emdash 0.40.0 → 0.41.0

package/dist/schema-Gqcl-8G4.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-Gqcl-8G4.mjs","names":[],"sources":["../src/database/reference-backfill.ts","../src/api/handlers/schema.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\nimport { sql } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { chunks, SQL_BATCH_SIZE } from \"../utils/chunks.js\";\nimport { currentTimestampValue, tableExists } from \"./dialect-helpers.js\";\nimport { REFERENCE_INSERT_BATCH_SIZE } from \"./repositories/relation.js\";\nimport { validateIdentifier } from \"./validate.js\";\n\n/** What to copy, and which relation to copy it into. */\nexport interface ReferenceBackfill {\n\t/** Collection owning the field, the relation's parent end. */\n\tparentCollection: string;\n\t/** The relation's child end, where the column's ids resolve. */\n\tchildCollection: string;\n\tfieldSlug: string;\n\trelationId: string;\n\t/** The relation's limit for this side. `null` is unlimited. */\n\tmaxChildren: number | null;\n}\n\n/** The ids one column value holds. */\nfunction parseColumnIds(value: unknown): string[] {\n\tif (typeof value !== \"string\" || value.length === 0) return [];\n\tif (!value.startsWith(\"[\")) return [value];\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(value);\n\t} catch {\n\t\treturn [value];\n\t}\n\tif (!Array.isArray(parsed)) return [];\n\treturn parsed.filter((entry): entry is string => typeof entry === \"string\" && entry.length > 0);\n}\n\n/**\n * Copy a reference field's column values in as relation edges.\n *\n * A reference field created before relations existed holds its selection in a\n * TEXT column: one entry id, or a JSON array of them for a multiple-reference\n * field (`serializeValue` stringifies the array). Binding the field to a relation\n * moves that selection into `_emdash_content_references`, and this is the copy.\n *\n * The column is not touched. On a site that predates pickers it was a free-text\n * box, so it can hold anything an editor typed, and only the ids that resolve to\n * an entry become edges — clearing it would destroy the rest. Nothing writes to\n * it once the field is bound and typegen stops declaring the key, but a content\n * read still reports the frozen value in `data` beside the live `references`.\n *\n * Both ends of an edge are translation groups, so the locale siblings of one\n * entry contribute to the same parent group. They are read in a fixed order and\n * their ids deduped, and the result is capped at the relation's limit — a\n * single-reference field whose locale rows point at different entries keeps the\n * first rather than storing a selection the relation forbids.\n *\n * Every insert is `ON CONFLICT DO NOTHING` against the edge table's unique\n * constraint, so running this twice adds nothing the first run already wrote.\n *\n * Migration 077 carries its own copy of this for the upgrade path. A migration\n * must not share a module with the handler layer — the bundler then puts the two\n * in chunks that cycle through the migration runner, and the built package throws\n * on import — and a shipped migration has to keep behaving the way it did anyway.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- runs against a migration's untyped Kysely as well as the app's\nexport async function backfillReferenceEdges(\n\tdb: Kysely<any>,\n\tbackfill: ReferenceBackfill,\n): Promise<void> {\n\tconst parentTable = `ec_${backfill.parentCollection}`;\n\tconst childTable = `ec_${backfill.childCollection}`;\n\tvalidateIdentifier(parentTable, \"content table name\");\n\tvalidateIdentifier(childTable, \"content table name\");\n\tvalidateIdentifier(backfill.fieldSlug, \"content field name\");\n\n\tif (!(await tableExists(db, parentTable)) || !(await tableExists(db, childTable))) return;\n\n\tconst entries = await sql<{ translation_group: string | null; value: unknown }>`\n\t\tSELECT translation_group, ${sql.ref(backfill.fieldSlug)} AS value\n\t\tFROM ${sql.ref(parentTable)}\n\t\tWHERE ${sql.ref(backfill.fieldSlug)} IS NOT NULL\n\t\tORDER BY locale, id\n\t`.execute(db);\n\n\t// Parent group -> the child entry ids it selects, in order, deduped.\n\tconst selections = new Map<string, string[]>();\n\tfor (const entry of entries.rows) {\n\t\tif (!entry.translation_group) continue;\n\t\tconst existing = selections.get(entry.translation_group) ?? [];\n\t\tfor (const id of parseColumnIds(entry.value)) {\n\t\t\tif (!existing.includes(id)) existing.push(id);\n\t\t}\n\t\tselections.set(entry.translation_group, existing);\n\t}\n\tif (selections.size === 0) return;\n\n\tconst childIds = [...new Set([...selections.values()].flat())];\n\tconst childGroups = new Map<string, string>();\n\tfor (const batch of chunks(childIds, SQL_BATCH_SIZE)) {\n\t\t// oxlint-disable-next-line no-await-in-loop -- one statement per bind-parameter batch\n\t\tconst resolved = await sql<{ id: string; translation_group: string | null }>`\n\t\t\tSELECT id, translation_group\n\t\t\tFROM ${sql.ref(childTable)}\n\t\t\tWHERE id IN (${sql.join(batch)})\n\t\t`.execute(db);\n\t\tfor (const row of resolved.rows) {\n\t\t\tif (row.translation_group) childGroups.set(row.id, row.translation_group);\n\t\t}\n\t}\n\n\tconst now = currentTimestampValue(db);\n\tconst rows: Array<{ parentGroup: string; childGroup: string; sortOrder: number }> = [];\n\tfor (const parentGroup of [...selections.keys()].toSorted()) {\n\t\tconst groups: string[] = [];\n\t\tfor (const id of selections.get(parentGroup) ?? []) {\n\t\t\tconst group = childGroups.get(id);\n\t\t\t// An id whose entry is gone is dropped; its value stays in the column.\n\t\t\tif (group && !groups.includes(group)) groups.push(group);\n\t\t}\n\t\tconst selected = backfill.maxChildren === null ? groups : groups.slice(0, backfill.maxChildren);\n\t\tfor (const [sortOrder, childGroup] of selected.entries()) {\n\t\t\trows.push({ parentGroup, childGroup, sortOrder });\n\t\t}\n\t}\n\n\t// This runs inside the transaction that binds the field, so an editor binding\n\t// a field on a large legacy collection waits for it: batch rather than paying\n\t// a round trip per edge.\n\tfor (const batch of chunks(rows, REFERENCE_INSERT_BATCH_SIZE)) {\n\t\tconst values = batch.map(\n\t\t\t(row) =>\n\t\t\t\tsql`(${ulid()}, ${backfill.relationId}, ${row.parentGroup}, ${row.childGroup}, ${row.sortOrder}, ${now})`,\n\t\t);\n\t\t// oxlint-disable-next-line no-await-in-loop -- one statement per bind-parameter batch\n\t\tawait sql`\n\t\t\tINSERT INTO ${sql.ref(\"_emdash_content_references\")}\n\t\t\t\t(id, relation_id, parent_group, child_group, sort_order, created_at)\n\t\t\tVALUES ${sql.join(values)}\n\t\t\tON CONFLICT DO NOTHING\n\t\t`.execute(db);\n\t}\n}\n","/**\n * Schema/collection management handlers\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { backfillReferenceEdges } from \"../../database/reference-backfill.js\";\nimport { RelationRepository, type Relation } from \"../../database/repositories/relation.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport {\n\tinvalidateCollectionCache,\n\tinvalidateSchemaObjectCache,\n} from \"../../object-cache/index.js\";\nimport {\n\tSchemaRegistry,\n\tSchemaError,\n\tinvalidateSchemaCache,\n\ttype Collection,\n\ttype Field,\n\ttype CreateCollectionInput,\n\ttype UpdateCollectionInput,\n\ttype CreateFieldInput,\n\ttype UpdateFieldInput,\n\ttype CollectionWithFields,\n\texpandCollectionBlockFields,\n} from \"../../schema/index.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { fieldsBoundToRelation, handleRelationDelete } from \"./relations.js\";\n\n/** Maximum attempts to allocate a unique relation slug for a new reference\n * field: the base `${collection}_${field}` slug, then `_2` through `_5`. */\nconst RELATION_NAME_MAX_ATTEMPTS = 5;\n\n/** True for SQLite UNIQUE / Postgres unique_violation messages — mirrors the\n * fingerprint used in the relations API handler. */\nfunction isUniqueViolation(error: unknown): boolean {\n\tconst message = error instanceof Error ? error.message.toLowerCase() : \"\";\n\treturn message.includes(\"unique constraint failed\") || message.includes(\"duplicate key\");\n}\n\n/**\n * Create the relation definition backing a new reference field, retrying\n * with a numeric suffix on a name collision. Runs inside the caller's\n * transaction so the relation and the field row it backs commit or roll\n * back together.\n */\nexport async function createFieldRelation(\n\ttrx: Kysely<Database>,\n\tcollectionSlug: string,\n\tfieldSlug: string,\n\tfieldLabel: string,\n\ttargetCollection: string,\n\t/** How many entries the new field may hold. `null` is unlimited. */\n\tmaxChildrenPerParent: number | null = null,\n): Promise<Relation> {\n\tconst registry = new SchemaRegistry(trx);\n\tconst relations = new RelationRepository(trx);\n\n\tconst parent = await registry.getCollection(collectionSlug);\n\tif (!parent) {\n\t\tthrow new SchemaError(`Collection \"${collectionSlug}\" not found`, \"COLLECTION_NOT_FOUND\");\n\t}\n\n\tif (!(await registry.getCollection(targetCollection))) {\n\t\tthrow new SchemaError(\n\t\t\t`Target collection \"${targetCollection}\" not found`,\n\t\t\t\"COLLECTION_NOT_FOUND\",\n\t\t);\n\t}\n\n\tconst baseSlug = `${collectionSlug}_${fieldSlug}`.slice(0, 63);\n\tfor (let attempt = 0; attempt < RELATION_NAME_MAX_ATTEMPTS; attempt++) {\n\t\tconst suffix = attempt === 0 ? \"\" : `_${attempt + 1}`;\n\t\tconst slug = attempt === 0 ? baseSlug : `${baseSlug.slice(0, 63 - suffix.length)}${suffix}`;\n\t\ttry {\n\t\t\treturn await relations.create({\n\t\t\t\tslug,\n\t\t\t\tparentCollection: collectionSlug,\n\t\t\t\tchildCollection: targetCollection,\n\t\t\t\tparentLabel: parent.label,\n\t\t\t\tparentLabelSingular: parent.labelSingular ?? null,\n\t\t\t\tchildLabel: fieldLabel,\n\t\t\t\tmaxChildrenPerParent,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst isLastAttempt = attempt === RELATION_NAME_MAX_ATTEMPTS - 1;\n\t\t\tif (isLastAttempt || !isUniqueViolation(error)) throw error;\n\t\t}\n\t}\n\tthrow new SchemaError(\"Could not allocate a unique relation name\", \"RELATION_NAME_CONFLICT\");\n}\n\n/**\n * Every cache a field change can stale.\n *\n * The schema object-cache namespace is bumped here rather than only by the\n * collection routes: the render path's reference field map lives in that\n * namespace, so a field created, bound, relabelled or deleted would otherwise\n * keep resolving against the shape the collection used to have.\n */\nfunction invalidateFieldCaches(collectionSlug: string): void {\n\tinvalidateCollectionCache(collectionSlug);\n\tinvalidateSchemaCache(collectionSlug);\n\tinvalidateSchemaObjectCache();\n}\n\n/**\n * Bind a reference field that has no relation to one, and copy the selection its\n * column holds in as edges.\n *\n * The column is left in place but stops being written, so the field also stops\n * being `indexed` and `searchable`: an index over a frozen column would answer\n * content-list filters and searches from values that no longer change. Clearing\n * both here drops the field index and re-syncs FTS through `updateField`.\n */\nexport async function bindReferenceField(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\texisting: Field,\n\tinput: UpdateFieldInput,\n\ttargetCollection: string,\n): Promise<Field> {\n\tconst label = input.label ?? existing.label;\n\tconst maxChildren = input.validation?.multiple ? null : 1;\n\n\treturn withTransaction(db, async (trx) => {\n\t\tconst relation = await createFieldRelation(\n\t\t\ttrx,\n\t\t\tcollectionSlug,\n\t\t\texisting.slug,\n\t\t\tlabel,\n\t\t\ttargetCollection,\n\t\t\tmaxChildren,\n\t\t);\n\t\tconst registry = new SchemaRegistry(trx);\n\t\tconst updated = await registry.updateField(collectionSlug, existing.slug, {\n\t\t\t...input,\n\t\t\tindexed: false,\n\t\t\tsearchable: false,\n\t\t\tvalidation: {\n\t\t\t\t...input.validation,\n\t\t\t\trelation: relation.slug,\n\t\t\t\trelationSide: \"parent\",\n\t\t\t\ttargetCollection,\n\t\t\t},\n\t\t});\n\n\t\tawait backfillReferenceEdges(trx, {\n\t\t\tparentCollection: collectionSlug,\n\t\t\tchildCollection: targetCollection,\n\t\t\tfieldSlug: existing.slug,\n\t\t\trelationId: relation.id,\n\t\t\tmaxChildren,\n\t\t});\n\n\t\treturn updated;\n\t});\n}\n\nexport interface CollectionListResponse {\n\titems: Collection[];\n}\n\nexport interface CollectionResponse {\n\titem: Collection;\n}\n\nexport interface CollectionWithFieldsResponse {\n\titem: CollectionWithFields;\n}\n\nexport interface FieldListResponse {\n\titems: Field[];\n}\n\nexport interface FieldResponse {\n\titem: Field;\n}\n\n/**\n * List all collections\n */\nexport async function handleSchemaCollectionList(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<CollectionListResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst items = await registry.listCollections();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { items },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list collections\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get a collection by slug\n */\nexport async function handleSchemaCollectionGet(\n\tdb: Kysely<Database>,\n\tslug: string,\n\toptions?: { includeFields?: boolean },\n): Promise<ApiResult<CollectionResponse | CollectionWithFieldsResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\n\t\tif (options?.includeFields) {\n\t\t\tconst stored = await registry.getCollectionWithFields(slug);\n\t\t\tconst item = stored ? await expandCollectionBlockFields(db, stored) : null;\n\t\t\tif (!item) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\t\tmessage: `Collection not found: ${slug}`,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: { item },\n\t\t\t};\n\t\t}\n\n\t\tconst item = await registry.getCollection(slug);\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Collection not found: ${slug}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: error.code, message: error.message, details: error.details },\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get collection\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Create a collection\n */\nexport async function handleSchemaCollectionCreate(\n\tdb: Kysely<Database>,\n\tinput: CreateCollectionInput,\n): Promise<ApiResult<CollectionResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst item = await registry.createCollection(input);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"[emdash] Failed to create collection:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create collection\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Update a collection\n */\nexport async function handleSchemaCollectionUpdate(\n\tdb: Kysely<Database>,\n\tslug: string,\n\tinput: UpdateCollectionInput,\n): Promise<ApiResult<CollectionResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst item = await registry.updateCollection(slug, input);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_UPDATE_ERROR\",\n\t\t\t\tmessage: \"Failed to update collection\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete a collection\n */\nexport async function handleSchemaCollectionDelete(\n\tdb: Kysely<Database>,\n\tslug: string,\n\toptions?: { force?: boolean },\n): Promise<ApiResult<{ success: boolean }>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\n\t\t// Nothing below can be undone on D1, so a delete that will be refused has\n\t\t// to be refused before the first relation goes.\n\t\tawait registry.assertCollectionDeletable(slug, options);\n\n\t\t// A relation with this collection on either end cannot outlive it: its\n\t\t// edges point at content that is about to be dropped, and the reference\n\t\t// fields viewing it — including ones on the *other* collection — would be\n\t\t// left addressing a collection that no longer exists. The admin lists both\n\t\t// before confirming. Relations go first, so an interrupted delete leaves a\n\t\t// collection with fewer relations rather than a dropped table with\n\t\t// relations still pointing at it.\n\t\tconst relations = new RelationRepository(db);\n\t\tfor (const relation of await relations.findForCollection(slug)) {\n\t\t\tconst removed = await handleRelationDelete(db, relation.id);\n\t\t\tif (!removed.success) return removed;\n\t\t}\n\n\t\tawait registry.deleteCollection(slug, options);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { success: true },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete collection\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List fields for a collection\n */\nexport async function handleSchemaFieldList(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n): Promise<ApiResult<FieldListResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst stored = await registry.getCollectionWithFields(collectionSlug);\n\n\t\tif (!stored) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Collection not found: ${collectionSlug}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst items = (await expandCollectionBlockFields(db, stored)).fields;\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { items },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: error.code, message: error.message, details: error.details },\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_FIELD_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list fields\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get a field\n */\nexport async function handleSchemaFieldGet(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tfieldSlug: string,\n): Promise<ApiResult<FieldResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst collection = await registry.getCollectionWithFields(collectionSlug);\n\t\tconst item = collection\n\t\t\t? (await expandCollectionBlockFields(db, collection)).fields.find(\n\t\t\t\t\t(field) => field.slug === fieldSlug,\n\t\t\t\t)\n\t\t\t: null;\n\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"NOT_FOUND\",\n\t\t\t\t\tmessage: `Field not found: ${fieldSlug} in collection ${collectionSlug}`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: error.code, message: error.message, details: error.details },\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_FIELD_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get field\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Resolve which end of `relation` a field on `collectionSlug` sits on.\n *\n * The side is only a choice when both ends are the same collection — a\n * self-referential relation such as related posts. Anywhere else the matching\n * end decides it, and an explicit side that disagrees is a client error rather\n * than something to silently override.\n */\nfunction resolveBindingSide(\n\trelation: Relation,\n\tcollectionSlug: string,\n\trequested: \"parent\" | \"child\" | undefined,\n): { side: \"parent\" | \"child\"; targetCollection: string } | { error: string } {\n\tconst isParent = relation.parentCollection === collectionSlug;\n\tconst isChild = relation.childCollection === collectionSlug;\n\n\tif (!isParent && !isChild) {\n\t\treturn {\n\t\t\terror: `Relation '${relation.slug}' does not touch collection '${collectionSlug}'`,\n\t\t};\n\t}\n\n\tif (isParent && isChild) {\n\t\tconst side = requested ?? \"parent\";\n\t\treturn {\n\t\t\tside,\n\t\t\ttargetCollection: side === \"parent\" ? relation.childCollection : relation.parentCollection,\n\t\t};\n\t}\n\n\tconst side = isParent ? \"parent\" : \"child\";\n\tif (requested && requested !== side) {\n\t\treturn {\n\t\t\terror: `Collection '${collectionSlug}' is the ${side} of relation '${relation.slug}'`,\n\t\t};\n\t}\n\n\treturn {\n\t\tside,\n\t\ttargetCollection: isParent ? relation.childCollection : relation.parentCollection,\n\t};\n}\n\n/**\n * Create a reference field that views an existing relation.\n *\n * Only one field may view a relation from a given end: two pickers writing the\n * same link set have no defined merge, and the second would silently overwrite\n * the first on every save.\n */\nasync function createBoundReferenceField(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tinput: CreateFieldInput,\n\trelationSlug: string,\n): Promise<ApiResult<FieldResponse>> {\n\tconst relation = await new RelationRepository(db).findBySlug(relationSlug);\n\tif (!relation) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"NOT_FOUND\", message: `Relation '${relationSlug}' not found` },\n\t\t};\n\t}\n\n\tconst resolved = resolveBindingSide(relation, collectionSlug, input.validation?.relationSide);\n\tif (\"error\" in resolved) {\n\t\treturn { success: false, error: { code: \"VALIDATION_ERROR\", message: resolved.error } };\n\t}\n\n\tconst bound = await fieldsBoundToRelation(db, relation.slug);\n\tconst taken = bound.find((field) => field.side === resolved.side);\n\tif (taken) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CONFLICT\",\n\t\t\t\tmessage: `Relation '${relation.slug}' is already picked from by ${taken.collectionSlug}.${taken.fieldSlug}`,\n\t\t\t},\n\t\t};\n\t}\n\n\tconst item = await new SchemaRegistry(db).createField(collectionSlug, {\n\t\t...input,\n\t\tvalidation: {\n\t\t\t...input.validation,\n\t\t\trelation: relation.slug,\n\t\t\trelationSide: resolved.side,\n\t\t\ttargetCollection: resolved.targetCollection,\n\t\t},\n\t});\n\n\tinvalidateFieldCaches(collectionSlug);\n\n\treturn { success: true, data: { item } };\n}\n\n/**\n * Create a field\n */\nexport async function handleSchemaFieldCreate(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tinput: CreateFieldInput,\n): Promise<ApiResult<FieldResponse>> {\n\ttry {\n\t\tif (input.type === \"reference\" && input.validation?.relation) {\n\t\t\treturn await createBoundReferenceField(db, collectionSlug, input, input.validation.relation);\n\t\t}\n\n\t\tif (input.type === \"reference\") {\n\t\t\tconst targetCollection = input.validation?.targetCollection;\n\t\t\tif (!targetCollection) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: \"Reference field requires a target collection\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// The relation def and the field row it backs must commit or roll\n\t\t\t// back together — a field without its relation (or vice versa) is\n\t\t\t// an inconsistent reference field.\n\t\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\t\t// A single-reference field is a one-to-many relation: the limit is the\n\t\t\t\t// relation's, so binding its other end later sees the same rule.\n\t\t\t\tconst relation = await createFieldRelation(\n\t\t\t\t\ttrx,\n\t\t\t\t\tcollectionSlug,\n\t\t\t\t\tinput.slug,\n\t\t\t\t\tinput.label,\n\t\t\t\t\ttargetCollection,\n\t\t\t\t\tinput.validation?.multiple ? null : 1,\n\t\t\t\t);\n\t\t\t\tconst registry = new SchemaRegistry(trx);\n\t\t\t\treturn registry.createField(collectionSlug, {\n\t\t\t\t\t...input,\n\t\t\t\t\tvalidation: {\n\t\t\t\t\t\t...input.validation,\n\t\t\t\t\t\trelation: relation.slug,\n\t\t\t\t\t\trelationSide: \"parent\" as const,\n\t\t\t\t\t\ttargetCollection,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t});\n\n\t\t\t// Content snapshots embed field values; a column change invalidates them.\n\t\t\tinvalidateFieldCaches(collectionSlug);\n\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: { item },\n\t\t\t};\n\t\t}\n\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst item = await registry.createField(collectionSlug, input);\n\n\t\t// Content snapshots embed field values; a column change invalidates them.\n\t\tinvalidateFieldCaches(collectionSlug);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_FIELD_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create field\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Update a field\n */\nexport async function handleSchemaFieldUpdate(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tfieldSlug: string,\n\tinput: UpdateFieldInput,\n): Promise<ApiResult<FieldResponse>> {\n\ttry {\n\t\tconst lookupRegistry = new SchemaRegistry(db);\n\t\tconst existing = await lookupRegistry.getField(collectionSlug, fieldSlug);\n\t\tconst relationSlug = existing?.type === \"reference\" ? existing.validation?.relation : undefined;\n\t\tconst relationSide = existing?.validation?.relationSide;\n\n\t\tif (existing && relationSlug) {\n\t\t\t// The relation's childCollection is immutable — a reference field's\n\t\t\t// target collection can't change after the relation is wired up.\n\t\t\tconst nextTargetCollection = input.validation?.targetCollection;\n\t\t\tif (\n\t\t\t\tnextTargetCollection !== undefined &&\n\t\t\t\tnextTargetCollection !== existing.validation?.targetCollection\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: \"Cannot change the target collection of an existing reference field\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// `relation` and `targetCollection` are immutable identity for a wired\n\t\t\t// reference field. An update that sends `validation: null` or a partial\n\t\t\t// validation object omitting these keys must not be allowed to clear\n\t\t\t// them -- registry.updateField() writes whatever is passed verbatim,\n\t\t\t// which would otherwise orphan the relation row and its edges.\n\t\t\tconst updateInput =\n\t\t\t\tinput.validation !== undefined\n\t\t\t\t\t? {\n\t\t\t\t\t\t\t...input,\n\t\t\t\t\t\t\tvalidation: {\n\t\t\t\t\t\t\t\t...input.validation,\n\t\t\t\t\t\t\t\trelation: existing.validation?.relation,\n\t\t\t\t\t\t\t\trelationSide: existing.validation?.relationSide,\n\t\t\t\t\t\t\t\ttargetCollection: existing.validation?.targetCollection,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: input;\n\n\t\t\tconst item = await withTransaction(db, async (trx) => {\n\t\t\t\tconst registry = new SchemaRegistry(trx);\n\t\t\t\tconst updated = await registry.updateField(collectionSlug, fieldSlug, updateInput);\n\n\t\t\t\tif (input.label !== undefined && input.label !== existing.label) {\n\t\t\t\t\tconst relations = new RelationRepository(trx);\n\t\t\t\t\tconst relation = await relations.findBySlug(relationSlug);\n\t\t\t\t\t// The field's label is the role name for the side it binds, so\n\t\t\t\t\t// renaming the field renames that role and leaves the other alone.\n\t\t\t\t\tif (relation) {\n\t\t\t\t\t\tawait relations.update(\n\t\t\t\t\t\t\trelation.id,\n\t\t\t\t\t\t\trelationSide === \"child\" ? { parentLabel: input.label } : { childLabel: input.label },\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn updated;\n\t\t\t});\n\n\t\t\tinvalidateFieldCaches(collectionSlug);\n\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: { item },\n\t\t\t};\n\t\t}\n\n\t\t// Giving an unbound reference field a target collection binds it: a field\n\t\t// created before relations existed, or one whose target could not be\n\t\t// resolved on upgrade, becomes a picker here rather than needing to be\n\t\t// deleted and recreated.\n\t\tconst bindTarget = existing?.type === \"reference\" ? input.validation?.targetCollection : null;\n\t\tif (existing && bindTarget) {\n\t\t\tconst item = await bindReferenceField(db, collectionSlug, existing, input, bindTarget);\n\t\t\tinvalidateFieldCaches(collectionSlug);\n\t\t\treturn { success: true, data: { item } };\n\t\t}\n\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst item = await registry.updateField(collectionSlug, fieldSlug, input);\n\n\t\tinvalidateFieldCaches(collectionSlug);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_FIELD_UPDATE_ERROR\",\n\t\t\t\tmessage: \"Failed to update field\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete a field\n */\n/**\n * Delete a field.\n *\n * For a reference field, `deleteRelation` also takes the relation, its edges,\n * and the field bound to its other side. It is opt-in on the wire and checked\n * by default in the admin's confirm dialog, which enumerates what goes first.\n */\nexport async function handleSchemaFieldDelete(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tfieldSlug: string,\n\toptions?: { deleteRelation?: boolean },\n): Promise<ApiResult<{ success: boolean }>> {\n\ttry {\n\t\tconst lookupRegistry = new SchemaRegistry(db);\n\t\tconst existing = await lookupRegistry.getField(collectionSlug, fieldSlug);\n\t\tconst relationSlug = existing?.type === \"reference\" ? existing.validation?.relation : undefined;\n\n\t\tif (relationSlug && options?.deleteRelation) {\n\t\t\t// Taking the relation takes its edges and the field bound to its other\n\t\t\t// side, so route through the shared cascade rather than deleting the\n\t\t\t// field here and the relation separately.\n\t\t\tconst relations = new RelationRepository(db);\n\t\t\tconst relation = await relations.findBySlug(relationSlug);\n\t\t\tif (relation) {\n\t\t\t\tconst result = await handleRelationDelete(db, relation.id);\n\t\t\t\tif (!result.success) return result;\n\t\t\t\tinvalidateFieldCaches(collectionSlug);\n\t\t\t\treturn { success: true, data: { success: true } };\n\t\t\t}\n\t\t}\n\n\t\tconst registry = new SchemaRegistry(db);\n\t\tawait registry.deleteField(collectionSlug, fieldSlug);\n\n\t\tinvalidateFieldCaches(collectionSlug);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { success: true },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_FIELD_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete field\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Reorder collections in the admin sidebar\n */\nexport async function handleSchemaCollectionReorder(\n\tdb: Kysely<Database>,\n\tslugs: string[],\n): Promise<ApiResult<{ success: boolean }>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tawait registry.reorderCollections(slugs);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { success: true },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"[emdash] Failed to reorder collections:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_COLLECTION_REORDER_ERROR\",\n\t\t\t\tmessage: \"Failed to reorder collections\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Reorder fields\n */\nexport async function handleSchemaFieldReorder(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tfieldSlugs: string[],\n): Promise<ApiResult<{ success: boolean }>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tawait registry.reorderFields(collectionSlug, fieldSlugs);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { success: true },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"SCHEMA_FIELD_REORDER_ERROR\",\n\t\t\t\tmessage: \"Failed to reorder fields\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ============================================\n// Orphaned Table Discovery\n// ============================================\n\nexport interface OrphanedTable {\n\tslug: string;\n\ttableName: string;\n\trowCount: number;\n}\n\nexport interface OrphanedTableListResponse {\n\titems: OrphanedTable[];\n}\n\n/**\n * List orphaned content tables\n */\nexport async function handleOrphanedTableList(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<OrphanedTableListResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst items = await registry.discoverOrphanedTables();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { items },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"[emdash] Failed to list orphaned tables:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"ORPHAN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list orphaned tables\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Register an orphaned table as a collection\n */\nexport async function handleOrphanedTableRegister(\n\tdb: Kysely<Database>,\n\tslug: string,\n\toptions?: {\n\t\tlabel?: string;\n\t\tlabelSingular?: string;\n\t\tdescription?: string;\n\t},\n): Promise<ApiResult<CollectionResponse>> {\n\ttry {\n\t\tconst registry = new SchemaRegistry(db);\n\t\tconst item = await registry.registerOrphanedTable(slug, options);\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { item },\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: error.code,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tdetails: error.details,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"ORPHAN_REGISTER_ERROR\",\n\t\t\t\tmessage: \"Failed to register orphaned table\",\n\t\t\t},\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,SAAS,eAAe,OAA0B;AACjD,KAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO,EAAE;AAC9D,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,CAAC,MAAM;CAC1C,IAAI;AACJ,KAAI;AACH,WAAS,KAAK,MAAM,MAAM;SACnB;AACP,SAAO,CAAC,MAAM;;AAEf,KAAI,CAAC,MAAM,QAAQ,OAAO,CAAE,QAAO,EAAE;AACrC,QAAO,OAAO,QAAQ,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgChG,eAAsB,uBACrB,IACA,UACgB;CAChB,MAAM,cAAc,MAAM,SAAS;CACnC,MAAM,aAAa,MAAM,SAAS;AAClC,oBAAmB,aAAa,qBAAqB;AACrD,oBAAmB,YAAY,qBAAqB;AACpD,oBAAmB,SAAS,WAAW,qBAAqB;AAE5D,KAAI,CAAE,MAAM,YAAY,IAAI,YAAY,IAAK,CAAE,MAAM,YAAY,IAAI,WAAW,CAAG;CAEnF,MAAM,UAAU,MAAM,GAAyD;8BAClD,IAAI,IAAI,SAAS,UAAU,CAAC;SACjD,IAAI,IAAI,YAAY,CAAC;UACpB,IAAI,IAAI,SAAS,UAAU,CAAC;;GAEnC,QAAQ,GAAG;CAGb,MAAM,6BAAa,IAAI,KAAuB;AAC9C,MAAK,MAAM,SAAS,QAAQ,MAAM;AACjC,MAAI,CAAC,MAAM,kBAAmB;EAC9B,MAAM,WAAW,WAAW,IAAI,MAAM,kBAAkB,IAAI,EAAE;AAC9D,OAAK,MAAM,MAAM,eAAe,MAAM,MAAM,CAC3C,KAAI,CAAC,SAAS,SAAS,GAAG,CAAE,UAAS,KAAK,GAAG;AAE9C,aAAW,IAAI,MAAM,mBAAmB,SAAS;;AAElD,KAAI,WAAW,SAAS,EAAG;CAE3B,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,WAAW,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;CAC9D,MAAM,8BAAc,IAAI,KAAqB;AAC7C,MAAK,MAAM,SAAS,OAAO,UAAU,eAAe,EAAE;EAErD,MAAM,WAAW,MAAM,GAAqD;;UAEpE,IAAI,IAAI,WAAW,CAAC;kBACZ,IAAI,KAAK,MAAM,CAAC;IAC9B,QAAQ,GAAG;AACb,OAAK,MAAM,OAAO,SAAS,KAC1B,KAAI,IAAI,kBAAmB,aAAY,IAAI,IAAI,IAAI,IAAI,kBAAkB;;CAI3E,MAAM,MAAM,sBAAsB,GAAG;CACrC,MAAM,OAA8E,EAAE;AACtF,MAAK,MAAM,eAAe,CAAC,GAAG,WAAW,MAAM,CAAC,CAAC,UAAU,EAAE;EAC5D,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,MAAM,WAAW,IAAI,YAAY,IAAI,EAAE,EAAE;GACnD,MAAM,QAAQ,YAAY,IAAI,GAAG;AAEjC,OAAI,SAAS,CAAC,OAAO,SAAS,MAAM,CAAE,QAAO,KAAK,MAAM;;EAEzD,MAAM,WAAW,SAAS,gBAAgB,OAAO,SAAS,OAAO,MAAM,GAAG,SAAS,YAAY;AAC/F,OAAK,MAAM,CAAC,WAAW,eAAe,SAAS,SAAS,CACvD,MAAK,KAAK;GAAE;GAAa;GAAY;GAAW,CAAC;;AAOnD,MAAK,MAAM,SAAS,OAAO,MAAM,4BAA4B,EAAE;EAC9D,MAAM,SAAS,MAAM,KACnB,QACA,GAAG,IAAI,MAAM,CAAC,IAAI,SAAS,WAAW,IAAI,IAAI,YAAY,IAAI,IAAI,WAAW,IAAI,IAAI,UAAU,IAAI,IAAI,GACxG;AAED,QAAM,GAAG;iBACM,IAAI,IAAI,6BAA6B,CAAC;;YAE3C,IAAI,KAAK,OAAO,CAAC;;IAEzB,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;AC1Gf,MAAM,6BAA6B;;;AAInC,SAAS,kBAAkB,OAAyB;CACnD,MAAM,UAAU,iBAAiB,QAAQ,MAAM,QAAQ,aAAa,GAAG;AACvE,QAAO,QAAQ,SAAS,2BAA2B,IAAI,QAAQ,SAAS,gBAAgB;;;;;;;;AASzF,eAAsB,oBACrB,KACA,gBACA,WACA,YACA,kBAEA,uBAAsC,MAClB;CACpB,MAAM,WAAW,IAAI,eAAe,IAAI;CACxC,MAAM,YAAY,IAAI,mBAAmB,IAAI;CAE7C,MAAM,SAAS,MAAM,SAAS,cAAc,eAAe;AAC3D,KAAI,CAAC,OACJ,OAAM,IAAI,YAAY,eAAe,eAAe,cAAc,uBAAuB;AAG1F,KAAI,CAAE,MAAM,SAAS,cAAc,iBAAiB,CACnD,OAAM,IAAI,YACT,sBAAsB,iBAAiB,cACvC,uBACA;CAGF,MAAM,WAAW,GAAG,eAAe,GAAG,YAAY,MAAM,GAAG,GAAG;AAC9D,MAAK,IAAI,UAAU,GAAG,UAAU,4BAA4B,WAAW;EACtE,MAAM,SAAS,YAAY,IAAI,KAAK,IAAI,UAAU;EAClD,MAAM,OAAO,YAAY,IAAI,WAAW,GAAG,SAAS,MAAM,GAAG,KAAK,OAAO,OAAO,GAAG;AACnF,MAAI;AACH,UAAO,MAAM,UAAU,OAAO;IAC7B;IACA,kBAAkB;IAClB,iBAAiB;IACjB,aAAa,OAAO;IACpB,qBAAqB,OAAO,iBAAiB;IAC7C,YAAY;IACZ;IACA,CAAC;WACM,OAAO;AAEf,OADsB,YAAY,6BAA6B,KAC1C,CAAC,kBAAkB,MAAM,CAAE,OAAM;;;AAGxD,OAAM,IAAI,YAAY,6CAA6C,yBAAyB;;;;;;;;;;AAW7F,SAAS,sBAAsB,gBAA8B;AAC5D,2BAA0B,eAAe;AACzC,uBAAsB,eAAe;AACrC,8BAA6B;;;;;;;;;;;AAY9B,eAAsB,mBACrB,IACA,gBACA,UACA,OACA,kBACiB;CACjB,MAAM,QAAQ,MAAM,SAAS,SAAS;CACtC,MAAM,cAAc,MAAM,YAAY,WAAW,OAAO;AAExD,QAAO,gBAAgB,IAAI,OAAO,QAAQ;EACzC,MAAM,WAAW,MAAM,oBACtB,KACA,gBACA,SAAS,MACT,OACA,kBACA,YACA;EAED,MAAM,UAAU,MADC,IAAI,eAAe,IAAI,CACT,YAAY,gBAAgB,SAAS,MAAM;GACzE,GAAG;GACH,SAAS;GACT,YAAY;GACZ,YAAY;IACX,GAAG,MAAM;IACT,UAAU,SAAS;IACnB,cAAc;IACd;IACA;GACD,CAAC;AAEF,QAAM,uBAAuB,KAAK;GACjC,kBAAkB;GAClB,iBAAiB;GACjB,WAAW,SAAS;GACpB,YAAY,SAAS;GACrB;GACA,CAAC;AAEF,SAAO;GACN;;;;;AA0BH,eAAsB,2BACrB,IAC6C;AAC7C,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,OAJK,MADG,IAAI,eAAe,GAAG,CACV,iBAAiB,EAI9B;GACf;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,0BACrB,IACA,MACA,SACwE;AACxE,KAAI;EACH,MAAM,WAAW,IAAI,eAAe,GAAG;AAEvC,MAAI,SAAS,eAAe;GAC3B,MAAM,SAAS,MAAM,SAAS,wBAAwB,KAAK;GAC3D,MAAM,OAAO,SAAS,MAAM,4BAA4B,IAAI,OAAO,GAAG;AACtE,OAAI,CAAC,KACJ,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS,yBAAyB;KAClC;IACD;AAEF,UAAO;IACN,SAAS;IACT,MAAM,EAAE,MAAM;IACd;;EAGF,MAAM,OAAO,MAAM,SAAS,cAAc,KAAK;AAC/C,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,yBAAyB;IAClC;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS;GAC3E;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,6BACrB,IACA,OACyC;AACzC,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAJI,MADI,IAAI,eAAe,GAAG,CACX,iBAAiB,MAAM,EAIpC;GACd;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,UAAQ,MAAM,yCAAyC,MAAM;AAC7D,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,6BACrB,IACA,MACA,OACyC;AACzC,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAJI,MADI,IAAI,eAAe,GAAG,CACX,iBAAiB,MAAM,MAAM,EAI1C;GACd;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,6BACrB,IACA,MACA,SAC2C;AAC3C,KAAI;EACH,MAAM,WAAW,IAAI,eAAe,GAAG;AAIvC,QAAM,SAAS,0BAA0B,MAAM,QAAQ;EASvD,MAAM,YAAY,IAAI,mBAAmB,GAAG;AAC5C,OAAK,MAAM,YAAY,MAAM,UAAU,kBAAkB,KAAK,EAAE;GAC/D,MAAM,UAAU,MAAM,qBAAqB,IAAI,SAAS,GAAG;AAC3D,OAAI,CAAC,QAAQ,QAAS,QAAO;;AAG9B,QAAM,SAAS,iBAAiB,MAAM,QAAQ;AAE9C,SAAO;GACN,SAAS;GACT,MAAM,EAAE,SAAS,MAAM;GACvB;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,sBACrB,IACA,gBACwC;AACxC,KAAI;EAEH,MAAM,SAAS,MADE,IAAI,eAAe,GAAG,CACT,wBAAwB,eAAe;AAErE,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,yBAAyB;IAClC;GACD;AAKF,SAAO;GACN,SAAS;GACT,MAAM,EAAE,QAJM,MAAM,4BAA4B,IAAI,OAAO,EAAE,QAI9C;GACf;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS;GAC3E;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,gBACA,WACoC;AACpC,KAAI;EAEH,MAAM,aAAa,MADF,IAAI,eAAe,GAAG,CACL,wBAAwB,eAAe;EACzE,MAAM,OAAO,cACT,MAAM,4BAA4B,IAAI,WAAW,EAAE,OAAO,MAC1D,UAAU,MAAM,SAAS,UAC1B,GACA;AAEH,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,oBAAoB,UAAU,iBAAiB;IACxD;GACD;AAGF,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS;GAC3E;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;AAYH,SAAS,mBACR,UACA,gBACA,WAC6E;CAC7E,MAAM,WAAW,SAAS,qBAAqB;CAC/C,MAAM,UAAU,SAAS,oBAAoB;AAE7C,KAAI,CAAC,YAAY,CAAC,QACjB,QAAO,EACN,OAAO,aAAa,SAAS,KAAK,+BAA+B,eAAe,IAChF;AAGF,KAAI,YAAY,SAAS;EACxB,MAAM,OAAO,aAAa;AAC1B,SAAO;GACN;GACA,kBAAkB,SAAS,WAAW,SAAS,kBAAkB,SAAS;GAC1E;;CAGF,MAAM,OAAO,WAAW,WAAW;AACnC,KAAI,aAAa,cAAc,KAC9B,QAAO,EACN,OAAO,eAAe,eAAe,WAAW,KAAK,gBAAgB,SAAS,KAAK,IACnF;AAGF,QAAO;EACN;EACA,kBAAkB,WAAW,SAAS,kBAAkB,SAAS;EACjE;;;;;;;;;AAUF,eAAe,0BACd,IACA,gBACA,OACA,cACoC;CACpC,MAAM,WAAW,MAAM,IAAI,mBAAmB,GAAG,CAAC,WAAW,aAAa;AAC1E,KAAI,CAAC,SACJ,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM;GAAa,SAAS,aAAa,aAAa;GAAc;EAC7E;CAGF,MAAM,WAAW,mBAAmB,UAAU,gBAAgB,MAAM,YAAY,aAAa;AAC7F,KAAI,WAAW,SACd,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAoB,SAAS,SAAS;GAAO;EAAE;CAIxF,MAAM,SADQ,MAAM,sBAAsB,IAAI,SAAS,KAAK,EACxC,MAAM,UAAU,MAAM,SAAS,SAAS,KAAK;AACjE,KAAI,MACH,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS,aAAa,SAAS,KAAK,8BAA8B,MAAM,eAAe,GAAG,MAAM;GAChG;EACD;CAGF,MAAM,OAAO,MAAM,IAAI,eAAe,GAAG,CAAC,YAAY,gBAAgB;EACrE,GAAG;EACH,YAAY;GACX,GAAG,MAAM;GACT,UAAU,SAAS;GACnB,cAAc,SAAS;GACvB,kBAAkB,SAAS;GAC3B;EACD,CAAC;AAEF,uBAAsB,eAAe;AAErC,QAAO;EAAE,SAAS;EAAM,MAAM,EAAE,MAAM;EAAE;;;;;AAMzC,eAAsB,wBACrB,IACA,gBACA,OACoC;AACpC,KAAI;AACH,MAAI,MAAM,SAAS,eAAe,MAAM,YAAY,SACnD,QAAO,MAAM,0BAA0B,IAAI,gBAAgB,OAAO,MAAM,WAAW,SAAS;AAG7F,MAAI,MAAM,SAAS,aAAa;GAC/B,MAAM,mBAAmB,MAAM,YAAY;AAC3C,OAAI,CAAC,iBACJ,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;GAMF,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;IAGrD,MAAM,WAAW,MAAM,oBACtB,KACA,gBACA,MAAM,MACN,MAAM,OACN,kBACA,MAAM,YAAY,WAAW,OAAO,EACpC;AAED,WADiB,IAAI,eAAe,IAAI,CACxB,YAAY,gBAAgB;KAC3C,GAAG;KACH,YAAY;MACX,GAAG,MAAM;MACT,UAAU,SAAS;MACnB,cAAc;MACd;MACA;KACD,CAAC;KACD;AAGF,yBAAsB,eAAe;AAErC,UAAO;IACN,SAAS;IACT,MAAM,EAAE,MAAM;IACd;;EAIF,MAAM,OAAO,MADI,IAAI,eAAe,GAAG,CACX,YAAY,gBAAgB,MAAM;AAG9D,wBAAsB,eAAe;AAErC,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,wBACrB,IACA,gBACA,WACA,OACoC;AACpC,KAAI;EAEH,MAAM,WAAW,MADM,IAAI,eAAe,GAAG,CACP,SAAS,gBAAgB,UAAU;EACzE,MAAM,eAAe,UAAU,SAAS,cAAc,SAAS,YAAY,WAAW;EACtF,MAAM,eAAe,UAAU,YAAY;AAE3C,MAAI,YAAY,cAAc;GAG7B,MAAM,uBAAuB,MAAM,YAAY;AAC/C,OACC,yBAAyB,UACzB,yBAAyB,SAAS,YAAY,iBAE9C,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;GAQF,MAAM,cACL,MAAM,eAAe,SAClB;IACA,GAAG;IACH,YAAY;KACX,GAAG,MAAM;KACT,UAAU,SAAS,YAAY;KAC/B,cAAc,SAAS,YAAY;KACnC,kBAAkB,SAAS,YAAY;KACvC;IACD,GACA;GAEJ,MAAM,OAAO,MAAM,gBAAgB,IAAI,OAAO,QAAQ;IAErD,MAAM,UAAU,MADC,IAAI,eAAe,IAAI,CACT,YAAY,gBAAgB,WAAW,YAAY;AAElF,QAAI,MAAM,UAAU,UAAa,MAAM,UAAU,SAAS,OAAO;KAChE,MAAM,YAAY,IAAI,mBAAmB,IAAI;KAC7C,MAAM,WAAW,MAAM,UAAU,WAAW,aAAa;AAGzD,SAAI,SACH,OAAM,UAAU,OACf,SAAS,IACT,iBAAiB,UAAU,EAAE,aAAa,MAAM,OAAO,GAAG,EAAE,YAAY,MAAM,OAAO,CACrF;;AAIH,WAAO;KACN;AAEF,yBAAsB,eAAe;AAErC,UAAO;IACN,SAAS;IACT,MAAM,EAAE,MAAM;IACd;;EAOF,MAAM,aAAa,UAAU,SAAS,cAAc,MAAM,YAAY,mBAAmB;AACzF,MAAI,YAAY,YAAY;GAC3B,MAAM,OAAO,MAAM,mBAAmB,IAAI,gBAAgB,UAAU,OAAO,WAAW;AACtF,yBAAsB,eAAe;AACrC,UAAO;IAAE,SAAS;IAAM,MAAM,EAAE,MAAM;IAAE;;EAIzC,MAAM,OAAO,MADI,IAAI,eAAe,GAAG,CACX,YAAY,gBAAgB,WAAW,MAAM;AAEzE,wBAAsB,eAAe;AAErC,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAAM;GACd;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAcH,eAAsB,wBACrB,IACA,gBACA,WACA,SAC2C;AAC3C,KAAI;EAEH,MAAM,WAAW,MADM,IAAI,eAAe,GAAG,CACP,SAAS,gBAAgB,UAAU;EACzE,MAAM,eAAe,UAAU,SAAS,cAAc,SAAS,YAAY,WAAW;AAEtF,MAAI,gBAAgB,SAAS,gBAAgB;GAK5C,MAAM,WAAW,MADC,IAAI,mBAAmB,GAAG,CACX,WAAW,aAAa;AACzD,OAAI,UAAU;IACb,MAAM,SAAS,MAAM,qBAAqB,IAAI,SAAS,GAAG;AAC1D,QAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,0BAAsB,eAAe;AACrC,WAAO;KAAE,SAAS;KAAM,MAAM,EAAE,SAAS,MAAM;KAAE;;;AAKnD,QADiB,IAAI,eAAe,GAAG,CACxB,YAAY,gBAAgB,UAAU;AAErD,wBAAsB,eAAe;AAErC,SAAO;GACN,SAAS;GACT,MAAM,EAAE,SAAS,MAAM;GACvB;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,8BACrB,IACA,OAC2C;AAC3C,KAAI;AAEH,QADiB,IAAI,eAAe,GAAG,CACxB,mBAAmB,MAAM;AAExC,SAAO;GACN,SAAS;GACT,MAAM,EAAE,SAAS,MAAM;GACvB;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,UAAQ,MAAM,2CAA2C,MAAM;AAC/D,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,yBACrB,IACA,gBACA,YAC2C;AAC3C,KAAI;AAEH,QADiB,IAAI,eAAe,GAAG,CACxB,cAAc,gBAAgB,WAAW;AAExD,SAAO;GACN,SAAS;GACT,MAAM,EAAE,SAAS,MAAM;GACvB;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAqBH,eAAsB,wBACrB,IACgD;AAChD,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,OAJK,MADG,IAAI,eAAe,GAAG,CACV,wBAAwB,EAIrC;GACf;UACO,OAAO;AACf,UAAQ,MAAM,4CAA4C,MAAM;AAChE,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,4BACrB,IACA,MACA,SAKyC;AACzC,KAAI;AAIH,SAAO;GACN,SAAS;GACT,MAAM,EAAE,MAJI,MADI,IAAI,eAAe,GAAG,CACX,sBAAsB,MAAM,QAAQ,EAIjD;GACd;UACO,OAAO;AACf,MAAI,iBAAiB,YACpB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf;GACD;AAEF,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD"}

package/dist/scopes-BqPOKoKf.mjs

@@ -0,0 +1,34 @@
+import { t as apiError } from "./error-BfsNNrIE.mjs";
+import { a as hasScope } from "./api-tokens-FaG1zPsj.mjs";
+
+//#region src/auth/scopes.ts
+/**
+* Scope enforcement for API token authentication.
+*
+* Routes call `requireScope(locals, "content:write")` alongside role checks.
+* Session-authenticated requests have no scope restrictions (implicit full access).
+* Token-authenticated requests must have the required scope (or "admin").
+*/
+/**
+* Check if the request has a required scope.
+* Returns a 403 Response if the scope is missing, or null if OK.
+*
+* For session-authenticated users (no tokenScopes), always returns null
+* since session auth has implicit full scope.
+*/
+function requireScope(locals, scope) {
+	if (!locals.tokenScopes) return null;
+	if (hasScope(locals.tokenScopes, scope)) return null;
+	return apiError("INSUFFICIENT_SCOPE", `Token lacks required scope: ${scope}`, 403);
+}
+/** Like {@link requireScope}, but satisfied by any of `scopes`. */
+function requireAnyScope(locals, scopes) {
+	const tokenScopes = locals.tokenScopes;
+	if (!tokenScopes) return null;
+	if (scopes.some((scope) => hasScope(tokenScopes, scope))) return null;
+	return apiError("INSUFFICIENT_SCOPE", `Token lacks required scope: ${scopes.join(" or ")}`, 403);
+}
+
+//#endregion
+export { requireScope as n, requireAnyScope as t };
+//# sourceMappingURL=scopes-BqPOKoKf.mjs.map

package/dist/scopes-BqPOKoKf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes-BqPOKoKf.mjs","names":[],"sources":["../src/auth/scopes.ts"],"sourcesContent":["/**\n * Scope enforcement for API token authentication.\n *\n * Routes call `requireScope(locals, \"content:write\")` alongside role checks.\n * Session-authenticated requests have no scope restrictions (implicit full access).\n * Token-authenticated requests must have the required scope (or \"admin\").\n */\n\nimport { apiError } from \"#api/error.js\";\n\nimport { hasScope } from \"./api-tokens.js\";\n\n/**\n * Check if the request has a required scope.\n * Returns a 403 Response if the scope is missing, or null if OK.\n *\n * For session-authenticated users (no tokenScopes), always returns null\n * since session auth has implicit full scope.\n */\nexport function requireScope(locals: { tokenScopes?: string[] }, scope: string): Response | null {\n\t// Session auth = no scope restrictions\n\tif (!locals.tokenScopes) return null;\n\n\tif (hasScope(locals.tokenScopes, scope)) return null;\n\n\treturn apiError(\"INSUFFICIENT_SCOPE\", `Token lacks required scope: ${scope}`, 403);\n}\n\n/** Like {@link requireScope}, but satisfied by any of `scopes`. */\nexport function requireAnyScope(\n\tlocals: { tokenScopes?: string[] },\n\tscopes: readonly string[],\n): Response | null {\n\tconst tokenScopes = locals.tokenScopes;\n\tif (!tokenScopes) return null;\n\tif (scopes.some((scope) => hasScope(tokenScopes, scope))) return null;\n\treturn apiError(\"INSUFFICIENT_SCOPE\", `Token lacks required scope: ${scopes.join(\" or \")}`, 403);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,SAAgB,aAAa,QAAoC,OAAgC;AAEhG,KAAI,CAAC,OAAO,YAAa,QAAO;AAEhC,KAAI,SAAS,OAAO,aAAa,MAAM,CAAE,QAAO;AAEhD,QAAO,SAAS,sBAAsB,+BAA+B,SAAS,IAAI;;;AAInF,SAAgB,gBACf,QACA,QACkB;CAClB,MAAM,cAAc,OAAO;AAC3B,KAAI,CAAC,YAAa,QAAO;AACzB,KAAI,OAAO,MAAM,UAAU,SAAS,aAAa,MAAM,CAAC,CAAE,QAAO;AACjE,QAAO,SAAS,sBAAsB,+BAA+B,OAAO,KAAK,OAAO,IAAI,IAAI"}

package/dist/search-YJKPIEV6.mjs

@@ -0,0 +1,448 @@
+import { u as __exportAll } from "./runner-B3eyB9Gb.mjs";
+import { t as validateIdentifier } from "./validate-DANX1-Qi.mjs";
+import { o as resolveConfiguredLocale } from "./config-CvmjJcVw.mjs";
+import { c as encodeCursor, i as InvalidCursorError, s as decodeCursor } from "./types-aOOxRSx6.mjs";
+import { t as FTSManager } from "./fts-manager-CCaZTp8y.mjs";
+import { s as getDb } from "./loader-CrRPfkHS.mjs";
+import { sql } from "kysely";
+import { toPlainText } from "@portabletext/toolkit";
+
+//#region src/search/query.ts
+/**
+* Marker stored in the `id` slot of a search pagination cursor.
+*
+* Search results are merged from per-collection FTS queries and re-sorted by
+* score, so there is no single stable keyset column to encode (the way
+* `getEmDashCollection` encodes `(orderValue, id)`). We page over the merged,
+* score-sorted set by offset instead, carried as the cursor's `orderValue`.
+* Reusing `encodeCursor`/`decodeCursor` keeps the opaque base64-JSON shape and
+* the `InvalidCursorError` handling consistent with the rest of the API.
+*/
+const SEARCH_CURSOR_MARKER = "search";
+/** Encode the next-page offset into an opaque search cursor. */
+function encodeSearchCursor(offset) {
+	return encodeCursor(String(offset), SEARCH_CURSOR_MARKER);
+}
+/**
+* Decode a search cursor back to its offset. Throws `InvalidCursorError` for a
+* malformed cursor or one that doesn't carry a non-negative integer offset, so
+* a client pagination bug surfaces immediately rather than silently restarting
+* from the first page.
+*/
+/** Upper bound on a decoded search offset, to cap the per-collection row fetch a forged cursor can trigger. */
+const MAX_SEARCH_OFFSET = 1e4;
+function decodeSearchOffset(cursor) {
+	const { orderValue, id } = decodeCursor(cursor);
+	if (id !== SEARCH_CURSOR_MARKER) throw new InvalidCursorError(cursor);
+	const offset = Number(orderValue);
+	if (!Number.isInteger(offset) || offset < 0 || offset > MAX_SEARCH_OFFSET) throw new InvalidCursorError(cursor);
+	return offset;
+}
+/** Pattern to split on whitespace for query term extraction */
+const WHITESPACE_SPLIT_PATTERN = /\s+/;
+const FTS_OPERATORS_PATTERN = /\b(AND|OR|NOT|NEAR)\b/i;
+const DOUBLE_QUOTE_PATTERN = /"/g;
+/**
+* Detect FTS5 query syntax errors. Match specifically on the SQLite FTS5
+* error fingerprints rather than a broad "fts5" / "syntax error" filter
+* (which would also swallow internal table-corruption errors). The two
+* fingerprints we care about are:
+*
+*  - "fts5: syntax error near …" — unbalanced quotes, stray operators,
+*    other malformed user input
+*  - "unknown special query: …" — bare special tokens like `^*` that
+*    parse but don't resolve to a real FTS5 directive
+*/
+function isFts5SyntaxError(error) {
+	if (!(error instanceof Error)) return false;
+	const message = error.message.toLowerCase();
+	return message.includes("fts5: syntax error") || message.includes("unknown special query");
+}
+/**
+* Search across multiple collections
+*
+* Public API that auto-injects the database.
+*
+* @param query - Search query (FTS5 syntax supported)
+* @param options - Search options
+* @returns Search results with pagination
+*
+* @example
+* ```typescript
+* import { search } from "emdash";
+*
+* const results = await search("hello world", {
+*   collections: ["posts", "pages"],
+*   limit: 20
+* });
+* ```
+*/
+async function search(query, options = {}) {
+	return searchWithDb(await getDb(), query, options);
+}
+/**
+* Search across multiple collections (with explicit db)
+*
+* @internal Use `search()` in templates. This variant is for admin routes
+* that already have a database handle.
+*
+* @param db - Kysely database instance
+* @param query - Search query (FTS5 syntax supported)
+* @param options - Search options
+* @returns Search results with pagination
+*/
+async function searchWithDb(db, query, options = {}) {
+	const ftsManager = new FTSManager(db);
+	const limit = options.limit ?? 20;
+	const status = options.status ?? "published";
+	const offset = options.cursor ? decodeSearchOffset(options.cursor) : 0;
+	let collections = options.collections;
+	if (!collections || collections.length === 0) collections = await getSearchableCollections(db);
+	if (collections.length === 0) return { items: [] };
+	const perCollectionLimit = offset + limit + 1;
+	const allResults = [];
+	const titleColumns = await ftsManager.getCollectionsWithTitleColumn(collections);
+	for (const collection of collections) {
+		const config = await ftsManager.getSearchConfig(collection);
+		if (!config?.enabled) continue;
+		const collectionResults = await searchSingleCollection(db, collection, query, {
+			status,
+			locale: options.locale,
+			limit: perCollectionLimit,
+			scope: options.scope
+		}, config.weights, titleColumns.has(collection), config.titleField);
+		allResults.push(...collectionResults);
+	}
+	allResults.sort((a, b) => b.score - a.score);
+	return {
+		items: allResults.slice(offset, offset + limit),
+		nextCursor: allResults.length > offset + limit ? encodeSearchCursor(offset + limit) : void 0
+	};
+}
+/**
+* Search within a single collection
+*
+* @param db - Kysely database instance
+* @param collection - Collection slug
+* @param query - Search query (FTS5 syntax supported)
+* @param options - Search options
+* @returns Search results with pagination
+*
+* @example
+* ```typescript
+* const results = await searchCollection(db, "posts", "hello world", {
+*   limit: 10
+* });
+* ```
+*/
+async function searchCollection(db, collection, query, options = {}) {
+	const config = await new FTSManager(db).getSearchConfig(collection);
+	if (!config?.enabled) return { items: [] };
+	const limit = options.limit ?? 20;
+	const offset = options.cursor ? decodeSearchOffset(options.cursor) : 0;
+	const fetched = await searchSingleCollection(db, collection, query, {
+		status: options.status,
+		locale: options.locale,
+		limit: offset + limit + 1,
+		scope: options.scope
+	}, config.weights, void 0, config.titleField);
+	return {
+		items: fetched.slice(offset, offset + limit),
+		nextCursor: fetched.length > offset + limit ? encodeSearchCursor(offset + limit) : void 0
+	};
+}
+/**
+* Internal function to search a single collection
+*/
+async function searchSingleCollection(db, collection, query, options, weights, hasTitle, titleField) {
+	validateIdentifier(collection, "collection slug");
+	const ftsManager = new FTSManager(db);
+	const ftsTable = ftsManager.getFtsTableName(collection);
+	const contentTable = ftsManager.getContentTableName(collection);
+	const limit = options.limit ?? 20;
+	const status = options.status ?? "published";
+	const locale = options.locale ? resolveConfiguredLocale(options.locale) : void 0;
+	if (!await ftsManager.ftsTableExists(collection)) return [];
+	const escapedQuery = escapeQuery(query);
+	if (!escapedQuery) return [];
+	const searchableFields = await ftsManager.getSearchableFields(collection);
+	let matchQuery = escapedQuery;
+	if (options.scope === "title") {
+		const titleColumn = titleField && searchableFields.includes(titleField) ? titleField : searchableFields.includes("title") ? "title" : void 0;
+		if (!titleColumn) return [];
+		validateIdentifier(titleColumn, "title field");
+		matchQuery = `${titleColumn} : (${escapeQuery(query, false)})`;
+	}
+	let titleExpr;
+	if (titleField) {
+		validateIdentifier(titleField, "title field");
+		titleExpr = sql`c.${sql.ref(titleField)}`;
+	} else titleExpr = hasTitle ?? await ftsManager.hasTitleColumn(collection) ? sql`c.title` : sql`NULL`;
+	let bm25Args = "";
+	if (weights && searchableFields.length > 0) {
+		const weightValues = ["0", "0"];
+		for (const field of searchableFields) weightValues.push(String(weights[field] ?? 1));
+		bm25Args = weightValues.join(", ");
+	}
+	const bm25Expr = bm25Args ? `bm25("${ftsTable}", ${bm25Args})` : `bm25("${ftsTable}")`;
+	let results;
+	try {
+		results = await sql`
+		SELECT
+			c.id,
+			c.slug,
+			c.locale,
+			${titleExpr} as title,
+			snippet("${sql.raw(ftsTable)}", 2, '<mark>', '</mark>', '...', 32) as snippet,
+			${sql.raw(bm25Expr)} as score
+		FROM "${sql.raw(ftsTable)}" f
+		JOIN "${sql.raw(contentTable)}" c ON f.id = c.id
+		WHERE "${sql.raw(ftsTable)}" MATCH ${matchQuery}
+		AND c.status = ${status}
+		AND c.deleted_at IS NULL
+		${locale ? sql`AND c.locale = ${locale}` : sql``}
+		ORDER BY score
+		LIMIT ${limit}
+	`.execute(db);
+	} catch (error) {
+		if (isFts5SyntaxError(error)) return [];
+		throw error;
+	}
+	return results.rows.map((row) => ({
+		collection,
+		id: row.id,
+		slug: row.slug,
+		locale: row.locale,
+		title: row.title ?? void 0,
+		snippet: row.snippet === null ? void 0 : sanitizeSnippet(row.snippet),
+		score: Math.abs(row.score)
+	}));
+}
+const SNIPPET_AMP_RE = /&/g;
+const SNIPPET_LT_RE = /</g;
+const SNIPPET_GT_RE = />/g;
+const SNIPPET_QUOT_RE = /"/g;
+const SNIPPET_APOS_RE = /'/g;
+/**
+* Make an FTS5 snippet safe to render with `set:html` / `innerHTML`.
+*
+* SQLite's `snippet()` function splices literal `<mark>` and `</mark>`
+* markers around matched terms but does not escape the surrounding
+* source text. Posts that legitimately contain `<`, `>`, `&`, `"` or
+* `'` would render as broken markup, and a `<script>` literal in a
+* title (or any other indexed field) would execute when displayed.
+*
+* The fix: HTML-escape the whole string, which turns the markers into
+* `&lt;mark&gt;` / `&lt;/mark&gt;`. Then restore those two patterns to
+* their original tag form. The result is "the indexed text with all
+* HTML metacharacters escaped, plus a small set of literal `<mark>`
+* highlight tags around matched terms" — which matches the API's
+* documented contract.
+*/
+function sanitizeSnippet(snippet) {
+	return snippet.replace(SNIPPET_AMP_RE, "&amp;").replace(SNIPPET_LT_RE, "&lt;").replace(SNIPPET_GT_RE, "&gt;").replace(SNIPPET_QUOT_RE, "&quot;").replace(SNIPPET_APOS_RE, "&#39;").replaceAll("&lt;mark&gt;", "<mark>").replaceAll("&lt;/mark&gt;", "</mark>");
+}
+/**
+* Get search suggestions for autocomplete
+*
+* @param db - Kysely database instance
+* @param query - Partial search query
+* @param options - Suggestion options
+* @returns Array of suggestions
+*/
+async function getSuggestions(db, query, options = {}) {
+	const limit = options.limit ?? 5;
+	const locale = options.locale ? resolveConfiguredLocale(options.locale) : void 0;
+	let collections = options.collections;
+	if (!collections || collections.length === 0) collections = await getSearchableCollections(db);
+	if (collections.length === 0) return [];
+	const suggestions = [];
+	const ftsManager = new FTSManager(db);
+	const titleColumns = await ftsManager.getCollectionsWithTitleColumn(collections);
+	for (const collection of collections) {
+		const config = await ftsManager.getSearchConfig(collection);
+		if (!config?.enabled) continue;
+		let titleExpr;
+		if (config.titleField) {
+			validateIdentifier(config.titleField, "title field");
+			titleExpr = sql`c.${sql.ref(config.titleField)}`;
+		} else if (titleColumns.has(collection)) titleExpr = sql`c.title`;
+		else continue;
+		validateIdentifier(collection, "collection slug");
+		const ftsTable = ftsManager.getFtsTableName(collection);
+		const contentTable = ftsManager.getContentTableName(collection);
+		const prefixQuery = escapeQuery(query);
+		if (!prefixQuery) continue;
+		let results;
+		try {
+			results = await sql`
+				SELECT
+					c.id,
+					c.slug,
+					${titleExpr} AS title
+				FROM "${sql.raw(ftsTable)}" f
+				JOIN "${sql.raw(contentTable)}" c ON f.id = c.id
+				WHERE "${sql.raw(ftsTable)}" MATCH ${prefixQuery}
+				AND c.status = 'published'
+				AND c.deleted_at IS NULL
+				AND ${titleExpr} IS NOT NULL
+				${locale ? sql`AND c.locale = ${locale}` : sql``}
+				ORDER BY bm25("${sql.raw(ftsTable)}")
+				LIMIT ${limit}
+			`.execute(db);
+		} catch (error) {
+			if (isFts5SyntaxError(error)) continue;
+			throw error;
+		}
+		for (const row of results.rows) suggestions.push({
+			collection,
+			id: row.id,
+			slug: row.slug,
+			title: row.title
+		});
+	}
+	return suggestions.slice(0, limit);
+}
+/**
+* Get search statistics for all collections
+*/
+async function getSearchStats(db) {
+	const ftsManager = new FTSManager(db);
+	const collections = await getSearchableCollections(db);
+	const stats = { collections: {} };
+	for (const collection of collections) {
+		const collectionStats = await ftsManager.getIndexStats(collection);
+		if (collectionStats) stats.collections[collection] = collectionStats;
+	}
+	return stats;
+}
+/**
+* Get list of collections with search enabled
+*/
+async function getSearchableCollections(db) {
+	return (await db.selectFrom("_emdash_collections").select(["slug", "search_config"]).execute()).filter((r) => {
+		if (!r.search_config) return false;
+		try {
+			return JSON.parse(r.search_config).enabled === true;
+		} catch {
+			return false;
+		}
+	}).map((r) => r.slug);
+}
+/**
+* Escape a query string for FTS5
+*
+* Handles special characters and prevents injection.
+*/
+function escapeQuery(query, allowOperators = true) {
+	if (!query || typeof query !== "string") return "";
+	query = query.trim();
+	if (query.length === 0) return "";
+	if (query.startsWith("\"") && query.endsWith("\"") && query.length >= 2) return `"${query.slice(1, -1).replace(DOUBLE_QUOTE_PATTERN, "\"\"")}"`;
+	const escaped = query.replace(DOUBLE_QUOTE_PATTERN, "\"\"");
+	if (allowOperators && FTS_OPERATORS_PATTERN.test(query)) return escaped;
+	const terms = escaped.split(WHITESPACE_SPLIT_PATTERN).filter((t) => t.length > 0);
+	if (terms.length === 0) return "";
+	return terms.map((t) => `"${t}"*`).join(" ");
+}
+
+//#endregion
+//#region src/search/text-extraction.ts
+/**
+* Text Extraction
+*
+* Extracts plain text from Portable Text blocks for FTS indexing.
+* Uses @portabletext/toolkit as base with extensions for custom block types.
+*/
+/**
+* Validate that a value looks like a Portable Text block array.
+* Each element must have at least a `_type` string property.
+*/
+function isPortableTextArray(value) {
+	return value.every((item) => typeof item === "object" && item !== null && "_type" in item && typeof item._type === "string");
+}
+/**
+* Extract additional text from custom block types that toPlainText doesn't handle
+*/
+function extractCustomBlockText(block) {
+	if (block._type === "code" && "code" in block && typeof block.code === "string") return block.code;
+	if (block._type === "image") {
+		const parts = [];
+		if ("alt" in block && typeof block.alt === "string" && block.alt) parts.push(block.alt);
+		if ("caption" in block && typeof block.caption === "string" && block.caption) parts.push(block.caption);
+		return parts.join(" ");
+	}
+	return "";
+}
+/**
+* Extract plain text from Portable Text blocks
+*
+* Uses @portabletext/toolkit's toPlainText for standard blocks,
+* plus extracts text from custom block types (code, images with alt/caption).
+*
+* @param blocks - Array of Portable Text blocks (or a JSON string)
+* @returns Plain text content
+*
+* @example
+* ```typescript
+* const text = extractPlainText([
+*   {
+*     _type: "block",
+*     _key: "abc",
+*     children: [{ _type: "span", _key: "s1", text: "Hello World" }]
+*   }
+* ]);
+* // Returns: "Hello World"
+* ```
+*/
+function extractPlainText(blocks) {
+	if (!blocks) return "";
+	let parsedBlocks;
+	if (typeof blocks === "string") try {
+		parsedBlocks = JSON.parse(blocks);
+	} catch {
+		return blocks;
+	}
+	else parsedBlocks = blocks;
+	if (!Array.isArray(parsedBlocks)) return "";
+	return [toPlainText(parsedBlocks.map((b) => {
+		const obj = { _type: b._type };
+		for (const [key, val] of Object.entries(b)) obj[key] = val;
+		return obj;
+	})), ...parsedBlocks.map(extractCustomBlockText).filter((text) => text.length > 0)].filter((t) => t.length > 0).join("\n");
+}
+/**
+* Extract searchable text from a content entry
+*
+* Extracts text from specified fields, handling both plain text and Portable Text.
+*
+* @param entry - Content entry data
+* @param fields - Field names to extract text from
+* @returns Object mapping field names to extracted text
+*/
+function extractSearchableFields(entry, fields) {
+	const result = {};
+	for (const field of fields) {
+		const value = entry[field];
+		if (value === null || value === void 0) {
+			result[field] = "";
+			continue;
+		}
+		if (typeof value === "string") if (value.startsWith("[")) result[field] = extractPlainText(value);
+		else result[field] = value;
+		else if (Array.isArray(value)) if (isPortableTextArray(value)) result[field] = extractPlainText(value);
+		else result[field] = JSON.stringify(value);
+		else if (typeof value === "object") result[field] = JSON.stringify(value);
+		else if (typeof value === "number" || typeof value === "boolean") result[field] = `${value}`;
+		else result[field] = "";
+	}
+	return result;
+}
+
+//#endregion
+//#region src/search/index.ts
+var search_exports = /* @__PURE__ */ __exportAll({ searchWithDb: () => searchWithDb });
+
+//#endregion
+export { getSuggestions as a, searchWithDb as c, getSearchStats as i, extractPlainText as n, search as o, extractSearchableFields as r, searchCollection as s, search_exports as t };
+//# sourceMappingURL=search-YJKPIEV6.mjs.map