emdash 0.39.1 → 0.40.1

package/dist/routes-CWzxcZpn.mjs

@@ -1,321 +0,0 @@
-import { t as PluginContextFactory } from "./context-DJP3aNeR.mjs";
-import { t as extractRequestMeta } from "./request-meta-C8yl_sIs.mjs";
-import { t as MediaUsageActivationWriteBlockedError } from "./media-usage-write-fence-DW5oHT7q.mjs";
-import { n as parseDeclaredPluginRouteInput } from "./route-wire-D66L2oaZ.mjs";
-import { z } from "zod";
-import { routeNameSchema } from "@emdash-cms/plugin-types";
-
-//#region src/plugins/routes.ts
-/**
-* Body-reading methods on `Request`. EmDash parses the request body once before
-* the handler runs and exposes the result as `ctx.input`, leaving the underlying
-* stream consumed. Calling any of these on `ctx.request` would re-read a spent
-* stream and throw an opaque platform error ("Body is unusable: Body has already
-* been read") with no hint about `ctx.input` — so the guard replaces them with an
-* actionable message instead.
-*/
-const CONSUMED_BODY_METHODS = new Set([
-	"json",
-	"text",
-	"arrayBuffer",
-	"blob",
-	"formData",
-	"bytes"
-]);
-/**
-* Wrap the request handed to a plugin route handler so an accidental
-* `ctx.request.json()` (or `.text()`, `.formData()`, …) fails with a message
-* pointing at `ctx.input` rather than the runtime's cryptic "body already read"
-* error. Every non-body member passes through unchanged; function members are
-* bound to the underlying request so methods like `clone()` don't throw an
-* "Illegal invocation" when called on the proxy.
-*/
-function guardConsumedRequestBody(request) {
-	return new Proxy(request, { get(target, prop) {
-		if (typeof prop === "string" && CONSUMED_BODY_METHODS.has(prop)) return () => {
-			throw new Error(`[emdash] ctx.request.${prop}() is not available inside a plugin route handler: EmDash has already parsed the request body and exposes it as ctx.input. Read ctx.input instead of ctx.request.${prop}().`);
-		};
-		const value = Reflect.get(target, prop, target);
-		return typeof value === "function" ? value.bind(target) : value;
-	} });
-}
-const pluginPublicRouteAcknowledgementSchema = z.array(routeNameSchema);
-/**
-* Build RouteMeta from a route's `public`/`cacheControl` flags. Single source
-* of truth for the "cacheControl is only ever exposed on public routes"
-* invariant — used for trusted routes and manifest-declared sandboxed routes.
-*/
-function buildRouteMeta(route) {
-	const meta = { public: route.public === true };
-	if (route.permission !== void 0) meta.permission = route.permission;
-	if (route.methods !== void 0) meta.methods = [...route.methods];
-	if (route.request !== void 0) meta.request = {
-		...route.request,
-		...route.request.headers ? { headers: [...route.request.headers] } : {}
-	};
-	if (route.response !== void 0) meta.response = route.response;
-	if (meta.public && typeof route.cacheControl === "string" && route.cacheControl.length > 0) meta.cacheControl = route.cacheControl;
-	return meta;
-}
-/**
-* HTTP methods that carry a request body. Everything else (GET, HEAD, DELETE)
-* takes its route input from the URL query string.
-*/
-const BODY_METHODS = new Set([
-	"POST",
-	"PUT",
-	"PATCH"
-]);
-/**
-* Parse a plugin route's input from the request, by method.
-*
-* Body methods (POST/PUT/PATCH) parse the JSON body as before. Bodyless
-* methods (GET/HEAD/DELETE) have no body, so `request.json()` resolves to
-* undefined and fails schema validation, so parse the query string into
-* an object instead. Repeated keys (`?tag=a&tag=b`) become an array so array
-* schemas work; a single key stays a scalar.
-*/
-async function parseRouteInput(request, declaration) {
-	if (declaration) return parseDeclaredPluginRouteInput(request, declaration);
-	if (BODY_METHODS.has(request.method.toUpperCase())) try {
-		return await request.json();
-	} catch {
-		return;
-	}
-	const params = new URL(request.url).searchParams;
-	const input = {};
-	for (const key of new Set(params.keys())) {
-		const values = params.getAll(key);
-		input[key] = values.length > 1 ? values : values[0];
-	}
-	return input;
-}
-/**
-* Convert the host's authenticated user into the read-only `UserInfo` shape
-* exposed to plugins as `ctx.user`. Strips sensitive/irrelevant fields and
-* keeps the value structured-clone-safe for sandboxed plugins.
-*/
-function toRouteCallerInfo(user) {
-	return {
-		id: user.id,
-		email: user.email,
-		name: user.name,
-		role: user.role,
-		createdAt: typeof user.createdAt === "string" ? user.createdAt : user.createdAt.toISOString()
-	};
-}
-/**
-* Route handler for a plugin
-*/
-var PluginRouteHandler = class {
-	contextFactory;
-	plugin;
-	trustedProxyHeaders;
-	constructor(plugin, factoryOptions) {
-		this.plugin = plugin;
-		this.contextFactory = new PluginContextFactory(factoryOptions);
-		this.trustedProxyHeaders = factoryOptions.trustedProxyHeaders ?? [];
-	}
-	/**
-	* Invoke a route by name
-	*/
-	async invoke(routeName, options) {
-		const route = this.plugin.routes[routeName];
-		if (!route) return {
-			success: false,
-			error: {
-				code: "ROUTE_NOT_FOUND",
-				message: `Route "${routeName}" not found in plugin "${this.plugin.id}"`
-			},
-			status: 404
-		};
-		let validatedInput;
-		if (route.input) {
-			const parseResult = route.input.safeParse(options.body);
-			if (!parseResult.success) return {
-				success: false,
-				error: {
-					code: "VALIDATION_ERROR",
-					message: "Invalid request body",
-					details: z.formatError(parseResult.error)
-				},
-				status: 400
-			};
-			validatedInput = parseResult.data;
-		} else validatedInput = options.body;
-		const routeContext = {
-			...this.contextFactory.createContext(this.plugin),
-			input: validatedInput,
-			request: guardConsumedRequestBody(options.request),
-			requestMeta: extractRequestMeta(options.request, this.trustedProxyHeaders),
-			user: options.user,
-			ui: options.ui
-		};
-		try {
-			return {
-				success: true,
-				data: await route.handler(routeContext),
-				status: 200
-			};
-		} catch (error) {
-			if (error instanceof MediaUsageActivationWriteBlockedError) return {
-				success: false,
-				error: {
-					code: error.code,
-					message: error.message
-				},
-				status: error.status
-			};
-			if (error instanceof PluginRouteError) return {
-				success: false,
-				error: {
-					code: error.code,
-					message: error.message,
-					details: error.details
-				},
-				status: error.status
-			};
-			console.error(`[plugin:${this.plugin.id}] Route handler failed:`, error);
-			return {
-				success: false,
-				error: {
-					code: "INTERNAL_ERROR",
-					message: "An internal error occurred"
-				},
-				status: 500
-			};
-		}
-	}
-	/**
-	* Get all route names
-	*/
-	getRouteNames() {
-		return Object.keys(this.plugin.routes);
-	}
-	/**
-	* Check if a route exists
-	*/
-	hasRoute(name) {
-		return name in this.plugin.routes;
-	}
-	/**
-	* Get route metadata without invoking the handler.
-	* Returns null if the route doesn't exist.
-	*/
-	getRouteMeta(name) {
-		const route = this.plugin.routes[name];
-		if (!route) return null;
-		return buildRouteMeta(route);
-	}
-};
-/**
-* Error class for plugin routes
-* Allows plugins to return structured errors with specific HTTP status codes
-*/
-var PluginRouteError = class PluginRouteError extends Error {
-	constructor(code, message, status = 400, details) {
-		super(message);
-		this.code = code;
-		this.status = status;
-		this.details = details;
-		this.name = "PluginRouteError";
-	}
-	/**
-	* Create a bad request error (400)
-	*/
-	static badRequest(message, details) {
-		return new PluginRouteError("BAD_REQUEST", message, 400, details);
-	}
-	/**
-	* Create an unauthorized error (401)
-	*/
-	static unauthorized(message = "Unauthorized") {
-		return new PluginRouteError("UNAUTHORIZED", message, 401);
-	}
-	/**
-	* Create a forbidden error (403)
-	*/
-	static forbidden(message = "Forbidden") {
-		return new PluginRouteError("FORBIDDEN", message, 403);
-	}
-	/**
-	* Create a not found error (404)
-	*/
-	static notFound(message = "Not found") {
-		return new PluginRouteError("NOT_FOUND", message, 404);
-	}
-	/**
-	* Create a conflict error (409)
-	*/
-	static conflict(message, details) {
-		return new PluginRouteError("CONFLICT", message, 409, details);
-	}
-	/**
-	* Create an internal error (500)
-	*/
-	static internal(message = "Internal error") {
-		return new PluginRouteError("INTERNAL_ERROR", message, 500);
-	}
-};
-/**
-* Registry for all plugin route handlers
-*/
-var PluginRouteRegistry = class {
-	handlers = /* @__PURE__ */ new Map();
-	constructor(factoryOptions) {
-		this.factoryOptions = factoryOptions;
-	}
-	/**
-	* Register a plugin's routes
-	*/
-	register(plugin) {
-		const handler = new PluginRouteHandler(plugin, this.factoryOptions);
-		this.handlers.set(plugin.id, handler);
-	}
-	/**
-	* Unregister a plugin's routes
-	*/
-	unregister(pluginId) {
-		this.handlers.delete(pluginId);
-	}
-	/**
-	* Invoke a plugin route
-	*/
-	async invoke(pluginId, routeName, options) {
-		const handler = this.handlers.get(pluginId);
-		if (!handler) return {
-			success: false,
-			error: {
-				code: "PLUGIN_NOT_FOUND",
-				message: `Plugin "${pluginId}" not found`
-			},
-			status: 404
-		};
-		return handler.invoke(routeName, options);
-	}
-	/**
-	* Get all registered plugin IDs
-	*/
-	getPluginIds() {
-		return [...this.handlers.keys()];
-	}
-	/**
-	* Get routes for a plugin
-	*/
-	getRoutes(pluginId) {
-		return this.handlers.get(pluginId)?.getRouteNames() ?? [];
-	}
-	/**
-	* Get route metadata for a specific plugin route.
-	* Returns null if the plugin or route doesn't exist.
-	*/
-	getRouteMeta(pluginId, routeName) {
-		const handler = this.handlers.get(pluginId);
-		if (!handler) return null;
-		return handler.getRouteMeta(routeName);
-	}
-};
-
-//#endregion
-export { pluginPublicRouteAcknowledgementSchema as a, parseRouteInput as i, PluginRouteRegistry as n, toRouteCallerInfo as o, buildRouteMeta as r, PluginRouteError as t };
-//# sourceMappingURL=routes-CWzxcZpn.mjs.map

package/dist/routes-CWzxcZpn.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes-CWzxcZpn.mjs","names":[],"sources":["../src/plugins/routes.ts"],"sourcesContent":["/**\n * Plugin Routes v2\n *\n * Handles plugin API route invocation with:\n * - Input validation via Zod schemas\n * - Route context creation\n * - Error handling\n *\n */\n\nimport type { PluginUiContext } from \"@emdash-cms/blocks/server\";\nimport type {\n\tPluginRouteMethod,\n\tPluginRouteRequest,\n\tPluginRouteResponseMode,\n} from \"@emdash-cms/plugin-types\";\nimport { routeNameSchema } from \"@emdash-cms/plugin-types\";\nimport { z } from \"zod\";\n\nimport { MediaUsageActivationWriteBlockedError } from \"../api/media-usage-write-fence.js\";\nimport { PluginContextFactory, type PluginContextFactoryOptions } from \"./context.js\";\nimport { extractRequestMeta } from \"./request-meta.js\";\nimport { parseDeclaredPluginRouteInput } from \"./route-wire.js\";\nimport type { ResolvedPlugin, RouteContext, PluginRoute, UserInfo } from \"./types.js\";\n\n/**\n * Body-reading methods on `Request`. EmDash parses the request body once before\n * the handler runs and exposes the result as `ctx.input`, leaving the underlying\n * stream consumed. Calling any of these on `ctx.request` would re-read a spent\n * stream and throw an opaque platform error (\"Body is unusable: Body has already\n * been read\") with no hint about `ctx.input` — so the guard replaces them with an\n * actionable message instead.\n */\nconst CONSUMED_BODY_METHODS = new Set([\"json\", \"text\", \"arrayBuffer\", \"blob\", \"formData\", \"bytes\"]);\n\n/**\n * Wrap the request handed to a plugin route handler so an accidental\n * `ctx.request.json()` (or `.text()`, `.formData()`, …) fails with a message\n * pointing at `ctx.input` rather than the runtime's cryptic \"body already read\"\n * error. Every non-body member passes through unchanged; function members are\n * bound to the underlying request so methods like `clone()` don't throw an\n * \"Illegal invocation\" when called on the proxy.\n */\nfunction guardConsumedRequestBody(request: Request): Request {\n\treturn new Proxy(request, {\n\t\tget(target, prop) {\n\t\t\tif (typeof prop === \"string\" && CONSUMED_BODY_METHODS.has(prop)) {\n\t\t\t\treturn () => {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`[emdash] ctx.request.${prop}() is not available inside a plugin route handler: ` +\n\t\t\t\t\t\t\t`EmDash has already parsed the request body and exposes it as ctx.input. ` +\n\t\t\t\t\t\t\t`Read ctx.input instead of ctx.request.${prop}().`,\n\t\t\t\t\t);\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst value = Reflect.get(target, prop, target);\n\t\t\treturn typeof value === \"function\" ? value.bind(target) : value;\n\t\t},\n\t});\n}\n\n/**\n * Route metadata (public flag) without the handler.\n * Used by the catch-all route to decide auth before dispatch.\n */\nexport interface RouteMeta {\n\tpublic: boolean;\n\tpermission?: string;\n\t/**\n\t * Cache-Control value for successful GET responses. Only ever set for\n\t * public routes — authenticated responses must stay `private, no-store`.\n\t */\n\tcacheControl?: string;\n\tmethods?: PluginRouteMethod[];\n\trequest?: PluginRouteRequest;\n\tresponse?: PluginRouteResponseMode;\n}\n\nexport const pluginPublicRouteAcknowledgementSchema = z.array(routeNameSchema);\n\nexport type PluginContentCacheInvalidator = (tags: string[]) => Promise<void>;\n\n/**\n * Build RouteMeta from a route's `public`/`cacheControl` flags. Single source\n * of truth for the \"cacheControl is only ever exposed on public routes\"\n * invariant — used for trusted routes and manifest-declared sandboxed routes.\n */\nexport function buildRouteMeta(route: {\n\tpublic?: boolean;\n\tpermission?: string;\n\tcacheControl?: string;\n\tmethods?: PluginRouteMethod[];\n\trequest?: PluginRouteRequest;\n\tresponse?: PluginRouteResponseMode;\n}): RouteMeta {\n\tconst meta: RouteMeta = { public: route.public === true };\n\tif (route.permission !== undefined) meta.permission = route.permission;\n\tif (route.methods !== undefined) meta.methods = [...route.methods];\n\tif (route.request !== undefined) {\n\t\tmeta.request = {\n\t\t\t...route.request,\n\t\t\t...(route.request.headers ? { headers: [...route.request.headers] } : {}),\n\t\t};\n\t}\n\tif (route.response !== undefined) meta.response = route.response;\n\t// Private responses are per-user and must never become cacheable, even if\n\t// a route sets both flags.\n\tif (meta.public && typeof route.cacheControl === \"string\" && route.cacheControl.length > 0) {\n\t\tmeta.cacheControl = route.cacheControl;\n\t}\n\treturn meta;\n}\n\n/**\n * HTTP methods that carry a request body. Everything else (GET, HEAD, DELETE)\n * takes its route input from the URL query string.\n */\nconst BODY_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\"]);\n\n/**\n * Parse a plugin route's input from the request, by method.\n *\n * Body methods (POST/PUT/PATCH) parse the JSON body as before. Bodyless\n * methods (GET/HEAD/DELETE) have no body, so `request.json()` resolves to\n * undefined and fails schema validation, so parse the query string into\n * an object instead. Repeated keys (`?tag=a&tag=b`) become an array so array\n * schemas work; a single key stays a scalar.\n */\nexport async function parseRouteInput(\n\trequest: Request,\n\tdeclaration?: PluginRouteRequest,\n): Promise<unknown> {\n\tif (declaration) return parseDeclaredPluginRouteInput(request, declaration);\n\tif (BODY_METHODS.has(request.method.toUpperCase())) {\n\t\ttry {\n\t\t\treturn await request.json();\n\t\t} catch {\n\t\t\t// No body or not JSON\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tconst params = new URL(request.url).searchParams;\n\tconst input: Record<string, string | string[]> = {};\n\tfor (const key of new Set(params.keys())) {\n\t\tconst values = params.getAll(key);\n\t\tinput[key] = values.length > 1 ? values : values[0];\n\t}\n\treturn input;\n}\n\n/**\n * Result from a route invocation\n */\nexport interface RouteResult<T = unknown> {\n\tsuccess: boolean;\n\tdata?: T;\n\terror?: {\n\t\tcode: string;\n\t\tmessage: string;\n\t\tdetails?: unknown;\n\t};\n\tstatus: number;\n}\n\n/**\n * Host-side user shape accepted when dispatching a plugin route. Structurally\n * matches `User` from `@emdash-cms/auth` so hosts can pass `locals.user`\n * directly without the plugin layer depending on the auth package.\n */\nexport interface RouteCallerInput {\n\tid: string;\n\temail: string;\n\tname: string | null;\n\trole: number;\n\tcreatedAt: Date | string;\n}\n\n/**\n * Convert the host's authenticated user into the read-only `UserInfo` shape\n * exposed to plugins as `ctx.user`. Strips sensitive/irrelevant fields and\n * keeps the value structured-clone-safe for sandboxed plugins.\n */\nexport function toRouteCallerInfo(user: RouteCallerInput): UserInfo {\n\treturn {\n\t\tid: user.id,\n\t\temail: user.email,\n\t\tname: user.name,\n\t\trole: user.role,\n\t\tcreatedAt: typeof user.createdAt === \"string\" ? user.createdAt : user.createdAt.toISOString(),\n\t};\n}\n\n/**\n * Route invocation options\n */\nexport interface InvokeRouteOptions {\n\t/** The original request */\n\trequest: Request;\n\t/** Request body (already parsed) */\n\tbody?: unknown;\n\t/**\n\t * Authenticated caller resolved by the host, exposed to the handler as\n\t * `ctx.user`. Undefined for public routes and unbound machine tokens.\n\t */\n\tuser?: UserInfo;\n\t/** Host-attested context for a validated Block Kit request. */\n\tui?: PluginUiContext;\n}\n\n/**\n * Route handler for a plugin\n */\nexport class PluginRouteHandler {\n\tprivate contextFactory: PluginContextFactory;\n\tprivate plugin: ResolvedPlugin;\n\tprivate trustedProxyHeaders: string[];\n\n\tconstructor(plugin: ResolvedPlugin, factoryOptions: PluginContextFactoryOptions) {\n\t\tthis.plugin = plugin;\n\t\tthis.contextFactory = new PluginContextFactory(factoryOptions);\n\t\tthis.trustedProxyHeaders = factoryOptions.trustedProxyHeaders ?? [];\n\t}\n\n\t/**\n\t * Invoke a route by name\n\t */\n\tasync invoke(routeName: string, options: InvokeRouteOptions): Promise<RouteResult> {\n\t\tconst route = this.plugin.routes[routeName];\n\n\t\tif (!route) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"ROUTE_NOT_FOUND\",\n\t\t\t\t\tmessage: `Route \"${routeName}\" not found in plugin \"${this.plugin.id}\"`,\n\t\t\t\t},\n\t\t\t\tstatus: 404,\n\t\t\t};\n\t\t}\n\n\t\t// Validate input if schema is provided\n\t\tlet validatedInput: unknown;\n\t\tif (route.input) {\n\t\t\tconst parseResult = route.input.safeParse(options.body);\n\t\t\tif (!parseResult.success) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: \"Invalid request body\",\n\t\t\t\t\t\tdetails: z.formatError(parseResult.error),\n\t\t\t\t\t},\n\t\t\t\t\tstatus: 400,\n\t\t\t\t};\n\t\t\t}\n\t\t\tvalidatedInput = parseResult.data;\n\t\t} else {\n\t\t\tvalidatedInput = options.body;\n\t\t}\n\n\t\t// Create route context\n\t\tconst baseContext = this.contextFactory.createContext(this.plugin);\n\t\tconst routeContext: RouteContext = {\n\t\t\t...baseContext,\n\t\t\tinput: validatedInput,\n\t\t\t// The body is already parsed into `input`; guard `ctx.request`'s\n\t\t\t// body-reading methods so a re-read fails with an actionable message.\n\t\t\t// Metadata extraction uses the original request (headers only).\n\t\t\trequest: guardConsumedRequestBody(options.request),\n\t\t\trequestMeta: extractRequestMeta(options.request, this.trustedProxyHeaders),\n\t\t\tuser: options.user,\n\t\t\tui: options.ui,\n\t\t};\n\n\t\t// Execute handler\n\t\ttry {\n\t\t\tconst result = await route.handler(routeContext);\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: result,\n\t\t\t\tstatus: 200,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (error instanceof MediaUsageActivationWriteBlockedError) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: { code: error.code, message: error.message },\n\t\t\t\t\tstatus: error.status,\n\t\t\t\t};\n\t\t\t}\n\t\t\t// Handle known error types\n\t\t\tif (error instanceof PluginRouteError) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: error.code,\n\t\t\t\t\t\tmessage: error.message,\n\t\t\t\t\t\tdetails: error.details,\n\t\t\t\t\t},\n\t\t\t\t\tstatus: error.status,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Unknown error -- log internally, return generic message\n\t\t\tconsole.error(`[plugin:${this.plugin.id}] Route handler failed:`, error);\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INTERNAL_ERROR\",\n\t\t\t\t\tmessage: \"An internal error occurred\",\n\t\t\t\t},\n\t\t\t\tstatus: 500,\n\t\t\t};\n\t\t}\n\t}\n\n\t/**\n\t * Get all route names\n\t */\n\tgetRouteNames(): string[] {\n\t\treturn Object.keys(this.plugin.routes);\n\t}\n\n\t/**\n\t * Check if a route exists\n\t */\n\thasRoute(name: string): boolean {\n\t\treturn name in this.plugin.routes;\n\t}\n\n\t/**\n\t * Get route metadata without invoking the handler.\n\t * Returns null if the route doesn't exist.\n\t */\n\tgetRouteMeta(name: string): RouteMeta | null {\n\t\tconst route: PluginRoute | undefined = this.plugin.routes[name];\n\t\tif (!route) return null;\n\t\treturn buildRouteMeta(route);\n\t}\n}\n\n/**\n * Error class for plugin routes\n * Allows plugins to return structured errors with specific HTTP status codes\n */\nexport class PluginRouteError extends Error {\n\tconstructor(\n\t\tpublic code: string,\n\t\tmessage: string,\n\t\tpublic status: number = 400,\n\t\tpublic details?: unknown,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"PluginRouteError\";\n\t}\n\n\t/**\n\t * Create a bad request error (400)\n\t */\n\tstatic badRequest(message: string, details?: unknown): PluginRouteError {\n\t\treturn new PluginRouteError(\"BAD_REQUEST\", message, 400, details);\n\t}\n\n\t/**\n\t * Create an unauthorized error (401)\n\t */\n\tstatic unauthorized(message: string = \"Unauthorized\"): PluginRouteError {\n\t\treturn new PluginRouteError(\"UNAUTHORIZED\", message, 401);\n\t}\n\n\t/**\n\t * Create a forbidden error (403)\n\t */\n\tstatic forbidden(message: string = \"Forbidden\"): PluginRouteError {\n\t\treturn new PluginRouteError(\"FORBIDDEN\", message, 403);\n\t}\n\n\t/**\n\t * Create a not found error (404)\n\t */\n\tstatic notFound(message: string = \"Not found\"): PluginRouteError {\n\t\treturn new PluginRouteError(\"NOT_FOUND\", message, 404);\n\t}\n\n\t/**\n\t * Create a conflict error (409)\n\t */\n\tstatic conflict(message: string, details?: unknown): PluginRouteError {\n\t\treturn new PluginRouteError(\"CONFLICT\", message, 409, details);\n\t}\n\n\t/**\n\t * Create an internal error (500)\n\t */\n\tstatic internal(message: string = \"Internal error\"): PluginRouteError {\n\t\treturn new PluginRouteError(\"INTERNAL_ERROR\", message, 500);\n\t}\n}\n\n/**\n * Registry for all plugin route handlers\n */\nexport class PluginRouteRegistry {\n\tprivate handlers: Map<string, PluginRouteHandler> = new Map();\n\n\tconstructor(private factoryOptions: PluginContextFactoryOptions) {}\n\n\t/**\n\t * Register a plugin's routes\n\t */\n\tregister(plugin: ResolvedPlugin): void {\n\t\tconst handler = new PluginRouteHandler(plugin, this.factoryOptions);\n\t\tthis.handlers.set(plugin.id, handler);\n\t}\n\n\t/**\n\t * Unregister a plugin's routes\n\t */\n\tunregister(pluginId: string): void {\n\t\tthis.handlers.delete(pluginId);\n\t}\n\n\t/**\n\t * Invoke a plugin route\n\t */\n\tasync invoke(\n\t\tpluginId: string,\n\t\trouteName: string,\n\t\toptions: InvokeRouteOptions,\n\t): Promise<RouteResult> {\n\t\tconst handler = this.handlers.get(pluginId);\n\n\t\tif (!handler) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"PLUGIN_NOT_FOUND\",\n\t\t\t\t\tmessage: `Plugin \"${pluginId}\" not found`,\n\t\t\t\t},\n\t\t\t\tstatus: 404,\n\t\t\t};\n\t\t}\n\n\t\treturn handler.invoke(routeName, options);\n\t}\n\n\t/**\n\t * Get all registered plugin IDs\n\t */\n\tgetPluginIds(): string[] {\n\t\treturn [...this.handlers.keys()];\n\t}\n\n\t/**\n\t * Get routes for a plugin\n\t */\n\tgetRoutes(pluginId: string): string[] {\n\t\treturn this.handlers.get(pluginId)?.getRouteNames() ?? [];\n\t}\n\n\t/**\n\t * Get route metadata for a specific plugin route.\n\t * Returns null if the plugin or route doesn't exist.\n\t */\n\tgetRouteMeta(pluginId: string, routeName: string): RouteMeta | null {\n\t\tconst handler = this.handlers.get(pluginId);\n\t\tif (!handler) return null;\n\t\treturn handler.getRouteMeta(routeName);\n\t}\n}\n\n/**\n * Create a route registry\n */\nexport function createRouteRegistry(\n\tfactoryOptions: PluginContextFactoryOptions,\n): PluginRouteRegistry {\n\treturn new PluginRouteRegistry(factoryOptions);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiCA,MAAM,wBAAwB,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAe;CAAQ;CAAY;CAAQ,CAAC;;;;;;;;;AAUnG,SAAS,yBAAyB,SAA2B;AAC5D,QAAO,IAAI,MAAM,SAAS,EACzB,IAAI,QAAQ,MAAM;AACjB,MAAI,OAAO,SAAS,YAAY,sBAAsB,IAAI,KAAK,CAC9D,cAAa;AACZ,SAAM,IAAI,MACT,wBAAwB,KAAK,mKAEa,KAAK,KAC/C;;EAGH,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM,OAAO;AAC/C,SAAO,OAAO,UAAU,aAAa,MAAM,KAAK,OAAO,GAAG;IAE3D,CAAC;;AAoBH,MAAa,yCAAyC,EAAE,MAAM,gBAAgB;;;;;;AAS9E,SAAgB,eAAe,OAOjB;CACb,MAAM,OAAkB,EAAE,QAAQ,MAAM,WAAW,MAAM;AACzD,KAAI,MAAM,eAAe,OAAW,MAAK,aAAa,MAAM;AAC5D,KAAI,MAAM,YAAY,OAAW,MAAK,UAAU,CAAC,GAAG,MAAM,QAAQ;AAClE,KAAI,MAAM,YAAY,OACrB,MAAK,UAAU;EACd,GAAG,MAAM;EACT,GAAI,MAAM,QAAQ,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,QAAQ,QAAQ,EAAE,GAAG,EAAE;EACxE;AAEF,KAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AAGxD,KAAI,KAAK,UAAU,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,SAAS,EACxF,MAAK,eAAe,MAAM;AAE3B,QAAO;;;;;;AAOR,MAAM,eAAe,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAQ,CAAC;;;;;;;;;;AAWtD,eAAsB,gBACrB,SACA,aACmB;AACnB,KAAI,YAAa,QAAO,8BAA8B,SAAS,YAAY;AAC3E,KAAI,aAAa,IAAI,QAAQ,OAAO,aAAa,CAAC,CACjD,KAAI;AACH,SAAO,MAAM,QAAQ,MAAM;SACpB;AAEP;;CAIF,MAAM,SAAS,IAAI,IAAI,QAAQ,IAAI,CAAC;CACpC,MAAM,QAA2C,EAAE;AACnD,MAAK,MAAM,OAAO,IAAI,IAAI,OAAO,MAAM,CAAC,EAAE;EACzC,MAAM,SAAS,OAAO,OAAO,IAAI;AACjC,QAAM,OAAO,OAAO,SAAS,IAAI,SAAS,OAAO;;AAElD,QAAO;;;;;;;AAmCR,SAAgB,kBAAkB,MAAkC;AACnE,QAAO;EACN,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU,aAAa;EAC7F;;;;;AAuBF,IAAa,qBAAb,MAAgC;CAC/B,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAY,QAAwB,gBAA6C;AAChF,OAAK,SAAS;AACd,OAAK,iBAAiB,IAAI,qBAAqB,eAAe;AAC9D,OAAK,sBAAsB,eAAe,uBAAuB,EAAE;;;;;CAMpE,MAAM,OAAO,WAAmB,SAAmD;EAClF,MAAM,QAAQ,KAAK,OAAO,OAAO;AAEjC,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,UAAU,UAAU,yBAAyB,KAAK,OAAO,GAAG;IACrE;GACD,QAAQ;GACR;EAIF,IAAI;AACJ,MAAI,MAAM,OAAO;GAChB,MAAM,cAAc,MAAM,MAAM,UAAU,QAAQ,KAAK;AACvD,OAAI,CAAC,YAAY,QAChB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT,SAAS,EAAE,YAAY,YAAY,MAAM;KACzC;IACD,QAAQ;IACR;AAEF,oBAAiB,YAAY;QAE7B,kBAAiB,QAAQ;EAK1B,MAAM,eAA6B;GAClC,GAFmB,KAAK,eAAe,cAAc,KAAK,OAAO;GAGjE,OAAO;GAIP,SAAS,yBAAyB,QAAQ,QAAQ;GAClD,aAAa,mBAAmB,QAAQ,SAAS,KAAK,oBAAoB;GAC1E,MAAM,QAAQ;GACd,IAAI,QAAQ;GACZ;AAGD,MAAI;AAEH,UAAO;IACN,SAAS;IACT,MAHc,MAAM,MAAM,QAAQ,aAAa;IAI/C,QAAQ;IACR;WACO,OAAO;AACf,OAAI,iBAAiB,sCACpB,QAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM,MAAM;KAAM,SAAS,MAAM;KAAS;IACnD,QAAQ,MAAM;IACd;AAGF,OAAI,iBAAiB,iBACpB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM,MAAM;KACZ,SAAS,MAAM;KACf,SAAS,MAAM;KACf;IACD,QAAQ,MAAM;IACd;AAIF,WAAQ,MAAM,WAAW,KAAK,OAAO,GAAG,0BAA0B,MAAM;AACxE,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD,QAAQ;IACR;;;;;;CAOH,gBAA0B;AACzB,SAAO,OAAO,KAAK,KAAK,OAAO,OAAO;;;;;CAMvC,SAAS,MAAuB;AAC/B,SAAO,QAAQ,KAAK,OAAO;;;;;;CAO5B,aAAa,MAAgC;EAC5C,MAAM,QAAiC,KAAK,OAAO,OAAO;AAC1D,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,eAAe,MAAM;;;;;;;AAQ9B,IAAa,mBAAb,MAAa,yBAAyB,MAAM;CAC3C,YACC,AAAO,MACP,SACA,AAAO,SAAiB,KACxB,AAAO,SACN;AACD,QAAM,QAAQ;EALP;EAEA;EACA;AAGP,OAAK,OAAO;;;;;CAMb,OAAO,WAAW,SAAiB,SAAqC;AACvE,SAAO,IAAI,iBAAiB,eAAe,SAAS,KAAK,QAAQ;;;;;CAMlE,OAAO,aAAa,UAAkB,gBAAkC;AACvE,SAAO,IAAI,iBAAiB,gBAAgB,SAAS,IAAI;;;;;CAM1D,OAAO,UAAU,UAAkB,aAA+B;AACjE,SAAO,IAAI,iBAAiB,aAAa,SAAS,IAAI;;;;;CAMvD,OAAO,SAAS,UAAkB,aAA+B;AAChE,SAAO,IAAI,iBAAiB,aAAa,SAAS,IAAI;;;;;CAMvD,OAAO,SAAS,SAAiB,SAAqC;AACrE,SAAO,IAAI,iBAAiB,YAAY,SAAS,KAAK,QAAQ;;;;;CAM/D,OAAO,SAAS,UAAkB,kBAAoC;AACrE,SAAO,IAAI,iBAAiB,kBAAkB,SAAS,IAAI;;;;;;AAO7D,IAAa,sBAAb,MAAiC;CAChC,AAAQ,2BAA4C,IAAI,KAAK;CAE7D,YAAY,AAAQ,gBAA6C;EAA7C;;;;;CAKpB,SAAS,QAA8B;EACtC,MAAM,UAAU,IAAI,mBAAmB,QAAQ,KAAK,eAAe;AACnE,OAAK,SAAS,IAAI,OAAO,IAAI,QAAQ;;;;;CAMtC,WAAW,UAAwB;AAClC,OAAK,SAAS,OAAO,SAAS;;;;;CAM/B,MAAM,OACL,UACA,WACA,SACuB;EACvB,MAAM,UAAU,KAAK,SAAS,IAAI,SAAS;AAE3C,MAAI,CAAC,QACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,WAAW,SAAS;IAC7B;GACD,QAAQ;GACR;AAGF,SAAO,QAAQ,OAAO,WAAW,QAAQ;;;;;CAM1C,eAAyB;AACxB,SAAO,CAAC,GAAG,KAAK,SAAS,MAAM,CAAC;;;;;CAMjC,UAAU,UAA4B;AACrC,SAAO,KAAK,SAAS,IAAI,SAAS,EAAE,eAAe,IAAI,EAAE;;;;;;CAO1D,aAAa,UAAkB,WAAqC;EACnE,MAAM,UAAU,KAAK,SAAS,IAAI,SAAS;AAC3C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,aAAa,UAAU"}

package/dist/runner-3gfxRsJG.d.mts

@@ -1,68 +0,0 @@
-import { t as Database } from "./types-CbwqGOXm.mjs";
-import { Kysely } from "kysely";
-import { Migrator } from "kysely/migration";
-
-//#region src/database/migrations/runner.d.ts
-/** Ordered names from the statically registered migration set. */
-declare const MIGRATION_NAMES: readonly string[];
-interface MigrationStatus {
-  applied: string[];
-  pending: string[];
-}
-interface ExactMigrationStatus {
-  knownApplied: string[];
-  pending: string[];
-  unknownApplied: string[];
-}
-interface MigrationOptions {
-  migrationTableSchema?: string;
-  /**
-   * Override how long to wait for a concurrent migrator to finish before
-   * giving up. Defaults to MIGRATION_RACE_WAIT_MS; tests shorten it so the
-   * give-up path doesn't take 10 seconds per case.
-   */
-  raceWaitMs?: number;
-}
-/**
- * Get migration status
- */
-declare function getMigrationStatus(db: Kysely<Database>, options?: MigrationOptions): Promise<MigrationStatus>;
-/**
- * Read exact migration status without invoking Kysely's migration
- * introspection. Registered names retain execution order; unknown database
- * records are sorted so reports remain stable across dialects.
- */
-declare function getExactMigrationStatus(db: Kysely<Database>, options?: MigrationOptions): Promise<ExactMigrationStatus>;
-/**
- * Run all pending migrations.
- *
- * Includes a fast-path: if the migration table already exists and contains
- * at least MIGRATION_COUNT rows, all migrations this build knows about have
- * been applied and we can skip the Kysely Migrator entirely. This avoids
- * the expensive `pragma_table_info` introspection that Kysely runs for
- * every table in the database (twice!) just to check if the migration
- * tables exist. On D1 with ~57 tables, that's ~116 queries saved per init.
- *
- * Concurrent-migration safety: the Kysely Migrator's `acquireMigrationLock`
- * is a no-op for SQLite, so two callers running this concurrently against the
- * same database will both try to apply pending migrations. (D1 and Postgres
- * take a lock, and the loser gets the busy error handled below.) SQLite
- * serializes the writes, but the loser still surfaces a
- * `UNIQUE constraint failed: _emdash_migrations.name` error. We treat that
- * specific error as benign: another caller is already applying the same
- * schema. We wait for the concurrent migrator to finish, then return
- * success. This matches the user-observable expectation that running
- * migrations twice in a row is a no-op.
- */
-declare function runMigrations(db: Kysely<Database>, options?: MigrationOptions): Promise<{
-  applied: string[];
-}>;
-/**
- * Rollback the last migration
- */
-declare function rollbackMigration(db: Kysely<Database>, options?: MigrationOptions): Promise<{
-  rolledBack: string | null;
-}>;
-//#endregion
-export { getMigrationStatus as a, getExactMigrationStatus as i, MIGRATION_NAMES as n, rollbackMigration as o, MigrationStatus as r, runMigrations as s, ExactMigrationStatus as t };
-//# sourceMappingURL=runner-3gfxRsJG.d.mts.map

package/dist/runner-3gfxRsJG.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"runner-3gfxRsJG.d.mts","names":[],"sources":["../src/database/migrations/runner.ts"],"mappings":";;;;;;cAkLa,eAAA;AAAA,UAeI,eAAA;EAChB,OAAA;EACA,OAAA;AAAA;AAAA,UAGgB,oBAAA;EAChB,YAAA;EACA,OAAA;EACA,cAAA;AAAA;AAAA,UAuCgB,gBAAA;EAChB,oBAAA;EAyBS;;;;;EAnBT,UAAA;AAAA;;;AAmLD;iBAnKsB,kBAAA,CACrB,EAAA,EAAI,MAAA,CAAO,QAAA,GACX,OAAA,GAAU,gBAAA,GACR,OAAA,CAAQ,eAAA;;;;;;iBAgKW,uBAAA,CACrB,EAAA,EAAI,MAAA,CAAO,QAAA,GACX,OAAA,GAAU,gBAAA,GACR,OAAA,CAAQ,oBAAA;;;;;AAkDX;;;;;;;;;;;;;;;;;iBAAsB,aAAA,CACrB,EAAA,EAAI,MAAA,CAAO,QAAA,GACX,OAAA,GAAU,gBAAA,GACR,OAAA;EAAU,OAAA;AAAA;;;;iBA8DS,iBAAA,CACrB,EAAA,EAAI,MAAA,CAAO,QAAA,GACX,OAAA,GAAU,gBAAA,GACR,OAAA;EAAU,UAAA;AAAA"}