emdash 0.40.0 → 0.41.0

package/dist/authorize-WgdKF8QY.mjs

@@ -0,0 +1,49 @@
+import { t as apiError } from "./error-BfsNNrIE.mjs";
+import { canActOnOwn, hasPermission, hasScope } from "@emdash-cms/auth";
+
+//#region src/api/authorize.ts
+function canReadMediaUsageCount(user, tokenScopes) {
+	return hasPermission(user, "content:read_drafts") && (!tokenScopes || hasScope(tokenScopes, "admin"));
+}
+/**
+* Check if user has a permission. Returns a 401/403 Response if not, or null if authorized.
+*
+* Usage:
+* ```ts
+* const denied = requirePerm(user, "schema:manage");
+* if (denied) return denied;
+* ```
+*/
+function requirePerm(user, permission) {
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+	if (!hasPermission(user, permission)) return apiError("FORBIDDEN", "Insufficient permissions", 403);
+	return null;
+}
+/**
+* Check if user can act on a resource, considering ownership.
+* Returns a 401/403 Response if not, or null if authorized.
+*
+* Usage:
+* ```ts
+* const denied = requireOwnerPerm(user, item.authorId, "content:edit_own", "content:edit_any");
+* if (denied) return denied;
+* ```
+*/
+function requireOwnerPerm(user, ownerId, ownPermission, anyPermission) {
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+	if (!canActOnOwn(user, ownerId, ownPermission, anyPermission)) return apiError("FORBIDDEN", "Insufficient permissions", 403);
+	return null;
+}
+/**
+* Like {@link requirePerm}, but authorized when the user has any of
+* `permissions`.
+*/
+function requireAnyPerm(user, permissions) {
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+	if (!permissions.some((permission) => hasPermission(user, permission))) return apiError("FORBIDDEN", "Insufficient permissions", 403);
+	return null;
+}
+
+//#endregion
+export { requirePerm as i, requireAnyPerm as n, requireOwnerPerm as r, canReadMediaUsageCount as t };
+//# sourceMappingURL=authorize-WgdKF8QY.mjs.map

package/dist/authorize-WgdKF8QY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-WgdKF8QY.mjs","names":[],"sources":["../src/api/authorize.ts"],"sourcesContent":["/**\n * Authorization helpers for API routes\n *\n * Thin wrappers around @emdash-cms/auth RBAC that return HTTP responses.\n * Auth middleware handles authentication; these handle authorization.\n */\n\nimport type { Permission, RoleLevel } from \"@emdash-cms/auth\";\nimport { hasPermission, canActOnOwn, hasScope } from \"@emdash-cms/auth\";\n\nimport { apiError } from \"./error.js\";\n\ninterface UserLike {\n\tid: string;\n\trole: RoleLevel;\n}\n\nexport function canReadMediaUsageCount(\n\tuser: UserLike | null | undefined,\n\ttokenScopes: string[] | undefined,\n): boolean {\n\treturn (\n\t\thasPermission(user, \"content:read_drafts\") && (!tokenScopes || hasScope(tokenScopes, \"admin\"))\n\t);\n}\n\n/**\n * Check if user has a permission. Returns a 401/403 Response if not, or null if authorized.\n *\n * Usage:\n * ```ts\n * const denied = requirePerm(user, \"schema:manage\");\n * if (denied) return denied;\n * ```\n */\nexport function requirePerm(\n\tuser: UserLike | null | undefined,\n\tpermission: Permission,\n): Response | null {\n\tif (!user) {\n\t\treturn apiError(\"UNAUTHORIZED\", \"Authentication required\", 401);\n\t}\n\tif (!hasPermission(user, permission)) {\n\t\treturn apiError(\"FORBIDDEN\", \"Insufficient permissions\", 403);\n\t}\n\treturn null;\n}\n\n/**\n * Check if user can act on a resource, considering ownership.\n * Returns a 401/403 Response if not, or null if authorized.\n *\n * Usage:\n * ```ts\n * const denied = requireOwnerPerm(user, item.authorId, \"content:edit_own\", \"content:edit_any\");\n * if (denied) return denied;\n * ```\n */\nexport function requireOwnerPerm(\n\tuser: UserLike | null | undefined,\n\townerId: string,\n\townPermission: Permission,\n\tanyPermission: Permission,\n): Response | null {\n\tif (!user) {\n\t\treturn apiError(\"UNAUTHORIZED\", \"Authentication required\", 401);\n\t}\n\tif (!canActOnOwn(user, ownerId, ownPermission, anyPermission)) {\n\t\treturn apiError(\"FORBIDDEN\", \"Insufficient permissions\", 403);\n\t}\n\treturn null;\n}\n\n/**\n * Like {@link requirePerm}, but authorized when the user has any of\n * `permissions`.\n */\nexport function requireAnyPerm(\n\tuser: UserLike | null | undefined,\n\tpermissions: readonly Permission[],\n): Response | null {\n\tif (!user) {\n\t\treturn apiError(\"UNAUTHORIZED\", \"Authentication required\", 401);\n\t}\n\tif (!permissions.some((permission) => hasPermission(user, permission))) {\n\t\treturn apiError(\"FORBIDDEN\", \"Insufficient permissions\", 403);\n\t}\n\treturn null;\n}\n"],"mappings":";;;;AAiBA,SAAgB,uBACf,MACA,aACU;AACV,QACC,cAAc,MAAM,sBAAsB,KAAK,CAAC,eAAe,SAAS,aAAa,QAAQ;;;;;;;;;;;AAa/F,SAAgB,YACf,MACA,YACkB;AAClB,KAAI,CAAC,KACJ,QAAO,SAAS,gBAAgB,2BAA2B,IAAI;AAEhE,KAAI,CAAC,cAAc,MAAM,WAAW,CACnC,QAAO,SAAS,aAAa,4BAA4B,IAAI;AAE9D,QAAO;;;;;;;;;;;;AAaR,SAAgB,iBACf,MACA,SACA,eACA,eACkB;AAClB,KAAI,CAAC,KACJ,QAAO,SAAS,gBAAgB,2BAA2B,IAAI;AAEhE,KAAI,CAAC,YAAY,MAAM,SAAS,eAAe,cAAc,CAC5D,QAAO,SAAS,aAAa,4BAA4B,IAAI;AAE9D,QAAO;;;;;;AAOR,SAAgB,eACf,MACA,aACkB;AAClB,KAAI,CAAC,KACJ,QAAO,SAAS,gBAAgB,2BAA2B,IAAI;AAEhE,KAAI,CAAC,YAAY,MAAM,eAAe,cAAc,MAAM,WAAW,CAAC,CACrE,QAAO,SAAS,aAAa,4BAA4B,IAAI;AAE9D,QAAO"}

package/dist/backup-Ck8_lMO3.mjs

@@ -0,0 +1,246 @@
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { t as ErrorCode } from "./errors-BN1QAnEY.mjs";
+import { n as VERSION } from "./version-Dq71scUb.mjs";
+import { t as generateSnapshot } from "./snapshot-CdcwwWAf.mjs";
+
+//#region src/api/handlers/backup.ts
+/** Storage key prefix for scheduled/manual archives. */
+const BACKUP_STORAGE_PREFIX = "backups/";
+/**
+* Filename prefix within the backups/ folder. Included in the list() prefix
+* so LocalStorage (which matches directory + filename prefix, not flat keys
+* like S3/R2) finds the archives too.
+*/
+const BACKUP_FILE_PREFIX = "emdash-backup-";
+/** Options key holding the scheduled-backup settings. */
+const BACKUP_SETTINGS_KEY = "emdash:backups";
+/** Options key holding the ISO timestamp of the last scheduled run. */
+const BACKUP_LAST_RUN_KEY = "emdash:backups_last_run";
+/** Minimum interval between scheduled backups (23h — daily with cron jitter). */
+const SCHEDULED_BACKUP_INTERVAL_MS = 1380 * 60 * 1e3;
+/** Retention bounds for stored archives. */
+const BACKUP_RETENTION_MIN = 1;
+const BACKUP_RETENTION_MAX = 30;
+const BACKUP_RETENTION_DEFAULT = 7;
+/**
+* Options-table key prefixes included in backups. Never widen this to a
+* prefix that can match secrets (`emdash:preview_secret`, `plugin:`,
+* `emdash:passkey_pending:`).
+*/
+const BACKUP_OPTION_PREFIXES = ["site:"];
+/**
+* Exact `emdash:*` keys included in backups. Do not add `emdash:site_url`: it
+* is the origin of the deployment that took the backup, not portable site data.
+*/
+const BACKUP_OPTION_KEYS = [
+	"emdash:site_title",
+	"emdash:site_tagline",
+	"emdash:locale"
+];
+/**
+* Archive filename shape. Strict allowlist — the download/delete routes
+* interpolate this into a storage key, so it must never contain `/` or `..`.
+* The random suffix makes names unguessable (defense in depth on top of the
+* media route's backups/ deny) and avoids same-second collisions.
+*/
+const ARCHIVE_NAME_PATTERN = /^emdash-backup-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-[0-9a-f]{8}\.json$/;
+function isValidArchiveName(name) {
+	return ARCHIVE_NAME_PATTERN.test(name);
+}
+const DEFAULT_SETTINGS = {
+	enabled: false,
+	retention: BACKUP_RETENTION_DEFAULT
+};
+function clampRetention(value) {
+	if (!Number.isFinite(value)) return BACKUP_RETENTION_DEFAULT;
+	return Math.min(BACKUP_RETENTION_MAX, Math.max(BACKUP_RETENTION_MIN, Math.trunc(value)));
+}
+/**
+* Generate a full content backup as a JSON string.
+*
+* ponytail: the whole backup is materialized in memory. Fine for the sites
+* EmDash targets today; truly huge databases should use `wrangler d1 export`
+* (documented on the backups docs page). Upgrade path: stream table-by-table.
+*/
+async function generateBackupJson(db) {
+	const snapshot = await generateSnapshot(db, {
+		includeDrafts: true,
+		includeTrashed: true,
+		optionPrefixes: BACKUP_OPTION_PREFIXES,
+		optionKeys: BACKUP_OPTION_KEYS
+	});
+	return JSON.stringify({
+		format: "emdash-backup",
+		formatVersion: 1,
+		emdashVersion: VERSION,
+		generatedAt: snapshot.generatedAt,
+		schema: snapshot.schema,
+		tables: snapshot.tables
+	});
+}
+/** Derive the archive filename for a given date (plus a random suffix). */
+function archiveNameForDate(date) {
+	return `emdash-backup-${date.toISOString().slice(0, 19).replaceAll(":", "-")}-${crypto.randomUUID().replaceAll("-", "").slice(0, 8)}.json`;
+}
+async function getBackupSettings(db) {
+	const stored = await new OptionsRepository(db).get(BACKUP_SETTINGS_KEY);
+	if (!stored) return { ...DEFAULT_SETTINGS };
+	return {
+		enabled: stored.enabled === true,
+		retention: clampRetention(stored.retention ?? BACKUP_RETENTION_DEFAULT)
+	};
+}
+async function updateBackupSettings(db, input) {
+	try {
+		const settings = {
+			enabled: input.enabled,
+			retention: clampRetention(input.retention)
+		};
+		await new OptionsRepository(db).set(BACKUP_SETTINGS_KEY, settings);
+		return {
+			success: true,
+			data: settings
+		};
+	} catch (error) {
+		console.error("[backup] Failed to update settings:", error);
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.BACKUP_SETTINGS_ERROR,
+				message: "Failed to update backup settings"
+			}
+		};
+	}
+}
+/**
+* List stored archives, newest first.
+*
+* ponytail: single unpaginated list. The retention cap (max 30) bounds the
+* archive count, so one page always suffices.
+*/
+async function listBackupArchives(storage) {
+	try {
+		return {
+			success: true,
+			data: (await storage.list({
+				prefix: `${BACKUP_STORAGE_PREFIX}${BACKUP_FILE_PREFIX}`,
+				limit: 100
+			})).files.map((file) => ({
+				name: file.key.slice(8),
+				size: file.size,
+				lastModified: file.lastModified.toISOString()
+			})).filter((archive) => isValidArchiveName(archive.name)).toSorted((a, b) => a.name < b.name ? 1 : -1)
+		};
+	} catch (error) {
+		console.error("[backup] Failed to list archives:", error);
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.BACKUP_LIST_ERROR,
+				message: "Failed to list backup archives"
+			}
+		};
+	}
+}
+/**
+* Create a backup and store it as an archive, then prune old archives
+* beyond `retention`.
+*/
+async function runBackupToStorage(db, storage, retention) {
+	try {
+		const json = await generateBackupJson(db);
+		const name = archiveNameForDate(/* @__PURE__ */ new Date());
+		const body = new TextEncoder().encode(json);
+		await storage.upload({
+			key: `${BACKUP_STORAGE_PREFIX}${name}`,
+			body,
+			contentType: "application/json"
+		});
+		await pruneArchives(storage, clampRetention(retention));
+		return {
+			success: true,
+			data: {
+				name,
+				size: body.byteLength,
+				lastModified: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
+	} catch (error) {
+		console.error("[backup] Failed to create archive:", error);
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.BACKUP_CREATE_ERROR,
+				message: "Failed to create backup archive"
+			}
+		};
+	}
+}
+/** Delete archives beyond the newest `keep`. Failures are logged, not fatal. */
+async function pruneArchives(storage, keep) {
+	const listed = await listBackupArchives(storage);
+	if (!listed.success) return;
+	for (const archive of listed.data.slice(keep)) try {
+		await storage.delete(`${BACKUP_STORAGE_PREFIX}${archive.name}`);
+	} catch (error) {
+		console.error(`[backup] Failed to prune archive ${archive.name}:`, error);
+	}
+}
+async function deleteBackupArchive(storage, name) {
+	if (!isValidArchiveName(name)) return {
+		success: false,
+		error: {
+			code: ErrorCode.VALIDATION_ERROR,
+			message: "Invalid archive name"
+		}
+	};
+	try {
+		await storage.delete(`${BACKUP_STORAGE_PREFIX}${name}`);
+		return {
+			success: true,
+			data: { deleted: true }
+		};
+	} catch (error) {
+		console.error(`[backup] Failed to delete archive ${name}:`, error);
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.BACKUP_DELETE_ERROR,
+				message: "Failed to delete backup archive"
+			}
+		};
+	}
+}
+/**
+* Run a scheduled backup if enabled and due. Called from the maintenance
+* tick alongside scheduled publishing and system cleanup — never from a
+* request. Never throws.
+*
+* ponytail: last-run bookkeeping is a plain read-then-write, so two isolates
+* ticking simultaneously could both back up. Worst case is a duplicate
+* archive that retention prunes; not worth a lock.
+*/
+async function maybeRunScheduledBackup(db, storage) {
+	try {
+		if (!storage) return;
+		const settings = await getBackupSettings(db);
+		if (!settings.enabled) return;
+		const options = new OptionsRepository(db);
+		const lastRun = await options.get(BACKUP_LAST_RUN_KEY);
+		if (lastRun) {
+			const elapsed = Date.now() - Date.parse(lastRun);
+			if (Number.isFinite(elapsed) && elapsed < SCHEDULED_BACKUP_INTERVAL_MS) return;
+		}
+		const result = await runBackupToStorage(db, storage, settings.retention);
+		if (result.success) {
+			await options.set(BACKUP_LAST_RUN_KEY, (/* @__PURE__ */ new Date()).toISOString());
+			console.log(`[backup] Scheduled backup stored: ${result.data.name}`);
+		}
+	} catch (error) {
+		console.error("[backup] Scheduled backup failed:", error);
+	}
+}
+
+//#endregion
+export { deleteBackupArchive as a, isValidArchiveName as c, runBackupToStorage as d, updateBackupSettings as f, archiveNameForDate as i, listBackupArchives as l, BACKUP_RETENTION_MIN as n, generateBackupJson as o, BACKUP_STORAGE_PREFIX as r, getBackupSettings as s, BACKUP_RETENTION_MAX as t, maybeRunScheduledBackup as u };
+//# sourceMappingURL=backup-Ck8_lMO3.mjs.map

package/dist/backup-Ck8_lMO3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-Ck8_lMO3.mjs","names":[],"sources":["../src/api/handlers/backup.ts"],"sourcesContent":["/**\n * Backup handlers — portable content backups, on demand and scheduled.\n *\n * A backup is the snapshot format (see `snapshot.ts`) wrapped in a small\n * envelope: all content (including drafts, scheduled, and trashed entries),\n * schema definitions, taxonomies, menus, widgets, revisions, media metadata,\n * and site settings.\n *\n * Deliberately NOT included:\n * - Users, sessions, credentials, API/OAuth tokens (auth data is neither\n *   portable nor safe in a user-downloadable file)\n * - Secrets (`emdash:preview_secret`, plugin config, passkey challenges)\n * - Media binaries (metadata only — the files live in the same bucket the\n *   scheduled archives are written to)\n *\n * For full point-in-time database recovery on Cloudflare, D1 Time Travel\n * covers the last 30 days out of the box; these backups complement it with\n * user-holdable, longer-lived archives.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../../database/repositories/options.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { Storage } from \"../../storage/types.js\";\nimport { VERSION } from \"../../version.js\";\nimport { ErrorCode } from \"../errors.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { generateSnapshot } from \"./snapshot.js\";\n\n// ── Constants ───────────────────────────────────────────────────\n\n/** Storage key prefix for scheduled/manual archives. */\nexport const BACKUP_STORAGE_PREFIX = \"backups/\";\n\n/**\n * Filename prefix within the backups/ folder. Included in the list() prefix\n * so LocalStorage (which matches directory + filename prefix, not flat keys\n * like S3/R2) finds the archives too.\n */\nconst BACKUP_FILE_PREFIX = \"emdash-backup-\";\n\n/** Options key holding the scheduled-backup settings. */\nexport const BACKUP_SETTINGS_KEY = \"emdash:backups\";\n\n/** Options key holding the ISO timestamp of the last scheduled run. */\nconst BACKUP_LAST_RUN_KEY = \"emdash:backups_last_run\";\n\n/** Minimum interval between scheduled backups (23h — daily with cron jitter). */\nconst SCHEDULED_BACKUP_INTERVAL_MS = 23 * 60 * 60 * 1000;\n\n/** Retention bounds for stored archives. */\nexport const BACKUP_RETENTION_MIN = 1;\nexport const BACKUP_RETENTION_MAX = 30;\nconst BACKUP_RETENTION_DEFAULT = 7;\n\n/**\n * Options-table key prefixes included in backups. Never widen this to a\n * prefix that can match secrets (`emdash:preview_secret`, `plugin:`,\n * `emdash:passkey_pending:`).\n */\nconst BACKUP_OPTION_PREFIXES = [\"site:\"];\n\n/**\n * Exact `emdash:*` keys included in backups. Do not add `emdash:site_url`: it\n * is the origin of the deployment that took the backup, not portable site data.\n */\nconst BACKUP_OPTION_KEYS = [\"emdash:site_title\", \"emdash:site_tagline\", \"emdash:locale\"];\n\n/**\n * Archive filename shape. Strict allowlist — the download/delete routes\n * interpolate this into a storage key, so it must never contain `/` or `..`.\n * The random suffix makes names unguessable (defense in depth on top of the\n * media route's backups/ deny) and avoids same-second collisions.\n */\nconst ARCHIVE_NAME_PATTERN =\n\t/^emdash-backup-\\d{4}-\\d{2}-\\d{2}T\\d{2}-\\d{2}-\\d{2}-[0-9a-f]{8}\\.json$/;\n\nexport function isValidArchiveName(name: string): boolean {\n\treturn ARCHIVE_NAME_PATTERN.test(name);\n}\n\n// ── Types ───────────────────────────────────────────────────────\n\nexport interface BackupSettings {\n\t/** Whether daily scheduled backups to storage are enabled. */\n\tenabled: boolean;\n\t/** How many archives to keep in storage (oldest pruned first). */\n\tretention: number;\n}\n\nexport interface BackupArchive {\n\t/** Filename within the backups/ prefix (no path separators). */\n\tname: string;\n\t/** Size in bytes. */\n\tsize: number;\n\t/** Last-modified timestamp (ISO). */\n\tlastModified: string;\n}\n\nconst DEFAULT_SETTINGS: BackupSettings = {\n\tenabled: false,\n\tretention: BACKUP_RETENTION_DEFAULT,\n};\n\nfunction clampRetention(value: number): number {\n\tif (!Number.isFinite(value)) return BACKUP_RETENTION_DEFAULT;\n\treturn Math.min(BACKUP_RETENTION_MAX, Math.max(BACKUP_RETENTION_MIN, Math.trunc(value)));\n}\n\n// ── Export ──────────────────────────────────────────────────────\n\n/**\n * Generate a full content backup as a JSON string.\n *\n * ponytail: the whole backup is materialized in memory. Fine for the sites\n * EmDash targets today; truly huge databases should use `wrangler d1 export`\n * (documented on the backups docs page). Upgrade path: stream table-by-table.\n */\nexport async function generateBackupJson(db: Kysely<Database>): Promise<string> {\n\tconst snapshot = await generateSnapshot(db, {\n\t\tincludeDrafts: true,\n\t\tincludeTrashed: true,\n\t\toptionPrefixes: BACKUP_OPTION_PREFIXES,\n\t\toptionKeys: BACKUP_OPTION_KEYS,\n\t});\n\n\treturn JSON.stringify({\n\t\tformat: \"emdash-backup\",\n\t\tformatVersion: 1,\n\t\temdashVersion: VERSION,\n\t\tgeneratedAt: snapshot.generatedAt,\n\t\tschema: snapshot.schema,\n\t\ttables: snapshot.tables,\n\t});\n}\n\n/** Derive the archive filename for a given date (plus a random suffix). */\nexport function archiveNameForDate(date: Date): string {\n\t// 2026-07-09T08:45:12.345Z → emdash-backup-2026-07-09T08-45-12-1a2b3c4d.json\n\tconst stamp = date.toISOString().slice(0, 19).replaceAll(\":\", \"-\");\n\tconst suffix = crypto.randomUUID().replaceAll(\"-\", \"\").slice(0, 8);\n\treturn `emdash-backup-${stamp}-${suffix}.json`;\n}\n\n// ── Settings ────────────────────────────────────────────────────\n\nexport async function getBackupSettings(db: Kysely<Database>): Promise<BackupSettings> {\n\tconst options = new OptionsRepository(db);\n\tconst stored = await options.get<Partial<BackupSettings>>(BACKUP_SETTINGS_KEY);\n\tif (!stored) return { ...DEFAULT_SETTINGS };\n\treturn {\n\t\tenabled: stored.enabled === true,\n\t\tretention: clampRetention(stored.retention ?? BACKUP_RETENTION_DEFAULT),\n\t};\n}\n\nexport async function updateBackupSettings(\n\tdb: Kysely<Database>,\n\tinput: { enabled: boolean; retention: number },\n): Promise<ApiResult<BackupSettings>> {\n\ttry {\n\t\tconst settings: BackupSettings = {\n\t\t\tenabled: input.enabled,\n\t\t\tretention: clampRetention(input.retention),\n\t\t};\n\t\tconst options = new OptionsRepository(db);\n\t\tawait options.set(BACKUP_SETTINGS_KEY, settings);\n\t\treturn { success: true, data: settings };\n\t} catch (error) {\n\t\tconsole.error(\"[backup] Failed to update settings:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: ErrorCode.BACKUP_SETTINGS_ERROR, message: \"Failed to update backup settings\" },\n\t\t};\n\t}\n}\n\n// ── Archives in storage ─────────────────────────────────────────\n\n/**\n * List stored archives, newest first.\n *\n * ponytail: single unpaginated list. The retention cap (max 30) bounds the\n * archive count, so one page always suffices.\n */\nexport async function listBackupArchives(storage: Storage): Promise<ApiResult<BackupArchive[]>> {\n\ttry {\n\t\tconst result = await storage.list({\n\t\t\tprefix: `${BACKUP_STORAGE_PREFIX}${BACKUP_FILE_PREFIX}`,\n\t\t\tlimit: 100,\n\t\t});\n\t\tconst archives = result.files\n\t\t\t.map((file) => ({\n\t\t\t\tname: file.key.slice(BACKUP_STORAGE_PREFIX.length),\n\t\t\t\tsize: file.size,\n\t\t\t\tlastModified: file.lastModified.toISOString(),\n\t\t\t}))\n\t\t\t.filter((archive) => isValidArchiveName(archive.name))\n\t\t\t.toSorted((a, b) => (a.name < b.name ? 1 : -1));\n\t\treturn { success: true, data: archives };\n\t} catch (error) {\n\t\tconsole.error(\"[backup] Failed to list archives:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: ErrorCode.BACKUP_LIST_ERROR, message: \"Failed to list backup archives\" },\n\t\t};\n\t}\n}\n\n/**\n * Create a backup and store it as an archive, then prune old archives\n * beyond `retention`.\n */\nexport async function runBackupToStorage(\n\tdb: Kysely<Database>,\n\tstorage: Storage,\n\tretention: number,\n): Promise<ApiResult<BackupArchive>> {\n\ttry {\n\t\tconst json = await generateBackupJson(db);\n\t\tconst name = archiveNameForDate(new Date());\n\t\tconst body = new TextEncoder().encode(json);\n\n\t\tawait storage.upload({\n\t\t\tkey: `${BACKUP_STORAGE_PREFIX}${name}`,\n\t\t\tbody,\n\t\t\tcontentType: \"application/json\",\n\t\t});\n\n\t\tawait pruneArchives(storage, clampRetention(retention));\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { name, size: body.byteLength, lastModified: new Date().toISOString() },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"[backup] Failed to create archive:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: ErrorCode.BACKUP_CREATE_ERROR, message: \"Failed to create backup archive\" },\n\t\t};\n\t}\n}\n\n/** Delete archives beyond the newest `keep`. Failures are logged, not fatal. */\nasync function pruneArchives(storage: Storage, keep: number): Promise<void> {\n\tconst listed = await listBackupArchives(storage);\n\tif (!listed.success) return;\n\n\tfor (const archive of listed.data.slice(keep)) {\n\t\ttry {\n\t\t\tawait storage.delete(`${BACKUP_STORAGE_PREFIX}${archive.name}`);\n\t\t} catch (error) {\n\t\t\tconsole.error(`[backup] Failed to prune archive ${archive.name}:`, error);\n\t\t}\n\t}\n}\n\nexport async function deleteBackupArchive(\n\tstorage: Storage,\n\tname: string,\n): Promise<ApiResult<{ deleted: true }>> {\n\tif (!isValidArchiveName(name)) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: ErrorCode.VALIDATION_ERROR, message: \"Invalid archive name\" },\n\t\t};\n\t}\n\ttry {\n\t\tawait storage.delete(`${BACKUP_STORAGE_PREFIX}${name}`);\n\t\treturn { success: true, data: { deleted: true } };\n\t} catch (error) {\n\t\tconsole.error(`[backup] Failed to delete archive ${name}:`, error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: ErrorCode.BACKUP_DELETE_ERROR, message: \"Failed to delete backup archive\" },\n\t\t};\n\t}\n}\n\n// ── Scheduled runs ──────────────────────────────────────────────\n\n/**\n * Run a scheduled backup if enabled and due. Called from the maintenance\n * tick alongside scheduled publishing and system cleanup — never from a\n * request. Never throws.\n *\n * ponytail: last-run bookkeeping is a plain read-then-write, so two isolates\n * ticking simultaneously could both back up. Worst case is a duplicate\n * archive that retention prunes; not worth a lock.\n */\nexport async function maybeRunScheduledBackup(\n\tdb: Kysely<Database>,\n\tstorage: Storage | undefined,\n): Promise<void> {\n\ttry {\n\t\tif (!storage) return;\n\n\t\tconst settings = await getBackupSettings(db);\n\t\tif (!settings.enabled) return;\n\n\t\tconst options = new OptionsRepository(db);\n\t\tconst lastRun = await options.get<string>(BACKUP_LAST_RUN_KEY);\n\t\tif (lastRun) {\n\t\t\tconst elapsed = Date.now() - Date.parse(lastRun);\n\t\t\tif (Number.isFinite(elapsed) && elapsed < SCHEDULED_BACKUP_INTERVAL_MS) return;\n\t\t}\n\n\t\tconst result = await runBackupToStorage(db, storage, settings.retention);\n\t\tif (result.success) {\n\t\t\tawait options.set(BACKUP_LAST_RUN_KEY, new Date().toISOString());\n\t\t\tconsole.log(`[backup] Scheduled backup stored: ${result.data.name}`);\n\t\t}\n\t} catch (error) {\n\t\tconsole.error(\"[backup] Scheduled backup failed:\", error);\n\t}\n}\n"],"mappings":";;;;;;;AAiCA,MAAa,wBAAwB;;;;;;AAOrC,MAAM,qBAAqB;;AAG3B,MAAa,sBAAsB;;AAGnC,MAAM,sBAAsB;;AAG5B,MAAM,+BAA+B,OAAU,KAAK;;AAGpD,MAAa,uBAAuB;AACpC,MAAa,uBAAuB;AACpC,MAAM,2BAA2B;;;;;;AAOjC,MAAM,yBAAyB,CAAC,QAAQ;;;;;AAMxC,MAAM,qBAAqB;CAAC;CAAqB;CAAuB;CAAgB;;;;;;;AAQxF,MAAM,uBACL;AAED,SAAgB,mBAAmB,MAAuB;AACzD,QAAO,qBAAqB,KAAK,KAAK;;AAqBvC,MAAM,mBAAmC;CACxC,SAAS;CACT,WAAW;CACX;AAED,SAAS,eAAe,OAAuB;AAC9C,KAAI,CAAC,OAAO,SAAS,MAAM,CAAE,QAAO;AACpC,QAAO,KAAK,IAAI,sBAAsB,KAAK,IAAI,sBAAsB,KAAK,MAAM,MAAM,CAAC,CAAC;;;;;;;;;AAYzF,eAAsB,mBAAmB,IAAuC;CAC/E,MAAM,WAAW,MAAM,iBAAiB,IAAI;EAC3C,eAAe;EACf,gBAAgB;EAChB,gBAAgB;EAChB,YAAY;EACZ,CAAC;AAEF,QAAO,KAAK,UAAU;EACrB,QAAQ;EACR,eAAe;EACf,eAAe;EACf,aAAa,SAAS;EACtB,QAAQ,SAAS;EACjB,QAAQ,SAAS;EACjB,CAAC;;;AAIH,SAAgB,mBAAmB,MAAoB;AAItD,QAAO,iBAFO,KAAK,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,WAAW,KAAK,IAAI,CAEpC,GADf,OAAO,YAAY,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM,GAAG,EAAE,CAC1B;;AAKzC,eAAsB,kBAAkB,IAA+C;CAEtF,MAAM,SAAS,MADC,IAAI,kBAAkB,GAAG,CACZ,IAA6B,oBAAoB;AAC9E,KAAI,CAAC,OAAQ,QAAO,EAAE,GAAG,kBAAkB;AAC3C,QAAO;EACN,SAAS,OAAO,YAAY;EAC5B,WAAW,eAAe,OAAO,aAAa,yBAAyB;EACvE;;AAGF,eAAsB,qBACrB,IACA,OACqC;AACrC,KAAI;EACH,MAAM,WAA2B;GAChC,SAAS,MAAM;GACf,WAAW,eAAe,MAAM,UAAU;GAC1C;AAED,QADgB,IAAI,kBAAkB,GAAG,CAC3B,IAAI,qBAAqB,SAAS;AAChD,SAAO;GAAE,SAAS;GAAM,MAAM;GAAU;UAChC,OAAO;AACf,UAAQ,MAAM,uCAAuC,MAAM;AAC3D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,UAAU;IAAuB,SAAS;IAAoC;GAC7F;;;;;;;;;AAYH,eAAsB,mBAAmB,SAAuD;AAC/F,KAAI;AAaH,SAAO;GAAE,SAAS;GAAM,OAZT,MAAM,QAAQ,KAAK;IACjC,QAAQ,GAAG,wBAAwB;IACnC,OAAO;IACP,CAAC,EACsB,MACtB,KAAK,UAAU;IACf,MAAM,KAAK,IAAI,MAAM,EAA6B;IAClD,MAAM,KAAK;IACX,cAAc,KAAK,aAAa,aAAa;IAC7C,EAAE,CACF,QAAQ,YAAY,mBAAmB,QAAQ,KAAK,CAAC,CACrD,UAAU,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,IAAI,GAAI;GACR;UAChC,OAAO;AACf,UAAQ,MAAM,qCAAqC,MAAM;AACzD,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,UAAU;IAAmB,SAAS;IAAkC;GACvF;;;;;;;AAQH,eAAsB,mBACrB,IACA,SACA,WACoC;AACpC,KAAI;EACH,MAAM,OAAO,MAAM,mBAAmB,GAAG;EACzC,MAAM,OAAO,mCAAmB,IAAI,MAAM,CAAC;EAC3C,MAAM,OAAO,IAAI,aAAa,CAAC,OAAO,KAAK;AAE3C,QAAM,QAAQ,OAAO;GACpB,KAAK,GAAG,wBAAwB;GAChC;GACA,aAAa;GACb,CAAC;AAEF,QAAM,cAAc,SAAS,eAAe,UAAU,CAAC;AAEvD,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAM,MAAM,KAAK;IAAY,+BAAc,IAAI,MAAM,EAAC,aAAa;IAAE;GAC7E;UACO,OAAO;AACf,UAAQ,MAAM,sCAAsC,MAAM;AAC1D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,UAAU;IAAqB,SAAS;IAAmC;GAC1F;;;;AAKH,eAAe,cAAc,SAAkB,MAA6B;CAC3E,MAAM,SAAS,MAAM,mBAAmB,QAAQ;AAChD,KAAI,CAAC,OAAO,QAAS;AAErB,MAAK,MAAM,WAAW,OAAO,KAAK,MAAM,KAAK,CAC5C,KAAI;AACH,QAAM,QAAQ,OAAO,GAAG,wBAAwB,QAAQ,OAAO;UACvD,OAAO;AACf,UAAQ,MAAM,oCAAoC,QAAQ,KAAK,IAAI,MAAM;;;AAK5E,eAAsB,oBACrB,SACA,MACwC;AACxC,KAAI,CAAC,mBAAmB,KAAK,CAC5B,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM,UAAU;GAAkB,SAAS;GAAwB;EAC5E;AAEF,KAAI;AACH,QAAM,QAAQ,OAAO,GAAG,wBAAwB,OAAO;AACvD,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;UACzC,OAAO;AACf,UAAQ,MAAM,qCAAqC,KAAK,IAAI,MAAM;AAClE,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM,UAAU;IAAqB,SAAS;IAAmC;GAC1F;;;;;;;;;;;;AAeH,eAAsB,wBACrB,IACA,SACgB;AAChB,KAAI;AACH,MAAI,CAAC,QAAS;EAEd,MAAM,WAAW,MAAM,kBAAkB,GAAG;AAC5C,MAAI,CAAC,SAAS,QAAS;EAEvB,MAAM,UAAU,IAAI,kBAAkB,GAAG;EACzC,MAAM,UAAU,MAAM,QAAQ,IAAY,oBAAoB;AAC9D,MAAI,SAAS;GACZ,MAAM,UAAU,KAAK,KAAK,GAAG,KAAK,MAAM,QAAQ;AAChD,OAAI,OAAO,SAAS,QAAQ,IAAI,UAAU,6BAA8B;;EAGzE,MAAM,SAAS,MAAM,mBAAmB,IAAI,SAAS,SAAS,UAAU;AACxE,MAAI,OAAO,SAAS;AACnB,SAAM,QAAQ,IAAI,sCAAqB,IAAI,MAAM,EAAC,aAAa,CAAC;AAChE,WAAQ,IAAI,qCAAqC,OAAO,KAAK,OAAO;;UAE7D,OAAO;AACf,UAAQ,MAAM,qCAAqC,MAAM"}

package/dist/block-types-BQ90asVI.mjs

@@ -0,0 +1,132 @@
+import { u as __exportAll } from "./runner-B3eyB9Gb.mjs";
+import { l as invalidateCollectionCache } from "./object-cache-CqWNY5uP.mjs";
+import { L as BlockTypeRegistry, t as SchemaError } from "./registry-CFcNCayZ.mjs";
+import { a as invalidateSchemaCache } from "./zod-generator-DmTKI-Ig.mjs";
+
+//#region src/api/handlers/block-types.ts
+var block_types_exports = /* @__PURE__ */ __exportAll({
+	handleBlockTypeCreate: () => handleBlockTypeCreate,
+	handleBlockTypeGet: () => handleBlockTypeGet,
+	handleBlockTypeList: () => handleBlockTypeList,
+	handleBlockTypeUpdate: () => handleBlockTypeUpdate,
+	handleBlockTypeVersionActivate: () => handleBlockTypeVersionActivate
+});
+function schemaError(error) {
+	return {
+		success: false,
+		error: {
+			code: error.code,
+			message: error.message,
+			details: error.details
+		}
+	};
+}
+async function invalidateConsumers(db, slug) {
+	const collections = await new BlockTypeRegistry(db).listAffectedCollections(slug);
+	for (const collection of collections) {
+		invalidateCollectionCache(collection);
+		invalidateSchemaCache(collection);
+	}
+}
+async function handleBlockTypeList(db) {
+	try {
+		return {
+			success: true,
+			data: { items: await new BlockTypeRegistry(db).listBlockTypes() }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "SCHEMA_LIST_ERROR",
+				message: "Failed to list block types"
+			}
+		};
+	}
+}
+async function handleBlockTypeGet(db, slug) {
+	try {
+		const item = await new BlockTypeRegistry(db).getBlockType(slug);
+		if (!item) return {
+			success: false,
+			error: {
+				code: "BLOCK_TYPE_NOT_FOUND",
+				message: `Block type '${slug}' not found`
+			}
+		};
+		return {
+			success: true,
+			data: { item }
+		};
+	} catch (error) {
+		if (error instanceof SchemaError) return schemaError(error);
+		return {
+			success: false,
+			error: {
+				code: "SCHEMA_GET_ERROR",
+				message: "Failed to get block type"
+			}
+		};
+	}
+}
+async function handleBlockTypeCreate(db, input) {
+	try {
+		const item = await new BlockTypeRegistry(db).createBlockType(input);
+		await invalidateConsumers(db, input.slug);
+		return {
+			success: true,
+			data: { item }
+		};
+	} catch (error) {
+		if (error instanceof SchemaError) return schemaError(error);
+		return {
+			success: false,
+			error: {
+				code: "SCHEMA_CREATE_ERROR",
+				message: "Failed to create block type"
+			}
+		};
+	}
+}
+async function handleBlockTypeUpdate(db, slug, input) {
+	try {
+		const item = await new BlockTypeRegistry(db).updateBlockType(slug, input);
+		await invalidateConsumers(db, slug);
+		return {
+			success: true,
+			data: { item }
+		};
+	} catch (error) {
+		if (error instanceof SchemaError) return schemaError(error);
+		return {
+			success: false,
+			error: {
+				code: "SCHEMA_UPDATE_ERROR",
+				message: "Failed to update block type"
+			}
+		};
+	}
+}
+async function handleBlockTypeVersionActivate(db, slug, version, expectedFingerprint) {
+	try {
+		const item = await new BlockTypeRegistry(db).activateVersion(slug, version, expectedFingerprint);
+		await invalidateConsumers(db, slug);
+		return {
+			success: true,
+			data: { item }
+		};
+	} catch (error) {
+		if (error instanceof SchemaError) return schemaError(error);
+		return {
+			success: false,
+			error: {
+				code: "SCHEMA_UPDATE_ERROR",
+				message: "Failed to activate block type version"
+			}
+		};
+	}
+}
+
+//#endregion
+export { handleBlockTypeUpdate as a, handleBlockTypeList as i, handleBlockTypeCreate as n, handleBlockTypeVersionActivate as o, handleBlockTypeGet as r, block_types_exports as t };
+//# sourceMappingURL=block-types-BQ90asVI.mjs.map

package/dist/block-types-BQ90asVI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"block-types-BQ90asVI.mjs","names":[],"sources":["../src/api/handlers/block-types.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport { invalidateCollectionCache } from \"../../object-cache/index.js\";\nimport {\n\tBlockTypeRegistry,\n\tSchemaError,\n\tinvalidateSchemaCache,\n\ttype BlockType,\n\ttype CreateBlockTypeInput,\n\ttype UpdateBlockTypeInput,\n} from \"../../schema/index.js\";\nimport type { ApiResult } from \"../types.js\";\n\nexport interface BlockTypeListResponse {\n\titems: BlockType[];\n}\n\nexport interface BlockTypeResponse {\n\titem: BlockType;\n}\n\nfunction schemaError(error: SchemaError) {\n\treturn {\n\t\tsuccess: false as const,\n\t\terror: { code: error.code, message: error.message, details: error.details },\n\t};\n}\n\nasync function invalidateConsumers(db: Kysely<Database>, slug: string): Promise<void> {\n\tconst collections = await new BlockTypeRegistry(db).listAffectedCollections(slug);\n\tfor (const collection of collections) {\n\t\tinvalidateCollectionCache(collection);\n\t\tinvalidateSchemaCache(collection);\n\t}\n}\n\nexport async function handleBlockTypeList(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<BlockTypeListResponse>> {\n\ttry {\n\t\treturn { success: true, data: { items: await new BlockTypeRegistry(db).listBlockTypes() } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SCHEMA_LIST_ERROR\", message: \"Failed to list block types\" },\n\t\t};\n\t}\n}\n\nexport async function handleBlockTypeGet(\n\tdb: Kysely<Database>,\n\tslug: string,\n): Promise<ApiResult<BlockTypeResponse>> {\n\ttry {\n\t\tconst item = await new BlockTypeRegistry(db).getBlockType(slug);\n\t\tif (!item) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"BLOCK_TYPE_NOT_FOUND\", message: `Block type '${slug}' not found` },\n\t\t\t};\n\t\t}\n\t\treturn { success: true, data: { item } };\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) return schemaError(error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SCHEMA_GET_ERROR\", message: \"Failed to get block type\" },\n\t\t};\n\t}\n}\n\nexport async function handleBlockTypeCreate(\n\tdb: Kysely<Database>,\n\tinput: CreateBlockTypeInput,\n): Promise<ApiResult<BlockTypeResponse>> {\n\ttry {\n\t\tconst item = await new BlockTypeRegistry(db).createBlockType(input);\n\t\tawait invalidateConsumers(db, input.slug);\n\t\treturn { success: true, data: { item } };\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) return schemaError(error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SCHEMA_CREATE_ERROR\", message: \"Failed to create block type\" },\n\t\t};\n\t}\n}\n\nexport async function handleBlockTypeUpdate(\n\tdb: Kysely<Database>,\n\tslug: string,\n\tinput: UpdateBlockTypeInput,\n): Promise<ApiResult<BlockTypeResponse>> {\n\ttry {\n\t\tconst item = await new BlockTypeRegistry(db).updateBlockType(slug, input);\n\t\tawait invalidateConsumers(db, slug);\n\t\treturn { success: true, data: { item } };\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) return schemaError(error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SCHEMA_UPDATE_ERROR\", message: \"Failed to update block type\" },\n\t\t};\n\t}\n}\n\nexport async function handleBlockTypeVersionActivate(\n\tdb: Kysely<Database>,\n\tslug: string,\n\tversion: number,\n\texpectedFingerprint: string,\n): Promise<ApiResult<BlockTypeResponse>> {\n\ttry {\n\t\tconst item = await new BlockTypeRegistry(db).activateVersion(\n\t\t\tslug,\n\t\t\tversion,\n\t\t\texpectedFingerprint,\n\t\t);\n\t\tawait invalidateConsumers(db, slug);\n\t\treturn { success: true, data: { item } };\n\t} catch (error) {\n\t\tif (error instanceof SchemaError) return schemaError(error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SCHEMA_UPDATE_ERROR\", message: \"Failed to activate block type version\" },\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,SAAS,YAAY,OAAoB;AACxC,QAAO;EACN,SAAS;EACT,OAAO;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;GAAS,SAAS,MAAM;GAAS;EAC3E;;AAGF,eAAe,oBAAoB,IAAsB,MAA6B;CACrF,MAAM,cAAc,MAAM,IAAI,kBAAkB,GAAG,CAAC,wBAAwB,KAAK;AACjF,MAAK,MAAM,cAAc,aAAa;AACrC,4BAA0B,WAAW;AACrC,wBAAsB,WAAW;;;AAInC,eAAsB,oBACrB,IAC4C;AAC5C,KAAI;AACH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,OAAO,MAAM,IAAI,kBAAkB,GAAG,CAAC,gBAAgB,EAAE;GAAE;SACpF;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAqB,SAAS;IAA8B;GAC3E;;;AAIH,eAAsB,mBACrB,IACA,MACwC;AACxC,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,kBAAkB,GAAG,CAAC,aAAa,KAAK;AAC/D,MAAI,CAAC,KACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS,eAAe,KAAK;IAAc;GAClF;AAEF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM;GAAE;UAChC,OAAO;AACf,MAAI,iBAAiB,YAAa,QAAO,YAAY,MAAM;AAC3D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA4B;GACxE;;;AAIH,eAAsB,sBACrB,IACA,OACwC;AACxC,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,kBAAkB,GAAG,CAAC,gBAAgB,MAAM;AACnE,QAAM,oBAAoB,IAAI,MAAM,KAAK;AACzC,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM;GAAE;UAChC,OAAO;AACf,MAAI,iBAAiB,YAAa,QAAO,YAAY,MAAM;AAC3D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA+B;GAC9E;;;AAIH,eAAsB,sBACrB,IACA,MACA,OACwC;AACxC,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,kBAAkB,GAAG,CAAC,gBAAgB,MAAM,MAAM;AACzE,QAAM,oBAAoB,IAAI,KAAK;AACnC,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM;GAAE;UAChC,OAAO;AACf,MAAI,iBAAiB,YAAa,QAAO,YAAY,MAAM;AAC3D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA+B;GAC9E;;;AAIH,eAAsB,+BACrB,IACA,MACA,SACA,qBACwC;AACxC,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,kBAAkB,GAAG,CAAC,gBAC5C,MACA,SACA,oBACA;AACD,QAAM,oBAAoB,IAAI,KAAK;AACnC,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,MAAM;GAAE;UAChC,OAAO;AACf,MAAI,iBAAiB,YAAa,QAAO,YAAY,MAAM;AAC3D,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAAyC;GACxF"}

package/dist/block-values-ACFqgB1D.mjs

@@ -0,0 +1,175 @@
+import { u as __exportAll } from "./runner-B3eyB9Gb.mjs";
+import { L as BlockTypeRegistry, t as SchemaError } from "./registry-CFcNCayZ.mjs";
+import { t as generateBlockFieldSchema } from "./zod-generator-DmTKI-Ig.mjs";
+import { z } from "zod";
+import { ulid } from "ulidx";
+
+//#region src/schema/block-values.ts
+var block_values_exports = /* @__PURE__ */ __exportAll({
+	expandCollectionBlockFields: () => expandCollectionBlockFields,
+	normalizeBlocksData: () => normalizeBlocksData,
+	resolveBlockTypes: () => resolveBlockTypes
+});
+async function resolveBlockTypes(db) {
+	const blockTypes = await new BlockTypeRegistry(db).listBlockTypes();
+	return new Map(blockTypes.map((type) => [type.slug, type]));
+}
+async function fingerprintResolvedTypes(allowedTypes, retiredTypes, types) {
+	const payload = JSON.stringify({
+		allowedTypes,
+		retiredTypes,
+		types: types.map((type) => ({
+			slug: type.slug,
+			currentVersion: type.currentVersion,
+			versions: type.versions.map((version) => ({
+				version: version.version,
+				fingerprint: version.fingerprint
+			}))
+		}))
+	});
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(payload));
+	return `blocks-field:v1:sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+async function expandCollectionBlockFields(db, collection) {
+	if (collection.fields.filter((field) => field.type === "blocks").length === 0) return collection;
+	const resolved = await resolveBlockTypes(db);
+	const fields = await Promise.all(collection.fields.map(async (field) => {
+		if (field.type !== "blocks") return field;
+		const allowedTypes = field.validation?.allowedTypes ?? [];
+		const retiredTypes = field.validation?.retiredTypes ?? [];
+		const blockTypes = [...allowedTypes, ...retiredTypes.filter((slug) => !allowedTypes.includes(slug))].map((slug) => {
+			const type = resolved.get(slug);
+			if (!type) unsupported(field.slug, `block type "${slug}" is unavailable`);
+			return type;
+		});
+		return {
+			...field,
+			blockTypes,
+			blockTypeFingerprint: await fingerprintResolvedTypes(allowedTypes, retiredTypes, blockTypes)
+		};
+	}));
+	return {
+		...collection,
+		fields
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validationError(path, message) {
+	throw new SchemaError(`${path}: ${message}`, "VALIDATION_ERROR", { issues: [{
+		path,
+		code: "custom",
+		message
+	}] });
+}
+function unsupported(path, message) {
+	throw new SchemaError(`${path}: ${message}`, "UNSUPPORTED_FIELD_TYPE", { path });
+}
+function versionFor(type, version, path) {
+	const definition = type.versions.find((candidate) => candidate.version === version);
+	if (!definition) unsupported(path, `block type "${type.slug}" has no retained version ${version}`);
+	if (definition.unsupportedTypes?.length) unsupported(path, `block type "${type.slug}" version ${version} uses unsupported field types`);
+	return definition;
+}
+function blockSchema(typeSlug, definition) {
+	const shape = {
+		_type: z.literal(typeSlug),
+		_version: z.literal(definition.version),
+		_key: z.string().min(1)
+	};
+	for (const field of definition.fields) shape[field.slug] = generateBlockFieldSchema(field);
+	return z.object(shape).strict();
+}
+function existingByKey(value, path) {
+	if (value === void 0 || value === null) return /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) validationError(path, "stored blocks value is not an array");
+	const result = /* @__PURE__ */ new Map();
+	for (const [index, block] of value.entries()) {
+		if (!isRecord(block)) validationError(`${path}[${index}]`, "stored block is not an object");
+		if (typeof block._key !== "string" || block._key.length === 0) validationError(`${path}[${index}]._key`, "stored block key is missing");
+		if (result.has(block._key)) validationError(`${path}[${index}]._key`, "stored block key is duplicated");
+		result.set(block._key, block);
+	}
+	return result;
+}
+function normalizeBlockArray(field, value, existingValue, types, options) {
+	const path = field.slug;
+	if (!Array.isArray(value)) validationError(path, "must be an array");
+	const minItems = field.validation?.minItems ?? 0;
+	const maxItems = field.validation?.maxItems;
+	if (value.length < minItems) validationError(path, `must contain at least ${minItems} blocks`);
+	if (maxItems !== void 0 && value.length > maxItems) validationError(path, `must contain at most ${maxItems} blocks`);
+	const allowed = new Set(field.validation?.allowedTypes ?? []);
+	const retired = new Set(field.validation?.retiredTypes ?? []);
+	const existing = existingByKey(existingValue, path);
+	const incomingKeyCount = value.filter((block) => isRecord(block) && block._key !== void 0).length;
+	if (options.replaceBlocks && incomingKeyCount > 0) validationError(path, "replaceBlocks requires an entirely keyless replacement array");
+	if (!options.replaceBlocks && existing.size > 0 && value.length > 0 && incomingKeyCount === 0) validationError(path, "updating an existing blocks field requires keys or replaceBlocks");
+	const seen = /* @__PURE__ */ new Set();
+	return value.map((rawBlock, index) => {
+		const blockPath = `${path}[${index}]`;
+		if (!isRecord(rawBlock)) validationError(blockPath, "must be an object");
+		if (typeof rawBlock._type !== "string" || rawBlock._type.length === 0) validationError(`${blockPath}._type`, "must be a block type slug");
+		if (rawBlock._version !== void 0 && (typeof rawBlock._version !== "number" || !Number.isInteger(rawBlock._version) || rawBlock._version < 1)) validationError(`${blockPath}._version`, "must be a positive integer");
+		if (rawBlock._key !== void 0 && (typeof rawBlock._key !== "string" || rawBlock._key.length === 0)) validationError(`${blockPath}._key`, "must be a non-empty string");
+		const previous = typeof rawBlock._key === "string" ? existing.get(rawBlock._key) : void 0;
+		const type = types.get(rawBlock._type);
+		if (!type) unsupported(`${blockPath}._type`, `block type "${rawBlock._type}" is unavailable`);
+		if (previous) {
+			if (previous._type !== rawBlock._type) validationError(`${blockPath}._type`, "cannot change an existing block's type");
+		} else if (!allowed.has(rawBlock._type) && !(options.restoreBlocks && retired.has(rawBlock._type))) {
+			const reason = retired.has(rawBlock._type) ? "is retired" : "is not allowed by this field";
+			validationError(`${blockPath}._type`, `block type "${rawBlock._type}" ${reason}`);
+		}
+		let version;
+		if (previous) {
+			if (typeof previous._version !== "number" || !Number.isInteger(previous._version)) validationError(`${blockPath}._version`, "stored block version is invalid");
+			version = rawBlock._version === void 0 ? previous._version : rawBlock._version;
+			if (version !== previous._version) {
+				if (!options.migrateBlocks) validationError(`${blockPath}._version`, "cannot change without migrateBlocks");
+				if (version !== type.currentVersion) validationError(`${blockPath}._version`, "migration target must be the active version");
+			}
+		} else {
+			version = rawBlock._version === void 0 ? type.currentVersion : rawBlock._version;
+			if (version !== type.currentVersion && !options.restoreBlocks) validationError(`${blockPath}._version`, "new blocks must use the active version");
+		}
+		const key = options.replaceBlocks ? ulid() : rawBlock._key ?? ulid();
+		if (seen.has(key)) validationError(`${blockPath}._key`, "must be unique within the field");
+		seen.add(key);
+		const definition = versionFor(type, version, `${blockPath}._version`);
+		const normalized = {
+			...rawBlock,
+			_type: rawBlock._type,
+			_version: version,
+			_key: key
+		};
+		if (!previous) {
+			for (const nestedField of definition.fields) if (normalized[nestedField.slug] === void 0 && nestedField.defaultValue !== void 0) normalized[nestedField.slug] = structuredClone(nestedField.defaultValue);
+		}
+		for (const nestedField of definition.fields) if (nestedField.required && normalized[nestedField.slug] === "") validationError(`${blockPath}.${nestedField.slug}`, "required field cannot be empty");
+		const parsed = blockSchema(type.slug, definition).safeParse(normalized);
+		if (!parsed.success) {
+			const issue = parsed.error.issues[0];
+			validationError(`${blockPath}${issue?.path.length ? `.${issue.path.map(String).join(".")}` : ""}`, issue?.message ?? "invalid block value");
+		}
+		return {
+			...normalized,
+			_type: rawBlock._type,
+			_version: version,
+			_key: key
+		};
+	});
+}
+async function normalizeBlocksData(db, collection, data, existingData = {}, options = {}, partial = true, resolvedTypes) {
+	const blockFields = collection.fields.filter((field) => field.type === "blocks" && (!partial || Object.hasOwn(data, field.slug)));
+	if (blockFields.length === 0) return data;
+	const types = resolvedTypes ?? await resolveBlockTypes(db);
+	const normalized = { ...data };
+	for (const field of blockFields) normalized[field.slug] = normalizeBlockArray(field, Object.hasOwn(data, field.slug) ? data[field.slug] : [], existingData[field.slug], types, options);
+	return normalized;
+}
+
+//#endregion
+export { resolveBlockTypes as i, expandCollectionBlockFields as n, normalizeBlocksData as r, block_values_exports as t };
+//# sourceMappingURL=block-values-ACFqgB1D.mjs.map