  The request URL (`new URL(request.url)` or `Astro.url`)\n * @param config  The EmDash config (from `locals.emdash?.config`)\n * @returns Origin string, e.g. `\"https://mysite.example.com\"`\n */\nexport function getPublicOrigin(url: URL, config?: SiteUrlConfig): string {\n\treturn getConfiguredOrigin(config) || url.origin;\n}\n\n/**\n * Return the operator-configured public origin, if any.\n *\n * The first two steps of {@link getPublicOrigin}'s resolution —\n * `config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars — without\n * the request-URL fallback. For callers that have a more trustworthy fallback\n * than the request (e.g. the stored setup origin used for outbound emails).\n */\nexport function getConfiguredOrigin(config?: SiteUrlConfig): string | undefined {\n\treturn config?.siteUrl || getEnvSiteUrl() || undefined;\n}\n\n/**\n * Resolve additional accepted passkey origins from runtime environment.\n *\n * Reads `EMDASH_ALLOWED_ORIGINS` (comma-separated list of origins) for\n * multi-origin deployments where the same RP is reachable under several\n * hostnames sharing the registrable parent domain (e.g. apex + preview).\n *\n * Each entry is parsed via `new URL()` and reduced to its `origin`. Unlike\n * `getEnvSiteUrl` (which silently falls back to `url.origin` on bad input),\n * this throws on any unparseable or non-http(s) entry — `EMDASH_ALLOWED_ORIGINS`\n * is an allowlist for passkey verification, so silently dropping a typo would\n * surface as \"I can't authenticate on this origin\" with no diagnostic. Fail\n * loud at first read.\n *\n * Uses `process.env` (Vite leaves it untouched at runtime). Result is cached\n * on success.\n */\nlet _envAllowedOrigins: string[] | null = null;\n\nexport function getEnvAllowedOrigins(): string[] {\n\tif (_envAllowedOrigins !== null) return _envAllowedOrigins;\n\tconst raw = typeof process !== \"undefined\" ? process.env?.EMDASH_ALLOWED_ORIGINS || \"\" : \"\";\n\tconst parsed: string[] = [];\n\tfor (const entry of raw.split(\",\")) {\n\t\tconst trimmed = entry.trim();\n\t\tif (!trimmed) continue;\n\t\tlet u: URL;\n\t\ttry {\n\t\t\tu = new URL(trimmed);\n\t\t} catch (e) {\n\t\t\tthrow new Error(`EmDash config error in EMDASH_ALLOWED_ORIGINS: invalid URL: \"${trimmed}\"`, {\n\t\t\t\tcause: e,\n\t\t\t});\n\t\t}\n\t\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") {\n\t\t\tthrow new Error(\n\t\t\t\t`EmDash config error in EMDASH_ALLOWED_ORIGINS: origin must be http or https: \"${trimmed}\" (got ${u.protocol})`,\n\t\t\t);\n\t\t}\n\t\tparsed.push(u.origin);\n\t}\n\t_envAllowedOrigins = parsed;\n\treturn parsed;\n}\n\n/**\n * Build a full public URL by appending a path to the public origin.\n *\n * @param url  The request URL\n * @param config  The EmDash config\n * @param path  Path to append (must start with `/`)\n * @returns Full URL string, e.g. `\"https://mysite.example.com/_emdash/admin/login\"`\n */\nexport function getPublicUrl(url: URL, config: SiteUrlConfig | undefined, path: string): string {\n\treturn `${getPublicOrigin(url, config)}${path}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,IAAI,cAAyC;AAQ7C,SAAS,gBAAoC;AAC5C,KAAI,gBAAgB,KAAM,QAAO,eAAe;AAChD,KAAI;EAEH,MAAM,QACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,mBAC/C,OAAO,YAAY,eAAe,QAAQ,KAAK,YAChD;AACD,MAAI,OAAO;GACV,MAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,OAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAChE,kBAAc;AACd;;AAED,iBAAc,OAAO;QAErB,eAAc;SAER;AACP,gBAAc;;AAEf,QAAO,eAAe;;;;;;;;;;;;;;AAevB,SAAgB,gBAAgB,KAAU,QAAgC;AACzE,QAAO,oBAAoB,OAAO,IAAI,IAAI;;;;;;;;;;AAW3C,SAAgB,oBAAoB,QAA4C;AAC/E,QAAO,QAAQ,WAAW,eAAe,IAAI;;;;;;;;;;;;;;;;;;;AAoB9C,IAAI,qBAAsC;AAE1C,SAAgB,uBAAiC;AAChD,KAAI,uBAAuB,KAAM,QAAO;CACxC,MAAM,MAAM,OAAO,YAAY,cAAc,QAAQ,KAAK,0BAA0B,KAAK;CACzF,MAAM,SAAmB,EAAE;AAC3B,MAAK,MAAM,SAAS,IAAI,MAAM,IAAI,EAAE;EACnC,MAAM,UAAU,MAAM,MAAM;AAC5B,MAAI,CAAC,QAAS;EACd,IAAI;AACJ,MAAI;AACH,OAAI,IAAI,IAAI,QAAQ;WACZ,GAAG;AACX,SAAM,IAAI,MAAM,gEAAgE,QAAQ,IAAI,EAC3F,OAAO,GACP,CAAC;;AAEH,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAC5C,OAAM,IAAI,MACT,iFAAiF,QAAQ,SAAS,EAAE,SAAS,GAC7G;AAEF,SAAO,KAAK,EAAE,OAAO;;AAEtB,sBAAqB;AACrB,QAAO"}