emdash 0.38.0 → 0.39.0

package/dist/media-allowlist-elXJgb_K.mjs

@@ -1,44 +0,0 @@
-import { r as parseAllowedMimeTypes } from "./mime-DYpsOAny.mjs";
-
-//#region src/api/handlers/media-allowlist.ts
-/**
-* MIME types allowed for upload by default (when no field-specific list
-* overrides this). Entries ending with "/" are prefix-matched (e.g.
-* "video/" matches "video/mp4", "video/webm", etc.).
-*
-* Image types are enumerated explicitly rather than using a bare "image/"
-* prefix so that "image/svg+xml" is excluded by default: there is no
-* upload-time content validation for SVG, so an unvalidated bare-prefix
-* allowlist would let a Contributor+ upload an SVG with an embedded
-* `<script>`. Fields that genuinely need SVG uploads can still opt in via
-* their own `allowedMimeTypes` (see `resolveFieldAllowlist` below), which is
-* unaffected by this default.
-*/
-const GLOBAL_UPLOAD_ALLOWLIST = [
-	"image/png",
-	"image/jpeg",
-	"image/gif",
-	"image/webp",
-	"image/avif",
-	"video/",
-	"audio/",
-	"application/pdf"
-];
-/**
-* Resolve the MIME allowlist for a specific field.
-*
-* Returns the field's `allowedMimeTypes` list when the field exists, is of
-* type "file" or "image", and has a non-empty list configured. Returns null
-* in all other cases — callers should fall back to GLOBAL_UPLOAD_ALLOWLIST.
-*
-* Authentication is the caller's responsibility (the upload routes already
-* gate on `media:upload`).
-*/
-async function resolveFieldAllowlist(db, fieldId) {
-	const row = await db.selectFrom("_emdash_fields").select(["type", "validation"]).where("id", "=", fieldId).where("type", "in", ["file", "image"]).executeTakeFirst();
-	return row ? parseAllowedMimeTypes(row.validation) : null;
-}
-
-//#endregion
-export { resolveFieldAllowlist as n, GLOBAL_UPLOAD_ALLOWLIST as t };
-//# sourceMappingURL=media-allowlist-elXJgb_K.mjs.map

package/dist/media-allowlist-elXJgb_K.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-allowlist-elXJgb_K.mjs","names":[],"sources":["../src/api/handlers/media-allowlist.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport { parseAllowedMimeTypes } from \"../../media/mime.js\";\n\n/**\n * MIME types allowed for upload by default (when no field-specific list\n * overrides this). Entries ending with \"/\" are prefix-matched (e.g.\n * \"video/\" matches \"video/mp4\", \"video/webm\", etc.).\n *\n * Image types are enumerated explicitly rather than using a bare \"image/\"\n * prefix so that \"image/svg+xml\" is excluded by default: there is no\n * upload-time content validation for SVG, so an unvalidated bare-prefix\n * allowlist would let a Contributor+ upload an SVG with an embedded\n * `<script>`. Fields that genuinely need SVG uploads can still opt in via\n * their own `allowedMimeTypes` (see `resolveFieldAllowlist` below), which is\n * unaffected by this default.\n */\nexport const GLOBAL_UPLOAD_ALLOWLIST: readonly string[] = [\n\t\"image/png\",\n\t\"image/jpeg\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"video/\",\n\t\"audio/\",\n\t\"application/pdf\",\n];\n\n/**\n * Resolve the MIME allowlist for a specific field.\n *\n * Returns the field's `allowedMimeTypes` list when the field exists, is of\n * type \"file\" or \"image\", and has a non-empty list configured. Returns null\n * in all other cases — callers should fall back to GLOBAL_UPLOAD_ALLOWLIST.\n *\n * Authentication is the caller's responsibility (the upload routes already\n * gate on `media:upload`).\n */\nexport async function resolveFieldAllowlist(\n\tdb: Kysely<Database>,\n\tfieldId: string,\n): Promise<string[] | null> {\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_fields\")\n\t\t.select([\"type\", \"validation\"])\n\t\t.where(\"id\", \"=\", fieldId)\n\t\t.where(\"type\", \"in\", [\"file\", \"image\"])\n\t\t.executeTakeFirst();\n\n\treturn row ? parseAllowedMimeTypes(row.validation) : null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,MAAa,0BAA6C;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;;;;AAYD,eAAsB,sBACrB,IACA,SAC2B;CAC3B,MAAM,MAAM,MAAM,GAChB,WAAW,iBAAiB,CAC5B,OAAO,CAAC,QAAQ,aAAa,CAAC,CAC9B,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,QAAQ,MAAM,CAAC,QAAQ,QAAQ,CAAC,CACtC,kBAAkB;AAEpB,QAAO,MAAM,sBAAsB,IAAI,WAAW,GAAG"}

package/dist/media-folders-DASfX_DH.mjs

@@ -1,210 +0,0 @@
-import { i as InvalidCursorError, o as decodeCursor, r as EmDashValidationError, s as encodeCursor } from "./types-CQPWhPxE.mjs";
-import { sql } from "kysely";
-import { ulid } from "ulidx";
-
-//#region src/database/repositories/media-folders.ts
-function escapeLike(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
-}
-function normalizeFolderSearch(value) {
-	return value.trim().normalize("NFKC").toLowerCase();
-}
-function normalizeFolderName(name) {
-	if (typeof name !== "string") throw new EmDashValidationError("Folder name must be a string");
-	const trimmed = name.trim();
-	if (trimmed.length < 1 || trimmed.length > 200) throw new EmDashValidationError("Folder name must be between 1 and 200 characters");
-	return {
-		name: trimmed,
-		nameKey: trimmed.normalize("NFKC").toLowerCase()
-	};
-}
-var MediaFolderRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	async findMany(options = {}) {
-		const limit = Math.max(1, Math.min(options.limit ?? 50, 100));
-		let query = this.db.selectFrom("media_folders").select([
-			"id",
-			"name",
-			"name_key"
-		]).orderBy("name_key", "asc").orderBy("id", "asc").limit(limit + 1);
-		const term = normalizeFolderSearch(options.q ?? "");
-		if (term) {
-			const pattern = `%${escapeLike(term)}%`;
-			query = query.where("name_key", "like", sql`${pattern} escape '\\'`);
-		}
-		if (options.cursor !== void 0) {
-			const { orderValue: nameKey, id } = decodeCursor(options.cursor);
-			query = query.where((eb) => eb.or([eb("name_key", ">", nameKey), eb.and([eb("name_key", "=", nameKey), eb("id", ">", id)])]));
-		}
-		const rows = await query.execute();
-		const hasMore = rows.length > limit;
-		const visible = rows.slice(0, limit);
-		return {
-			items: visible.map(({ id, name }) => ({
-				id,
-				name
-			})),
-			nextCursor: hasMore && visible.length > 0 ? encodeCursor(visible.at(-1).name_key, visible.at(-1).id) : void 0
-		};
-	}
-	async findById(id) {
-		return await this.db.selectFrom("media_folders").select(["id", "name"]).where("id", "=", id).executeTakeFirst() ?? null;
-	}
-	async create(inputName) {
-		const { name, nameKey } = normalizeFolderName(inputName);
-		return await this.db.insertInto("media_folders").values({
-			id: ulid(),
-			name,
-			name_key: nameKey
-		}).returning(["id", "name"]).executeTakeFirstOrThrow();
-	}
-	async update(id, inputName) {
-		const { name, nameKey } = normalizeFolderName(inputName);
-		return await this.db.updateTable("media_folders").set({
-			name,
-			name_key: nameKey
-		}).where("id", "=", id).returning(["id", "name"]).executeTakeFirst() ?? null;
-	}
-	async delete(id) {
-		return await this.db.deleteFrom("media_folders").where("id", "=", id).returning("id").executeTakeFirst() !== void 0;
-	}
-};
-
-//#endregion
-//#region src/api/handlers/media-folders.ts
-const UNIQUE_VIOLATION_RE = /unique constraint failed|duplicate key value violates unique constraint/i;
-async function handleMediaFolderList(db, options = {}) {
-	try {
-		return {
-			success: true,
-			data: await new MediaFolderRepository(db).findMany(options)
-		};
-	} catch (error) {
-		if (error instanceof InvalidCursorError) return {
-			success: false,
-			error: {
-				code: "INVALID_CURSOR",
-				message: error.message
-			}
-		};
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_FOLDER_LIST_ERROR",
-				message: "Failed to list media folders"
-			}
-		};
-	}
-}
-async function handleMediaFolderGet(db, id) {
-	try {
-		const item = await new MediaFolderRepository(db).findById(id);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "Media folder not found"
-			}
-		};
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_FOLDER_GET_ERROR",
-				message: "Failed to get media folder"
-			}
-		};
-	}
-}
-async function handleMediaFolderCreate(db, input) {
-	try {
-		return {
-			success: true,
-			data: { item: await new MediaFolderRepository(db).create(input.name) }
-		};
-	} catch (error) {
-		return mediaFolderWriteError(error, "MEDIA_FOLDER_CREATE_ERROR", "Failed to create media folder");
-	}
-}
-async function handleMediaFolderUpdate(db, id, input) {
-	try {
-		const item = await new MediaFolderRepository(db).update(id, input.name);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "Media folder not found"
-			}
-		};
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch (error) {
-		return mediaFolderWriteError(error, "MEDIA_FOLDER_UPDATE_ERROR", "Failed to update media folder");
-	}
-}
-async function handleMediaFolderDelete(db, id) {
-	try {
-		if (!await new MediaFolderRepository(db).delete(id)) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "Media folder not found"
-			}
-		};
-		return {
-			success: true,
-			data: { deleted: true }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_FOLDER_DELETE_ERROR",
-				message: "Failed to delete media folder"
-			}
-		};
-	}
-}
-function mediaFolderWriteError(error, code, message) {
-	if (error instanceof EmDashValidationError) return {
-		success: false,
-		error: {
-			code: "VALIDATION_ERROR",
-			message: error.message
-		}
-	};
-	if (isUniqueViolation(error)) return {
-		success: false,
-		error: {
-			code: "CONFLICT",
-			message: "A media folder with this name already exists"
-		}
-	};
-	return {
-		success: false,
-		error: {
-			code,
-			message
-		}
-	};
-}
-function isUniqueViolation(error) {
-	if (error && typeof error === "object") {
-		if ("code" in error && error.code === "23505") return true;
-	}
-	const message = error instanceof Error ? error.message : "";
-	if (UNIQUE_VIOLATION_RE.test(message)) return true;
-	return Boolean(error && typeof error === "object" && "cause" in error && isUniqueViolation(error.cause));
-}
-
-//#endregion
-export { handleMediaFolderUpdate as a, handleMediaFolderList as i, handleMediaFolderDelete as n, handleMediaFolderGet as r, handleMediaFolderCreate as t };
-//# sourceMappingURL=media-folders-DASfX_DH.mjs.map

package/dist/media-folders-DASfX_DH.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-folders-DASfX_DH.mjs","names":[],"sources":["../src/database/repositories/media-folders.ts","../src/api/handlers/media-folders.ts"],"sourcesContent":["import { sql, type Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport type { Database } from \"../types.js\";\nimport { decodeCursor, EmDashValidationError, encodeCursor, type FindManyResult } from \"./types.js\";\n\nexport interface MediaFolder {\n\tid: string;\n\tname: string;\n}\n\nexport interface FindManyMediaFoldersOptions {\n\tlimit?: number;\n\tcursor?: string;\n\tq?: string;\n}\n\nfunction escapeLike(value: string): string {\n\treturn value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll(\"%\", \"\\\\%\").replaceAll(\"_\", \"\\\\_\");\n}\n\nfunction normalizeFolderSearch(value: string): string {\n\treturn value.trim().normalize(\"NFKC\").toLowerCase();\n}\n\nfunction normalizeFolderName(name: string): { name: string; nameKey: string } {\n\tif (typeof name !== \"string\") {\n\t\tthrow new EmDashValidationError(\"Folder name must be a string\");\n\t}\n\tconst trimmed = name.trim();\n\tif (trimmed.length < 1 || trimmed.length > 200) {\n\t\tthrow new EmDashValidationError(\"Folder name must be between 1 and 200 characters\");\n\t}\n\treturn { name: trimmed, nameKey: trimmed.normalize(\"NFKC\").toLowerCase() };\n}\n\nexport class MediaFolderRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\tasync findMany(options: FindManyMediaFoldersOptions = {}): Promise<FindManyResult<MediaFolder>> {\n\t\tconst limit = Math.max(1, Math.min(options.limit ?? 50, 100));\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"media_folders\")\n\t\t\t.select([\"id\", \"name\", \"name_key\"])\n\t\t\t.orderBy(\"name_key\", \"asc\")\n\t\t\t.orderBy(\"id\", \"asc\")\n\t\t\t.limit(limit + 1);\n\n\t\tconst term = normalizeFolderSearch(options.q ?? \"\");\n\t\tif (term) {\n\t\t\tconst pattern = `%${escapeLike(term)}%`;\n\t\t\tquery = query.where(\"name_key\", \"like\", sql<string>`${pattern} escape '\\\\'`);\n\t\t}\n\n\t\tif (options.cursor !== undefined) {\n\t\t\tconst { orderValue: nameKey, id } = decodeCursor(options.cursor);\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"name_key\", \">\", nameKey),\n\t\t\t\t\teb.and([eb(\"name_key\", \"=\", nameKey), eb(\"id\", \">\", id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\tconst hasMore = rows.length > limit;\n\t\tconst visible = rows.slice(0, limit);\n\t\treturn {\n\t\t\titems: visible.map(({ id, name }) => ({ id, name })),\n\t\t\tnextCursor:\n\t\t\t\thasMore && visible.length > 0\n\t\t\t\t\t? encodeCursor(visible.at(-1)!.name_key, visible.at(-1)!.id)\n\t\t\t\t\t: undefined,\n\t\t};\n\t}\n\n\tasync findById(id: string): Promise<MediaFolder | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"media_folders\")\n\t\t\t.select([\"id\", \"name\"])\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\t\treturn row ?? null;\n\t}\n\n\tasync create(inputName: string): Promise<MediaFolder> {\n\t\tconst { name, nameKey } = normalizeFolderName(inputName);\n\t\tconst row = await this.db\n\t\t\t.insertInto(\"media_folders\")\n\t\t\t.values({ id: ulid(), name, name_key: nameKey })\n\t\t\t.returning([\"id\", \"name\"])\n\t\t\t.executeTakeFirstOrThrow();\n\t\treturn row;\n\t}\n\n\tasync update(id: string, inputName: string): Promise<MediaFolder | null> {\n\t\tconst { name, nameKey } = normalizeFolderName(inputName);\n\t\tconst row = await this.db\n\t\t\t.updateTable(\"media_folders\")\n\t\t\t.set({ name, name_key: nameKey })\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.returning([\"id\", \"name\"])\n\t\t\t.executeTakeFirst();\n\t\treturn row ?? null;\n\t}\n\n\tasync delete(id: string): Promise<boolean> {\n\t\tconst row = await this.db\n\t\t\t.deleteFrom(\"media_folders\")\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.returning(\"id\")\n\t\t\t.executeTakeFirst();\n\t\treturn row !== undefined;\n\t}\n}\n","import type { Kysely } from \"kysely\";\n\nimport {\n\tMediaFolderRepository,\n\ttype MediaFolder,\n} from \"../../database/repositories/media-folders.js\";\nimport { EmDashValidationError, InvalidCursorError } from \"../../database/repositories/types.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\nconst UNIQUE_VIOLATION_RE =\n\t/unique constraint failed|duplicate key value violates unique constraint/i;\n\nexport async function handleMediaFolderList(\n\tdb: Kysely<Database>,\n\toptions: { limit?: number; cursor?: string; q?: string } = {},\n): Promise<ApiResult<{ items: MediaFolder[]; nextCursor?: string }>> {\n\ttry {\n\t\tconst result = await new MediaFolderRepository(db).findMany(options);\n\t\treturn { success: true, data: result };\n\t} catch (error) {\n\t\tif (error instanceof InvalidCursorError) {\n\t\t\treturn { success: false, error: { code: \"INVALID_CURSOR\", message: error.message } };\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MEDIA_FOLDER_LIST_ERROR\", message: \"Failed to list media folders\" },\n\t\t};\n\t}\n}\n\nexport async function handleMediaFolderGet(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<{ item: MediaFolder }>> {\n\ttry {\n\t\tconst item = await new MediaFolderRepository(db).findById(id);\n\t\tif (!item) {\n\t\t\treturn { success: false, error: { code: \"NOT_FOUND\", message: \"Media folder not found\" } };\n\t\t}\n\t\treturn { success: true, data: { item } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MEDIA_FOLDER_GET_ERROR\", message: \"Failed to get media folder\" },\n\t\t};\n\t}\n}\n\nexport async function handleMediaFolderCreate(\n\tdb: Kysely<Database>,\n\tinput: { name: string },\n): Promise<ApiResult<{ item: MediaFolder }>> {\n\ttry {\n\t\tconst item = await new MediaFolderRepository(db).create(input.name);\n\t\treturn { success: true, data: { item } };\n\t} catch (error) {\n\t\treturn mediaFolderWriteError(\n\t\t\terror,\n\t\t\t\"MEDIA_FOLDER_CREATE_ERROR\",\n\t\t\t\"Failed to create media folder\",\n\t\t);\n\t}\n}\n\nexport async function handleMediaFolderUpdate(\n\tdb: Kysely<Database>,\n\tid: string,\n\tinput: { name: string },\n): Promise<ApiResult<{ item: MediaFolder }>> {\n\ttry {\n\t\tconst item = await new MediaFolderRepository(db).update(id, input.name);\n\t\tif (!item) {\n\t\t\treturn { success: false, error: { code: \"NOT_FOUND\", message: \"Media folder not found\" } };\n\t\t}\n\t\treturn { success: true, data: { item } };\n\t} catch (error) {\n\t\treturn mediaFolderWriteError(\n\t\t\terror,\n\t\t\t\"MEDIA_FOLDER_UPDATE_ERROR\",\n\t\t\t\"Failed to update media folder\",\n\t\t);\n\t}\n}\n\nexport async function handleMediaFolderDelete(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<ApiResult<{ deleted: true }>> {\n\ttry {\n\t\tconst deleted = await new MediaFolderRepository(db).delete(id);\n\t\tif (!deleted) {\n\t\t\treturn { success: false, error: { code: \"NOT_FOUND\", message: \"Media folder not found\" } };\n\t\t}\n\t\treturn { success: true, data: { deleted: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"MEDIA_FOLDER_DELETE_ERROR\", message: \"Failed to delete media folder\" },\n\t\t};\n\t}\n}\n\nfunction mediaFolderWriteError(\n\terror: unknown,\n\tcode: \"MEDIA_FOLDER_CREATE_ERROR\" | \"MEDIA_FOLDER_UPDATE_ERROR\",\n\tmessage: string,\n): ApiResult<never> {\n\tif (error instanceof EmDashValidationError) {\n\t\treturn { success: false, error: { code: \"VALIDATION_ERROR\", message: error.message } };\n\t}\n\tif (isUniqueViolation(error)) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"CONFLICT\", message: \"A media folder with this name already exists\" },\n\t\t};\n\t}\n\treturn { success: false, error: { code, message } };\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n\tif (error && typeof error === \"object\") {\n\t\tif (\"code\" in error && error.code === \"23505\") return true;\n\t}\n\tconst message = error instanceof Error ? error.message : \"\";\n\tif (UNIQUE_VIOLATION_RE.test(message)) return true;\n\treturn Boolean(\n\t\terror && typeof error === \"object\" && \"cause\" in error && isUniqueViolation(error.cause),\n\t);\n}\n"],"mappings":";;;;;AAiBA,SAAS,WAAW,OAAuB;AAC1C,QAAO,MAAM,WAAW,MAAM,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,MAAM;;AAGpF,SAAS,sBAAsB,OAAuB;AACrD,QAAO,MAAM,MAAM,CAAC,UAAU,OAAO,CAAC,aAAa;;AAGpD,SAAS,oBAAoB,MAAiD;AAC7E,KAAI,OAAO,SAAS,SACnB,OAAM,IAAI,sBAAsB,+BAA+B;CAEhE,MAAM,UAAU,KAAK,MAAM;AAC3B,KAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,IAC1C,OAAM,IAAI,sBAAsB,mDAAmD;AAEpF,QAAO;EAAE,MAAM;EAAS,SAAS,QAAQ,UAAU,OAAO,CAAC,aAAa;EAAE;;AAG3E,IAAa,wBAAb,MAAmC;CAClC,YAAY,AAAQ,IAAsB;EAAtB;;CAEpB,MAAM,SAAS,UAAuC,EAAE,EAAwC;EAC/F,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,IAAI,QAAQ,SAAS,IAAI,IAAI,CAAC;EAC7D,IAAI,QAAQ,KAAK,GACf,WAAW,gBAAgB,CAC3B,OAAO;GAAC;GAAM;GAAQ;GAAW,CAAC,CAClC,QAAQ,YAAY,MAAM,CAC1B,QAAQ,MAAM,MAAM,CACpB,MAAM,QAAQ,EAAE;EAElB,MAAM,OAAO,sBAAsB,QAAQ,KAAK,GAAG;AACnD,MAAI,MAAM;GACT,MAAM,UAAU,IAAI,WAAW,KAAK,CAAC;AACrC,WAAQ,MAAM,MAAM,YAAY,QAAQ,GAAW,GAAG,QAAQ,cAAc;;AAG7E,MAAI,QAAQ,WAAW,QAAW;GACjC,MAAM,EAAE,YAAY,SAAS,OAAO,aAAa,QAAQ,OAAO;AAChE,WAAQ,MAAM,OAAO,OACpB,GAAG,GAAG,CACL,GAAG,YAAY,KAAK,QAAQ,EAC5B,GAAG,IAAI,CAAC,GAAG,YAAY,KAAK,QAAQ,EAAE,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CACzD,CAAC,CACF;;EAGF,MAAM,OAAO,MAAM,MAAM,SAAS;EAClC,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,UAAU,KAAK,MAAM,GAAG,MAAM;AACpC,SAAO;GACN,OAAO,QAAQ,KAAK,EAAE,IAAI,YAAY;IAAE;IAAI;IAAM,EAAE;GACpD,YACC,WAAW,QAAQ,SAAS,IACzB,aAAa,QAAQ,GAAG,GAAG,CAAE,UAAU,QAAQ,GAAG,GAAG,CAAE,GAAG,GAC1D;GACJ;;CAGF,MAAM,SAAS,IAAyC;AAMvD,SALY,MAAM,KAAK,GACrB,WAAW,gBAAgB,CAC3B,OAAO,CAAC,MAAM,OAAO,CAAC,CACtB,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB,IACN;;CAGf,MAAM,OAAO,WAAyC;EACrD,MAAM,EAAE,MAAM,YAAY,oBAAoB,UAAU;AAMxD,SALY,MAAM,KAAK,GACrB,WAAW,gBAAgB,CAC3B,OAAO;GAAE,IAAI,MAAM;GAAE;GAAM,UAAU;GAAS,CAAC,CAC/C,UAAU,CAAC,MAAM,OAAO,CAAC,CACzB,yBAAyB;;CAI5B,MAAM,OAAO,IAAY,WAAgD;EACxE,MAAM,EAAE,MAAM,YAAY,oBAAoB,UAAU;AAOxD,SANY,MAAM,KAAK,GACrB,YAAY,gBAAgB,CAC5B,IAAI;GAAE;GAAM,UAAU;GAAS,CAAC,CAChC,MAAM,MAAM,KAAK,GAAG,CACpB,UAAU,CAAC,MAAM,OAAO,CAAC,CACzB,kBAAkB,IACN;;CAGf,MAAM,OAAO,IAA8B;AAM1C,SALY,MAAM,KAAK,GACrB,WAAW,gBAAgB,CAC3B,MAAM,MAAM,KAAK,GAAG,CACpB,UAAU,KAAK,CACf,kBAAkB,KACL;;;;;;ACtGjB,MAAM,sBACL;AAED,eAAsB,sBACrB,IACA,UAA2D,EAAE,EACO;AACpE,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MADT,MAAM,IAAI,sBAAsB,GAAG,CAAC,SAAS,QAAQ;GAC9B;UAC9B,OAAO;AACf,MAAI,iBAAiB,mBACpB,QAAO;GAAE,SAAS;GAAO,OAAO;IAAE,MAAM;IAAkB,SAAS,MAAM;IAAS;GAAE;AAErF,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA2B,SAAS;IAAgC;GACnF;;;AAIH,eAAsB,qBACrB,IACA,IAC4C;AAC5C,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,sBAAsB,GAAG,CAAC,SAAS,GAAG;AAC7D,MAAI,CAAC,KACJ,QAAO;GAAE,SAAS;GAAO,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAAE;AAE3F,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM;GAAE;SACjC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAA8B;GAChF;;;AAIH,eAAsB,wBACrB,IACA,OAC4C;AAC5C,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MADnB,MAAM,IAAI,sBAAsB,GAAG,CAAC,OAAO,MAAM,KAAK,EAC7B;GAAE;UAChC,OAAO;AACf,SAAO,sBACN,OACA,6BACA,gCACA;;;AAIH,eAAsB,wBACrB,IACA,IACA,OAC4C;AAC5C,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,sBAAsB,GAAG,CAAC,OAAO,IAAI,MAAM,KAAK;AACvE,MAAI,CAAC,KACJ,QAAO;GAAE,SAAS;GAAO,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAAE;AAE3F,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM;GAAE;UAChC,OAAO;AACf,SAAO,sBACN,OACA,6BACA,gCACA;;;AAIH,eAAsB,wBACrB,IACA,IACwC;AACxC,KAAI;AAEH,MAAI,CADY,MAAM,IAAI,sBAAsB,GAAG,CAAC,OAAO,GAAG,CAE7D,QAAO;GAAE,SAAS;GAAO,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAAE;AAE3F,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA6B,SAAS;IAAiC;GACtF;;;AAIH,SAAS,sBACR,OACA,MACA,SACmB;AACnB,KAAI,iBAAiB,sBACpB,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAoB,SAAS,MAAM;GAAS;EAAE;AAEvF,KAAI,kBAAkB,MAAM,CAC3B,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAAY,SAAS;GAAgD;EACpF;AAEF,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE;GAAM;GAAS;EAAE;;AAGpD,SAAS,kBAAkB,OAAyB;AACnD,KAAI,SAAS,OAAO,UAAU,UAC7B;MAAI,UAAU,SAAS,MAAM,SAAS,QAAS,QAAO;;CAEvD,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,KAAI,oBAAoB,KAAK,QAAQ,CAAE,QAAO;AAC9C,QAAO,QACN,SAAS,OAAO,UAAU,YAAY,WAAW,SAAS,kBAAkB,MAAM,MAAM,CACxF"}

package/dist/media-upload-C7_AQJ5v.mjs

@@ -1,147 +0,0 @@
-import "./config-C3EBstHi.mjs";
-import { n as decodeBase64Bytes } from "./base64-CvLhUKQv.mjs";
-import "./types-CQPWhPxE.mjs";
-import { t as MediaRepository } from "./media-BBm8Wg3f.mjs";
-import "./dist-BAsh8dbf.mjs";
-import { n as normalizeMime, t as matchesMimeAllowlist } from "./mime-DYpsOAny.mjs";
-import { t as enrichImageMetadata } from "./enrich-t2Xvjdqa.mjs";
-import { n as computeContentHash } from "./hash-BRweX6jz.mjs";
-import { a as ssrfSafeFetch, t as SsrfError } from "./ssrf-gl4gFNhw.mjs";
-import { n as DEFAULT_MAX_UPLOAD_SIZE, r as formatFileSize, t as CONTENT_TYPE_RE } from "./media-C1EIZKh1.mjs";
-import { t as GLOBAL_UPLOAD_ALLOWLIST } from "./media-allowlist-elXJgb_K.mjs";
-import { ulid } from "ulidx";
-import * as path from "node:path";
-
-//#region src/api/handlers/media-upload.ts
-/**
-* Programmatic media upload handler (MCP `media_upload` tool).
-*
-* Accepts file bytes as base64 or fetches them from an external URL
-* (SSRF-guarded), then runs the same pipeline as the multipart REST
-* upload route: allowlist + size validation, content-hash deduplication,
-* storage upload, image metadata enrichment, and record creation.
-*/
-function fail(code, message) {
-	return {
-		success: false,
-		error: {
-			code,
-			message
-		}
-	};
-}
-/** Same relative-URL shape the REST media routes return. */
-function withUrl(item) {
-	return {
-		...item,
-		url: `/_emdash/api/media/file/${item.storageKey}`
-	};
-}
-/** Strip parameters from a Content-Type header value (e.g. '; charset=...'). */
-function bareMime(headerValue) {
-	return (headerValue.split(";")[0] ?? "").trim();
-}
-/**
-* Acquire the file bytes and MIME type from either the base64 payload or
-* the external URL. Returns an error result on any validation failure.
-*/
-async function acquireBytes(input, maxUploadSize) {
-	if (input.base64) {
-		if (!input.contentType) return fail("VALIDATION_ERROR", "contentType is required when uploading base64 data");
-		if (input.base64.length * 3 / 4 > maxUploadSize) return fail("PAYLOAD_TOO_LARGE", `File exceeds maximum size of ${formatFileSize(maxUploadSize)}`);
-		try {
-			return {
-				bytes: decodeBase64Bytes(input.base64),
-				mimeType: input.contentType
-			};
-		} catch {
-			return fail("VALIDATION_ERROR", "Invalid base64 data");
-		}
-	}
-	const url = input.url;
-	if (!url) return fail("VALIDATION_ERROR", "Provide exactly one of 'base64' or 'url'");
-	let response;
-	try {
-		response = await ssrfSafeFetch(url, { headers: { accept: "*/*" } });
-	} catch (error) {
-		if (error instanceof SsrfError) return fail("VALIDATION_ERROR", `URL not allowed: ${error.message}`);
-		return fail("FETCH_ERROR", "Failed to fetch file from URL");
-	}
-	if (!response.ok) return fail("FETCH_ERROR", `Failed to fetch file from URL (HTTP ${response.status})`);
-	const contentLength = response.headers.get("Content-Length");
-	if (contentLength && parseInt(contentLength, 10) > maxUploadSize) return fail("PAYLOAD_TOO_LARGE", `File exceeds maximum size of ${formatFileSize(maxUploadSize)}`);
-	const mimeType = input.contentType ?? bareMime(response.headers.get("Content-Type") ?? "");
-	if (!mimeType) return fail("VALIDATION_ERROR", "Could not determine MIME type — pass contentType explicitly");
-	return {
-		bytes: new Uint8Array(await response.arrayBuffer()),
-		mimeType
-	};
-}
-/**
-* Upload a media file from base64 data or an external URL.
-*
-* Mirrors the REST `POST /_emdash/api/media` route: global MIME allowlist,
-* size limit, content-hash dedupe (returns the existing item with
-* `deduplicated: true`), storage upload with cleanup on failure, and
-* image metadata enrichment (dimensions, blurhash, dominant color).
-*/
-async function handleMediaUpload(db, storage, input) {
-	if (!input.base64 === !input.url) return fail("VALIDATION_ERROR", "Provide exactly one of 'base64' or 'url'");
-	const rawMax = input.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;
-	if (!Number.isFinite(rawMax) || rawMax <= 0) return fail("CONFIGURATION_ERROR", "Invalid maxUploadSize configuration");
-	const acquired = await acquireBytes(input, rawMax);
-	if ("success" in acquired) return acquired;
-	const { bytes } = acquired;
-	if (!CONTENT_TYPE_RE.test(acquired.mimeType)) return fail("VALIDATION_ERROR", "Invalid content type");
-	const mimeType = normalizeMime(acquired.mimeType);
-	if (!matchesMimeAllowlist(mimeType, GLOBAL_UPLOAD_ALLOWLIST)) return fail("INVALID_TYPE", "File type not allowed");
-	if (bytes.byteLength > rawMax) return fail("PAYLOAD_TOO_LARGE", `File exceeds maximum size of ${formatFileSize(rawMax)}`);
-	try {
-		const contentHash = await computeContentHash(bytes);
-		const repo = new MediaRepository(db);
-		const existing = await repo.findByContentHash(contentHash);
-		if (existing) return {
-			success: true,
-			data: {
-				item: withUrl(existing),
-				deduplicated: true
-			}
-		};
-		const storageKey = `${ulid()}${path.extname(input.filename)}`;
-		await storage.upload({
-			key: storageKey,
-			body: bytes,
-			contentType: mimeType
-		});
-		try {
-			const enriched = await enrichImageMetadata(bytes, mimeType);
-			return {
-				success: true,
-				data: { item: withUrl(await repo.create({
-					filename: input.filename,
-					mimeType,
-					size: bytes.byteLength,
-					width: enriched.width,
-					height: enriched.height,
-					alt: input.alt,
-					storageKey,
-					contentHash,
-					blurhash: enriched.blurhash,
-					dominantColor: enriched.dominantColor,
-					authorId: input.authorId
-				})) }
-			};
-		} catch (error) {
-			try {
-				await storage.delete(storageKey);
-			} catch {}
-			throw error;
-		}
-	} catch {
-		return fail("UPLOAD_ERROR", "Upload failed");
-	}
-}
-
-//#endregion
-export { handleMediaUpload };
-//# sourceMappingURL=media-upload-C7_AQJ5v.mjs.map

package/dist/media-upload-C7_AQJ5v.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-upload-C7_AQJ5v.mjs","names":[],"sources":["../src/api/handlers/media-upload.ts"],"sourcesContent":["/**\n * Programmatic media upload handler (MCP `media_upload` tool).\n *\n * Accepts file bytes as base64 or fetches them from an external URL\n * (SSRF-guarded), then runs the same pipeline as the multipart REST\n * upload route: allowlist + size validation, content-hash deduplication,\n * storage upload, image metadata enrichment, and record creation.\n */\n\nimport * as path from \"node:path\";\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { MediaRepository, type MediaItem } from \"../../database/repositories/media.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { enrichImageMetadata } from \"../../media/enrich.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"../../media/mime.js\";\nimport { SsrfError, ssrfSafeFetch } from \"../../security/ssrf.js\";\nimport type { Storage } from \"../../storage/types.js\";\nimport { decodeBase64Bytes } from \"../../utils/base64.js\";\nimport { computeContentHash } from \"../../utils/hash.js\";\nimport { CONTENT_TYPE_RE, DEFAULT_MAX_UPLOAD_SIZE, formatFileSize } from \"../schemas/media.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST } from \"./media-allowlist.js\";\n\nexport interface MediaUploadInput {\n\t/** Original filename (e.g. 'logo.png'); the extension is kept on the storage key. */\n\tfilename: string;\n\t/** Base64-encoded file contents. Exactly one of `base64` / `url` must be set. */\n\tbase64?: string;\n\t/** External http(s) URL to fetch the file from. Exactly one of `base64` / `url` must be set. */\n\turl?: string;\n\t/**\n\t * MIME type. Required with `base64`; optional with `url` (falls back to\n\t * the response's Content-Type header).\n\t */\n\tcontentType?: string;\n\t/** Alt text stored on the media record. */\n\talt?: string;\n\tauthorId?: string;\n\t/** Upload size limit in bytes (defaults to DEFAULT_MAX_UPLOAD_SIZE). */\n\tmaxUploadSize?: number;\n}\n\nexport type MediaUploadResult = ApiResult<{\n\titem: MediaItem & { url: string };\n\tdeduplicated?: boolean;\n}>;\n\nfunction fail(code: string, message: string): MediaUploadResult {\n\treturn { success: false, error: { code, message } };\n}\n\n/** Same relative-URL shape the REST media routes return. */\nfunction withUrl(item: MediaItem): MediaItem & { url: string } {\n\treturn { ...item, url: `/_emdash/api/media/file/${item.storageKey}` };\n}\n\n/** Strip parameters from a Content-Type header value (e.g. '; charset=...'). */\nfunction bareMime(headerValue: string): string {\n\treturn (headerValue.split(\";\")[0] ?? \"\").trim();\n}\n\n/**\n * Acquire the file bytes and MIME type from either the base64 payload or\n * the external URL. Returns an error result on any validation failure.\n */\nasync function acquireBytes(\n\tinput: MediaUploadInput,\n\tmaxUploadSize: number,\n): Promise<{ bytes: Uint8Array; mimeType: string } | MediaUploadResult> {\n\tif (input.base64) {\n\t\tif (!input.contentType) {\n\t\t\treturn fail(\"VALIDATION_ERROR\", \"contentType is required when uploading base64 data\");\n\t\t}\n\t\t// Cheap size precheck on the encoded string (decoded size is ~3/4 of\n\t\t// the base64 length) before allocating the decoded buffer.\n\t\tif ((input.base64.length * 3) / 4 > maxUploadSize) {\n\t\t\treturn fail(\n\t\t\t\t\"PAYLOAD_TOO_LARGE\",\n\t\t\t\t`File exceeds maximum size of ${formatFileSize(maxUploadSize)}`,\n\t\t\t);\n\t\t}\n\t\ttry {\n\t\t\treturn { bytes: decodeBase64Bytes(input.base64), mimeType: input.contentType };\n\t\t} catch {\n\t\t\treturn fail(\"VALIDATION_ERROR\", \"Invalid base64 data\");\n\t\t}\n\t}\n\n\t// url mode — the caller guarantees exactly one source, so url is set here\n\tconst url = input.url;\n\tif (!url) {\n\t\treturn fail(\"VALIDATION_ERROR\", \"Provide exactly one of 'base64' or 'url'\");\n\t}\n\tlet response: Response;\n\ttry {\n\t\tresponse = await ssrfSafeFetch(url, { headers: { accept: \"*/*\" } });\n\t} catch (error) {\n\t\tif (error instanceof SsrfError) {\n\t\t\treturn fail(\"VALIDATION_ERROR\", `URL not allowed: ${error.message}`);\n\t\t}\n\t\treturn fail(\"FETCH_ERROR\", \"Failed to fetch file from URL\");\n\t}\n\tif (!response.ok) {\n\t\treturn fail(\"FETCH_ERROR\", `Failed to fetch file from URL (HTTP ${response.status})`);\n\t}\n\n\tconst contentLength = response.headers.get(\"Content-Length\");\n\tif (contentLength && parseInt(contentLength, 10) > maxUploadSize) {\n\t\treturn fail(\n\t\t\t\"PAYLOAD_TOO_LARGE\",\n\t\t\t`File exceeds maximum size of ${formatFileSize(maxUploadSize)}`,\n\t\t);\n\t}\n\n\tconst mimeType = input.contentType ?? bareMime(response.headers.get(\"Content-Type\") ?? \"\");\n\tif (!mimeType) {\n\t\treturn fail(\"VALIDATION_ERROR\", \"Could not determine MIME type — pass contentType explicitly\");\n\t}\n\n\tconst bytes = new Uint8Array(await response.arrayBuffer());\n\treturn { bytes, mimeType };\n}\n\n/**\n * Upload a media file from base64 data or an external URL.\n *\n * Mirrors the REST `POST /_emdash/api/media` route: global MIME allowlist,\n * size limit, content-hash dedupe (returns the existing item with\n * `deduplicated: true`), storage upload with cleanup on failure, and\n * image metadata enrichment (dimensions, blurhash, dominant color).\n */\nexport async function handleMediaUpload(\n\tdb: Kysely<Database>,\n\tstorage: Storage,\n\tinput: MediaUploadInput,\n): Promise<MediaUploadResult> {\n\tif (!input.base64 === !input.url) {\n\t\treturn fail(\"VALIDATION_ERROR\", \"Provide exactly one of 'base64' or 'url'\");\n\t}\n\n\tconst rawMax = input.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\tif (!Number.isFinite(rawMax) || rawMax <= 0) {\n\t\treturn fail(\"CONFIGURATION_ERROR\", \"Invalid maxUploadSize configuration\");\n\t}\n\n\tconst acquired = await acquireBytes(input, rawMax);\n\tif (\"success\" in acquired) return acquired;\n\tconst { bytes } = acquired;\n\n\t// Validate the raw MIME string before normalize/allowlist: normalizeMime\n\t// only strips parameters and matchesMimeAllowlist only checks startsWith,\n\t// so without this a crafted value like \"image/png\\r\\nX-Evil: 1\" would\n\t// reach the storage backend's ContentType header and be echoed by the\n\t// media file serving route.\n\tif (!CONTENT_TYPE_RE.test(acquired.mimeType)) {\n\t\treturn fail(\"VALIDATION_ERROR\", \"Invalid content type\");\n\t}\n\tconst mimeType = normalizeMime(acquired.mimeType);\n\n\tif (!matchesMimeAllowlist(mimeType, GLOBAL_UPLOAD_ALLOWLIST)) {\n\t\treturn fail(\"INVALID_TYPE\", \"File type not allowed\");\n\t}\n\tif (bytes.byteLength > rawMax) {\n\t\treturn fail(\"PAYLOAD_TOO_LARGE\", `File exceeds maximum size of ${formatFileSize(rawMax)}`);\n\t}\n\n\ttry {\n\t\tconst contentHash = await computeContentHash(bytes);\n\t\tconst repo = new MediaRepository(db);\n\n\t\tconst existing = await repo.findByContentHash(contentHash);\n\t\tif (existing) {\n\t\t\treturn { success: true, data: { item: withUrl(existing), deduplicated: true } };\n\t\t}\n\n\t\tconst storageKey = `${ulid()}${path.extname(input.filename)}`;\n\t\tawait storage.upload({ key: storageKey, body: bytes, contentType: mimeType });\n\n\t\ttry {\n\t\t\tconst enriched = await enrichImageMetadata(bytes, mimeType);\n\t\t\tconst item = await repo.create({\n\t\t\t\tfilename: input.filename,\n\t\t\t\tmimeType,\n\t\t\t\tsize: bytes.byteLength,\n\t\t\t\twidth: enriched.width,\n\t\t\t\theight: enriched.height,\n\t\t\t\talt: input.alt,\n\t\t\t\tstorageKey,\n\t\t\t\tcontentHash,\n\t\t\t\tblurhash: enriched.blurhash,\n\t\t\t\tdominantColor: enriched.dominantColor,\n\t\t\t\tauthorId: input.authorId,\n\t\t\t});\n\t\t\treturn { success: true, data: { item: withUrl(item) } };\n\t\t} catch (error) {\n\t\t\t// Don't leave an orphaned object in storage when record creation fails\n\t\t\ttry {\n\t\t\t\tawait storage.delete(storageKey);\n\t\t\t} catch {\n\t\t\t\t// Ignore cleanup errors\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t} catch {\n\t\treturn fail(\"UPLOAD_ERROR\", \"Upload failed\");\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkDA,SAAS,KAAK,MAAc,SAAoC;AAC/D,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE;GAAM;GAAS;EAAE;;;AAIpD,SAAS,QAAQ,MAA8C;AAC9D,QAAO;EAAE,GAAG;EAAM,KAAK,2BAA2B,KAAK;EAAc;;;AAItE,SAAS,SAAS,aAA6B;AAC9C,SAAQ,YAAY,MAAM,IAAI,CAAC,MAAM,IAAI,MAAM;;;;;;AAOhD,eAAe,aACd,OACA,eACuE;AACvE,KAAI,MAAM,QAAQ;AACjB,MAAI,CAAC,MAAM,YACV,QAAO,KAAK,oBAAoB,qDAAqD;AAItF,MAAK,MAAM,OAAO,SAAS,IAAK,IAAI,cACnC,QAAO,KACN,qBACA,gCAAgC,eAAe,cAAc,GAC7D;AAEF,MAAI;AACH,UAAO;IAAE,OAAO,kBAAkB,MAAM,OAAO;IAAE,UAAU,MAAM;IAAa;UACvE;AACP,UAAO,KAAK,oBAAoB,sBAAsB;;;CAKxD,MAAM,MAAM,MAAM;AAClB,KAAI,CAAC,IACJ,QAAO,KAAK,oBAAoB,2CAA2C;CAE5E,IAAI;AACJ,KAAI;AACH,aAAW,MAAM,cAAc,KAAK,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE,CAAC;UAC3D,OAAO;AACf,MAAI,iBAAiB,UACpB,QAAO,KAAK,oBAAoB,oBAAoB,MAAM,UAAU;AAErE,SAAO,KAAK,eAAe,gCAAgC;;AAE5D,KAAI,CAAC,SAAS,GACb,QAAO,KAAK,eAAe,uCAAuC,SAAS,OAAO,GAAG;CAGtF,MAAM,gBAAgB,SAAS,QAAQ,IAAI,iBAAiB;AAC5D,KAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,KACN,qBACA,gCAAgC,eAAe,cAAc,GAC7D;CAGF,MAAM,WAAW,MAAM,eAAe,SAAS,SAAS,QAAQ,IAAI,eAAe,IAAI,GAAG;AAC1F,KAAI,CAAC,SACJ,QAAO,KAAK,oBAAoB,8DAA8D;AAI/F,QAAO;EAAE,OADK,IAAI,WAAW,MAAM,SAAS,aAAa,CAAC;EAC1C;EAAU;;;;;;;;;;AAW3B,eAAsB,kBACrB,IACA,SACA,OAC6B;AAC7B,KAAI,CAAC,MAAM,WAAW,CAAC,MAAM,IAC5B,QAAO,KAAK,oBAAoB,2CAA2C;CAG5E,MAAM,SAAS,MAAM,iBAAiB;AACtC,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACzC,QAAO,KAAK,uBAAuB,sCAAsC;CAG1E,MAAM,WAAW,MAAM,aAAa,OAAO,OAAO;AAClD,KAAI,aAAa,SAAU,QAAO;CAClC,MAAM,EAAE,UAAU;AAOlB,KAAI,CAAC,gBAAgB,KAAK,SAAS,SAAS,CAC3C,QAAO,KAAK,oBAAoB,uBAAuB;CAExD,MAAM,WAAW,cAAc,SAAS,SAAS;AAEjD,KAAI,CAAC,qBAAqB,UAAU,wBAAwB,CAC3D,QAAO,KAAK,gBAAgB,wBAAwB;AAErD,KAAI,MAAM,aAAa,OACtB,QAAO,KAAK,qBAAqB,gCAAgC,eAAe,OAAO,GAAG;AAG3F,KAAI;EACH,MAAM,cAAc,MAAM,mBAAmB,MAAM;EACnD,MAAM,OAAO,IAAI,gBAAgB,GAAG;EAEpC,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY;AAC1D,MAAI,SACH,QAAO;GAAE,SAAS;GAAM,MAAM;IAAE,MAAM,QAAQ,SAAS;IAAE,cAAc;IAAM;GAAE;EAGhF,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,QAAQ,MAAM,SAAS;AAC3D,QAAM,QAAQ,OAAO;GAAE,KAAK;GAAY,MAAM;GAAO,aAAa;GAAU,CAAC;AAE7E,MAAI;GACH,MAAM,WAAW,MAAM,oBAAoB,OAAO,SAAS;AAc3D,UAAO;IAAE,SAAS;IAAM,MAAM,EAAE,MAAM,QAbzB,MAAM,KAAK,OAAO;KAC9B,UAAU,MAAM;KAChB;KACA,MAAM,MAAM;KACZ,OAAO,SAAS;KAChB,QAAQ,SAAS;KACjB,KAAK,MAAM;KACX;KACA;KACA,UAAU,SAAS;KACnB,eAAe,SAAS;KACxB,UAAU,MAAM;KAChB,CAAC,CACiD,EAAE;IAAE;WAC/C,OAAO;AAEf,OAAI;AACH,UAAM,QAAQ,OAAO,WAAW;WACzB;AAGR,SAAM;;SAEA;AACP,SAAO,KAAK,gBAAgB,gBAAgB"}

package/dist/media-url-8dVl1loq.mjs

@@ -1,43 +0,0 @@
-//#region src/seo/media-url.ts
-/**
-* Resolve a stored SEO image reference to a URL.
-*
-* The CMS SEO panel stores `seo_image` in one of these shapes:
-* - an absolute URL (`https://...`) — returned as-is;
-* - a root-relative path that already includes the media API prefix
-*   (`/_emdash/api/media/file/01KS....webp`) — prefixed with `siteUrl`;
-* - a bare media id (`01KS...`) — expanded to the media API path, then
-*   prefixed with `siteUrl`.
-*
-* Shared by the SEO meta builder (`og:image`) and the sitemap route
-* (`<image:image>`) so both resolve image references identically.
-*/
-const TRAILING_SLASH_RE = /\/$/;
-const ABSOLUTE_URL_RE = /^https?:\/\//i;
-function buildSeoImageUrl(imageRef, siteUrl) {
-	if (ABSOLUTE_URL_RE.test(imageRef)) return imageRef;
-	if (imageRef.startsWith("//")) return imageRef;
-	if (imageRef.startsWith("/")) return siteUrl ? `${siteUrl.replace(TRAILING_SLASH_RE, "")}${imageRef}` : imageRef;
-	const mediaPath = `/_emdash/api/media/file/${imageRef}`;
-	return siteUrl ? `${siteUrl.replace(TRAILING_SLASH_RE, "")}${mediaPath}` : mediaPath;
-}
-/**
-* Resolve a stored SEO canonical value to a URL.
-*
-* The SEO panel accepts absolute URLs, root-relative paths, and bare
-* relative paths. Relative paths are joined with `siteUrl` (adding a
-* leading slash when missing, so we never produce
-* `https://example.composts/x`). Without a `siteUrl` the value is
-* returned as-is. Absolute output matters here: the resolved value feeds
-* `<link rel="canonical">` and `og:url`, both of which search engines and
-* scrapers expect fully qualified.
-*/
-function resolveSeoCanonicalUrl(canonical, siteUrl) {
-	if (!siteUrl || ABSOLUTE_URL_RE.test(canonical) || canonical.startsWith("//")) return canonical;
-	const path = canonical.startsWith("/") ? canonical : `/${canonical}`;
-	return `${siteUrl.replace(TRAILING_SLASH_RE, "")}${path}`;
-}
-
-//#endregion
-export { resolveSeoCanonicalUrl as n, buildSeoImageUrl as t };
-//# sourceMappingURL=media-url-8dVl1loq.mjs.map

package/dist/media-url-8dVl1loq.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-url-8dVl1loq.mjs","names":[],"sources":["../src/seo/media-url.ts"],"sourcesContent":["/**\n * Resolve a stored SEO image reference to a URL.\n *\n * The CMS SEO panel stores `seo_image` in one of these shapes:\n * - an absolute URL (`https://...`) — returned as-is;\n * - a root-relative path that already includes the media API prefix\n *   (`/_emdash/api/media/file/01KS....webp`) — prefixed with `siteUrl`;\n * - a bare media id (`01KS...`) — expanded to the media API path, then\n *   prefixed with `siteUrl`.\n *\n * Shared by the SEO meta builder (`og:image`) and the sitemap route\n * (`<image:image>`) so both resolve image references identically.\n */\nconst TRAILING_SLASH_RE = /\\/$/;\nconst ABSOLUTE_URL_RE = /^https?:\\/\\//i;\n\nexport function buildSeoImageUrl(imageRef: string, siteUrl?: string): string {\n\t// Already absolute — use as-is.\n\tif (ABSOLUTE_URL_RE.test(imageRef)) {\n\t\treturn imageRef;\n\t}\n\n\t// `//host/path` is protocol-relative — already qualified, not a path\n\t// to prefix with the site URL.\n\tif (imageRef.startsWith(\"//\")) {\n\t\treturn imageRef;\n\t}\n\n\t// Root-relative path (already includes the media API prefix). Without\n\t// this branch we'd re-prefix and produce a doubled path that 404s.\n\tif (imageRef.startsWith(\"/\")) {\n\t\treturn siteUrl ? `${siteUrl.replace(TRAILING_SLASH_RE, \"\")}${imageRef}` : imageRef;\n\t}\n\n\t// Bare media id — build the full media API path.\n\tconst mediaPath = `/_emdash/api/media/file/${imageRef}`;\n\treturn siteUrl ? `${siteUrl.replace(TRAILING_SLASH_RE, \"\")}${mediaPath}` : mediaPath;\n}\n\n/**\n * Resolve a stored SEO canonical value to a URL.\n *\n * The SEO panel accepts absolute URLs, root-relative paths, and bare\n * relative paths. Relative paths are joined with `siteUrl` (adding a\n * leading slash when missing, so we never produce\n * `https://example.composts/x`). Without a `siteUrl` the value is\n * returned as-is. Absolute output matters here: the resolved value feeds\n * `<link rel=\"canonical\">` and `og:url`, both of which search engines and\n * scrapers expect fully qualified.\n */\nexport function resolveSeoCanonicalUrl(canonical: string, siteUrl?: string): string {\n\t// `//host/path` is protocol-relative — already qualified, not a path.\n\tif (!siteUrl || ABSOLUTE_URL_RE.test(canonical) || canonical.startsWith(\"//\")) {\n\t\treturn canonical;\n\t}\n\tconst path = canonical.startsWith(\"/\") ? canonical : `/${canonical}`;\n\treturn `${siteUrl.replace(TRAILING_SLASH_RE, \"\")}${path}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAaA,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;AAExB,SAAgB,iBAAiB,UAAkB,SAA0B;AAE5E,KAAI,gBAAgB,KAAK,SAAS,CACjC,QAAO;AAKR,KAAI,SAAS,WAAW,KAAK,CAC5B,QAAO;AAKR,KAAI,SAAS,WAAW,IAAI,CAC3B,QAAO,UAAU,GAAG,QAAQ,QAAQ,mBAAmB,GAAG,GAAG,aAAa;CAI3E,MAAM,YAAY,2BAA2B;AAC7C,QAAO,UAAU,GAAG,QAAQ,QAAQ,mBAAmB,GAAG,GAAG,cAAc;;;;;;;;;;;;;AAc5E,SAAgB,uBAAuB,WAAmB,SAA0B;AAEnF,KAAI,CAAC,WAAW,gBAAgB,KAAK,UAAU,IAAI,UAAU,WAAW,KAAK,CAC5E,QAAO;CAER,MAAM,OAAO,UAAU,WAAW,IAAI,GAAG,YAAY,IAAI;AACzD,QAAO,GAAG,QAAQ,QAAQ,mBAAmB,GAAG,GAAG"}