emdash 0.40.0 → 0.41.0

package/dist/errors-Bt3goF8I.mjs

@@ -0,0 +1,120 @@
+import { z } from "zod";
+
+//#region src/transfer/errors.ts
+/**
+* Stable error codes for site transfer (export, analysis, import).
+*
+* Every code is `SCREAMING_SNAKE_CASE` with the `TRANSFER_` prefix and has a
+* fixed HTTP status. `mapErrorStatus` in `api/errors.ts` consults
+* {@link transferErrorStatus} first, so handlers can return these codes in an
+* `ApiResult` and `unwrapResult` picks the right status.
+*/
+const TransferErrorCode = {
+	TRANSFER_IMPORT_IN_PROGRESS: "TRANSFER_IMPORT_IN_PROGRESS",
+	TRANSFER_FENCE_CHECK_FAILED: "TRANSFER_FENCE_CHECK_FAILED",
+	TRANSFER_EXPORT_CONCURRENT_WRITES: "TRANSFER_EXPORT_CONCURRENT_WRITES",
+	TRANSFER_OPERATION_NOT_FOUND: "TRANSFER_OPERATION_NOT_FOUND",
+	TRANSFER_INVALID_STATE: "TRANSFER_INVALID_STATE",
+	TRANSFER_LEASE_ACTIVE: "TRANSFER_LEASE_ACTIVE",
+	TRANSFER_LEASE_LOST: "TRANSFER_LEASE_LOST",
+	TRANSFER_RUNTIME_MISMATCH: "TRANSFER_RUNTIME_MISMATCH",
+	TRANSFER_IDEMPOTENCY_CONFLICT: "TRANSFER_IDEMPOTENCY_CONFLICT",
+	TRANSFER_TARGET_NOT_EMPTY: "TRANSFER_TARGET_NOT_EMPTY",
+	TRANSFER_EXPIRED: "TRANSFER_EXPIRED",
+	TRANSFER_MANIFEST_INVALID: "TRANSFER_MANIFEST_INVALID",
+	TRANSFER_UNSUPPORTED_FORMAT: "TRANSFER_UNSUPPORTED_FORMAT",
+	TRANSFER_UNSUPPORTED_FEATURE: "TRANSFER_UNSUPPORTED_FEATURE",
+	TRANSFER_PATH_INVALID: "TRANSFER_PATH_INVALID",
+	TRANSFER_FILE_NOT_DECLARED: "TRANSFER_FILE_NOT_DECLARED",
+	TRANSFER_FILE_MISSING: "TRANSFER_FILE_MISSING",
+	TRANSFER_FILE_SIZE_MISMATCH: "TRANSFER_FILE_SIZE_MISMATCH",
+	TRANSFER_FILE_DIGEST_MISMATCH: "TRANSFER_FILE_DIGEST_MISMATCH",
+	TRANSFER_CONTAINER_INVALID: "TRANSFER_CONTAINER_INVALID",
+	TRANSFER_LIMIT_EXCEEDED: "TRANSFER_LIMIT_EXCEEDED",
+	TRANSFER_RECORD_INVALID: "TRANSFER_RECORD_INVALID",
+	TRANSFER_REFERENCE_INVALID: "TRANSFER_REFERENCE_INVALID",
+	TRANSFER_MEDIA_REF_INVALID: "TRANSFER_MEDIA_REF_INVALID",
+	TRANSFER_MEDIA_BLOB_MISSING: "TRANSFER_MEDIA_BLOB_MISSING",
+	TRANSFER_SCHEMA_UNCLASSIFIED: "TRANSFER_SCHEMA_UNCLASSIFIED",
+	TRANSFER_PACKAGE_DIGEST_MISMATCH: "TRANSFER_PACKAGE_DIGEST_MISMATCH",
+	TRANSFER_PLAN_DIGEST_MISMATCH: "TRANSFER_PLAN_DIGEST_MISMATCH",
+	TRANSFER_PLAN_BLOCKED: "TRANSFER_PLAN_BLOCKED",
+	TRANSFER_DECISIONS_INVALID: "TRANSFER_DECISIONS_INVALID",
+	TRANSFER_VERIFICATION_FAILED: "TRANSFER_VERIFICATION_FAILED",
+	TRANSFER_APPROVAL_REQUIRED: "TRANSFER_APPROVAL_REQUIRED",
+	TRANSFER_APPROVAL_INVALID: "TRANSFER_APPROVAL_INVALID",
+	TRANSFER_STORAGE_ERROR: "TRANSFER_STORAGE_ERROR",
+	TRANSFER_EXPORT_ERROR: "TRANSFER_EXPORT_ERROR",
+	TRANSFER_ANALYZE_ERROR: "TRANSFER_ANALYZE_ERROR",
+	TRANSFER_IMPORT_ERROR: "TRANSFER_IMPORT_ERROR"
+};
+const TRANSFER_ERROR_STATUS = Object.freeze({
+	TRANSFER_IMPORT_IN_PROGRESS: 503,
+	TRANSFER_FENCE_CHECK_FAILED: 503,
+	TRANSFER_EXPORT_CONCURRENT_WRITES: 409,
+	TRANSFER_OPERATION_NOT_FOUND: 404,
+	TRANSFER_INVALID_STATE: 409,
+	TRANSFER_LEASE_ACTIVE: 409,
+	TRANSFER_LEASE_LOST: 409,
+	TRANSFER_RUNTIME_MISMATCH: 409,
+	TRANSFER_IDEMPOTENCY_CONFLICT: 409,
+	TRANSFER_TARGET_NOT_EMPTY: 409,
+	TRANSFER_EXPIRED: 410,
+	TRANSFER_MANIFEST_INVALID: 422,
+	TRANSFER_UNSUPPORTED_FORMAT: 422,
+	TRANSFER_UNSUPPORTED_FEATURE: 422,
+	TRANSFER_PATH_INVALID: 422,
+	TRANSFER_FILE_NOT_DECLARED: 422,
+	TRANSFER_FILE_MISSING: 422,
+	TRANSFER_FILE_SIZE_MISMATCH: 422,
+	TRANSFER_FILE_DIGEST_MISMATCH: 422,
+	TRANSFER_CONTAINER_INVALID: 422,
+	TRANSFER_LIMIT_EXCEEDED: 413,
+	TRANSFER_RECORD_INVALID: 422,
+	TRANSFER_REFERENCE_INVALID: 422,
+	TRANSFER_MEDIA_REF_INVALID: 422,
+	TRANSFER_MEDIA_BLOB_MISSING: 422,
+	TRANSFER_SCHEMA_UNCLASSIFIED: 500,
+	TRANSFER_PACKAGE_DIGEST_MISMATCH: 409,
+	TRANSFER_PLAN_DIGEST_MISMATCH: 409,
+	TRANSFER_PLAN_BLOCKED: 409,
+	TRANSFER_DECISIONS_INVALID: 422,
+	TRANSFER_VERIFICATION_FAILED: 422,
+	TRANSFER_APPROVAL_REQUIRED: 403,
+	TRANSFER_APPROVAL_INVALID: 403,
+	TRANSFER_STORAGE_ERROR: 500,
+	TRANSFER_EXPORT_ERROR: 500,
+	TRANSFER_ANALYZE_ERROR: 500,
+	TRANSFER_IMPORT_ERROR: 500
+});
+function isTransferErrorCode(code) {
+	return code !== void 0 && Object.hasOwn(TRANSFER_ERROR_STATUS, code);
+}
+function transferErrorStatus(code) {
+	return isTransferErrorCode(code) ? TRANSFER_ERROR_STATUS[code] : void 0;
+}
+const transferErrorDetailSchema = z.record(z.string(), z.union([
+	z.string(),
+	z.number(),
+	z.boolean(),
+	z.null()
+]));
+var TransferError = class extends Error {
+	code;
+	status;
+	detail;
+	constructor(code, message, options = {}) {
+		super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+		this.name = "TransferError";
+		this.code = code;
+		this.status = TRANSFER_ERROR_STATUS[code];
+		this.detail = options.detail;
+	}
+};
+function isTransferError(error) {
+	return error instanceof TransferError;
+}
+
+//#endregion
+export { transferErrorStatus as a, transferErrorDetailSchema as i, TransferErrorCode as n, isTransferError as r, TransferError as t };
+//# sourceMappingURL=errors-Bt3goF8I.mjs.map

package/dist/errors-Bt3goF8I.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-Bt3goF8I.mjs","names":[],"sources":["../src/transfer/errors.ts"],"sourcesContent":["/**\n * Stable error codes for site transfer (export, analysis, import).\n *\n * Every code is `SCREAMING_SNAKE_CASE` with the `TRANSFER_` prefix and has a\n * fixed HTTP status. `mapErrorStatus` in `api/errors.ts` consults\n * {@link transferErrorStatus} first, so handlers can return these codes in an\n * `ApiResult` and `unwrapResult` picks the right status.\n */\n\nimport { z } from \"zod\";\n\nexport const TransferErrorCode = {\n\tTRANSFER_IMPORT_IN_PROGRESS: \"TRANSFER_IMPORT_IN_PROGRESS\",\n\tTRANSFER_FENCE_CHECK_FAILED: \"TRANSFER_FENCE_CHECK_FAILED\",\n\tTRANSFER_EXPORT_CONCURRENT_WRITES: \"TRANSFER_EXPORT_CONCURRENT_WRITES\",\n\tTRANSFER_OPERATION_NOT_FOUND: \"TRANSFER_OPERATION_NOT_FOUND\",\n\tTRANSFER_INVALID_STATE: \"TRANSFER_INVALID_STATE\",\n\tTRANSFER_LEASE_ACTIVE: \"TRANSFER_LEASE_ACTIVE\",\n\tTRANSFER_LEASE_LOST: \"TRANSFER_LEASE_LOST\",\n\tTRANSFER_RUNTIME_MISMATCH: \"TRANSFER_RUNTIME_MISMATCH\",\n\tTRANSFER_IDEMPOTENCY_CONFLICT: \"TRANSFER_IDEMPOTENCY_CONFLICT\",\n\tTRANSFER_TARGET_NOT_EMPTY: \"TRANSFER_TARGET_NOT_EMPTY\",\n\tTRANSFER_EXPIRED: \"TRANSFER_EXPIRED\",\n\tTRANSFER_MANIFEST_INVALID: \"TRANSFER_MANIFEST_INVALID\",\n\tTRANSFER_UNSUPPORTED_FORMAT: \"TRANSFER_UNSUPPORTED_FORMAT\",\n\tTRANSFER_UNSUPPORTED_FEATURE: \"TRANSFER_UNSUPPORTED_FEATURE\",\n\tTRANSFER_PATH_INVALID: \"TRANSFER_PATH_INVALID\",\n\tTRANSFER_FILE_NOT_DECLARED: \"TRANSFER_FILE_NOT_DECLARED\",\n\tTRANSFER_FILE_MISSING: \"TRANSFER_FILE_MISSING\",\n\tTRANSFER_FILE_SIZE_MISMATCH: \"TRANSFER_FILE_SIZE_MISMATCH\",\n\tTRANSFER_FILE_DIGEST_MISMATCH: \"TRANSFER_FILE_DIGEST_MISMATCH\",\n\tTRANSFER_CONTAINER_INVALID: \"TRANSFER_CONTAINER_INVALID\",\n\tTRANSFER_LIMIT_EXCEEDED: \"TRANSFER_LIMIT_EXCEEDED\",\n\tTRANSFER_RECORD_INVALID: \"TRANSFER_RECORD_INVALID\",\n\tTRANSFER_REFERENCE_INVALID: \"TRANSFER_REFERENCE_INVALID\",\n\tTRANSFER_MEDIA_REF_INVALID: \"TRANSFER_MEDIA_REF_INVALID\",\n\tTRANSFER_MEDIA_BLOB_MISSING: \"TRANSFER_MEDIA_BLOB_MISSING\",\n\tTRANSFER_SCHEMA_UNCLASSIFIED: \"TRANSFER_SCHEMA_UNCLASSIFIED\",\n\tTRANSFER_PACKAGE_DIGEST_MISMATCH: \"TRANSFER_PACKAGE_DIGEST_MISMATCH\",\n\tTRANSFER_PLAN_DIGEST_MISMATCH: \"TRANSFER_PLAN_DIGEST_MISMATCH\",\n\tTRANSFER_PLAN_BLOCKED: \"TRANSFER_PLAN_BLOCKED\",\n\tTRANSFER_DECISIONS_INVALID: \"TRANSFER_DECISIONS_INVALID\",\n\tTRANSFER_VERIFICATION_FAILED: \"TRANSFER_VERIFICATION_FAILED\",\n\tTRANSFER_APPROVAL_REQUIRED: \"TRANSFER_APPROVAL_REQUIRED\",\n\tTRANSFER_APPROVAL_INVALID: \"TRANSFER_APPROVAL_INVALID\",\n\tTRANSFER_STORAGE_ERROR: \"TRANSFER_STORAGE_ERROR\",\n\tTRANSFER_EXPORT_ERROR: \"TRANSFER_EXPORT_ERROR\",\n\tTRANSFER_ANALYZE_ERROR: \"TRANSFER_ANALYZE_ERROR\",\n\tTRANSFER_IMPORT_ERROR: \"TRANSFER_IMPORT_ERROR\",\n} as const;\n\nexport type TransferErrorCode = (typeof TransferErrorCode)[keyof typeof TransferErrorCode];\n\nexport const TRANSFER_ERROR_STATUS: Readonly<Record<TransferErrorCode, number>> = Object.freeze({\n\tTRANSFER_IMPORT_IN_PROGRESS: 503,\n\tTRANSFER_FENCE_CHECK_FAILED: 503,\n\tTRANSFER_EXPORT_CONCURRENT_WRITES: 409,\n\tTRANSFER_OPERATION_NOT_FOUND: 404,\n\tTRANSFER_INVALID_STATE: 409,\n\tTRANSFER_LEASE_ACTIVE: 409,\n\tTRANSFER_LEASE_LOST: 409,\n\tTRANSFER_RUNTIME_MISMATCH: 409,\n\tTRANSFER_IDEMPOTENCY_CONFLICT: 409,\n\tTRANSFER_TARGET_NOT_EMPTY: 409,\n\tTRANSFER_EXPIRED: 410,\n\tTRANSFER_MANIFEST_INVALID: 422,\n\tTRANSFER_UNSUPPORTED_FORMAT: 422,\n\tTRANSFER_UNSUPPORTED_FEATURE: 422,\n\tTRANSFER_PATH_INVALID: 422,\n\tTRANSFER_FILE_NOT_DECLARED: 422,\n\tTRANSFER_FILE_MISSING: 422,\n\tTRANSFER_FILE_SIZE_MISMATCH: 422,\n\tTRANSFER_FILE_DIGEST_MISMATCH: 422,\n\tTRANSFER_CONTAINER_INVALID: 422,\n\tTRANSFER_LIMIT_EXCEEDED: 413,\n\tTRANSFER_RECORD_INVALID: 422,\n\tTRANSFER_REFERENCE_INVALID: 422,\n\tTRANSFER_MEDIA_REF_INVALID: 422,\n\tTRANSFER_MEDIA_BLOB_MISSING: 422,\n\tTRANSFER_SCHEMA_UNCLASSIFIED: 500,\n\tTRANSFER_PACKAGE_DIGEST_MISMATCH: 409,\n\tTRANSFER_PLAN_DIGEST_MISMATCH: 409,\n\tTRANSFER_PLAN_BLOCKED: 409,\n\tTRANSFER_DECISIONS_INVALID: 422,\n\tTRANSFER_VERIFICATION_FAILED: 422,\n\tTRANSFER_APPROVAL_REQUIRED: 403,\n\tTRANSFER_APPROVAL_INVALID: 403,\n\tTRANSFER_STORAGE_ERROR: 500,\n\tTRANSFER_EXPORT_ERROR: 500,\n\tTRANSFER_ANALYZE_ERROR: 500,\n\tTRANSFER_IMPORT_ERROR: 500,\n});\n\nexport function isTransferErrorCode(code: string | undefined): code is TransferErrorCode {\n\treturn code !== undefined && Object.hasOwn(TRANSFER_ERROR_STATUS, code);\n}\n\nexport function transferErrorStatus(code: string | undefined): number | undefined {\n\treturn isTransferErrorCode(code) ? TRANSFER_ERROR_STATUS[code] : undefined;\n}\n\n/**\n * JSON-safe, bounded detail attached to a transfer error. Never put record\n * contents, credentials, or storage keys here: details reach API clients and\n * operation rows.\n */\nexport type TransferErrorDetail = Readonly<Record<string, string | number | boolean | null>>;\n\nexport const transferErrorDetailSchema = z.record(\n\tz.string(),\n\tz.union([z.string(), z.number(), z.boolean(), z.null()]),\n);\n\nexport class TransferError extends Error {\n\treadonly code: TransferErrorCode;\n\treadonly status: number;\n\treadonly detail: TransferErrorDetail | undefined;\n\n\tconstructor(\n\t\tcode: TransferErrorCode,\n\t\tmessage: string,\n\t\toptions: { detail?: TransferErrorDetail; cause?: unknown } = {},\n\t) {\n\t\tsuper(message, options.cause === undefined ? undefined : { cause: options.cause });\n\t\tthis.name = \"TransferError\";\n\t\tthis.code = code;\n\t\tthis.status = TRANSFER_ERROR_STATUS[code];\n\t\tthis.detail = options.detail;\n\t}\n}\n\nexport function isTransferError(error: unknown): error is TransferError {\n\treturn error instanceof TransferError;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAa,oBAAoB;CAChC,6BAA6B;CAC7B,6BAA6B;CAC7B,mCAAmC;CACnC,8BAA8B;CAC9B,wBAAwB;CACxB,uBAAuB;CACvB,qBAAqB;CACrB,2BAA2B;CAC3B,+BAA+B;CAC/B,2BAA2B;CAC3B,kBAAkB;CAClB,2BAA2B;CAC3B,6BAA6B;CAC7B,8BAA8B;CAC9B,uBAAuB;CACvB,4BAA4B;CAC5B,uBAAuB;CACvB,6BAA6B;CAC7B,+BAA+B;CAC/B,4BAA4B;CAC5B,yBAAyB;CACzB,yBAAyB;CACzB,4BAA4B;CAC5B,4BAA4B;CAC5B,6BAA6B;CAC7B,8BAA8B;CAC9B,kCAAkC;CAClC,+BAA+B;CAC/B,uBAAuB;CACvB,4BAA4B;CAC5B,8BAA8B;CAC9B,4BAA4B;CAC5B,2BAA2B;CAC3B,wBAAwB;CACxB,uBAAuB;CACvB,wBAAwB;CACxB,uBAAuB;CACvB;AAID,MAAa,wBAAqE,OAAO,OAAO;CAC/F,6BAA6B;CAC7B,6BAA6B;CAC7B,mCAAmC;CACnC,8BAA8B;CAC9B,wBAAwB;CACxB,uBAAuB;CACvB,qBAAqB;CACrB,2BAA2B;CAC3B,+BAA+B;CAC/B,2BAA2B;CAC3B,kBAAkB;CAClB,2BAA2B;CAC3B,6BAA6B;CAC7B,8BAA8B;CAC9B,uBAAuB;CACvB,4BAA4B;CAC5B,uBAAuB;CACvB,6BAA6B;CAC7B,+BAA+B;CAC/B,4BAA4B;CAC5B,yBAAyB;CACzB,yBAAyB;CACzB,4BAA4B;CAC5B,4BAA4B;CAC5B,6BAA6B;CAC7B,8BAA8B;CAC9B,kCAAkC;CAClC,+BAA+B;CAC/B,uBAAuB;CACvB,4BAA4B;CAC5B,8BAA8B;CAC9B,4BAA4B;CAC5B,2BAA2B;CAC3B,wBAAwB;CACxB,uBAAuB;CACvB,wBAAwB;CACxB,uBAAuB;CACvB,CAAC;AAEF,SAAgB,oBAAoB,MAAqD;AACxF,QAAO,SAAS,UAAa,OAAO,OAAO,uBAAuB,KAAK;;AAGxE,SAAgB,oBAAoB,MAA8C;AACjF,QAAO,oBAAoB,KAAK,GAAG,sBAAsB,QAAQ;;AAUlE,MAAa,4BAA4B,EAAE,OAC1C,EAAE,QAAQ,EACV,EAAE,MAAM;CAAC,EAAE,QAAQ;CAAE,EAAE,QAAQ;CAAE,EAAE,SAAS;CAAE,EAAE,MAAM;CAAC,CAAC,CACxD;AAED,IAAa,gBAAb,cAAmC,MAAM;CACxC,AAAS;CACT,AAAS;CACT,AAAS;CAET,YACC,MACA,SACA,UAA6D,EAAE,EAC9D;AACD,QAAM,SAAS,QAAQ,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,OAAO,CAAC;AAClF,OAAK,OAAO;AACZ,OAAK,OAAO;AACZ,OAAK,SAAS,sBAAsB;AACpC,OAAK,SAAS,QAAQ;;;AAIxB,SAAgB,gBAAgB,OAAwC;AACvE,QAAO,iBAAiB"}

package/dist/escape-BveidMa2.mjs

@@ -0,0 +1,9 @@
+//#region src/api/escape.ts
+/** HTML-escape a string to prevent XSS when interpolated into HTML/JS */
+function escapeHtml(str) {
+	return str.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#x27;");
+}
+
+//#endregion
+export { escapeHtml as t };
+//# sourceMappingURL=escape-BveidMa2.mjs.map

package/dist/escape-BveidMa2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-BveidMa2.mjs","names":[],"sources":["../src/api/escape.ts"],"sourcesContent":["/** HTML-escape a string to prevent XSS when interpolated into HTML/JS */\nexport function escapeHtml(str: string): string {\n\treturn str\n\t\t.replaceAll(\"&\", \"&amp;\")\n\t\t.replaceAll(\"<\", \"&lt;\")\n\t\t.replaceAll(\">\", \"&gt;\")\n\t\t.replaceAll('\"', \"&quot;\")\n\t\t.replaceAll(\"'\", \"&#x27;\");\n}\n"],"mappings":";;AACA,SAAgB,WAAW,KAAqB;AAC/C,QAAO,IACL,WAAW,KAAK,QAAQ,CACxB,WAAW,KAAK,OAAO,CACvB,WAAW,KAAK,OAAO,CACvB,WAAW,MAAK,SAAS,CACzB,WAAW,KAAK,SAAS"}

package/dist/fence-Bb_IbCxI.mjs

@@ -0,0 +1,162 @@
+import { n as isMissingTableError } from "./db-errors-CBD5yMro.mjs";
+import { y as tableExists } from "./dialect-helpers-7_IqPdh9.mjs";
+import { t as apiError } from "./error-BfsNNrIE.mjs";
+import { sql } from "kysely";
+
+//#region src/api/media-usage-write-fence.ts
+/**
+* The media usage activation fence alone. Write paths use the unified site
+* write fence in `transfer/fence.ts`, which falls back to this before the
+* transfer tables exist.
+*/
+async function findMediaUsageActivationWriteFenceError(db) {
+	if (!await tableExists(db, "_emdash_media_usage_activation")) return null;
+	try {
+		if ((await db.selectFrom("_emdash_media_usage_activation").select("state").where("task_key", "=", "incremental_capture").executeTakeFirst())?.state === "activating") return {
+			code: "MEDIA_USAGE_ACTIVATION_IN_PROGRESS",
+			message: "Media usage activation is in progress",
+			status: 503
+		};
+	} catch (error) {
+		console.error("[media-usage] Failed to check the activation write fence:", error);
+		return {
+			code: "MEDIA_USAGE_ACTIVATION_CHECK_FAILED",
+			message: "Unable to verify media usage activation state",
+			status: 503
+		};
+	}
+	return null;
+}
+
+//#endregion
+//#region src/transfer/fence.ts
+/**
+* Unified site write fence: media-usage activation and transfer imports.
+*
+* One query answers both questions, so a fenced write path pays a single
+* round trip. A transfer import fences writes while it executes and, after a
+* failure or cancellation once writing started, until it is abandoned. The
+* same query reports whether an export is running, so a fenced write can
+* bump the export's write epoch without an extra query when none is.
+*/
+var SiteWriteBlockedError = class extends Error {
+	code;
+	status;
+	operationId;
+	constructor(error) {
+		super(error.message);
+		this.name = error.code;
+		this.code = error.code;
+		this.status = error.status;
+		this.operationId = error.operationId;
+	}
+};
+const CHECK_FAILED = {
+	code: "TRANSFER_FENCE_CHECK_FAILED",
+	message: "Unable to verify whether site writes are allowed",
+	status: 503
+};
+/** Read both fences and the running-export flag with one query. */
+async function readSiteWriteFence(db, scope = {}) {
+	const mediaUsage = scope.mediaUsage !== false;
+	const transfer = scope.transfer !== false;
+	let row;
+	try {
+		row = (await sql`
+			SELECT
+				(
+					SELECT state FROM _emdash_media_usage_activation
+					WHERE task_key = 'incremental_capture'
+				) AS media_state,
+				(
+					SELECT id FROM _emdash_transfer_operations
+					WHERE kind = 'import'
+						AND (
+							state IN ('running', 'verifying')
+							OR (state IN ('failed', 'cancelled') AND mutation_started_at IS NOT NULL)
+						)
+					LIMIT 1
+				) AS import_id,
+				(
+					SELECT id FROM _emdash_transfer_operations
+					WHERE kind = 'export' AND state = 'running'
+					LIMIT 1
+				) AS export_id
+		`.execute(db)).rows[0];
+	} catch (error) {
+		if (isMissingTableError(error)) return {
+			error: mediaUsage ? await findMediaUsageActivationWriteFenceError(db) : null,
+			exportRunning: false
+		};
+		console.error("[transfer] Failed to check the site write fence:", error);
+		return {
+			error: CHECK_FAILED,
+			exportRunning: false
+		};
+	}
+	const exportRunning = Boolean(row?.export_id);
+	if (transfer && row?.import_id) return {
+		error: {
+			code: "TRANSFER_IMPORT_IN_PROGRESS",
+			message: "A site import is in progress or incomplete; writes are disabled",
+			status: 503,
+			operationId: row.import_id
+		},
+		exportRunning
+	};
+	if (mediaUsage && row?.media_state === "activating") return {
+		error: {
+			code: "MEDIA_USAGE_ACTIVATION_IN_PROGRESS",
+			message: "Media usage activation is in progress",
+			status: 503
+		},
+		exportRunning
+	};
+	return {
+		error: null,
+		exportRunning
+	};
+}
+/**
+* Tell running exports that a fenced write happened, so their consistency
+* fence restarts them. Failures are logged, not thrown: the write itself is
+* allowed either way.
+*/
+async function recordSiteWrite(db) {
+	try {
+		await bumpRunningExportWriteEpochs(db);
+	} catch (error) {
+		console.error("[transfer] Failed to record a write for running exports:", error);
+	}
+}
+/** Increments the write epoch of every running export; returns how many there were. */
+async function bumpRunningExportWriteEpochs(db) {
+	const result = await db.updateTable("_emdash_transfer_operations").set({ write_epoch: sql`write_epoch + 1` }).where("kind", "=", "export").where("state", "=", "running").executeTakeFirst();
+	return Number(result.numUpdatedRows ?? 0n);
+}
+const NOTHING_TO_RECORD = async () => {};
+/**
+* Throw {@link SiteWriteBlockedError} when a fence blocks writes. Call it
+* immediately before the write, and call the returned function once the
+* write has succeeded: recording it afterwards means an export whose fence
+* was captured while the write ran still sees it.
+*/
+async function assertSiteWriteAllowed(db) {
+	const status = await readSiteWriteFence(db);
+	if (status.error) throw new SiteWriteBlockedError(status.error);
+	return status.exportRunning ? () => recordSiteWrite(db) : NOTHING_TO_RECORD;
+}
+/**
+* The fence as an API error response, or null when writes are allowed.
+* Records nothing: for the plugin lifecycle routes that call it, the fence
+* middleware records a successful response's write.
+*/
+async function checkSiteWriteFence(db) {
+	const status = await readSiteWriteFence(db);
+	if (status.error) return apiError(status.error.code, status.error.message, status.error.status);
+	return null;
+}
+
+//#endregion
+export { readSiteWriteFence as a, checkSiteWriteFence as i, assertSiteWriteAllowed as n, recordSiteWrite as o, bumpRunningExportWriteEpochs as r, SiteWriteBlockedError as t };
+//# sourceMappingURL=fence-Bb_IbCxI.mjs.map

package/dist/fence-Bb_IbCxI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fence-Bb_IbCxI.mjs","names":[],"sources":["../src/api/media-usage-write-fence.ts","../src/transfer/fence.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\n\nimport { tableExists } from \"../database/dialect-helpers.js\";\nimport type { Database } from \"../database/types.js\";\n\nexport interface MediaUsageActivationWriteFenceError {\n\tcode: \"MEDIA_USAGE_ACTIVATION_IN_PROGRESS\" | \"MEDIA_USAGE_ACTIVATION_CHECK_FAILED\";\n\tmessage: string;\n\tstatus: 503;\n}\n\n/**\n * The media usage activation fence alone. Write paths use the unified site\n * write fence in `transfer/fence.ts`, which falls back to this before the\n * transfer tables exist.\n */\nexport async function findMediaUsageActivationWriteFenceError(\n\tdb: Kysely<Database>,\n): Promise<MediaUsageActivationWriteFenceError | null> {\n\tif (!(await tableExists(db, \"_emdash_media_usage_activation\"))) return null;\n\ttry {\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_media_usage_activation\")\n\t\t\t.select(\"state\")\n\t\t\t.where(\"task_key\", \"=\", \"incremental_capture\")\n\t\t\t.executeTakeFirst();\n\t\tif (row?.state === \"activating\") {\n\t\t\treturn {\n\t\t\t\tcode: \"MEDIA_USAGE_ACTIVATION_IN_PROGRESS\",\n\t\t\t\tmessage: \"Media usage activation is in progress\",\n\t\t\t\tstatus: 503,\n\t\t\t};\n\t\t}\n\t} catch (error) {\n\t\tconsole.error(\"[media-usage] Failed to check the activation write fence:\", error);\n\t\treturn {\n\t\t\tcode: \"MEDIA_USAGE_ACTIVATION_CHECK_FAILED\",\n\t\t\tmessage: \"Unable to verify media usage activation state\",\n\t\t\tstatus: 503,\n\t\t};\n\t}\n\treturn null;\n}\n","/**\n * Unified site write fence: media-usage activation and transfer imports.\n *\n * One query answers both questions, so a fenced write path pays a single\n * round trip. A transfer import fences writes while it executes and, after a\n * failure or cancellation once writing started, until it is abandoned. The\n * same query reports whether an export is running, so a fenced write can\n * bump the export's write epoch without an extra query when none is.\n */\n\nimport { sql, type Kysely } from \"kysely\";\n\nimport { apiError } from \"../api/error.js\";\nimport { findMediaUsageActivationWriteFenceError } from \"../api/media-usage-write-fence.js\";\nimport type { Database } from \"../database/types.js\";\nimport { isMissingTableError } from \"../utils/db-errors.js\";\n\nexport type SiteWriteFenceCode =\n\t| \"MEDIA_USAGE_ACTIVATION_IN_PROGRESS\"\n\t| \"MEDIA_USAGE_ACTIVATION_CHECK_FAILED\"\n\t| \"TRANSFER_IMPORT_IN_PROGRESS\"\n\t| \"TRANSFER_FENCE_CHECK_FAILED\";\n\nexport interface SiteWriteFenceError {\n\tcode: SiteWriteFenceCode;\n\tmessage: string;\n\tstatus: 503;\n\t/** The fencing import, when the fence is a transfer import. */\n\toperationId?: string;\n}\n\nexport class SiteWriteBlockedError extends Error {\n\treadonly code: SiteWriteFenceCode;\n\treadonly status: 503;\n\treadonly operationId: string | undefined;\n\n\tconstructor(error: SiteWriteFenceError) {\n\t\tsuper(error.message);\n\t\tthis.name = error.code;\n\t\tthis.code = error.code;\n\t\tthis.status = error.status;\n\t\tthis.operationId = error.operationId;\n\t}\n}\n\n/** Which fences apply to a write. Both apply unless one is turned off. */\nexport interface SiteWriteFenceScope {\n\tmediaUsage?: boolean;\n\ttransfer?: boolean;\n}\n\nexport interface SiteWriteFenceStatus {\n\terror: SiteWriteFenceError | null;\n\t/** Whether an export was running when the fence was read. */\n\texportRunning: boolean;\n}\n\nconst CHECK_FAILED: SiteWriteFenceError = {\n\tcode: \"TRANSFER_FENCE_CHECK_FAILED\",\n\tmessage: \"Unable to verify whether site writes are allowed\",\n\tstatus: 503,\n};\n\n/** Read both fences and the running-export flag with one query. */\nexport async function readSiteWriteFence(\n\tdb: Kysely<Database>,\n\tscope: SiteWriteFenceScope = {},\n): Promise<SiteWriteFenceStatus> {\n\tconst mediaUsage = scope.mediaUsage !== false;\n\tconst transfer = scope.transfer !== false;\n\tlet row:\n\t\t| { media_state: string | null; import_id: string | null; export_id: string | null }\n\t\t| undefined;\n\ttry {\n\t\tconst result = await sql<{\n\t\t\tmedia_state: string | null;\n\t\t\timport_id: string | null;\n\t\t\texport_id: string | null;\n\t\t}>`\n\t\t\tSELECT\n\t\t\t\t(\n\t\t\t\t\tSELECT state FROM _emdash_media_usage_activation\n\t\t\t\t\tWHERE task_key = 'incremental_capture'\n\t\t\t\t) AS media_state,\n\t\t\t\t(\n\t\t\t\t\tSELECT id FROM _emdash_transfer_operations\n\t\t\t\t\tWHERE kind = 'import'\n\t\t\t\t\t\tAND (\n\t\t\t\t\t\t\tstate IN ('running', 'verifying')\n\t\t\t\t\t\t\tOR (state IN ('failed', 'cancelled') AND mutation_started_at IS NOT NULL)\n\t\t\t\t\t\t)\n\t\t\t\t\tLIMIT 1\n\t\t\t\t) AS import_id,\n\t\t\t\t(\n\t\t\t\t\tSELECT id FROM _emdash_transfer_operations\n\t\t\t\t\tWHERE kind = 'export' AND state = 'running'\n\t\t\t\t\tLIMIT 1\n\t\t\t\t) AS export_id\n\t\t`.execute(db);\n\t\trow = result.rows[0];\n\t} catch (error) {\n\t\tif (isMissingTableError(error)) {\n\t\t\treturn {\n\t\t\t\terror: mediaUsage ? await findMediaUsageActivationWriteFenceError(db) : null,\n\t\t\t\texportRunning: false,\n\t\t\t};\n\t\t}\n\t\tconsole.error(\"[transfer] Failed to check the site write fence:\", error);\n\t\treturn { error: CHECK_FAILED, exportRunning: false };\n\t}\n\n\tconst exportRunning = Boolean(row?.export_id);\n\tif (transfer && row?.import_id) {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\tcode: \"TRANSFER_IMPORT_IN_PROGRESS\",\n\t\t\t\tmessage: \"A site import is in progress or incomplete; writes are disabled\",\n\t\t\t\tstatus: 503,\n\t\t\t\toperationId: row.import_id,\n\t\t\t},\n\t\t\texportRunning,\n\t\t};\n\t}\n\tif (mediaUsage && row?.media_state === \"activating\") {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\tcode: \"MEDIA_USAGE_ACTIVATION_IN_PROGRESS\",\n\t\t\t\tmessage: \"Media usage activation is in progress\",\n\t\t\t\tstatus: 503,\n\t\t\t},\n\t\t\texportRunning,\n\t\t};\n\t}\n\treturn { error: null, exportRunning };\n}\n\nexport async function findSiteWriteFenceError(\n\tdb: Kysely<Database>,\n): Promise<SiteWriteFenceError | null> {\n\treturn (await readSiteWriteFence(db)).error;\n}\n\n/**\n * Tell running exports that a fenced write happened, so their consistency\n * fence restarts them. Failures are logged, not thrown: the write itself is\n * allowed either way.\n */\nexport async function recordSiteWrite(db: Kysely<Database>): Promise<void> {\n\ttry {\n\t\tawait bumpRunningExportWriteEpochs(db);\n\t} catch (error) {\n\t\tconsole.error(\"[transfer] Failed to record a write for running exports:\", error);\n\t}\n}\n\n/** Increments the write epoch of every running export; returns how many there were. */\nexport async function bumpRunningExportWriteEpochs(db: Kysely<Database>): Promise<number> {\n\tconst result = await db\n\t\t.updateTable(\"_emdash_transfer_operations\")\n\t\t.set({ write_epoch: sql<number>`write_epoch + 1` })\n\t\t.where(\"kind\", \"=\", \"export\")\n\t\t.where(\"state\", \"=\", \"running\")\n\t\t.executeTakeFirst();\n\treturn Number(result.numUpdatedRows ?? 0n);\n}\n\n/** Records a completed write for running exports; a no-op when none was running. */\nexport type RecordSiteWrite = () => Promise<void>;\n\nconst NOTHING_TO_RECORD: RecordSiteWrite = async () => {};\n\n/**\n * Throw {@link SiteWriteBlockedError} when a fence blocks writes. Call it\n * immediately before the write, and call the returned function once the\n * write has succeeded: recording it afterwards means an export whose fence\n * was captured while the write ran still sees it.\n */\nexport async function assertSiteWriteAllowed(db: Kysely<Database>): Promise<RecordSiteWrite> {\n\tconst status = await readSiteWriteFence(db);\n\tif (status.error) throw new SiteWriteBlockedError(status.error);\n\treturn status.exportRunning ? () => recordSiteWrite(db) : NOTHING_TO_RECORD;\n}\n\n/**\n * The fence as an API error response, or null when writes are allowed.\n * Records nothing: for the plugin lifecycle routes that call it, the fence\n * middleware records a successful response's write.\n */\nexport async function checkSiteWriteFence(db: Kysely<Database>): Promise<Response | null> {\n\tconst status = await readSiteWriteFence(db);\n\tif (status.error) return apiError(status.error.code, status.error.message, status.error.status);\n\treturn null;\n}\n"],"mappings":";;;;;;;;;;;AAgBA,eAAsB,wCACrB,IACsD;AACtD,KAAI,CAAE,MAAM,YAAY,IAAI,iCAAiC,CAAG,QAAO;AACvE,KAAI;AAMH,OALY,MAAM,GAChB,WAAW,iCAAiC,CAC5C,OAAO,QAAQ,CACf,MAAM,YAAY,KAAK,sBAAsB,CAC7C,kBAAkB,GACX,UAAU,aAClB,QAAO;GACN,MAAM;GACN,SAAS;GACT,QAAQ;GACR;UAEM,OAAO;AACf,UAAQ,MAAM,6DAA6D,MAAM;AACjF,SAAO;GACN,MAAM;GACN,SAAS;GACT,QAAQ;GACR;;AAEF,QAAO;;;;;;;;;;;;;;ACVR,IAAa,wBAAb,cAA2C,MAAM;CAChD,AAAS;CACT,AAAS;CACT,AAAS;CAET,YAAY,OAA4B;AACvC,QAAM,MAAM,QAAQ;AACpB,OAAK,OAAO,MAAM;AAClB,OAAK,OAAO,MAAM;AAClB,OAAK,SAAS,MAAM;AACpB,OAAK,cAAc,MAAM;;;AAgB3B,MAAM,eAAoC;CACzC,MAAM;CACN,SAAS;CACT,QAAQ;CACR;;AAGD,eAAsB,mBACrB,IACA,QAA6B,EAAE,EACC;CAChC,MAAM,aAAa,MAAM,eAAe;CACxC,MAAM,WAAW,MAAM,aAAa;CACpC,IAAI;AAGJ,KAAI;AA0BH,SAzBe,MAAM,GAInB;;;;;;;;;;;;;;;;;;;;IAoBA,QAAQ,GAAG,EACA,KAAK;UACV,OAAO;AACf,MAAI,oBAAoB,MAAM,CAC7B,QAAO;GACN,OAAO,aAAa,MAAM,wCAAwC,GAAG,GAAG;GACxE,eAAe;GACf;AAEF,UAAQ,MAAM,oDAAoD,MAAM;AACxE,SAAO;GAAE,OAAO;GAAc,eAAe;GAAO;;CAGrD,MAAM,gBAAgB,QAAQ,KAAK,UAAU;AAC7C,KAAI,YAAY,KAAK,UACpB,QAAO;EACN,OAAO;GACN,MAAM;GACN,SAAS;GACT,QAAQ;GACR,aAAa,IAAI;GACjB;EACD;EACA;AAEF,KAAI,cAAc,KAAK,gBAAgB,aACtC,QAAO;EACN,OAAO;GACN,MAAM;GACN,SAAS;GACT,QAAQ;GACR;EACD;EACA;AAEF,QAAO;EAAE,OAAO;EAAM;EAAe;;;;;;;AActC,eAAsB,gBAAgB,IAAqC;AAC1E,KAAI;AACH,QAAM,6BAA6B,GAAG;UAC9B,OAAO;AACf,UAAQ,MAAM,4DAA4D,MAAM;;;;AAKlF,eAAsB,6BAA6B,IAAuC;CACzF,MAAM,SAAS,MAAM,GACnB,YAAY,8BAA8B,CAC1C,IAAI,EAAE,aAAa,GAAW,mBAAmB,CAAC,CAClD,MAAM,QAAQ,KAAK,SAAS,CAC5B,MAAM,SAAS,KAAK,UAAU,CAC9B,kBAAkB;AACpB,QAAO,OAAO,OAAO,kBAAkB,GAAG;;AAM3C,MAAM,oBAAqC,YAAY;;;;;;;AAQvD,eAAsB,uBAAuB,IAAgD;CAC5F,MAAM,SAAS,MAAM,mBAAmB,GAAG;AAC3C,KAAI,OAAO,MAAO,OAAM,IAAI,sBAAsB,OAAO,MAAM;AAC/D,QAAO,OAAO,sBAAsB,gBAAgB,GAAG,GAAG;;;;;;;AAQ3D,eAAsB,oBAAoB,IAAgD;CACzF,MAAM,SAAS,MAAM,mBAAmB,GAAG;AAC3C,KAAI,OAAO,MAAO,QAAO,SAAS,OAAO,MAAM,MAAM,OAAO,MAAM,SAAS,OAAO,MAAM,OAAO;AAC/F,QAAO"}

package/dist/field-defs-cache-CsZctvbu.mjs

@@ -0,0 +1,77 @@
+import { u as __exportAll } from "./runner-B3eyB9Gb.mjs";
+import { t as after } from "./after-PcEvMY_6.mjs";
+import { getRequestContext } from "./request-context.mjs";
+import { n as initWithLock, t as createInitLock } from "./init-lock-4eRRB4Le.mjs";
+import { r as requestCached } from "./request-cache-iHRlHx1d.mjs";
+import { n as BylineSchemaRegistry } from "./byline-registry-B_EK_TQf.mjs";
+
+//#region src/bylines/field-defs-cache.ts
+var field_defs_cache_exports = /* @__PURE__ */ __exportAll({ getBylineFieldDefs: () => getBylineFieldDefs });
+const HOLDER_KEY = Symbol.for("emdash:byline-field-defs");
+const g = globalThis;
+const holder = g[HOLDER_KEY] ?? (() => {
+	const h = {
+		value: null,
+		hasValue: false,
+		cachedVersion: -1,
+		lock: createInitLock()
+	};
+	g[HOLDER_KEY] = h;
+	return h;
+})();
+const REQUEST_CACHE_KEY_VERSION = "byline-fields-version";
+const REQUEST_CACHE_KEY_DEFS_PREFIX = "byline-field-defs:";
+/**
+* Reclaim window for the single-flight lock: if an owner holds it past
+* this without publishing (e.g. its request was cancelled and the
+* anchored fetch hasn't completed yet), the next reader reclaims and
+* refetches. `listFields` is a single fast SELECT, so this only needs to
+* cover a genuinely slow/stranded query. Mutable solely so tests can
+* shorten it; production never changes it.
+*/
+let reclaimDeadlineMs = 1e4;
+/**
+* Read the persisted `options.byline_fields_version` counter. Cached for
+* the duration of the current request via `requestCached`. Returns `0`
+* when the row is missing (matches `BylineSchemaRegistry.getVersion`).
+*/
+async function getBylineFieldsVersion(db) {
+	return requestCached(REQUEST_CACHE_KEY_VERSION, () => new BylineSchemaRegistry(db).getVersion());
+}
+/**
+* Resolve registered byline custom-field definitions. Two-tier cache:
+* per-request via `requestCached`, then per-isolate via the global
+* holder.
+*
+* The global holder is bypassed for isolated requests (playground / DO
+* preview, which point at a divergent schema) and for dirty versions
+* (odd counter — see `BylineSchemaRegistry`'s class JSDoc — indicates
+* an in-flight or crashed mutation). Both bypass paths still hit the
+* per-request cache, so a single render dedupes within itself.
+*
+* Always returns an array. Empty = no custom fields registered.
+*/
+async function getBylineFieldDefs(db) {
+	const isolated = getRequestContext()?.dbIsIsolated === true;
+	const version = await getBylineFieldsVersion(db);
+	const dirty = version % 2 !== 0;
+	return requestCached(`${REQUEST_CACHE_KEY_DEFS_PREFIX}${version}`, async () => {
+		if (isolated || dirty) return new BylineSchemaRegistry(db).listFields();
+		return initWithLock(holder.lock, () => holder.hasValue && holder.cachedVersion === version ? holder.value : null, (isCurrentClaim) => (async () => {
+			const defs = await new BylineSchemaRegistry(db).listFields();
+			if (isCurrentClaim() && version >= holder.cachedVersion) {
+				holder.value = defs;
+				holder.hasValue = true;
+				holder.cachedVersion = version;
+			}
+			return defs;
+		})(), {
+			deadlineMs: reclaimDeadlineMs,
+			anchor: (promise) => after(() => promise)
+		});
+	});
+}
+
+//#endregion
+export { getBylineFieldDefs as n, field_defs_cache_exports as t };
+//# sourceMappingURL=field-defs-cache-CsZctvbu.mjs.map

package/dist/field-defs-cache-CsZctvbu.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-defs-cache-CsZctvbu.mjs","names":[],"sources":["../src/bylines/field-defs-cache.ts"],"sourcesContent":["/**\n * Byline field-definitions cache\n *\n * Discussion #1174 / Phase 3. Two-tier cache for the byline custom-field\n * registry, mirroring the `settings/index.ts` pattern.\n *\n * **Tier 1 — per-isolate (globalThis).** Field definitions change rarely\n * but are read on every byline hydration (admin pages, content rendering,\n * API responses). Caching at the isolate level drops the SELECT-from-\n * `_emdash_byline_fields` from once-per-hydration to once-per-isolate-\n * after-bump. The cache holds the resolved *value* behind a reclaimable\n * single-flight lock (see `utils/single-flight-cache.ts`), never an\n * in-flight promise: concurrent cold-isolate readers coalesce onto one\n * query by polling the published value, so a reader whose request is\n * cancelled mid-query can never strand later byline hydrations on the\n * isolate (the workerd never-settling-promise hazard that produced 524s).\n *\n * Stored on globalThis under `Symbol.for(\"emdash:byline-field-defs\")` so\n * Vite SSR chunk duplication can't produce two independent caches (same\n * pattern as `request-cache.ts` and `request-context.ts`).\n *\n * **Tier 2 — per-request.** Wraps both the version read and the defs\n * fetch in `requestCached` so a single page render that hits byline\n * hydration multiple times (e.g. list view + individual byline lookups\n * in a sidebar) pays at most one version read and one defs fetch in\n * total. The defs cache key includes the version, so a (highly\n * unlikely) mid-request bump still produces a self-consistent view —\n * the second call sees a different key and refetches.\n *\n * **Invalidation.** `options.byline_fields_version` is bumped by every\n * `BylineSchemaRegistry` mutation (Phase 2). Each isolate independently\n * reads the persisted version on the next request and compares against\n * its cached version; mismatch triggers a refetch and overwrite. Other\n * isolates see the change within one request after the bump propagates.\n *\n * **Isolated databases bypass the global cache.** Playground and DO\n * preview sessions set `requestContext.dbIsIsolated = true`, signalling\n * the per-request `db` points at an isolated schema that may diverge\n * from the singleton. Schema-derived caches keyed by the singleton's\n * version would silently leak the singleton's defs into the isolated\n * request. We follow the `loader.ts:74` `getTaxonomyNames` precedent:\n * skip both reading from and writing to the global holder when the\n * request is isolated. The per-request cache (`requestCached`) is keyed\n * by the WeakMap'd `EmDashRequestContext`, so it can't cross-pollinate\n * between requests — it stays in play even for isolated DBs.\n *\n * **Why a versioned cache and not a TTL?** The version counter gives\n * deterministic invalidation without the staleness window a TTL would\n * impose. Field-definition changes need to be visible to the next\n * request, not eventually. The cost is one cheap `options` read per\n * request — cheaper than the field-defs fetch it replaces, and cheaper\n * than maintaining a TTL state machine.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { after } from \"../after.js\";\nimport type { Database } from \"../database/types.js\";\nimport { requestCached } from \"../request-cache.js\";\nimport { getRequestContext } from \"../request-context.js\";\nimport { BylineSchemaRegistry } from \"../schema/byline-registry.js\";\nimport type { BylineFieldDefinition } from \"../schema/types.js\";\nimport { createInitLock, type InitLock, initWithLock } from \"../utils/init-lock.js\";\n\ninterface FieldDefsHolder {\n\t/** Last resolved defs, valid only when `hasValue` is true. */\n\tvalue: BylineFieldDefinition[] | null;\n\t/** Presence flag, separate from `value` so an empty-array result still caches. */\n\thasValue: boolean;\n\t/** Persisted-version value that `value` was fetched against. */\n\tcachedVersion: number;\n\t/** Reclaimable single-flight lock so a cancelled owner can't wedge readers. */\n\tlock: InitLock;\n}\n\nconst HOLDER_KEY = Symbol.for(\"emdash:byline-field-defs\");\nconst g = globalThis as Record<symbol, unknown>;\nconst holder: FieldDefsHolder =\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-cache.ts)\n\t(g[HOLDER_KEY] as FieldDefsHolder | undefined) ??\n\t(() => {\n\t\tconst h: FieldDefsHolder = {\n\t\t\tvalue: null,\n\t\t\thasValue: false,\n\t\t\tcachedVersion: -1,\n\t\t\tlock: createInitLock(),\n\t\t};\n\t\tg[HOLDER_KEY] = h;\n\t\treturn h;\n\t})();\n\nconst REQUEST_CACHE_KEY_VERSION = \"byline-fields-version\";\nconst REQUEST_CACHE_KEY_DEFS_PREFIX = \"byline-field-defs:\";\n\n/**\n * Reclaim window for the single-flight lock: if an owner holds it past\n * this without publishing (e.g. its request was cancelled and the\n * anchored fetch hasn't completed yet), the next reader reclaims and\n * refetches. `listFields` is a single fast SELECT, so this only needs to\n * cover a genuinely slow/stranded query. Mutable solely so tests can\n * shorten it; production never changes it.\n */\nlet reclaimDeadlineMs = 10_000;\n\n/**\n * Read the persisted `options.byline_fields_version` counter. Cached for\n * the duration of the current request via `requestCached`. Returns `0`\n * when the row is missing (matches `BylineSchemaRegistry.getVersion`).\n */\nasync function getBylineFieldsVersion(db: Kysely<Database>): Promise<number> {\n\treturn requestCached(REQUEST_CACHE_KEY_VERSION, () => new BylineSchemaRegistry(db).getVersion());\n}\n\n/**\n * Resolve registered byline custom-field definitions. Two-tier cache:\n * per-request via `requestCached`, then per-isolate via the global\n * holder.\n *\n * The global holder is bypassed for isolated requests (playground / DO\n * preview, which point at a divergent schema) and for dirty versions\n * (odd counter — see `BylineSchemaRegistry`'s class JSDoc — indicates\n * an in-flight or crashed mutation). Both bypass paths still hit the\n * per-request cache, so a single render dedupes within itself.\n *\n * Always returns an array. Empty = no custom fields registered.\n */\nexport async function getBylineFieldDefs(db: Kysely<Database>): Promise<BylineFieldDefinition[]> {\n\tconst isolated = getRequestContext()?.dbIsIsolated === true;\n\tconst version = await getBylineFieldsVersion(db);\n\tconst dirty = version % 2 !== 0;\n\treturn requestCached(`${REQUEST_CACHE_KEY_DEFS_PREFIX}${version}`, async () => {\n\t\tif (isolated || dirty) {\n\t\t\treturn new BylineSchemaRegistry(db).listFields();\n\t\t}\n\t\t// Per-isolate single-flight cache keyed on the persisted version.\n\t\t// Coalesce concurrent cold readers via the lock and read the\n\t\t// published value; never await another request's in-flight promise\n\t\t// (a cancelled owner would otherwise strand every later byline\n\t\t// hydration on the isolate). The fetch is anchored so a cancelled\n\t\t// originator still drives it to completion and populates the cache.\n\t\treturn initWithLock<BylineFieldDefinition[]>(\n\t\t\tholder.lock,\n\t\t\t() => (holder.hasValue && holder.cachedVersion === version ? holder.value : null),\n\t\t\t(isCurrentClaim) =>\n\t\t\t\t(async () => {\n\t\t\t\t\tconst defs = await new BylineSchemaRegistry(db).listFields();\n\t\t\t\t\t// Publish only while still the current claim, and never\n\t\t\t\t\t// regress over a newer version a concurrent reader stored.\n\t\t\t\t\tif (isCurrentClaim() && version >= holder.cachedVersion) {\n\t\t\t\t\t\tholder.value = defs;\n\t\t\t\t\t\tholder.hasValue = true;\n\t\t\t\t\t\tholder.cachedVersion = version;\n\t\t\t\t\t}\n\t\t\t\t\treturn defs;\n\t\t\t\t})(),\n\t\t\t{ deadlineMs: reclaimDeadlineMs, anchor: (promise) => after(() => promise) },\n\t\t);\n\t});\n}\n\n/**\n * Test/internal helper: clear the per-isolate cache. Useful for unit\n * tests that mutate the registry directly and need to force a refetch\n * without going through the full version-bump path.\n *\n * Production code paths should rely on the version counter for\n * invalidation — calling this from a write path would bypass the\n * coordination that lets other isolates see the change.\n */\nexport function resetBylineFieldDefsCacheForTests(): void {\n\tholder.value = null;\n\tholder.hasValue = false;\n\tholder.cachedVersion = -1;\n\tholder.lock.ownerStartedAt = null;\n\tholder.lock.generation = 0;\n\treclaimDeadlineMs = 10_000;\n}\n\n/**\n * Test-only: shorten the single-flight reclaim window so a \"stranded\n * owner\" scenario can be exercised without waiting out the production\n * deadline. Reset by `resetBylineFieldDefsCacheForTests`.\n *\n * @internal\n */\nexport function setBylineFieldDefsReclaimDeadlineForTests(ms: number): void {\n\treclaimDeadlineMs = ms;\n}\n"],"mappings":";;;;;;;;;AA2EA,MAAM,aAAa,OAAO,IAAI,2BAA2B;AACzD,MAAM,IAAI;AACV,MAAM,SAEJ,EAAE,sBACI;CACN,MAAM,IAAqB;EAC1B,OAAO;EACP,UAAU;EACV,eAAe;EACf,MAAM,gBAAgB;EACtB;AACD,GAAE,cAAc;AAChB,QAAO;IACJ;AAEL,MAAM,4BAA4B;AAClC,MAAM,gCAAgC;;;;;;;;;AAUtC,IAAI,oBAAoB;;;;;;AAOxB,eAAe,uBAAuB,IAAuC;AAC5E,QAAO,cAAc,iCAAiC,IAAI,qBAAqB,GAAG,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;AAgBjG,eAAsB,mBAAmB,IAAwD;CAChG,MAAM,WAAW,mBAAmB,EAAE,iBAAiB;CACvD,MAAM,UAAU,MAAM,uBAAuB,GAAG;CAChD,MAAM,QAAQ,UAAU,MAAM;AAC9B,QAAO,cAAc,GAAG,gCAAgC,WAAW,YAAY;AAC9E,MAAI,YAAY,MACf,QAAO,IAAI,qBAAqB,GAAG,CAAC,YAAY;AAQjD,SAAO,aACN,OAAO,YACA,OAAO,YAAY,OAAO,kBAAkB,UAAU,OAAO,QAAQ,OAC3E,oBACC,YAAY;GACZ,MAAM,OAAO,MAAM,IAAI,qBAAqB,GAAG,CAAC,YAAY;AAG5D,OAAI,gBAAgB,IAAI,WAAW,OAAO,eAAe;AACxD,WAAO,QAAQ;AACf,WAAO,WAAW;AAClB,WAAO,gBAAgB;;AAExB,UAAO;MACJ,EACL;GAAE,YAAY;GAAmB,SAAS,YAAY,YAAY,QAAQ;GAAE,CAC5E;GACA"}

package/dist/field-map-6m9rF49t.mjs

@@ -0,0 +1,83 @@
+import { u as __exportAll } from "./runner-B3eyB9Gb.mjs";
+import { n as isMissingTableError } from "./db-errors-CBD5yMro.mjs";
+import { f as jsonExtractExpr } from "./dialect-helpers-7_IqPdh9.mjs";
+import { n as cachedQuery, t as CacheNamespace } from "./object-cache-CqWNY5uP.mjs";
+import { r as requestCached } from "./request-cache-iHRlHx1d.mjs";
+import { s as getDb } from "./loader-CrRPfkHS.mjs";
+import { sql } from "kysely";
+
+//#region src/references/field-map.ts
+/**
+* The reference fields a collection carries, for the public query path.
+*
+* `referenceFieldConstraints` (api/handlers) answers the write question — how
+* many entries may a field select, and is it required. Rendering asks a
+* different one: which collection do I load, and which end of the relation am I
+* standing on. Both read the same rows; keeping them apart keeps the render
+* path off the relation table, which the constraints map has to read for its
+* limits.
+*/
+var field_map_exports = /* @__PURE__ */ __exportAll({ getReferenceFieldMap: () => getReferenceFieldMap });
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadBindings(db, collection) {
+	const relationSlug = jsonExtractExpr(db, "validation", "relation");
+	let rows;
+	try {
+		rows = (await sql`
+			SELECT f.slug AS slug, f.validation AS validation, r.id AS relation_id
+			FROM ${sql.ref("_emdash_fields")} AS f
+			INNER JOIN ${sql.ref("_emdash_collections")} AS c ON c.id = f.collection_id
+			LEFT JOIN ${sql.ref("_emdash_relations")} AS r ON r.slug = ${sql.raw(relationSlug)}
+			WHERE c.slug = ${collection} AND f.type = 'reference'
+		`.execute(db)).rows;
+	} catch (error) {
+		if (isMissingTableError(error)) return [];
+		throw error;
+	}
+	const bindings = [];
+	for (const row of rows) {
+		if (!row.validation) continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(row.validation);
+		} catch {
+			continue;
+		}
+		if (!isRecord(parsed)) continue;
+		const { relation, targetCollection } = parsed;
+		if (typeof relation !== "string" || typeof targetCollection !== "string") continue;
+		if (!row.relation_id) continue;
+		bindings.push({
+			slug: row.slug,
+			relation,
+			relationId: row.relation_id,
+			targetCollection,
+			side: parsed.relationSide === "child" ? "child" : "parent"
+		});
+	}
+	return bindings;
+}
+/**
+* Every bound reference field on `collection`, by field slug.
+*
+* Cached twice over: once per request, and once in the schema object-cache
+* namespace, which a schema edit already bumps. A render that asks for
+* references therefore pays for this lookup at most once per isolate between
+* schema changes, and a render that asks for none never issues it.
+*/
+function getReferenceFieldMap(collection) {
+	return requestCached(`reference-field-map:${collection}`, async () => {
+		const bindings = await cachedQuery({
+			namespace: CacheNamespace.SCHEMA,
+			key: `reference-field-map:${collection}`,
+			load: async () => loadBindings(await getDb(), collection)
+		});
+		return new Map(bindings.map((binding) => [binding.slug, binding]));
+	});
+}
+
+//#endregion
+export { getReferenceFieldMap as n, field_map_exports as t };
+//# sourceMappingURL=field-map-6m9rF49t.mjs.map

package/dist/field-map-6m9rF49t.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-map-6m9rF49t.mjs","names":[],"sources":["../src/references/field-map.ts"],"sourcesContent":["/**\n * The reference fields a collection carries, for the public query path.\n *\n * `referenceFieldConstraints` (api/handlers) answers the write question — how\n * many entries may a field select, and is it required. Rendering asks a\n * different one: which collection do I load, and which end of the relation am I\n * standing on. Both read the same rows; keeping them apart keeps the render\n * path off the relation table, which the constraints map has to read for its\n * limits.\n */\n\nimport { sql, type Kysely } from \"kysely\";\n\nimport { jsonExtractExpr } from \"../database/dialect-helpers.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getDb } from \"../loader.js\";\nimport { cachedQuery, CacheNamespace } from \"../object-cache/index.js\";\nimport { requestCached } from \"../request-cache.js\";\nimport { isMissingTableError } from \"../utils/db-errors.js\";\n\n/** One reference field, as a render needs it. */\nexport interface ReferenceFieldBinding {\n\t/** Field slug — the key a caller names a selection under. */\n\tslug: string;\n\t/** Relation slug the field binds to. */\n\trelation: string;\n\t/**\n\t * The relation's id, read in the same statement as the binding. Rendering\n\t * pages the link table by id, so carrying it here is what keeps a field's\n\t * cost at one link read rather than a slug lookup and then the read.\n\t */\n\trelationId: string;\n\t/** Which end of the relation this field's own collection sits on. */\n\tside: \"parent\" | \"child\";\n\t/** The collection at the other end. */\n\ttargetCollection: string;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nasync function loadBindings(\n\tdb: Kysely<Database>,\n\tcollection: string,\n): Promise<ReferenceFieldBinding[]> {\n\t// The relation's id joins in here rather than being looked up per field at\n\t// render time: the field stores a slug, but the link table is keyed by id.\n\tconst relationSlug = jsonExtractExpr(db, \"validation\", \"relation\");\n\tlet rows: { slug: string; validation: string | null; relation_id: string | null }[];\n\ttry {\n\t\tconst result = await sql<{\n\t\t\tslug: string;\n\t\t\tvalidation: string | null;\n\t\t\trelation_id: string | null;\n\t\t}>`\n\t\t\tSELECT f.slug AS slug, f.validation AS validation, r.id AS relation_id\n\t\t\tFROM ${sql.ref(\"_emdash_fields\")} AS f\n\t\t\tINNER JOIN ${sql.ref(\"_emdash_collections\")} AS c ON c.id = f.collection_id\n\t\t\tLEFT JOIN ${sql.ref(\"_emdash_relations\")} AS r ON r.slug = ${sql.raw(relationSlug)}\n\t\t\tWHERE c.slug = ${collection} AND f.type = 'reference'\n\t\t`.execute(db);\n\t\trows = result.rows;\n\t} catch (error) {\n\t\tif (isMissingTableError(error)) return [];\n\t\tthrow error;\n\t}\n\n\tconst bindings: ReferenceFieldBinding[] = [];\n\tfor (const row of rows) {\n\t\tif (!row.validation) continue;\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(row.validation);\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!isRecord(parsed)) continue;\n\t\tconst { relation, targetCollection } = parsed;\n\t\t// A field with neither is unbound: it keeps its own column, and its value\n\t\t// is already in `data`. There is nothing to resolve. Nor is there when the\n\t\t// named relation is gone — the join leaves no id to page by.\n\t\tif (typeof relation !== \"string\" || typeof targetCollection !== \"string\") continue;\n\t\tif (!row.relation_id) continue;\n\t\tbindings.push({\n\t\t\tslug: row.slug,\n\t\t\trelation,\n\t\t\trelationId: row.relation_id,\n\t\t\ttargetCollection,\n\t\t\tside: parsed.relationSide === \"child\" ? \"child\" : \"parent\",\n\t\t});\n\t}\n\treturn bindings;\n}\n\n/**\n * Every bound reference field on `collection`, by field slug.\n *\n * Cached twice over: once per request, and once in the schema object-cache\n * namespace, which a schema edit already bumps. A render that asks for\n * references therefore pays for this lookup at most once per isolate between\n * schema changes, and a render that asks for none never issues it.\n */\nexport function getReferenceFieldMap(\n\tcollection: string,\n): Promise<Map<string, ReferenceFieldBinding>> {\n\treturn requestCached(`reference-field-map:${collection}`, async () => {\n\t\tconst bindings = await cachedQuery({\n\t\t\tnamespace: CacheNamespace.SCHEMA,\n\t\t\tkey: `reference-field-map:${collection}`,\n\t\t\tload: async () => loadBindings(await getDb(), collection),\n\t\t});\n\t\treturn new Map(bindings.map((binding) => [binding.slug, binding]));\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsCA,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,eAAe,aACd,IACA,YACmC;CAGnC,MAAM,eAAe,gBAAgB,IAAI,cAAc,WAAW;CAClE,IAAI;AACJ,KAAI;AAYH,UAXe,MAAM,GAInB;;UAEM,IAAI,IAAI,iBAAiB,CAAC;gBACpB,IAAI,IAAI,sBAAsB,CAAC;eAChC,IAAI,IAAI,oBAAoB,CAAC,oBAAoB,IAAI,IAAI,aAAa,CAAC;oBAClE,WAAW;IAC3B,QAAQ,GAAG,EACC;UACN,OAAO;AACf,MAAI,oBAAoB,MAAM,CAAE,QAAO,EAAE;AACzC,QAAM;;CAGP,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,OAAO,MAAM;AACvB,MAAI,CAAC,IAAI,WAAY;EACrB,IAAI;AACJ,MAAI;AACH,YAAS,KAAK,MAAM,IAAI,WAAW;UAC5B;AACP;;AAED,MAAI,CAAC,SAAS,OAAO,CAAE;EACvB,MAAM,EAAE,UAAU,qBAAqB;AAIvC,MAAI,OAAO,aAAa,YAAY,OAAO,qBAAqB,SAAU;AAC1E,MAAI,CAAC,IAAI,YAAa;AACtB,WAAS,KAAK;GACb,MAAM,IAAI;GACV;GACA,YAAY,IAAI;GAChB;GACA,MAAM,OAAO,iBAAiB,UAAU,UAAU;GAClD,CAAC;;AAEH,QAAO;;;;;;;;;;AAWR,SAAgB,qBACf,YAC8C;AAC9C,QAAO,cAAc,uBAAuB,cAAc,YAAY;EACrE,MAAM,WAAW,MAAM,YAAY;GAClC,WAAW,eAAe;GAC1B,KAAK,uBAAuB;GAC5B,MAAM,YAAY,aAAa,MAAM,OAAO,EAAE,WAAW;GACzD,CAAC;AACF,SAAO,IAAI,IAAI,SAAS,KAAK,YAAY,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC;GACjE"}

package/dist/focal-point-CZ3d1wK5.mjs

@@ -0,0 +1,23 @@
+//#region src/media/focal-point.ts
+function isFocalCoordinate(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+function normalizeFocalPoint(focalX, focalY) {
+	if (!isFocalCoordinate(focalX) || !isFocalCoordinate(focalY)) return null;
+	return {
+		focalX,
+		focalY
+	};
+}
+function isValidFocalPointUpdate(input) {
+	const hasX = input.focalX !== void 0;
+	const hasY = input.focalY !== void 0;
+	if (!hasX && !hasY) return true;
+	if (!hasX || !hasY) return false;
+	if (input.focalX === null || input.focalY === null) return input.focalX === null && input.focalY === null;
+	return normalizeFocalPoint(input.focalX, input.focalY) !== null;
+}
+
+//#endregion
+export { normalizeFocalPoint as n, isValidFocalPointUpdate as t };
+//# sourceMappingURL=focal-point-CZ3d1wK5.mjs.map

package/dist/focal-point-CZ3d1wK5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"focal-point-CZ3d1wK5.mjs","names":[],"sources":["../src/media/focal-point.ts"],"sourcesContent":["export interface FocalPoint {\n\tfocalX: number;\n\tfocalY: number;\n}\n\nexport interface FocalPointUpdate {\n\tfocalX?: number | null;\n\tfocalY?: number | null;\n}\n\nfunction isFocalCoordinate(value: unknown): value is number {\n\treturn typeof value === \"number\" && Number.isFinite(value) && value >= 0 && value <= 1;\n}\n\nexport function normalizeFocalPoint(focalX: unknown, focalY: unknown): FocalPoint | null {\n\tif (!isFocalCoordinate(focalX) || !isFocalCoordinate(focalY)) return null;\n\treturn { focalX, focalY };\n}\n\nexport function isValidFocalPointUpdate(input: FocalPointUpdate): boolean {\n\tconst hasX = input.focalX !== undefined;\n\tconst hasY = input.focalY !== undefined;\n\tif (!hasX && !hasY) return true;\n\tif (!hasX || !hasY) return false;\n\tif (input.focalX === null || input.focalY === null) {\n\t\treturn input.focalX === null && input.focalY === null;\n\t}\n\treturn normalizeFocalPoint(input.focalX, input.focalY) !== null;\n}\n\nexport function focalPointToObjectPosition(focalX: unknown, focalY: unknown): string | undefined {\n\tconst point = normalizeFocalPoint(focalX, focalY);\n\tif (!point) return undefined;\n\tconst x = Math.round(point.focalX * 10_000) / 100;\n\tconst y = Math.round(point.focalY * 10_000) / 100;\n\treturn `${x}% ${y}%`;\n}\n"],"mappings":";AAUA,SAAS,kBAAkB,OAAiC;AAC3D,QAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,SAAS,KAAK,SAAS;;AAGtF,SAAgB,oBAAoB,QAAiB,QAAoC;AACxF,KAAI,CAAC,kBAAkB,OAAO,IAAI,CAAC,kBAAkB,OAAO,CAAE,QAAO;AACrE,QAAO;EAAE;EAAQ;EAAQ;;AAG1B,SAAgB,wBAAwB,OAAkC;CACzE,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,OAAO,MAAM,WAAW;AAC9B,KAAI,CAAC,QAAQ,CAAC,KAAM,QAAO;AAC3B,KAAI,CAAC,QAAQ,CAAC,KAAM,QAAO;AAC3B,KAAI,MAAM,WAAW,QAAQ,MAAM,WAAW,KAC7C,QAAO,MAAM,WAAW,QAAQ,MAAM,WAAW;AAElD,QAAO,oBAAoB,MAAM,QAAQ,MAAM,OAAO,KAAK"}