emdash 0.37.0 → 0.39.0

package/dist/redirect-D2Yo-b6S.mjs

@@ -0,0 +1,415 @@
+import { l as isPostgres, o as currentTimestampValue } from "./dialect-helpers-CtYdsX4W.mjs";
+import { o as decodeCursor, s as encodeCursor } from "./types-BkUg2yHx.mjs";
+import { t as interpolateUrlPattern } from "./resolve-BJIS8wKr.mjs";
+import { i as matchPattern, n as interpolateDestination, r as isPattern, t as compilePattern } from "./patterns-Do3iqi7N.mjs";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+
+//#region src/database/repositories/redirect.ts
+/**
+* Hard cap on rows stored in `_emdash_404_log`. When exceeded, the oldest
+* rows (by `last_seen_at`) are evicted on insert. Prevents an unauthenticated
+* attacker from growing the table without bound by requesting unique URLs.
+*/
+const MAX_404_LOG_ROWS = 1e4;
+/** Max stored length for the `Referer` header — truncated on insert. */
+const REFERRER_MAX_LENGTH = 512;
+/** Max stored length for the `User-Agent` header — truncated on insert. */
+const USER_AGENT_MAX_LENGTH = 256;
+/** Pattern to escape LIKE wildcards: %, _, and backslash */
+const LIKE_ESCAPE_RE = /[\\%_]/g;
+/**
+* Truncate a header-derived string to `max` chars, preserving `null`/`undefined`
+* as `null`. Empty strings stay empty (the caller decides whether to coerce).
+*/
+function truncateOrNull(value, max) {
+	if (value === null || value === void 0) return null;
+	return value.length > max ? value.slice(0, max) : value;
+}
+var RedirectWriteBusyError = class extends Error {
+	name = "RedirectWriteBusyError";
+};
+const REDIRECT_WRITE_LOCK_ID = 1;
+const REDIRECT_WRITE_LEASE_MS = 3e4;
+const REDIRECT_WRITE_LOCK_ATTEMPTS = 5;
+const POSTGRES_REDIRECT_LOCK_KEY = 1168624763;
+function rowToRedirect(row) {
+	return {
+		id: row.id,
+		source: row.source,
+		destination: row.destination,
+		type: row.type,
+		isPattern: row.is_pattern === 1,
+		enabled: row.enabled === 1,
+		hits: row.hits,
+		lastHitAt: row.last_hit_at,
+		groupName: row.group_name,
+		auto: row.auto === 1,
+		createdAt: row.created_at,
+		updatedAt: row.updated_at
+	};
+}
+var RedirectRepository = class RedirectRepository {
+	constructor(db) {
+		this.db = db;
+	}
+	async findById(id) {
+		return (await this.findVersionedById(id))?.redirect ?? null;
+	}
+	async findVersionedById(id) {
+		const row = await this.db.selectFrom("_emdash_redirects").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? {
+			redirect: rowToRedirect(row),
+			configRevision: row.config_revision
+		} : null;
+	}
+	async findBySource(source) {
+		const row = await this.db.selectFrom("_emdash_redirects").selectAll().where("source", "=", source).executeTakeFirst();
+		return row ? rowToRedirect(row) : null;
+	}
+	async findConfigRevision(id) {
+		return (await this.db.selectFrom("_emdash_redirects").select("config_revision").where("id", "=", id).executeTakeFirst())?.config_revision ?? null;
+	}
+	async withWriteLock(action) {
+		if (isPostgres(this.db)) {
+			if (this.db.isTransaction) {
+				await sql`SELECT pg_advisory_xact_lock(${POSTGRES_REDIRECT_LOCK_KEY})`.execute(this.db);
+				return this.withLease(action);
+			}
+			return this.db.transaction().execute(async (transaction) => {
+				await sql`SELECT pg_advisory_xact_lock(${POSTGRES_REDIRECT_LOCK_KEY})`.execute(transaction);
+				return new RedirectRepository(transaction).withLease(action);
+			});
+		}
+		return this.withLease(action);
+	}
+	async withLease(action) {
+		const token = ulid();
+		let fence;
+		for (let attempt = 0; attempt < REDIRECT_WRITE_LOCK_ATTEMPTS; attempt++) {
+			const now = Date.now();
+			const result = await this.db.updateTable("_emdash_redirect_write_lock").set({
+				token,
+				expires_at: now + REDIRECT_WRITE_LEASE_MS,
+				generation: sql`generation + 1`
+			}).where("id", "=", REDIRECT_WRITE_LOCK_ID).where((eb) => eb.or([eb("token", "=", ""), eb("expires_at", "<", now)])).returning("generation").executeTakeFirst();
+			if (result) {
+				fence = {
+					token,
+					generation: result.generation
+				};
+				break;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 10 * 2 ** attempt));
+		}
+		if (!fence) throw new RedirectWriteBusyError("Another redirect change is in progress");
+		try {
+			return await action(fence, this);
+		} finally {
+			try {
+				await this.db.updateTable("_emdash_redirect_write_lock").set({
+					token: "",
+					expires_at: 0
+				}).where("id", "=", REDIRECT_WRITE_LOCK_ID).where("token", "=", token).execute();
+			} catch (error) {
+				console.error("Failed to release redirect write lock:", error);
+			}
+		}
+	}
+	async findMany(opts) {
+		const limit = Math.min(Math.max(opts.limit ?? 50, 1), 100);
+		let query = this.db.selectFrom("_emdash_redirects").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (opts.search) {
+			const term = `%${opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\${c}`)}%`;
+			query = query.where((eb) => eb.or([sql`source LIKE ${term} ESCAPE '\\'`, sql`destination LIKE ${term} ESCAPE '\\'`]));
+		}
+		if (opts.group !== void 0) query = query.where("group_name", "=", opts.group);
+		if (opts.enabled !== void 0) query = query.where("enabled", "=", opts.enabled ? 1 : 0);
+		if (opts.auto !== void 0) query = query.where("auto", "=", opts.auto ? 1 : 0);
+		if (opts.cursor) {
+			const decoded = decodeCursor(opts.cursor);
+			query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		const rows = await query.execute();
+		const items = rows.slice(0, limit).map(rowToRedirect);
+		const result = { items };
+		if (rows.length > limit) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+	async create(input, fence) {
+		if (!fence) return this.withWriteLock((currentFence, repository) => repository.create(input, currentFence));
+		const id = ulid();
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const patternFlag = input.isPattern ?? isPattern(input.source);
+		await this.db.insertInto("_emdash_redirects").values({
+			id,
+			source: input.source,
+			destination: input.destination,
+			type: input.type ?? 301,
+			is_pattern: patternFlag ? 1 : 0,
+			enabled: input.enabled !== false ? 1 : 0,
+			hits: 0,
+			last_hit_at: null,
+			group_name: input.groupName ?? null,
+			auto: input.auto ? 1 : 0,
+			config_revision: ulid(),
+			source_guard: 1,
+			write_generation: fence?.generation ?? 0,
+			created_at: now,
+			updated_at: now
+		}).execute();
+		return await this.findById(id);
+	}
+	async update(id, input, expectedRevision, fence) {
+		if (!fence) return this.withWriteLock((currentFence, repository) => repository.update(id, input, expectedRevision, currentFence));
+		const existing = await this.findById(id);
+		if (!existing) return null;
+		const values = {
+			updated_at: new Date(Math.max(Date.now(), new Date(existing.updatedAt).getTime() + 1)).toISOString(),
+			config_revision: ulid()
+		};
+		if (fence) values.write_generation = fence.generation;
+		if (input.source !== void 0) {
+			values.source = input.source;
+			values.source_guard = 1;
+			values.is_pattern = input.isPattern !== void 0 ? input.isPattern ? 1 : 0 : isPattern(input.source) ? 1 : 0;
+		} else if (input.isPattern !== void 0) values.is_pattern = input.isPattern ? 1 : 0;
+		if (input.destination !== void 0) values.destination = input.destination;
+		if (input.type !== void 0) values.type = input.type;
+		if (input.enabled !== void 0) values.enabled = input.enabled ? 1 : 0;
+		if (input.groupName !== void 0) values.group_name = input.groupName;
+		let query = this.db.updateTable("_emdash_redirects").set(values).where("id", "=", id);
+		if (expectedRevision !== void 0) query = query.where("config_revision", "=", expectedRevision);
+		if (fence) query = query.where((eb) => eb.exists(eb.selectFrom("_emdash_redirect_write_lock").select("id").where("id", "=", REDIRECT_WRITE_LOCK_ID).where("token", "=", fence.token).where("generation", "=", fence.generation)));
+		const result = await query.executeTakeFirst();
+		if (BigInt(result.numUpdatedRows) === 0n) return null;
+		return await this.findById(id);
+	}
+	async delete(id, expectedRevision, fence) {
+		if (!fence) return this.withWriteLock((currentFence, repository) => repository.delete(id, expectedRevision, currentFence));
+		let query = this.db.deleteFrom("_emdash_redirects").where("id", "=", id);
+		if (expectedRevision !== void 0) query = query.where("config_revision", "=", expectedRevision);
+		if (fence) query = query.where((eb) => eb.exists(eb.selectFrom("_emdash_redirect_write_lock").select("id").where("id", "=", REDIRECT_WRITE_LOCK_ID).where("token", "=", fence.token).where("generation", "=", fence.generation)));
+		const result = await query.executeTakeFirst();
+		return BigInt(result.numDeletedRows) > 0n;
+	}
+	/**
+	* Fetch all enabled redirects (for loop detection graph building).
+	* Not paginated — returns the full set.
+	*/
+	async findAllEnabled() {
+		return (await this.db.selectFrom("_emdash_redirects").selectAll().where("enabled", "=", 1).execute()).map(rowToRedirect);
+	}
+	async findExactMatch(path) {
+		const row = await this.db.selectFrom("_emdash_redirects").selectAll().where("source", "=", path).where("enabled", "=", 1).where("is_pattern", "=", 0).executeTakeFirst();
+		return row ? rowToRedirect(row) : null;
+	}
+	async findEnabledPatternRules() {
+		return (await this.db.selectFrom("_emdash_redirects").selectAll().where("enabled", "=", 1).where("is_pattern", "=", 1).execute()).map(rowToRedirect);
+	}
+	/**
+	* Match a request path against all enabled redirect rules.
+	* Checks exact matches first (indexed), then pattern rules.
+	* Returns the matched redirect and the resolved destination URL.
+	*/
+	async matchPath(path) {
+		const exact = await this.findExactMatch(path);
+		if (exact) return {
+			redirect: exact,
+			resolvedDestination: exact.destination
+		};
+		const patterns = await this.findEnabledPatternRules();
+		for (const redirect of patterns) {
+			const params = matchPattern(compilePattern(redirect.source), path);
+			if (params) return {
+				redirect,
+				resolvedDestination: interpolateDestination(redirect.destination, params)
+			};
+		}
+		return null;
+	}
+	async recordHit(id) {
+		await sql`
+			UPDATE _emdash_redirects
+			SET hits = hits + 1, last_hit_at = ${currentTimestampValue(this.db)}, updated_at = ${currentTimestampValue(this.db)}
+			WHERE id = ${id}
+		`.execute(this.db);
+	}
+	/**
+	* Create an auto-redirect when a content slug changes.
+	* Uses the collection's URL pattern to compute old/new URLs.
+	* Collapses existing redirect chains pointing to the old URL and
+	* removes redirects that would shadow the now-live new URL, so a
+	* rename that is later reverted cannot form a loop (#1986).
+	*
+	* Returns null when old and new URL are identical (nothing to redirect).
+	*/
+	async createAutoRedirect(collection, oldSlug, newSlug, contentId, urlPattern, oldPublishedAt, newPublishedAt) {
+		return this.withWriteLock(async (fence, repository) => {
+			const oldUrl = interpolateUrlPattern({
+				pattern: urlPattern,
+				collection,
+				slug: oldSlug,
+				id: contentId,
+				date: oldPublishedAt
+			});
+			const newUrl = interpolateUrlPattern({
+				pattern: urlPattern,
+				collection,
+				slug: newSlug,
+				id: contentId,
+				date: newPublishedAt
+			});
+			if (oldUrl === newUrl) return null;
+			await repository.db.deleteFrom("_emdash_redirects").where("source", "=", newUrl).where((eb) => eb.exists(eb.selectFrom("_emdash_redirect_write_lock").select("id").where("id", "=", REDIRECT_WRITE_LOCK_ID).where("token", "=", fence.token).where("generation", "=", fence.generation))).execute();
+			await repository.collapseChains(oldUrl, newUrl, fence);
+			const existing = await repository.findBySource(oldUrl);
+			if (existing) return await repository.update(existing.id, { destination: newUrl }, void 0, fence);
+			return repository.create({
+				source: oldUrl,
+				destination: newUrl,
+				type: 301,
+				isPattern: false,
+				auto: true,
+				groupName: "Auto: slug change"
+			}, fence);
+		});
+	}
+	/**
+	* Update all redirects whose destination matches oldDestination
+	* to point to newDestination instead. Prevents redirect chains.
+	* Returns the number of updated rows.
+	*/
+	async collapseChains(oldDestination, newDestination, fence) {
+		if (!fence) return this.withWriteLock((currentFence, repository) => repository.collapseChains(oldDestination, newDestination, currentFence));
+		let query = this.db.updateTable("_emdash_redirects").set({
+			destination: newDestination,
+			updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+			config_revision: ulid(),
+			...fence ? { write_generation: fence.generation } : {}
+		}).where("destination", "=", oldDestination);
+		if (fence) query = query.where((eb) => eb.exists(eb.selectFrom("_emdash_redirect_write_lock").select("id").where("id", "=", REDIRECT_WRITE_LOCK_ID).where("token", "=", fence.token).where("generation", "=", fence.generation)));
+		const result = await query.executeTakeFirst();
+		return Number(result.numUpdatedRows);
+	}
+	/**
+	* Record a 404 hit for `entry.path`.
+	*
+	* Dedups by path: repeat hits increment `hits` and refresh `last_seen_at`
+	* on the existing row instead of inserting a new one. Referrer and
+	* user-agent are truncated to bounded lengths so a malicious client can't
+	* blow up storage with huge headers. When the table would exceed
+	* MAX_404_LOG_ROWS, the oldest entries (by `last_seen_at`) are evicted.
+	*
+	* This is called from the public redirect middleware on every 404 and
+	* must never throw for an unauthenticated caller — failures bubble up to
+	* the middleware, which swallows them.
+	*/
+	async log404(entry) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const referrer = truncateOrNull(entry.referrer, REFERRER_MAX_LENGTH);
+		const userAgent = truncateOrNull(entry.userAgent, USER_AGENT_MAX_LENGTH);
+		const ip = entry.ip ?? null;
+		const id = ulid();
+		if ((await this.db.insertInto("_emdash_404_log").values({
+			id,
+			path: entry.path,
+			referrer,
+			user_agent: userAgent,
+			ip,
+			hits: 1,
+			last_seen_at: now,
+			created_at: now
+		}).onConflict((oc) => oc.column("path").doUpdateSet({
+			hits: sql`${sql.ref("_emdash_404_log.hits")} + 1`,
+			last_seen_at: now,
+			referrer,
+			user_agent: userAgent,
+			ip
+		})).returning("id").executeTakeFirst())?.id !== id) return;
+		await this.enforce404Cap();
+	}
+	/**
+	* Delete the oldest rows from `_emdash_404_log` if the row count exceeds
+	* MAX_404_LOG_ROWS. "Oldest" is by `last_seen_at`, so a path that keeps
+	* getting hit stays in the table even if it was first seen long ago.
+	*
+	* Private — called by `log404` only after a new path was inserted.
+	*/
+	async enforce404Cap() {
+		const countRow = await this.db.selectFrom("_emdash_404_log").select((eb) => eb.fn.countAll().as("c")).executeTakeFirst();
+		const count = Number(countRow?.c ?? 0);
+		if (count <= MAX_404_LOG_ROWS) return;
+		const excess = count - MAX_404_LOG_ROWS;
+		await this.db.deleteFrom("_emdash_404_log").where("id", "in", this.db.selectFrom("_emdash_404_log").select("id").orderBy("last_seen_at", "asc").orderBy("id", "asc").limit(excess)).execute();
+	}
+	async find404s(opts) {
+		const limit = Math.min(Math.max(opts.limit ?? 50, 1), 100);
+		let query = this.db.selectFrom("_emdash_404_log").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (opts.search) {
+			const term = `%${opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\${c}`)}%`;
+			query = query.where(sql`path LIKE ${term} ESCAPE '\\'`);
+		}
+		if (opts.cursor) {
+			const decoded = decodeCursor(opts.cursor);
+			query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		const rows = await query.execute();
+		const items = rows.slice(0, limit).map((row) => ({
+			id: row.id,
+			path: row.path,
+			referrer: row.referrer,
+			userAgent: row.user_agent,
+			ip: row.ip,
+			createdAt: row.created_at
+		}));
+		const result = { items };
+		if (rows.length > limit) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+	async get404Summary(limit = 50) {
+		return (await sql`
+			SELECT
+				path,
+				SUM(hits) as count,
+				MAX(last_seen_at) as last_seen,
+				(
+					SELECT referrer FROM _emdash_404_log AS inner_log
+					WHERE inner_log.path = _emdash_404_log.path
+						AND referrer IS NOT NULL AND referrer != ''
+					LIMIT 1
+				) as top_referrer
+			FROM _emdash_404_log
+			GROUP BY path
+			ORDER BY count DESC
+			LIMIT ${limit}
+		`.execute(this.db)).rows.map((row) => ({
+			path: row.path,
+			count: Number(row.count),
+			lastSeen: row.last_seen,
+			topReferrer: row.top_referrer
+		}));
+	}
+	async delete404(id) {
+		const result = await this.db.deleteFrom("_emdash_404_log").where("id", "=", id).executeTakeFirst();
+		return BigInt(result.numDeletedRows) > 0n;
+	}
+	async clear404s() {
+		const result = await this.db.deleteFrom("_emdash_404_log").executeTakeFirst();
+		return Number(result.numDeletedRows);
+	}
+	async prune404s(olderThan) {
+		const result = await this.db.deleteFrom("_emdash_404_log").where("created_at", "<", olderThan).executeTakeFirst();
+		return Number(result.numDeletedRows);
+	}
+};
+
+//#endregion
+export { RedirectWriteBusyError as n, RedirectRepository as t };
+//# sourceMappingURL=redirect-D2Yo-b6S.mjs.map

package/dist/redirect-D2Yo-b6S.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-D2Yo-b6S.mjs","names":[],"sources":["../src/database/repositories/redirect.ts"],"sourcesContent":["import { sql, type Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { interpolateUrlPattern } from \"../../i18n/resolve.js\";\nimport {\n\tcompilePattern,\n\tmatchPattern,\n\tinterpolateDestination,\n\tisPattern,\n} from \"../../redirects/patterns.js\";\nimport { currentTimestampValue, isPostgres } from \"../dialect-helpers.js\";\nimport type { Database, RedirectTable } from \"../types.js\";\nimport { encodeCursor, decodeCursor, type FindManyResult } from \"./types.js\";\n\n// ---------------------------------------------------------------------------\n// Bounded 404 logging\n// ---------------------------------------------------------------------------\n\n/**\n * Hard cap on rows stored in `_emdash_404_log`. When exceeded, the oldest\n * rows (by `last_seen_at`) are evicted on insert. Prevents an unauthenticated\n * attacker from growing the table without bound by requesting unique URLs.\n */\nexport const MAX_404_LOG_ROWS = 10_000;\n\n/** Max stored length for the `Referer` header — truncated on insert. */\nexport const REFERRER_MAX_LENGTH = 512;\n\n/** Max stored length for the `User-Agent` header — truncated on insert. */\nexport const USER_AGENT_MAX_LENGTH = 256;\n\n/** Pattern to escape LIKE wildcards: %, _, and backslash */\nconst LIKE_ESCAPE_RE = /[\\\\%_]/g;\n\n/**\n * Truncate a header-derived string to `max` chars, preserving `null`/`undefined`\n * as `null`. Empty strings stay empty (the caller decides whether to coerce).\n */\nfunction truncateOrNull(value: string | null | undefined, max: number): string | null {\n\tif (value === null || value === undefined) return null;\n\treturn value.length > max ? value.slice(0, max) : value;\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface Redirect {\n\tid: string;\n\tsource: string;\n\tdestination: string;\n\ttype: number;\n\tisPattern: boolean;\n\tenabled: boolean;\n\thits: number;\n\tlastHitAt: string | null;\n\tgroupName: string | null;\n\tauto: boolean;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface CreateRedirectInput {\n\tsource: string;\n\tdestination: string;\n\ttype?: number;\n\tisPattern?: boolean;\n\tenabled?: boolean;\n\tgroupName?: string | null;\n\tauto?: boolean;\n}\n\nexport interface UpdateRedirectInput {\n\tsource?: string;\n\tdestination?: string;\n\ttype?: number;\n\tisPattern?: boolean;\n\tenabled?: boolean;\n\tgroupName?: string | null;\n}\n\nexport interface NotFoundEntry {\n\tid: string;\n\tpath: string;\n\treferrer: string | null;\n\tuserAgent: string | null;\n\tip: string | null;\n\tcreatedAt: string;\n}\n\nexport interface NotFoundSummary {\n\tpath: string;\n\tcount: number;\n\tlastSeen: string;\n\ttopReferrer: string | null;\n}\n\nexport interface RedirectMatch {\n\tredirect: Redirect;\n\tresolvedDestination: string;\n}\n\nexport interface VersionedRedirectRecord {\n\tredirect: Redirect;\n\tconfigRevision: string;\n}\n\nexport class RedirectWriteBusyError extends Error {\n\toverride readonly name = \"RedirectWriteBusyError\";\n}\n\nexport interface RedirectWriteFence {\n\ttoken: string;\n\tgeneration: number;\n}\n\nconst REDIRECT_WRITE_LOCK_ID = 1;\nconst REDIRECT_WRITE_LEASE_MS = 30_000;\nconst REDIRECT_WRITE_LOCK_ATTEMPTS = 5;\nconst POSTGRES_REDIRECT_LOCK_KEY = 1_168_624_763;\n\n// ---------------------------------------------------------------------------\n// Row mapping\n// ---------------------------------------------------------------------------\n\nfunction rowToRedirect(row: RedirectTable): Redirect {\n\treturn {\n\t\tid: row.id,\n\t\tsource: row.source,\n\t\tdestination: row.destination,\n\t\ttype: row.type,\n\t\tisPattern: row.is_pattern === 1,\n\t\tenabled: row.enabled === 1,\n\t\thits: row.hits,\n\t\tlastHitAt: row.last_hit_at,\n\t\tgroupName: row.group_name,\n\t\tauto: row.auto === 1,\n\t\tcreatedAt: row.created_at,\n\t\tupdatedAt: row.updated_at,\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Repository\n// ---------------------------------------------------------------------------\n\nexport class RedirectRepository {\n\tconstructor(readonly db: Kysely<Database>) {}\n\n\t// --- CRUD ---------------------------------------------------------------\n\n\tasync findById(id: string): Promise<Redirect | null> {\n\t\treturn (await this.findVersionedById(id))?.redirect ?? null;\n\t}\n\n\tasync findVersionedById(id: string): Promise<VersionedRedirectRecord | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"_emdash_redirects\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn row ? { redirect: rowToRedirect(row), configRevision: row.config_revision } : null;\n\t}\n\n\tasync findBySource(source: string): Promise<Redirect | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"_emdash_redirects\")\n\t\t\t.selectAll()\n\t\t\t.where(\"source\", \"=\", source)\n\t\t\t.executeTakeFirst();\n\t\treturn row ? rowToRedirect(row) : null;\n\t}\n\n\tasync findConfigRevision(id: string): Promise<string | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"_emdash_redirects\")\n\t\t\t.select(\"config_revision\")\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn row?.config_revision ?? null;\n\t}\n\n\tasync withWriteLock<T>(\n\t\taction: (fence: RedirectWriteFence, repository: RedirectRepository) => Promise<T>,\n\t): Promise<T> {\n\t\tif (isPostgres(this.db)) {\n\t\t\tif (this.db.isTransaction) {\n\t\t\t\tawait sql`SELECT pg_advisory_xact_lock(${POSTGRES_REDIRECT_LOCK_KEY})`.execute(this.db);\n\t\t\t\treturn this.withLease(action);\n\t\t\t}\n\t\t\treturn this.db.transaction().execute(async (transaction) => {\n\t\t\t\tawait sql`SELECT pg_advisory_xact_lock(${POSTGRES_REDIRECT_LOCK_KEY})`.execute(transaction);\n\t\t\t\tconst repository = new RedirectRepository(transaction);\n\t\t\t\treturn repository.withLease(action);\n\t\t\t});\n\t\t}\n\t\treturn this.withLease(action);\n\t}\n\n\tprivate async withLease<T>(\n\t\taction: (fence: RedirectWriteFence, repository: RedirectRepository) => Promise<T>,\n\t): Promise<T> {\n\t\tconst token = ulid();\n\t\tlet fence: RedirectWriteFence | undefined;\n\t\tfor (let attempt = 0; attempt < REDIRECT_WRITE_LOCK_ATTEMPTS; attempt++) {\n\t\t\tconst now = Date.now();\n\t\t\tconst result = await this.db\n\t\t\t\t.updateTable(\"_emdash_redirect_write_lock\")\n\t\t\t\t.set({\n\t\t\t\t\ttoken,\n\t\t\t\t\texpires_at: now + REDIRECT_WRITE_LEASE_MS,\n\t\t\t\t\tgeneration: sql`generation + 1`,\n\t\t\t\t})\n\t\t\t\t.where(\"id\", \"=\", REDIRECT_WRITE_LOCK_ID)\n\t\t\t\t.where((eb) => eb.or([eb(\"token\", \"=\", \"\"), eb(\"expires_at\", \"<\", now)]))\n\t\t\t\t.returning(\"generation\")\n\t\t\t\t.executeTakeFirst();\n\t\t\tif (result) {\n\t\t\t\tfence = { token, generation: result.generation };\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 10 * 2 ** attempt));\n\t\t}\n\t\tif (!fence) {\n\t\t\tthrow new RedirectWriteBusyError(\"Another redirect change is in progress\");\n\t\t}\n\t\ttry {\n\t\t\treturn await action(fence, this);\n\t\t} finally {\n\t\t\ttry {\n\t\t\t\tawait this.db\n\t\t\t\t\t.updateTable(\"_emdash_redirect_write_lock\")\n\t\t\t\t\t.set({ token: \"\", expires_at: 0 })\n\t\t\t\t\t.where(\"id\", \"=\", REDIRECT_WRITE_LOCK_ID)\n\t\t\t\t\t.where(\"token\", \"=\", token)\n\t\t\t\t\t.execute();\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\"Failed to release redirect write lock:\", error);\n\t\t\t}\n\t\t}\n\t}\n\n\tasync findMany(opts: {\n\t\tcursor?: string;\n\t\tlimit?: number;\n\t\tsearch?: string;\n\t\tgroup?: string;\n\t\tenabled?: boolean;\n\t\tauto?: boolean;\n\t}): Promise<FindManyResult<Redirect>> {\n\t\tconst limit = Math.min(Math.max(opts.limit ?? 50, 1), 100);\n\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"_emdash_redirects\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.orderBy(\"id\", \"desc\")\n\t\t\t.limit(limit + 1);\n\n\t\tif (opts.search) {\n\t\t\t// Escape LIKE wildcards in the search term to prevent injection.\n\t\t\t// Must include ESCAPE clause for SQLite to recognize backslash as escape char.\n\t\t\tconst escaped = opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\\\${c}`);\n\t\t\tconst term = `%${escaped}%`;\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\tsql<boolean>`source LIKE ${term} ESCAPE '\\\\'`,\n\t\t\t\t\tsql<boolean>`destination LIKE ${term} ESCAPE '\\\\'`,\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tif (opts.group !== undefined) {\n\t\t\tquery = query.where(\"group_name\", \"=\", opts.group);\n\t\t}\n\n\t\tif (opts.enabled !== undefined) {\n\t\t\tquery = query.where(\"enabled\", \"=\", opts.enabled ? 1 : 0);\n\t\t}\n\n\t\tif (opts.auto !== undefined) {\n\t\t\tquery = query.where(\"auto\", \"=\", opts.auto ? 1 : 0);\n\t\t}\n\n\t\tif (opts.cursor) {\n\t\t\tconst decoded = decodeCursor(opts.cursor);\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"created_at\", \"<\", decoded.orderValue),\n\t\t\t\t\teb.and([eb(\"created_at\", \"=\", decoded.orderValue), eb(\"id\", \"<\", decoded.id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\tconst items = rows.slice(0, limit).map(rowToRedirect);\n\t\tconst result: FindManyResult<Redirect> = { items };\n\n\t\tif (rows.length > limit) {\n\t\t\tconst last = items.at(-1)!;\n\t\t\tresult.nextCursor = encodeCursor(last.createdAt, last.id);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\tasync create(input: CreateRedirectInput, fence?: RedirectWriteFence): Promise<Redirect> {\n\t\tif (!fence) {\n\t\t\treturn this.withWriteLock((currentFence, repository) =>\n\t\t\t\trepository.create(input, currentFence),\n\t\t\t);\n\t\t}\n\t\tconst id = ulid();\n\t\tconst now = new Date().toISOString();\n\t\tconst patternFlag = input.isPattern ?? isPattern(input.source);\n\n\t\tawait this.db\n\t\t\t.insertInto(\"_emdash_redirects\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tsource: input.source,\n\t\t\t\tdestination: input.destination,\n\t\t\t\ttype: input.type ?? 301,\n\t\t\t\tis_pattern: patternFlag ? 1 : 0,\n\t\t\t\tenabled: input.enabled !== false ? 1 : 0,\n\t\t\t\thits: 0,\n\t\t\t\tlast_hit_at: null,\n\t\t\t\tgroup_name: input.groupName ?? null,\n\t\t\t\tauto: input.auto ? 1 : 0,\n\t\t\t\tconfig_revision: ulid(),\n\t\t\t\tsource_guard: 1,\n\t\t\t\twrite_generation: fence?.generation ?? 0,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn (await this.findById(id))!;\n\t}\n\n\tasync update(\n\t\tid: string,\n\t\tinput: UpdateRedirectInput,\n\t\texpectedRevision?: string,\n\t\tfence?: RedirectWriteFence,\n\t): Promise<Redirect | null> {\n\t\tif (!fence) {\n\t\t\treturn this.withWriteLock((currentFence, repository) =>\n\t\t\t\trepository.update(id, input, expectedRevision, currentFence),\n\t\t\t);\n\t\t}\n\t\tconst existing = await this.findById(id);\n\t\tif (!existing) return null;\n\n\t\tconst now = new Date(\n\t\t\tMath.max(Date.now(), new Date(existing.updatedAt).getTime() + 1),\n\t\t).toISOString();\n\t\tconst values: Record<string, unknown> = { updated_at: now, config_revision: ulid() };\n\t\tif (fence) values.write_generation = fence.generation;\n\n\t\tif (input.source !== undefined) {\n\t\t\tvalues.source = input.source;\n\t\t\tvalues.source_guard = 1;\n\t\t\tvalues.is_pattern =\n\t\t\t\tinput.isPattern !== undefined ? (input.isPattern ? 1 : 0) : isPattern(input.source) ? 1 : 0;\n\t\t} else if (input.isPattern !== undefined) {\n\t\t\tvalues.is_pattern = input.isPattern ? 1 : 0;\n\t\t}\n\n\t\tif (input.destination !== undefined) values.destination = input.destination;\n\t\tif (input.type !== undefined) values.type = input.type;\n\t\tif (input.enabled !== undefined) values.enabled = input.enabled ? 1 : 0;\n\t\tif (input.groupName !== undefined) values.group_name = input.groupName;\n\n\t\tlet query = this.db.updateTable(\"_emdash_redirects\").set(values).where(\"id\", \"=\", id);\n\t\tif (expectedRevision !== undefined) {\n\t\t\tquery = query.where(\"config_revision\", \"=\", expectedRevision);\n\t\t}\n\t\tif (fence) {\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.exists(\n\t\t\t\t\teb\n\t\t\t\t\t\t.selectFrom(\"_emdash_redirect_write_lock\")\n\t\t\t\t\t\t.select(\"id\")\n\t\t\t\t\t\t.where(\"id\", \"=\", REDIRECT_WRITE_LOCK_ID)\n\t\t\t\t\t\t.where(\"token\", \"=\", fence.token)\n\t\t\t\t\t\t.where(\"generation\", \"=\", fence.generation),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst result = await query.executeTakeFirst();\n\t\tif (BigInt(result.numUpdatedRows) === 0n) return null;\n\n\t\treturn (await this.findById(id))!;\n\t}\n\n\tasync delete(\n\t\tid: string,\n\t\texpectedRevision?: string,\n\t\tfence?: RedirectWriteFence,\n\t): Promise<boolean> {\n\t\tif (!fence) {\n\t\t\treturn this.withWriteLock((currentFence, repository) =>\n\t\t\t\trepository.delete(id, expectedRevision, currentFence),\n\t\t\t);\n\t\t}\n\t\tlet query = this.db.deleteFrom(\"_emdash_redirects\").where(\"id\", \"=\", id);\n\t\tif (expectedRevision !== undefined) {\n\t\t\tquery = query.where(\"config_revision\", \"=\", expectedRevision);\n\t\t}\n\t\tif (fence) {\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.exists(\n\t\t\t\t\teb\n\t\t\t\t\t\t.selectFrom(\"_emdash_redirect_write_lock\")\n\t\t\t\t\t\t.select(\"id\")\n\t\t\t\t\t\t.where(\"id\", \"=\", REDIRECT_WRITE_LOCK_ID)\n\t\t\t\t\t\t.where(\"token\", \"=\", fence.token)\n\t\t\t\t\t\t.where(\"generation\", \"=\", fence.generation),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst result = await query.executeTakeFirst();\n\t\treturn BigInt(result.numDeletedRows) > 0n;\n\t}\n\n\t/**\n\t * Fetch all enabled redirects (for loop detection graph building).\n\t * Not paginated — returns the full set.\n\t */\n\tasync findAllEnabled(): Promise<Redirect[]> {\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"_emdash_redirects\")\n\t\t\t.selectAll()\n\t\t\t.where(\"enabled\", \"=\", 1)\n\t\t\t.execute();\n\t\treturn rows.map(rowToRedirect);\n\t}\n\n\t// --- Matching -----------------------------------------------------------\n\n\tasync findExactMatch(path: string): Promise<Redirect | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"_emdash_redirects\")\n\t\t\t.selectAll()\n\t\t\t.where(\"source\", \"=\", path)\n\t\t\t.where(\"enabled\", \"=\", 1)\n\t\t\t.where(\"is_pattern\", \"=\", 0)\n\t\t\t.executeTakeFirst();\n\t\treturn row ? rowToRedirect(row) : null;\n\t}\n\n\tasync findEnabledPatternRules(): Promise<Redirect[]> {\n\t\tconst rows = await this.db\n\t\t\t.selectFrom(\"_emdash_redirects\")\n\t\t\t.selectAll()\n\t\t\t.where(\"enabled\", \"=\", 1)\n\t\t\t.where(\"is_pattern\", \"=\", 1)\n\t\t\t.execute();\n\t\treturn rows.map(rowToRedirect);\n\t}\n\n\t/**\n\t * Match a request path against all enabled redirect rules.\n\t * Checks exact matches first (indexed), then pattern rules.\n\t * Returns the matched redirect and the resolved destination URL.\n\t */\n\tasync matchPath(path: string): Promise<RedirectMatch | null> {\n\t\t// 1. Exact match (fast, indexed)\n\t\tconst exact = await this.findExactMatch(path);\n\t\tif (exact) {\n\t\t\treturn { redirect: exact, resolvedDestination: exact.destination };\n\t\t}\n\n\t\t// 2. Pattern match\n\t\tconst patterns = await this.findEnabledPatternRules();\n\t\tfor (const redirect of patterns) {\n\t\t\tconst compiled = compilePattern(redirect.source);\n\t\t\tconst params = matchPattern(compiled, path);\n\t\t\tif (params) {\n\t\t\t\tconst resolved = interpolateDestination(redirect.destination, params);\n\t\t\t\treturn { redirect, resolvedDestination: resolved };\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t}\n\n\t// --- Hit tracking -------------------------------------------------------\n\n\tasync recordHit(id: string): Promise<void> {\n\t\tawait sql`\n\t\t\tUPDATE _emdash_redirects\n\t\t\tSET hits = hits + 1, last_hit_at = ${currentTimestampValue(this.db)}, updated_at = ${currentTimestampValue(this.db)}\n\t\t\tWHERE id = ${id}\n\t\t`.execute(this.db);\n\t}\n\n\t// --- Auto-redirects (slug change) ---------------------------------------\n\n\t/**\n\t * Create an auto-redirect when a content slug changes.\n\t * Uses the collection's URL pattern to compute old/new URLs.\n\t * Collapses existing redirect chains pointing to the old URL and\n\t * removes redirects that would shadow the now-live new URL, so a\n\t * rename that is later reverted cannot form a loop (#1986).\n\t *\n\t * Returns null when old and new URL are identical (nothing to redirect).\n\t */\n\tasync createAutoRedirect(\n\t\tcollection: string,\n\t\toldSlug: string,\n\t\tnewSlug: string,\n\t\tcontentId: string,\n\t\turlPattern: string | null,\n\t\toldPublishedAt?: string | null,\n\t\tnewPublishedAt?: string | null,\n\t): Promise<Redirect | null> {\n\t\treturn this.withWriteLock(async (fence, repository) => {\n\t\t\tconst oldUrl = interpolateUrlPattern({\n\t\t\t\tpattern: urlPattern,\n\t\t\t\tcollection,\n\t\t\t\tslug: oldSlug,\n\t\t\t\tid: contentId,\n\t\t\t\tdate: oldPublishedAt,\n\t\t\t});\n\t\t\tconst newUrl = interpolateUrlPattern({\n\t\t\t\tpattern: urlPattern,\n\t\t\t\tcollection,\n\t\t\t\tslug: newSlug,\n\t\t\t\tid: contentId,\n\t\t\t\tdate: newPublishedAt,\n\t\t\t});\n\n\t\t\t// A redirect from a URL to itself would make the page unreachable\n\t\t\tif (oldUrl === newUrl) return null;\n\n\t\t\t// The new URL serves live content again — any redirect from it would\n\t\t\tawait repository.db\n\t\t\t\t.deleteFrom(\"_emdash_redirects\")\n\t\t\t\t.where(\"source\", \"=\", newUrl)\n\t\t\t\t.where((eb) =>\n\t\t\t\t\teb.exists(\n\t\t\t\t\t\teb\n\t\t\t\t\t\t\t.selectFrom(\"_emdash_redirect_write_lock\")\n\t\t\t\t\t\t\t.select(\"id\")\n\t\t\t\t\t\t\t.where(\"id\", \"=\", REDIRECT_WRITE_LOCK_ID)\n\t\t\t\t\t\t\t.where(\"token\", \"=\", fence.token)\n\t\t\t\t\t\t\t.where(\"generation\", \"=\", fence.generation),\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t\t.execute();\n\n\t\t\t// Collapse chains: update any existing redirects pointing to the old URL\n\t\t\tawait repository.collapseChains(oldUrl, newUrl, fence);\n\n\t\t\t// Check if a redirect from this source already exists\n\t\t\tconst existing = await repository.findBySource(oldUrl);\n\t\t\tif (existing) {\n\t\t\t\t// Update the existing redirect to point to the new URL\n\t\t\t\treturn (await repository.update(existing.id, { destination: newUrl }, undefined, fence))!;\n\t\t\t}\n\n\t\t\treturn repository.create(\n\t\t\t\t{\n\t\t\t\t\tsource: oldUrl,\n\t\t\t\t\tdestination: newUrl,\n\t\t\t\t\ttype: 301,\n\t\t\t\t\tisPattern: false,\n\t\t\t\t\tauto: true,\n\t\t\t\t\tgroupName: \"Auto: slug change\",\n\t\t\t\t},\n\t\t\t\tfence,\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Update all redirects whose destination matches oldDestination\n\t * to point to newDestination instead. Prevents redirect chains.\n\t * Returns the number of updated rows.\n\t */\n\tasync collapseChains(\n\t\toldDestination: string,\n\t\tnewDestination: string,\n\t\tfence?: RedirectWriteFence,\n\t): Promise<number> {\n\t\tif (!fence) {\n\t\t\treturn this.withWriteLock((currentFence, repository) =>\n\t\t\t\trepository.collapseChains(oldDestination, newDestination, currentFence),\n\t\t\t);\n\t\t}\n\t\tlet query = this.db\n\t\t\t.updateTable(\"_emdash_redirects\")\n\t\t\t.set({\n\t\t\t\tdestination: newDestination,\n\t\t\t\tupdated_at: new Date().toISOString(),\n\t\t\t\tconfig_revision: ulid(),\n\t\t\t\t...(fence ? { write_generation: fence.generation } : {}),\n\t\t\t})\n\t\t\t.where(\"destination\", \"=\", oldDestination);\n\t\tif (fence) {\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.exists(\n\t\t\t\t\teb\n\t\t\t\t\t\t.selectFrom(\"_emdash_redirect_write_lock\")\n\t\t\t\t\t\t.select(\"id\")\n\t\t\t\t\t\t.where(\"id\", \"=\", REDIRECT_WRITE_LOCK_ID)\n\t\t\t\t\t\t.where(\"token\", \"=\", fence.token)\n\t\t\t\t\t\t.where(\"generation\", \"=\", fence.generation),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst result = await query.executeTakeFirst();\n\t\treturn Number(result.numUpdatedRows);\n\t}\n\n\t// --- 404 log ------------------------------------------------------------\n\n\t/**\n\t * Record a 404 hit for `entry.path`.\n\t *\n\t * Dedups by path: repeat hits increment `hits` and refresh `last_seen_at`\n\t * on the existing row instead of inserting a new one. Referrer and\n\t * user-agent are truncated to bounded lengths so a malicious client can't\n\t * blow up storage with huge headers. When the table would exceed\n\t * MAX_404_LOG_ROWS, the oldest entries (by `last_seen_at`) are evicted.\n\t *\n\t * This is called from the public redirect middleware on every 404 and\n\t * must never throw for an unauthenticated caller — failures bubble up to\n\t * the middleware, which swallows them.\n\t */\n\tasync log404(entry: {\n\t\tpath: string;\n\t\treferrer?: string | null;\n\t\tuserAgent?: string | null;\n\t\tip?: string | null;\n\t}): Promise<void> {\n\t\tconst now = new Date().toISOString();\n\t\tconst referrer = truncateOrNull(entry.referrer, REFERRER_MAX_LENGTH);\n\t\tconst userAgent = truncateOrNull(entry.userAgent, USER_AGENT_MAX_LENGTH);\n\t\tconst ip = entry.ip ?? null;\n\t\tconst id = ulid();\n\n\t\t// Atomic upsert by path. The UNIQUE index on `path` makes this safe\n\t\t// under concurrency: two requests for the same new path can't both\n\t\t// insert — the second one hits the conflict branch and increments\n\t\t// hits instead of failing with a uniqueness error.\n\t\tconst result = await this.db\n\t\t\t.insertInto(\"_emdash_404_log\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tpath: entry.path,\n\t\t\t\treferrer,\n\t\t\t\tuser_agent: userAgent,\n\t\t\t\tip,\n\t\t\t\thits: 1,\n\t\t\t\tlast_seen_at: now,\n\t\t\t\tcreated_at: now,\n\t\t\t})\n\t\t\t.onConflict((oc) =>\n\t\t\t\toc.column(\"path\").doUpdateSet({\n\t\t\t\t\thits: sql`${sql.ref(\"_emdash_404_log.hits\")} + 1`,\n\t\t\t\t\tlast_seen_at: now,\n\t\t\t\t\treferrer,\n\t\t\t\t\tuser_agent: userAgent,\n\t\t\t\t\tip,\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.returning(\"id\")\n\t\t\t.executeTakeFirst();\n\n\t\t// The conflict branch only updates existing rows, so repeat hits\n\t\t// cannot grow the table. Only enforce the row cap when we actually\n\t\t// inserted a new path.\n\t\tif (result?.id !== id) return;\n\t\tawait this.enforce404Cap();\n\t}\n\n\t/**\n\t * Delete the oldest rows from `_emdash_404_log` if the row count exceeds\n\t * MAX_404_LOG_ROWS. \"Oldest\" is by `last_seen_at`, so a path that keeps\n\t * getting hit stays in the table even if it was first seen long ago.\n\t *\n\t * Private — called by `log404` only after a new path was inserted.\n\t */\n\tprivate async enforce404Cap(): Promise<void> {\n\t\tconst countRow = await this.db\n\t\t\t.selectFrom(\"_emdash_404_log\")\n\t\t\t.select((eb) => eb.fn.countAll<number>().as(\"c\"))\n\t\t\t.executeTakeFirst();\n\t\tconst count = Number(countRow?.c ?? 0);\n\t\tif (count <= MAX_404_LOG_ROWS) return;\n\n\t\tconst excess = count - MAX_404_LOG_ROWS;\n\n\t\t// Evict the oldest rows in a single SQL statement. Using a subquery\n\t\t// (rather than materialising the victim IDs in JS and passing them\n\t\t// back as bind parameters) keeps the statement bounded regardless of\n\t\t// how far over cap the table is — important for existing installs\n\t\t// that crossed the threshold before this cap was introduced.\n\t\tawait this.db\n\t\t\t.deleteFrom(\"_emdash_404_log\")\n\t\t\t.where(\n\t\t\t\t\"id\",\n\t\t\t\t\"in\",\n\t\t\t\tthis.db\n\t\t\t\t\t.selectFrom(\"_emdash_404_log\")\n\t\t\t\t\t.select(\"id\")\n\t\t\t\t\t.orderBy(\"last_seen_at\", \"asc\")\n\t\t\t\t\t.orderBy(\"id\", \"asc\")\n\t\t\t\t\t.limit(excess),\n\t\t\t)\n\t\t\t.execute();\n\t}\n\n\tasync find404s(opts: {\n\t\tcursor?: string;\n\t\tlimit?: number;\n\t\tsearch?: string;\n\t}): Promise<FindManyResult<NotFoundEntry>> {\n\t\tconst limit = Math.min(Math.max(opts.limit ?? 50, 1), 100);\n\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"_emdash_404_log\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.orderBy(\"id\", \"desc\")\n\t\t\t.limit(limit + 1);\n\n\t\tif (opts.search) {\n\t\t\tconst escaped = opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\\\${c}`);\n\t\t\tconst term = `%${escaped}%`;\n\t\t\tquery = query.where(sql<boolean>`path LIKE ${term} ESCAPE '\\\\'`);\n\t\t}\n\n\t\tif (opts.cursor) {\n\t\t\tconst decoded = decodeCursor(opts.cursor);\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"created_at\", \"<\", decoded.orderValue),\n\t\t\t\t\teb.and([eb(\"created_at\", \"=\", decoded.orderValue), eb(\"id\", \"<\", decoded.id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\tconst items: NotFoundEntry[] = rows.slice(0, limit).map((row) => ({\n\t\t\tid: row.id,\n\t\t\tpath: row.path,\n\t\t\treferrer: row.referrer,\n\t\t\tuserAgent: row.user_agent,\n\t\t\tip: row.ip,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\tconst result: FindManyResult<NotFoundEntry> = { items };\n\t\tif (rows.length > limit) {\n\t\t\tconst last = items.at(-1)!;\n\t\t\tresult.nextCursor = encodeCursor(last.createdAt, last.id);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\tasync get404Summary(limit = 50): Promise<NotFoundSummary[]> {\n\t\t// Since rows are now deduped by path, each path has exactly one row\n\t\t// with `hits` as the running count and `last_seen_at` as the latest\n\t\t// timestamp. The subquery for `top_referrer` collapses to a simple\n\t\t// pick of the row's stored referrer (the most recent one seen).\n\t\tconst rows = await sql<{\n\t\t\tpath: string;\n\t\t\tcount: number;\n\t\t\tlast_seen: string;\n\t\t\ttop_referrer: string | null;\n\t\t}>`\n\t\t\tSELECT\n\t\t\t\tpath,\n\t\t\t\tSUM(hits) as count,\n\t\t\t\tMAX(last_seen_at) as last_seen,\n\t\t\t\t(\n\t\t\t\t\tSELECT referrer FROM _emdash_404_log AS inner_log\n\t\t\t\t\tWHERE inner_log.path = _emdash_404_log.path\n\t\t\t\t\t\tAND referrer IS NOT NULL AND referrer != ''\n\t\t\t\t\tLIMIT 1\n\t\t\t\t) as top_referrer\n\t\t\tFROM _emdash_404_log\n\t\t\tGROUP BY path\n\t\t\tORDER BY count DESC\n\t\t\tLIMIT ${limit}\n\t\t`.execute(this.db);\n\n\t\treturn rows.rows.map((row) => ({\n\t\t\tpath: row.path,\n\t\t\tcount: Number(row.count),\n\t\t\tlastSeen: row.last_seen,\n\t\t\ttopReferrer: row.top_referrer,\n\t\t}));\n\t}\n\n\tasync delete404(id: string): Promise<boolean> {\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"_emdash_404_log\")\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn BigInt(result.numDeletedRows) > 0n;\n\t}\n\n\tasync clear404s(): Promise<number> {\n\t\tconst result = await this.db.deleteFrom(\"_emdash_404_log\").executeTakeFirst();\n\t\treturn Number(result.numDeletedRows);\n\t}\n\n\tasync prune404s(olderThan: string): Promise<number> {\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"_emdash_404_log\")\n\t\t\t.where(\"created_at\", \"<\", olderThan)\n\t\t\t.executeTakeFirst();\n\t\treturn Number(result.numDeletedRows);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,MAAa,mBAAmB;;AAGhC,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB;;AAGrC,MAAM,iBAAiB;;;;;AAMvB,SAAS,eAAe,OAAkC,KAA4B;AACrF,KAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAO,MAAM,SAAS,MAAM,MAAM,MAAM,GAAG,IAAI,GAAG;;AAmEnD,IAAa,yBAAb,cAA4C,MAAM;CACjD,AAAkB,OAAO;;AAQ1B,MAAM,yBAAyB;AAC/B,MAAM,0BAA0B;AAChC,MAAM,+BAA+B;AACrC,MAAM,6BAA6B;AAMnC,SAAS,cAAc,KAA8B;AACpD,QAAO;EACN,IAAI,IAAI;EACR,QAAQ,IAAI;EACZ,aAAa,IAAI;EACjB,MAAM,IAAI;EACV,WAAW,IAAI,eAAe;EAC9B,SAAS,IAAI,YAAY;EACzB,MAAM,IAAI;EACV,WAAW,IAAI;EACf,WAAW,IAAI;EACf,MAAM,IAAI,SAAS;EACnB,WAAW,IAAI;EACf,WAAW,IAAI;EACf;;AAOF,IAAa,qBAAb,MAAa,mBAAmB;CAC/B,YAAY,AAAS,IAAsB;EAAtB;;CAIrB,MAAM,SAAS,IAAsC;AACpD,UAAQ,MAAM,KAAK,kBAAkB,GAAG,GAAG,YAAY;;CAGxD,MAAM,kBAAkB,IAAqD;EAC5E,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,oBAAoB,CAC/B,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AACpB,SAAO,MAAM;GAAE,UAAU,cAAc,IAAI;GAAE,gBAAgB,IAAI;GAAiB,GAAG;;CAGtF,MAAM,aAAa,QAA0C;EAC5D,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,oBAAoB,CAC/B,WAAW,CACX,MAAM,UAAU,KAAK,OAAO,CAC5B,kBAAkB;AACpB,SAAO,MAAM,cAAc,IAAI,GAAG;;CAGnC,MAAM,mBAAmB,IAAoC;AAM5D,UALY,MAAM,KAAK,GACrB,WAAW,oBAAoB,CAC/B,OAAO,kBAAkB,CACzB,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB,GACR,mBAAmB;;CAGhC,MAAM,cACL,QACa;AACb,MAAI,WAAW,KAAK,GAAG,EAAE;AACxB,OAAI,KAAK,GAAG,eAAe;AAC1B,UAAM,GAAG,gCAAgC,2BAA2B,GAAG,QAAQ,KAAK,GAAG;AACvF,WAAO,KAAK,UAAU,OAAO;;AAE9B,UAAO,KAAK,GAAG,aAAa,CAAC,QAAQ,OAAO,gBAAgB;AAC3D,UAAM,GAAG,gCAAgC,2BAA2B,GAAG,QAAQ,YAAY;AAE3F,WADmB,IAAI,mBAAmB,YAAY,CACpC,UAAU,OAAO;KAClC;;AAEH,SAAO,KAAK,UAAU,OAAO;;CAG9B,MAAc,UACb,QACa;EACb,MAAM,QAAQ,MAAM;EACpB,IAAI;AACJ,OAAK,IAAI,UAAU,GAAG,UAAU,8BAA8B,WAAW;GACxE,MAAM,MAAM,KAAK,KAAK;GACtB,MAAM,SAAS,MAAM,KAAK,GACxB,YAAY,8BAA8B,CAC1C,IAAI;IACJ;IACA,YAAY,MAAM;IAClB,YAAY,GAAG;IACf,CAAC,CACD,MAAM,MAAM,KAAK,uBAAuB,CACxC,OAAO,OAAO,GAAG,GAAG,CAAC,GAAG,SAAS,KAAK,GAAG,EAAE,GAAG,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,CACxE,UAAU,aAAa,CACvB,kBAAkB;AACpB,OAAI,QAAQ;AACX,YAAQ;KAAE;KAAO,YAAY,OAAO;KAAY;AAChD;;AAED,SAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,KAAK,QAAQ,CAAC;;AAEvE,MAAI,CAAC,MACJ,OAAM,IAAI,uBAAuB,yCAAyC;AAE3E,MAAI;AACH,UAAO,MAAM,OAAO,OAAO,KAAK;YACvB;AACT,OAAI;AACH,UAAM,KAAK,GACT,YAAY,8BAA8B,CAC1C,IAAI;KAAE,OAAO;KAAI,YAAY;KAAG,CAAC,CACjC,MAAM,MAAM,KAAK,uBAAuB,CACxC,MAAM,SAAS,KAAK,MAAM,CAC1B,SAAS;YACH,OAAO;AACf,YAAQ,MAAM,0CAA0C,MAAM;;;;CAKjE,MAAM,SAAS,MAOuB;EACrC,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,SAAS,IAAI,EAAE,EAAE,IAAI;EAE1D,IAAI,QAAQ,KAAK,GACf,WAAW,oBAAoB,CAC/B,WAAW,CACX,QAAQ,cAAc,OAAO,CAC7B,QAAQ,MAAM,OAAO,CACrB,MAAM,QAAQ,EAAE;AAElB,MAAI,KAAK,QAAQ;GAIhB,MAAM,OAAO,IADG,KAAK,OAAO,QAAQ,iBAAiB,MAAM,KAAK,IAAI,CAC3C;AACzB,WAAQ,MAAM,OAAO,OACpB,GAAG,GAAG,CACL,GAAY,eAAe,KAAK,eAChC,GAAY,oBAAoB,KAAK,cACrC,CAAC,CACF;;AAGF,MAAI,KAAK,UAAU,OAClB,SAAQ,MAAM,MAAM,cAAc,KAAK,KAAK,MAAM;AAGnD,MAAI,KAAK,YAAY,OACpB,SAAQ,MAAM,MAAM,WAAW,KAAK,KAAK,UAAU,IAAI,EAAE;AAG1D,MAAI,KAAK,SAAS,OACjB,SAAQ,MAAM,MAAM,QAAQ,KAAK,KAAK,OAAO,IAAI,EAAE;AAGpD,MAAI,KAAK,QAAQ;GAChB,MAAM,UAAU,aAAa,KAAK,OAAO;AACzC,WAAQ,MAAM,OAAO,OACpB,GAAG,GAAG,CACL,GAAG,cAAc,KAAK,QAAQ,WAAW,EACzC,GAAG,IAAI,CAAC,GAAG,cAAc,KAAK,QAAQ,WAAW,EAAE,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,CAC9E,CAAC,CACF;;EAGF,MAAM,OAAO,MAAM,MAAM,SAAS;EAClC,MAAM,QAAQ,KAAK,MAAM,GAAG,MAAM,CAAC,IAAI,cAAc;EACrD,MAAM,SAAmC,EAAE,OAAO;AAElD,MAAI,KAAK,SAAS,OAAO;GACxB,MAAM,OAAO,MAAM,GAAG,GAAG;AACzB,UAAO,aAAa,aAAa,KAAK,WAAW,KAAK,GAAG;;AAG1D,SAAO;;CAGR,MAAM,OAAO,OAA4B,OAA+C;AACvF,MAAI,CAAC,MACJ,QAAO,KAAK,eAAe,cAAc,eACxC,WAAW,OAAO,OAAO,aAAa,CACtC;EAEF,MAAM,KAAK,MAAM;EACjB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;EACpC,MAAM,cAAc,MAAM,aAAa,UAAU,MAAM,OAAO;AAE9D,QAAM,KAAK,GACT,WAAW,oBAAoB,CAC/B,OAAO;GACP;GACA,QAAQ,MAAM;GACd,aAAa,MAAM;GACnB,MAAM,MAAM,QAAQ;GACpB,YAAY,cAAc,IAAI;GAC9B,SAAS,MAAM,YAAY,QAAQ,IAAI;GACvC,MAAM;GACN,aAAa;GACb,YAAY,MAAM,aAAa;GAC/B,MAAM,MAAM,OAAO,IAAI;GACvB,iBAAiB,MAAM;GACvB,cAAc;GACd,kBAAkB,OAAO,cAAc;GACvC,YAAY;GACZ,YAAY;GACZ,CAAC,CACD,SAAS;AAEX,SAAQ,MAAM,KAAK,SAAS,GAAG;;CAGhC,MAAM,OACL,IACA,OACA,kBACA,OAC2B;AAC3B,MAAI,CAAC,MACJ,QAAO,KAAK,eAAe,cAAc,eACxC,WAAW,OAAO,IAAI,OAAO,kBAAkB,aAAa,CAC5D;EAEF,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SAAU,QAAO;EAKtB,MAAM,SAAkC;GAAE,YAH9B,IAAI,KACf,KAAK,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,SAAS,UAAU,CAAC,SAAS,GAAG,EAAE,CAChE,CAAC,aAAa;GAC4C,iBAAiB,MAAM;GAAE;AACpF,MAAI,MAAO,QAAO,mBAAmB,MAAM;AAE3C,MAAI,MAAM,WAAW,QAAW;AAC/B,UAAO,SAAS,MAAM;AACtB,UAAO,eAAe;AACtB,UAAO,aACN,MAAM,cAAc,SAAa,MAAM,YAAY,IAAI,IAAK,UAAU,MAAM,OAAO,GAAG,IAAI;aACjF,MAAM,cAAc,OAC9B,QAAO,aAAa,MAAM,YAAY,IAAI;AAG3C,MAAI,MAAM,gBAAgB,OAAW,QAAO,cAAc,MAAM;AAChE,MAAI,MAAM,SAAS,OAAW,QAAO,OAAO,MAAM;AAClD,MAAI,MAAM,YAAY,OAAW,QAAO,UAAU,MAAM,UAAU,IAAI;AACtE,MAAI,MAAM,cAAc,OAAW,QAAO,aAAa,MAAM;EAE7D,IAAI,QAAQ,KAAK,GAAG,YAAY,oBAAoB,CAAC,IAAI,OAAO,CAAC,MAAM,MAAM,KAAK,GAAG;AACrF,MAAI,qBAAqB,OACxB,SAAQ,MAAM,MAAM,mBAAmB,KAAK,iBAAiB;AAE9D,MAAI,MACH,SAAQ,MAAM,OAAO,OACpB,GAAG,OACF,GACE,WAAW,8BAA8B,CACzC,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,uBAAuB,CACxC,MAAM,SAAS,KAAK,MAAM,MAAM,CAChC,MAAM,cAAc,KAAK,MAAM,WAAW,CAC5C,CACD;EAEF,MAAM,SAAS,MAAM,MAAM,kBAAkB;AAC7C,MAAI,OAAO,OAAO,eAAe,KAAK,GAAI,QAAO;AAEjD,SAAQ,MAAM,KAAK,SAAS,GAAG;;CAGhC,MAAM,OACL,IACA,kBACA,OACmB;AACnB,MAAI,CAAC,MACJ,QAAO,KAAK,eAAe,cAAc,eACxC,WAAW,OAAO,IAAI,kBAAkB,aAAa,CACrD;EAEF,IAAI,QAAQ,KAAK,GAAG,WAAW,oBAAoB,CAAC,MAAM,MAAM,KAAK,GAAG;AACxE,MAAI,qBAAqB,OACxB,SAAQ,MAAM,MAAM,mBAAmB,KAAK,iBAAiB;AAE9D,MAAI,MACH,SAAQ,MAAM,OAAO,OACpB,GAAG,OACF,GACE,WAAW,8BAA8B,CACzC,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,uBAAuB,CACxC,MAAM,SAAS,KAAK,MAAM,MAAM,CAChC,MAAM,cAAc,KAAK,MAAM,WAAW,CAC5C,CACD;EAEF,MAAM,SAAS,MAAM,MAAM,kBAAkB;AAC7C,SAAO,OAAO,OAAO,eAAe,GAAG;;;;;;CAOxC,MAAM,iBAAsC;AAM3C,UALa,MAAM,KAAK,GACtB,WAAW,oBAAoB,CAC/B,WAAW,CACX,MAAM,WAAW,KAAK,EAAE,CACxB,SAAS,EACC,IAAI,cAAc;;CAK/B,MAAM,eAAe,MAAwC;EAC5D,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,oBAAoB,CAC/B,WAAW,CACX,MAAM,UAAU,KAAK,KAAK,CAC1B,MAAM,WAAW,KAAK,EAAE,CACxB,MAAM,cAAc,KAAK,EAAE,CAC3B,kBAAkB;AACpB,SAAO,MAAM,cAAc,IAAI,GAAG;;CAGnC,MAAM,0BAA+C;AAOpD,UANa,MAAM,KAAK,GACtB,WAAW,oBAAoB,CAC/B,WAAW,CACX,MAAM,WAAW,KAAK,EAAE,CACxB,MAAM,cAAc,KAAK,EAAE,CAC3B,SAAS,EACC,IAAI,cAAc;;;;;;;CAQ/B,MAAM,UAAU,MAA6C;EAE5D,MAAM,QAAQ,MAAM,KAAK,eAAe,KAAK;AAC7C,MAAI,MACH,QAAO;GAAE,UAAU;GAAO,qBAAqB,MAAM;GAAa;EAInE,MAAM,WAAW,MAAM,KAAK,yBAAyB;AACrD,OAAK,MAAM,YAAY,UAAU;GAEhC,MAAM,SAAS,aADE,eAAe,SAAS,OAAO,EACV,KAAK;AAC3C,OAAI,OAEH,QAAO;IAAE;IAAU,qBADF,uBAAuB,SAAS,aAAa,OAAO;IACnB;;AAIpD,SAAO;;CAKR,MAAM,UAAU,IAA2B;AAC1C,QAAM,GAAG;;wCAE6B,sBAAsB,KAAK,GAAG,CAAC,iBAAiB,sBAAsB,KAAK,GAAG,CAAC;gBACvG,GAAG;IACf,QAAQ,KAAK,GAAG;;;;;;;;;;;CAcnB,MAAM,mBACL,YACA,SACA,SACA,WACA,YACA,gBACA,gBAC2B;AAC3B,SAAO,KAAK,cAAc,OAAO,OAAO,eAAe;GACtD,MAAM,SAAS,sBAAsB;IACpC,SAAS;IACT;IACA,MAAM;IACN,IAAI;IACJ,MAAM;IACN,CAAC;GACF,MAAM,SAAS,sBAAsB;IACpC,SAAS;IACT;IACA,MAAM;IACN,IAAI;IACJ,MAAM;IACN,CAAC;AAGF,OAAI,WAAW,OAAQ,QAAO;AAG9B,SAAM,WAAW,GACf,WAAW,oBAAoB,CAC/B,MAAM,UAAU,KAAK,OAAO,CAC5B,OAAO,OACP,GAAG,OACF,GACE,WAAW,8BAA8B,CACzC,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,uBAAuB,CACxC,MAAM,SAAS,KAAK,MAAM,MAAM,CAChC,MAAM,cAAc,KAAK,MAAM,WAAW,CAC5C,CACD,CACA,SAAS;AAGX,SAAM,WAAW,eAAe,QAAQ,QAAQ,MAAM;GAGtD,MAAM,WAAW,MAAM,WAAW,aAAa,OAAO;AACtD,OAAI,SAEH,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI,EAAE,aAAa,QAAQ,EAAE,QAAW,MAAM;AAGxF,UAAO,WAAW,OACjB;IACC,QAAQ;IACR,aAAa;IACb,MAAM;IACN,WAAW;IACX,MAAM;IACN,WAAW;IACX,EACD,MACA;IACA;;;;;;;CAQH,MAAM,eACL,gBACA,gBACA,OACkB;AAClB,MAAI,CAAC,MACJ,QAAO,KAAK,eAAe,cAAc,eACxC,WAAW,eAAe,gBAAgB,gBAAgB,aAAa,CACvE;EAEF,IAAI,QAAQ,KAAK,GACf,YAAY,oBAAoB,CAChC,IAAI;GACJ,aAAa;GACb,6BAAY,IAAI,MAAM,EAAC,aAAa;GACpC,iBAAiB,MAAM;GACvB,GAAI,QAAQ,EAAE,kBAAkB,MAAM,YAAY,GAAG,EAAE;GACvD,CAAC,CACD,MAAM,eAAe,KAAK,eAAe;AAC3C,MAAI,MACH,SAAQ,MAAM,OAAO,OACpB,GAAG,OACF,GACE,WAAW,8BAA8B,CACzC,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,uBAAuB,CACxC,MAAM,SAAS,KAAK,MAAM,MAAM,CAChC,MAAM,cAAc,KAAK,MAAM,WAAW,CAC5C,CACD;EAEF,MAAM,SAAS,MAAM,MAAM,kBAAkB;AAC7C,SAAO,OAAO,OAAO,eAAe;;;;;;;;;;;;;;;CAkBrC,MAAM,OAAO,OAKK;EACjB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;EACpC,MAAM,WAAW,eAAe,MAAM,UAAU,oBAAoB;EACpE,MAAM,YAAY,eAAe,MAAM,WAAW,sBAAsB;EACxE,MAAM,KAAK,MAAM,MAAM;EACvB,MAAM,KAAK,MAAM;AAiCjB,OA3Be,MAAM,KAAK,GACxB,WAAW,kBAAkB,CAC7B,OAAO;GACP;GACA,MAAM,MAAM;GACZ;GACA,YAAY;GACZ;GACA,MAAM;GACN,cAAc;GACd,YAAY;GACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,OAAO,CAAC,YAAY;GAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,uBAAuB,CAAC;GAC5C,cAAc;GACd;GACA,YAAY;GACZ;GACA,CAAC,CACF,CACA,UAAU,KAAK,CACf,kBAAkB,GAKR,OAAO,GAAI;AACvB,QAAM,KAAK,eAAe;;;;;;;;;CAU3B,MAAc,gBAA+B;EAC5C,MAAM,WAAW,MAAM,KAAK,GAC1B,WAAW,kBAAkB,CAC7B,QAAQ,OAAO,GAAG,GAAG,UAAkB,CAAC,GAAG,IAAI,CAAC,CAChD,kBAAkB;EACpB,MAAM,QAAQ,OAAO,UAAU,KAAK,EAAE;AACtC,MAAI,SAAS,iBAAkB;EAE/B,MAAM,SAAS,QAAQ;AAOvB,QAAM,KAAK,GACT,WAAW,kBAAkB,CAC7B,MACA,MACA,MACA,KAAK,GACH,WAAW,kBAAkB,CAC7B,OAAO,KAAK,CACZ,QAAQ,gBAAgB,MAAM,CAC9B,QAAQ,MAAM,MAAM,CACpB,MAAM,OAAO,CACf,CACA,SAAS;;CAGZ,MAAM,SAAS,MAI4B;EAC1C,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,SAAS,IAAI,EAAE,EAAE,IAAI;EAE1D,IAAI,QAAQ,KAAK,GACf,WAAW,kBAAkB,CAC7B,WAAW,CACX,QAAQ,cAAc,OAAO,CAC7B,QAAQ,MAAM,OAAO,CACrB,MAAM,QAAQ,EAAE;AAElB,MAAI,KAAK,QAAQ;GAEhB,MAAM,OAAO,IADG,KAAK,OAAO,QAAQ,iBAAiB,MAAM,KAAK,IAAI,CAC3C;AACzB,WAAQ,MAAM,MAAM,GAAY,aAAa,KAAK,cAAc;;AAGjE,MAAI,KAAK,QAAQ;GAChB,MAAM,UAAU,aAAa,KAAK,OAAO;AACzC,WAAQ,MAAM,OAAO,OACpB,GAAG,GAAG,CACL,GAAG,cAAc,KAAK,QAAQ,WAAW,EACzC,GAAG,IAAI,CAAC,GAAG,cAAc,KAAK,QAAQ,WAAW,EAAE,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,CAC9E,CAAC,CACF;;EAGF,MAAM,OAAO,MAAM,MAAM,SAAS;EAClC,MAAM,QAAyB,KAAK,MAAM,GAAG,MAAM,CAAC,KAAK,SAAS;GACjE,IAAI,IAAI;GACR,MAAM,IAAI;GACV,UAAU,IAAI;GACd,WAAW,IAAI;GACf,IAAI,IAAI;GACR,WAAW,IAAI;GACf,EAAE;EAEH,MAAM,SAAwC,EAAE,OAAO;AACvD,MAAI,KAAK,SAAS,OAAO;GACxB,MAAM,OAAO,MAAM,GAAG,GAAG;AACzB,UAAO,aAAa,aAAa,KAAK,WAAW,KAAK,GAAG;;AAG1D,SAAO;;CAGR,MAAM,cAAc,QAAQ,IAAgC;AA2B3D,UAtBa,MAAM,GAKjB;;;;;;;;;;;;;;WAcO,MAAM;IACb,QAAQ,KAAK,GAAG,EAEN,KAAK,KAAK,SAAS;GAC9B,MAAM,IAAI;GACV,OAAO,OAAO,IAAI,MAAM;GACxB,UAAU,IAAI;GACd,aAAa,IAAI;GACjB,EAAE;;CAGJ,MAAM,UAAU,IAA8B;EAC7C,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,kBAAkB,CAC7B,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AACpB,SAAO,OAAO,OAAO,eAAe,GAAG;;CAGxC,MAAM,YAA6B;EAClC,MAAM,SAAS,MAAM,KAAK,GAAG,WAAW,kBAAkB,CAAC,kBAAkB;AAC7E,SAAO,OAAO,OAAO,eAAe;;CAGrC,MAAM,UAAU,WAAoC;EACnD,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,UAAU,CACnC,kBAAkB;AACpB,SAAO,OAAO,OAAO,eAAe"}

package/dist/redirects-BCiTaIQ-.mjs

@@ -0,0 +1,146 @@
+import { t as LOCALE_CODE_PATTERN } from "./config-CGVeT8Hc.mjs";
+import { n as isTerminalStatus, t as REDIRECT_RULE_STATUSES } from "./status-DLoBmcDz.mjs";
+import { z } from "zod";
+
+//#region src/api/schemas/common.ts
+/** Valid role level values */
+const VALID_ROLE_LEVELS = new Set([
+	10,
+	20,
+	30,
+	40,
+	50
+]);
+/** Role level — coerces string/number to valid RoleLevel (10|20|30|40|50) */
+const roleLevel = z.coerce.number().int().refine((n) => VALID_ROLE_LEVELS.has(n), { message: "Invalid role level. Must be 10, 20, 30, 40, or 50" });
+/** Pagination query params — cursor-based */
+const cursorPaginationQuery = z.object({
+	cursor: z.string().max(2048).optional().meta({ description: "Opaque cursor for pagination" }),
+	limit: z.coerce.number().int().min(1).max(100).optional().default(50).meta({ description: "Maximum number of items to return (1-100, default 50)" })
+}).meta({ id: "CursorPaginationQuery" });
+/** Pagination query params — offset-based */
+const offsetPaginationQuery = z.object({
+	limit: z.coerce.number().int().min(1).max(100).optional().default(50),
+	offset: z.coerce.number().int().min(0).optional().default(0)
+}).meta({ id: "OffsetPaginationQuery" });
+/** Slug pattern: lowercase letters, digits, underscores; starts with letter */
+const slugPattern = /^[a-z][a-z0-9_]*$/;
+/** Matches http(s) scheme at start of URL */
+const HTTP_SCHEME_RE = /^https?:\/\//i;
+/** Validates that a URL string uses http or https scheme. Rejects javascript:/data: URI XSS vectors. */
+const httpUrl = z.url().refine((url) => HTTP_SCHEME_RE.test(url), "URL must use http or https");
+/**
+* BCP 47 locale code — language with optional script/region subtags (e.g. en, en-US, pt-BR, es-419, zh-Hant).
+* Validation is case-insensitive, but the value is preserved verbatim because the site config, stored
+* `locale` columns, and public query path all keep the raw BCP-47 casing.
+*/
+const localeCode = z.string().regex(LOCALE_CODE_PATTERN, "Invalid locale code");
+/** Shared `?locale=xx` query shape for endpoints that filter by locale. */
+const localeFilterQuery = z.object({ locale: localeCode.optional() }).meta({ id: "LocaleFilterQuery" });
+/** Standard API error response */
+const apiErrorSchema = z.object({
+	success: z.literal(false).meta({ description: "Discriminant: always false for errors" }),
+	error: z.object({
+		code: z.string().meta({
+			description: "Machine-readable error code",
+			examples: ["NOT_FOUND"]
+		}),
+		message: z.string().meta({ description: "Human-readable error message" })
+	})
+}).meta({ id: "ApiError" });
+/** Wrap a data schema in the standard success envelope: { success: true, data: T } */
+function successEnvelope(dataSchema) {
+	return z.object({
+		success: z.literal(true).meta({ description: "Discriminant: always true for success" }),
+		data: dataSchema
+	});
+}
+/** Standard delete response */
+const deleteResponseSchema = z.object({ deleted: z.literal(true) }).meta({ id: "DeleteResponse" });
+/** Standard count response */
+const countResponseSchema = z.object({ count: z.number().int().min(0) }).meta({ id: "CountResponse" });
+
+//#endregion
+//#region src/api/schemas/redirects.ts
+const redirectType = z.coerce.number().int().refine((n) => REDIRECT_RULE_STATUSES.includes(n), { message: "Redirect type must be 301, 302, 307, 308, 410, or 451" });
+/** Matches CR or LF characters */
+const CRLF = /[\r\n]/;
+/** Path must start with / and not be protocol-relative, contain no CRLF, and no path traversal */
+const urlPath = z.string().min(1).refine((s) => s.startsWith("/") && !s.startsWith("//"), { message: "Must be a path starting with / (no protocol-relative URLs)" }).refine((s) => !CRLF.test(s), { message: "URL must not contain newline characters" }).refine((s) => {
+	try {
+		return !decodeURIComponent(s).split("/").includes("..");
+	} catch {
+		return false;
+	}
+}, { message: "URL must not contain path traversal segments" });
+const createRedirectBody = z.object({
+	source: urlPath,
+	destination: z.union([urlPath, z.literal("")]).optional(),
+	type: redirectType.optional().default(301),
+	enabled: z.boolean().optional().default(true),
+	groupName: z.string().nullish()
+}).refine((o) => isTerminalStatus(o.type ?? 301) || !!o.destination, {
+	message: "destination is required for redirect types (301, 302, 307, 308)",
+	path: ["destination"]
+}).meta({ id: "CreateRedirectBody" });
+const updateRedirectBody = z.object({
+	source: urlPath.optional(),
+	destination: z.union([urlPath, z.literal("")]).optional(),
+	type: redirectType.optional(),
+	enabled: z.boolean().optional(),
+	groupName: z.string().nullish()
+}).refine((o) => Object.values(o).some((v) => v !== void 0), { message: "At least one field must be provided" }).meta({ id: "UpdateRedirectBody" });
+const redirectsListQuery = cursorPaginationQuery.extend({
+	search: z.string().optional(),
+	group: z.string().optional(),
+	enabled: z.enum(["true", "false"]).transform((v) => v === "true").optional(),
+	auto: z.enum(["true", "false"]).transform((v) => v === "true").optional()
+}).meta({ id: "RedirectsListQuery" });
+const notFoundListQuery = cursorPaginationQuery.extend({ search: z.string().optional() }).meta({ id: "NotFoundListQuery" });
+const notFoundSummaryQuery = z.object({ limit: z.coerce.number().int().min(1).max(100).optional().default(50) });
+const notFoundPruneBody = z.object({ olderThan: z.iso.datetime({ message: "olderThan must be an ISO 8601 datetime" }).or(z.iso.datetime({
+	precision: -1,
+	message: "olderThan must be an ISO 8601 datetime"
+})) }).meta({ id: "NotFoundPruneBody" });
+const redirectSchema = z.object({
+	id: z.string(),
+	source: z.string(),
+	destination: z.string(),
+	type: z.number().int(),
+	isPattern: z.boolean(),
+	enabled: z.boolean(),
+	hits: z.number().int(),
+	lastHitAt: z.string().nullable(),
+	groupName: z.string().nullable(),
+	auto: z.boolean(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+}).meta({ id: "Redirect" });
+const redirectListResponseSchema = z.object({
+	items: z.array(redirectSchema),
+	nextCursor: z.string().optional(),
+	loopRedirectIds: z.array(z.string()).optional()
+}).meta({ id: "RedirectListResponse" });
+const notFoundEntrySchema = z.object({
+	id: z.string(),
+	path: z.string(),
+	referrer: z.string().nullable(),
+	userAgent: z.string().nullable(),
+	ip: z.string().nullable(),
+	createdAt: z.string()
+}).meta({ id: "NotFoundEntry" });
+const notFoundListResponseSchema = z.object({
+	items: z.array(notFoundEntrySchema),
+	nextCursor: z.string().optional()
+}).meta({ id: "NotFoundListResponse" });
+const notFoundSummarySchema = z.object({
+	path: z.string(),
+	count: z.number().int(),
+	lastSeen: z.string(),
+	topReferrer: z.string().nullable()
+}).meta({ id: "NotFoundSummary" });
+const notFoundSummaryResponseSchema = z.object({ items: z.array(notFoundSummarySchema) }).meta({ id: "NotFoundSummaryResponse" });
+
+//#endregion
+export { slugPattern as C, roleLevel as S, deleteResponseSchema as _, notFoundPruneBody as a, localeFilterQuery as b, notFoundSummarySchema as c, redirectsListQuery as d, updateRedirectBody as f, cursorPaginationQuery as g, countResponseSchema as h, notFoundListResponseSchema as i, redirectListResponseSchema as l, apiErrorSchema as m, notFoundEntrySchema as n, notFoundSummaryQuery as o, VALID_ROLE_LEVELS as p, notFoundListQuery as r, notFoundSummaryResponseSchema as s, createRedirectBody as t, redirectSchema as u, httpUrl as v, successEnvelope as w, offsetPaginationQuery as x, localeCode as y };
+//# sourceMappingURL=redirects-BCiTaIQ-.mjs.map