emdash 0.40.1 → 0.41.0

package/dist/transfer-download-Pml7RMio.mjs

@@ -1,33 +0,0 @@
-//#region src/api/transfer-download.ts
-const DOWNLOAD_HEADERS = {
-	"Cache-Control": "private, no-store",
-	"X-Content-Type-Options": "nosniff"
-};
-/** A downloaded package file: raw bytes with their size and SHA-256 ETag. */
-function exportFileResponse(file) {
-	return new Response(file.body, {
-		status: 200,
-		headers: {
-			...DOWNLOAD_HEADERS,
-			"Content-Type": file.path === "manifest.json" ? "application/json" : "application/octet-stream",
-			"Content-Length": String(file.bytes),
-			"Content-Disposition": "attachment",
-			ETag: `"${file.sha256}"`
-		}
-	});
-}
-/** A streamed `.emdash` archive of an export. */
-function exportArchiveResponse(operationId, body) {
-	return new Response(body, {
-		status: 200,
-		headers: {
-			...DOWNLOAD_HEADERS,
-			"Content-Type": "application/x-tar",
-			"Content-Disposition": `attachment; filename="emdash-site-${operationId}.emdash"`
-		}
-	});
-}
-
-//#endregion
-export { exportFileResponse as n, exportArchiveResponse as t };
-//# sourceMappingURL=transfer-download-Pml7RMio.mjs.map

package/dist/transfer-download-Pml7RMio.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"transfer-download-Pml7RMio.mjs","names":[],"sources":["../src/api/transfer-download.ts"],"sourcesContent":["import type { ExportFileStream } from \"./handlers/transfer.js\";\n\nconst DOWNLOAD_HEADERS = {\n\t\"Cache-Control\": \"private, no-store\",\n\t\"X-Content-Type-Options\": \"nosniff\",\n};\n\n/** A downloaded package file: raw bytes with their size and SHA-256 ETag. */\nexport function exportFileResponse(file: ExportFileStream): Response {\n\treturn new Response(file.body, {\n\t\tstatus: 200,\n\t\theaders: {\n\t\t\t...DOWNLOAD_HEADERS,\n\t\t\t\"Content-Type\":\n\t\t\t\tfile.path === \"manifest.json\" ? \"application/json\" : \"application/octet-stream\",\n\t\t\t\"Content-Length\": String(file.bytes),\n\t\t\t\"Content-Disposition\": \"attachment\",\n\t\t\tETag: `\"${file.sha256}\"`,\n\t\t},\n\t});\n}\n\n/** A streamed `.emdash` archive of an export. */\nexport function exportArchiveResponse(\n\toperationId: string,\n\tbody: ReadableStream<Uint8Array>,\n): Response {\n\treturn new Response(body, {\n\t\tstatus: 200,\n\t\theaders: {\n\t\t\t...DOWNLOAD_HEADERS,\n\t\t\t\"Content-Type\": \"application/x-tar\",\n\t\t\t\"Content-Disposition\": `attachment; filename=\"emdash-site-${operationId}.emdash\"`,\n\t\t},\n\t});\n}\n"],"mappings":";AAEA,MAAM,mBAAmB;CACxB,iBAAiB;CACjB,0BAA0B;CAC1B;;AAGD,SAAgB,mBAAmB,MAAkC;AACpE,QAAO,IAAI,SAAS,KAAK,MAAM;EAC9B,QAAQ;EACR,SAAS;GACR,GAAG;GACH,gBACC,KAAK,SAAS,kBAAkB,qBAAqB;GACtD,kBAAkB,OAAO,KAAK,MAAM;GACpC,uBAAuB;GACvB,MAAM,IAAI,KAAK,OAAO;GACtB;EACD,CAAC;;;AAIH,SAAgB,sBACf,aACA,MACW;AACX,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ;EACR,SAAS;GACR,GAAG;GACH,gBAAgB;GAChB,uBAAuB,qCAAqC,YAAY;GACxE;EACD,CAAC"}

package/dist/transformations-9gfpwY65.mjs

@@ -1,196 +0,0 @@
-import { h as portableIdSchema, i as RECORD_KINDS } from "./kinds-CRu_T5T5.mjs";
-import { z } from "zod";
-
-//#region src/transfer/format/transformations.ts
-/**
-* Declared transformations: every way the target state may legitimately
-* differ from the package's records.
-*
-* Two families exist:
-* - Export transformations are applied by the exporter and declared in
-*   `manifest.transformations` (the package already reflects them).
-* - Import transformations are decided during analysis, declared in the plan
-*   (and therefore covered by the plan digest), applied by the importer, and
-*   predicted by verification with {@link applyTransformations}.
-*
-* A plan lists the package's export transformations ahead of its import
-* transformations, so it declares every difference from the origin site.
-* Plan warnings never repeat a transformation.
-*
-* Storage-key placeholders are not a transformation: verification converts
-* target keys back to placeholders with `rewriteMediaRefs(…, { mode: "verify" })`.
-*/
-const EXPORT_TRANSFORMATION_CODES = [
-	"soft_orphan_dropped",
-	"avatar_nulled",
-	"redirect_duplicate_dropped",
-	"media_not_ready_dropped",
-	"media_url_relativized",
-	"orphan_dropped",
-	"orphan_reference_nulled",
-	"media_ref_unlinked",
-	"unknown_storage_key"
-];
-const IMPORT_TRANSFORMATION_CODES = [
-	"principal_mapped",
-	"principal_unmapped",
-	"seeded_scaffold_removed",
-	"redirect_loop_disabled",
-	"search_unsupported",
-	"float4_rounded",
-	"locale_recased"
-];
-const recordKindSchema = z.enum(RECORD_KINDS);
-const count = z.number().int().nonnegative();
-const MAX_LISTED_IDS = 1e4;
-const MAX_LISTED_LOCALES = 1e3;
-const localeSchema = z.string().min(1).max(64);
-/**
-* Declared in `manifest.transformations`, sorted by `(code, kind)`.
-* `unknown_storage_key` counts records that refer to a media file URL or
-* storage key the origin media table does not know; those references are
-* exported unchanged and will not resolve on the target.
-*/
-const exportTransformationSchema = z.strictObject({
-	code: z.enum(EXPORT_TRANSFORMATION_CODES),
-	kind: recordKindSchema,
-	count
-});
-const importTransformationSchema = z.discriminatedUnion("code", [
-	z.strictObject({
-		code: z.literal("principal_mapped"),
-		count
-	}),
-	z.strictObject({
-		code: z.literal("principal_unmapped"),
-		count
-	}),
-	z.strictObject({
-		code: z.literal("seeded_scaffold_removed"),
-		count,
-		items: z.array(z.strictObject({
-			type: z.string().max(64),
-			id: portableIdSchema
-		})).max(MAX_LISTED_IDS)
-	}),
-	z.strictObject({
-		code: z.literal("redirect_loop_disabled"),
-		kind: z.literal("redirect"),
-		ids: z.array(portableIdSchema).max(MAX_LISTED_IDS)
-	}),
-	z.strictObject({
-		code: z.literal("search_unsupported"),
-		kind: z.literal("collection"),
-		ids: z.array(portableIdSchema).max(MAX_LISTED_IDS)
-	}),
-	z.strictObject({
-		code: z.literal("float4_rounded"),
-		count
-	}),
-	z.strictObject({
-		code: z.literal("locale_recased"),
-		locales: z.array(z.strictObject({
-			from: localeSchema,
-			to: localeSchema
-		})).max(MAX_LISTED_LOCALES)
-	})
-]);
-const planTransformationSchema = z.union([exportTransformationSchema, importTransformationSchema]);
-const compiled = /* @__PURE__ */ new WeakMap();
-function compile(plan, context) {
-	const cached = compiled.get(plan);
-	if (cached && cached.fieldColumnTypes === context.fieldColumnTypes) return cached;
-	const disabledRedirects = /* @__PURE__ */ new Set();
-	const searchDisabled = /* @__PURE__ */ new Set();
-	const locales = /* @__PURE__ */ new Map();
-	let float4 = false;
-	for (const transformation of plan.transformations) switch (transformation.code) {
-		case "redirect_loop_disabled":
-			for (const id of transformation.ids) disabledRedirects.add(id);
-			break;
-		case "search_unsupported":
-			for (const id of transformation.ids) searchDisabled.add(id);
-			break;
-		case "float4_rounded":
-			float4 = true;
-			break;
-		case "locale_recased":
-			for (const { from, to } of transformation.locales) locales.set(from, to);
-			break;
-		default: break;
-	}
-	const result = {
-		principalMappings: plan.decisions.principalMappings,
-		disabledRedirects,
-		searchDisabled,
-		float4,
-		locales,
-		fieldColumnTypes: context.fieldColumnTypes
-	};
-	compiled.set(plan, result);
-	return result;
-}
-function mapPrincipal(record, property, mappings) {
-	const principal = record[property];
-	if (typeof principal !== "string") return;
-	const target = Object.hasOwn(mappings, principal) ? mappings[principal] : null;
-	if (target === null || target === void 0) delete record[property];
-	else record[property] = target;
-}
-function fround(value) {
-	return typeof value === "number" ? Math.fround(value) : value;
-}
-/**
-* Predict the target form of a package record: the record as the exporter's
-* reader would produce it from the target, minus storage-key placeholder
-* resolution. Returns a new object; never mutates `record`. `principal`
-* records are returned unchanged (they are never written to the target).
-*/
-function applyTransformations(record, plan, context) {
-	const rules = compile(plan, context);
-	const next = { ...record };
-	switch (record.kind) {
-		case "media":
-			mapPrincipal(next, "authorPrincipal", rules.principalMappings);
-			if (rules.float4) {
-				if (next.focalX !== void 0) next.focalX = fround(next.focalX);
-				if (next.focalY !== void 0) next.focalY = fround(next.focalY);
-			}
-			break;
-		case "revision":
-		case "comment":
-			mapPrincipal(next, "authorPrincipal", rules.principalMappings);
-			break;
-		case "byline":
-			mapPrincipal(next, "userPrincipal", rules.principalMappings);
-			break;
-		case "entry":
-			mapPrincipal(next, "authorPrincipal", rules.principalMappings);
-			if (rules.float4) {
-				const fields = { ...record.fields };
-				const types = rules.fieldColumnTypes.get(record.collection);
-				for (const [slug, value] of Object.entries(fields)) if (types?.get(slug) === "REAL") fields[slug] = fround(value);
-				next.fields = fields;
-			}
-			break;
-		case "redirect":
-			if (rules.disabledRedirects.has(record.id)) next.enabled = false;
-			break;
-		case "collection": {
-			const config = record.searchConfig;
-			if (rules.searchDisabled.has(record.id) && config !== null && typeof config === "object" && !Array.isArray(config) && config.enabled === true) next.searchConfig = {
-				...config,
-				enabled: false
-			};
-			break;
-		}
-		default: break;
-	}
-	const recased = typeof next.locale === "string" ? rules.locales.get(next.locale) : void 0;
-	if (recased !== void 0) next.locale = recased;
-	return next;
-}
-
-//#endregion
-export { planTransformationSchema as a, exportTransformationSchema as i, IMPORT_TRANSFORMATION_CODES as n, applyTransformations as r, EXPORT_TRANSFORMATION_CODES as t };
-//# sourceMappingURL=transformations-9gfpwY65.mjs.map

package/dist/transformations-9gfpwY65.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"transformations-9gfpwY65.mjs","names":[],"sources":["../src/transfer/format/transformations.ts"],"sourcesContent":["/**\n * Declared transformations: every way the target state may legitimately\n * differ from the package's records.\n *\n * Two families exist:\n * - Export transformations are applied by the exporter and declared in\n *   `manifest.transformations` (the package already reflects them).\n * - Import transformations are decided during analysis, declared in the plan\n *   (and therefore covered by the plan digest), applied by the importer, and\n *   predicted by verification with {@link applyTransformations}.\n *\n * A plan lists the package's export transformations ahead of its import\n * transformations, so it declares every difference from the origin site.\n * Plan warnings never repeat a transformation.\n *\n * Storage-key placeholders are not a transformation: verification converts\n * target keys back to placeholders with `rewriteMediaRefs(…, { mode: \"verify\" })`.\n */\n\nimport { z } from \"zod\";\n\nimport type { SitePackageRecord } from \"./kinds.js\";\nimport { portableIdSchema, RECORD_KINDS } from \"./kinds.js\";\n\nexport const EXPORT_TRANSFORMATION_CODES = [\n\t\"soft_orphan_dropped\",\n\t\"avatar_nulled\",\n\t\"redirect_duplicate_dropped\",\n\t\"media_not_ready_dropped\",\n\t\"media_url_relativized\",\n\t\"orphan_dropped\",\n\t\"orphan_reference_nulled\",\n\t\"media_ref_unlinked\",\n\t\"unknown_storage_key\",\n] as const;\n\nexport type ExportTransformationCode = (typeof EXPORT_TRANSFORMATION_CODES)[number];\n\nexport const IMPORT_TRANSFORMATION_CODES = [\n\t\"principal_mapped\",\n\t\"principal_unmapped\",\n\t\"seeded_scaffold_removed\",\n\t\"redirect_loop_disabled\",\n\t\"search_unsupported\",\n\t\"float4_rounded\",\n\t\"locale_recased\",\n] as const;\n\nexport type ImportTransformationCode = (typeof IMPORT_TRANSFORMATION_CODES)[number];\n\nconst recordKindSchema = z.enum(RECORD_KINDS);\nconst count = z.number().int().nonnegative();\nconst MAX_LISTED_IDS = 10_000;\nconst MAX_LISTED_LOCALES = 1000;\nconst localeSchema = z.string().min(1).max(64);\n\n/**\n * Declared in `manifest.transformations`, sorted by `(code, kind)`.\n * `unknown_storage_key` counts records that refer to a media file URL or\n * storage key the origin media table does not know; those references are\n * exported unchanged and will not resolve on the target.\n */\nexport const exportTransformationSchema = z.strictObject({\n\tcode: z.enum(EXPORT_TRANSFORMATION_CODES),\n\tkind: recordKindSchema,\n\tcount,\n});\n\nexport type ExportTransformation = z.infer<typeof exportTransformationSchema>;\n\nexport const importTransformationSchema = z.discriminatedUnion(\"code\", [\n\t/** Principal references rewritten to target users per `decisions.principalMappings`. */\n\tz.strictObject({ code: z.literal(\"principal_mapped\"), count }),\n\t/** Principal references removed (mapping is null or absent). */\n\tz.strictObject({ code: z.literal(\"principal_unmapped\"), count }),\n\t/** Seeded target scaffold deleted before the schema stage. */\n\tz.strictObject({\n\t\tcode: z.literal(\"seeded_scaffold_removed\"),\n\t\tcount,\n\t\titems: z\n\t\t\t.array(z.strictObject({ type: z.string().max(64), id: portableIdSchema }))\n\t\t\t.max(MAX_LISTED_IDS),\n\t}),\n\t/** Redirects that form a loop are imported disabled. */\n\tz.strictObject({\n\t\tcode: z.literal(\"redirect_loop_disabled\"),\n\t\tkind: z.literal(\"redirect\"),\n\t\tids: z.array(portableIdSchema).max(MAX_LISTED_IDS),\n\t}),\n\t/** Full-text search cannot be enabled on the target; `searchConfig.enabled` becomes false. */\n\tz.strictObject({\n\t\tcode: z.literal(\"search_unsupported\"),\n\t\tkind: z.literal(\"collection\"),\n\t\tids: z.array(portableIdSchema).max(MAX_LISTED_IDS),\n\t}),\n\t/** The target stores REAL columns as float4; values are rounded with `Math.fround`. */\n\tz.strictObject({ code: z.literal(\"float4_rounded\"), count }),\n\t/** Locales written with the target's casing (`pt-br` → `pt-BR`). */\n\tz.strictObject({\n\t\tcode: z.literal(\"locale_recased\"),\n\t\tlocales: z\n\t\t\t.array(z.strictObject({ from: localeSchema, to: localeSchema }))\n\t\t\t.max(MAX_LISTED_LOCALES),\n\t}),\n]);\n\nexport type ImportTransformation = z.infer<typeof importTransformationSchema>;\n\nexport const planTransformationSchema = z.union([\n\texportTransformationSchema,\n\timportTransformationSchema,\n]);\n\nexport type PlanTransformation = z.infer<typeof planTransformationSchema>;\n\nexport interface TransformationPlan {\n\ttransformations: readonly PlanTransformation[];\n\tdecisions: { principalMappings: Readonly<Record<string, string | null>> };\n}\n\nexport type FieldColumnType = \"TEXT\" | \"REAL\" | \"INTEGER\" | \"JSON\";\n\nexport interface TransformationContext {\n\t/** Column type of every entry field, by collection slug then field slug (from package `field` records). */\n\tfieldColumnTypes: ReadonlyMap<string, ReadonlyMap<string, FieldColumnType>>;\n}\n\ninterface CompiledTransformations {\n\tprincipalMappings: Readonly<Record<string, string | null>>;\n\tdisabledRedirects: ReadonlySet<string>;\n\tsearchDisabled: ReadonlySet<string>;\n\tfloat4: boolean;\n\tlocales: ReadonlyMap<string, string>;\n\tfieldColumnTypes: TransformationContext[\"fieldColumnTypes\"];\n}\n\nconst compiled = new WeakMap<TransformationPlan, CompiledTransformations>();\n\nfunction compile(\n\tplan: TransformationPlan,\n\tcontext: TransformationContext,\n): CompiledTransformations {\n\tconst cached = compiled.get(plan);\n\tif (cached && cached.fieldColumnTypes === context.fieldColumnTypes) return cached;\n\tconst disabledRedirects = new Set<string>();\n\tconst searchDisabled = new Set<string>();\n\tconst locales = new Map<string, string>();\n\tlet float4 = false;\n\tfor (const transformation of plan.transformations) {\n\t\tswitch (transformation.code) {\n\t\t\tcase \"redirect_loop_disabled\":\n\t\t\t\tfor (const id of transformation.ids) disabledRedirects.add(id);\n\t\t\t\tbreak;\n\t\t\tcase \"search_unsupported\":\n\t\t\t\tfor (const id of transformation.ids) searchDisabled.add(id);\n\t\t\t\tbreak;\n\t\t\tcase \"float4_rounded\":\n\t\t\t\tfloat4 = true;\n\t\t\t\tbreak;\n\t\t\tcase \"locale_recased\":\n\t\t\t\tfor (const { from, to } of transformation.locales) locales.set(from, to);\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tbreak;\n\t\t}\n\t}\n\tconst result: CompiledTransformations = {\n\t\tprincipalMappings: plan.decisions.principalMappings,\n\t\tdisabledRedirects,\n\t\tsearchDisabled,\n\t\tfloat4,\n\t\tlocales,\n\t\tfieldColumnTypes: context.fieldColumnTypes,\n\t};\n\tcompiled.set(plan, result);\n\treturn result;\n}\n\nfunction mapPrincipal(\n\trecord: Record<string, unknown>,\n\tproperty: string,\n\tmappings: Readonly<Record<string, string | null>>,\n): void {\n\tconst principal = record[property];\n\tif (typeof principal !== \"string\") return;\n\tconst target = Object.hasOwn(mappings, principal) ? mappings[principal] : null;\n\tif (target === null || target === undefined) delete record[property];\n\telse record[property] = target;\n}\n\nfunction fround(value: unknown): unknown {\n\treturn typeof value === \"number\" ? Math.fround(value) : value;\n}\n\n/**\n * Predict the target form of a package record: the record as the exporter's\n * reader would produce it from the target, minus storage-key placeholder\n * resolution. Returns a new object; never mutates `record`. `principal`\n * records are returned unchanged (they are never written to the target).\n */\nexport function applyTransformations<R extends SitePackageRecord>(\n\trecord: R,\n\tplan: TransformationPlan,\n\tcontext: TransformationContext,\n): R {\n\tconst rules = compile(plan, context);\n\tconst next: Record<string, unknown> = { ...record };\n\n\tswitch (record.kind) {\n\t\tcase \"media\":\n\t\t\tmapPrincipal(next, \"authorPrincipal\", rules.principalMappings);\n\t\t\tif (rules.float4) {\n\t\t\t\tif (next.focalX !== undefined) next.focalX = fround(next.focalX);\n\t\t\t\tif (next.focalY !== undefined) next.focalY = fround(next.focalY);\n\t\t\t}\n\t\t\tbreak;\n\t\tcase \"revision\":\n\t\tcase \"comment\":\n\t\t\tmapPrincipal(next, \"authorPrincipal\", rules.principalMappings);\n\t\t\tbreak;\n\t\tcase \"byline\":\n\t\t\tmapPrincipal(next, \"userPrincipal\", rules.principalMappings);\n\t\t\tbreak;\n\t\tcase \"entry\": {\n\t\t\tmapPrincipal(next, \"authorPrincipal\", rules.principalMappings);\n\t\t\tif (rules.float4) {\n\t\t\t\tconst fields: Record<string, unknown> = { ...record.fields };\n\t\t\t\tconst types = rules.fieldColumnTypes.get(record.collection);\n\t\t\t\tfor (const [slug, value] of Object.entries(fields)) {\n\t\t\t\t\tif (types?.get(slug) === \"REAL\") fields[slug] = fround(value);\n\t\t\t\t}\n\t\t\t\tnext.fields = fields;\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tcase \"redirect\":\n\t\t\tif (rules.disabledRedirects.has(record.id)) next.enabled = false;\n\t\t\tbreak;\n\t\tcase \"collection\": {\n\t\t\tconst config = record.searchConfig;\n\t\t\tif (\n\t\t\t\trules.searchDisabled.has(record.id) &&\n\t\t\t\tconfig !== null &&\n\t\t\t\ttypeof config === \"object\" &&\n\t\t\t\t!Array.isArray(config) &&\n\t\t\t\tconfig.enabled === true\n\t\t\t) {\n\t\t\t\tnext.searchConfig = { ...config, enabled: false };\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tdefault:\n\t\t\tbreak;\n\t}\n\tconst recased = typeof next.locale === \"string\" ? rules.locales.get(next.locale) : undefined;\n\tif (recased !== undefined) next.locale = recased;\n\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- a copy of `record` with only same-kind properties changed or removed\n\treturn next as R;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,8BAA8B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAa,8BAA8B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAM,mBAAmB,EAAE,KAAK,aAAa;AAC7C,MAAM,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;AAC5C,MAAM,iBAAiB;AACvB,MAAM,qBAAqB;AAC3B,MAAM,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG;;;;;;;AAQ9C,MAAa,6BAA6B,EAAE,aAAa;CACxD,MAAM,EAAE,KAAK,4BAA4B;CACzC,MAAM;CACN;CACA,CAAC;AAIF,MAAa,6BAA6B,EAAE,mBAAmB,QAAQ;CAEtE,EAAE,aAAa;EAAE,MAAM,EAAE,QAAQ,mBAAmB;EAAE;EAAO,CAAC;CAE9D,EAAE,aAAa;EAAE,MAAM,EAAE,QAAQ,qBAAqB;EAAE;EAAO,CAAC;CAEhE,EAAE,aAAa;EACd,MAAM,EAAE,QAAQ,0BAA0B;EAC1C;EACA,OAAO,EACL,MAAM,EAAE,aAAa;GAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG;GAAE,IAAI;GAAkB,CAAC,CAAC,CACzE,IAAI,eAAe;EACrB,CAAC;CAEF,EAAE,aAAa;EACd,MAAM,EAAE,QAAQ,yBAAyB;EACzC,MAAM,EAAE,QAAQ,WAAW;EAC3B,KAAK,EAAE,MAAM,iBAAiB,CAAC,IAAI,eAAe;EAClD,CAAC;CAEF,EAAE,aAAa;EACd,MAAM,EAAE,QAAQ,qBAAqB;EACrC,MAAM,EAAE,QAAQ,aAAa;EAC7B,KAAK,EAAE,MAAM,iBAAiB,CAAC,IAAI,eAAe;EAClD,CAAC;CAEF,EAAE,aAAa;EAAE,MAAM,EAAE,QAAQ,iBAAiB;EAAE;EAAO,CAAC;CAE5D,EAAE,aAAa;EACd,MAAM,EAAE,QAAQ,iBAAiB;EACjC,SAAS,EACP,MAAM,EAAE,aAAa;GAAE,MAAM;GAAc,IAAI;GAAc,CAAC,CAAC,CAC/D,IAAI,mBAAmB;EACzB,CAAC;CACF,CAAC;AAIF,MAAa,2BAA2B,EAAE,MAAM,CAC/C,4BACA,2BACA,CAAC;AAyBF,MAAM,2BAAW,IAAI,SAAsD;AAE3E,SAAS,QACR,MACA,SAC0B;CAC1B,MAAM,SAAS,SAAS,IAAI,KAAK;AACjC,KAAI,UAAU,OAAO,qBAAqB,QAAQ,iBAAkB,QAAO;CAC3E,MAAM,oCAAoB,IAAI,KAAa;CAC3C,MAAM,iCAAiB,IAAI,KAAa;CACxC,MAAM,0BAAU,IAAI,KAAqB;CACzC,IAAI,SAAS;AACb,MAAK,MAAM,kBAAkB,KAAK,gBACjC,SAAQ,eAAe,MAAvB;EACC,KAAK;AACJ,QAAK,MAAM,MAAM,eAAe,IAAK,mBAAkB,IAAI,GAAG;AAC9D;EACD,KAAK;AACJ,QAAK,MAAM,MAAM,eAAe,IAAK,gBAAe,IAAI,GAAG;AAC3D;EACD,KAAK;AACJ,YAAS;AACT;EACD,KAAK;AACJ,QAAK,MAAM,EAAE,MAAM,QAAQ,eAAe,QAAS,SAAQ,IAAI,MAAM,GAAG;AACxE;EACD,QACC;;CAGH,MAAM,SAAkC;EACvC,mBAAmB,KAAK,UAAU;EAClC;EACA;EACA;EACA;EACA,kBAAkB,QAAQ;EAC1B;AACD,UAAS,IAAI,MAAM,OAAO;AAC1B,QAAO;;AAGR,SAAS,aACR,QACA,UACA,UACO;CACP,MAAM,YAAY,OAAO;AACzB,KAAI,OAAO,cAAc,SAAU;CACnC,MAAM,SAAS,OAAO,OAAO,UAAU,UAAU,GAAG,SAAS,aAAa;AAC1E,KAAI,WAAW,QAAQ,WAAW,OAAW,QAAO,OAAO;KACtD,QAAO,YAAY;;AAGzB,SAAS,OAAO,OAAyB;AACxC,QAAO,OAAO,UAAU,WAAW,KAAK,OAAO,MAAM,GAAG;;;;;;;;AASzD,SAAgB,qBACf,QACA,MACA,SACI;CACJ,MAAM,QAAQ,QAAQ,MAAM,QAAQ;CACpC,MAAM,OAAgC,EAAE,GAAG,QAAQ;AAEnD,SAAQ,OAAO,MAAf;EACC,KAAK;AACJ,gBAAa,MAAM,mBAAmB,MAAM,kBAAkB;AAC9D,OAAI,MAAM,QAAQ;AACjB,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,OAAO,KAAK,OAAO;AAChE,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,OAAO,KAAK,OAAO;;AAEjE;EACD,KAAK;EACL,KAAK;AACJ,gBAAa,MAAM,mBAAmB,MAAM,kBAAkB;AAC9D;EACD,KAAK;AACJ,gBAAa,MAAM,iBAAiB,MAAM,kBAAkB;AAC5D;EACD,KAAK;AACJ,gBAAa,MAAM,mBAAmB,MAAM,kBAAkB;AAC9D,OAAI,MAAM,QAAQ;IACjB,MAAM,SAAkC,EAAE,GAAG,OAAO,QAAQ;IAC5D,MAAM,QAAQ,MAAM,iBAAiB,IAAI,OAAO,WAAW;AAC3D,SAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,CACjD,KAAI,OAAO,IAAI,KAAK,KAAK,OAAQ,QAAO,QAAQ,OAAO,MAAM;AAE9D,SAAK,SAAS;;AAEf;EAED,KAAK;AACJ,OAAI,MAAM,kBAAkB,IAAI,OAAO,GAAG,CAAE,MAAK,UAAU;AAC3D;EACD,KAAK,cAAc;GAClB,MAAM,SAAS,OAAO;AACtB,OACC,MAAM,eAAe,IAAI,OAAO,GAAG,IACnC,WAAW,QACX,OAAO,WAAW,YAClB,CAAC,MAAM,QAAQ,OAAO,IACtB,OAAO,YAAY,KAEnB,MAAK,eAAe;IAAE,GAAG;IAAQ,SAAS;IAAO;AAElD;;EAED,QACC;;CAEF,MAAM,UAAU,OAAO,KAAK,WAAW,WAAW,MAAM,QAAQ,IAAI,KAAK,OAAO,GAAG;AACnF,KAAI,YAAY,OAAW,MAAK,SAAS;AAGzC,QAAO"}

package/dist/transport-BIfH7_hx.d.mts

@@ -1,42 +0,0 @@
-//#region src/client/transport.d.ts
-/**
- * Transport layer for the EmDash client.
- *
- * Implements a composable interceptor pipeline that modifies requests
- * and responses. The client calls `transport.fetch(request)` — everything
- * else (auth, CSRF, retry) is handled by interceptors.
- */
-/**
- * An interceptor can modify the request, call next(), inspect
- * the response, and optionally retry.
- */
-type Interceptor = (request: Request, next: (request: Request) => Promise<Response>) => Promise<Response>;
-interface TransportOptions {
-  interceptors?: Interceptor[];
-}
-/**
- * Creates a fetch function that runs requests through an interceptor pipeline.
- */
-declare function createTransport(options?: TransportOptions): {
-  fetch: (request: Request) => Promise<Response>;
-};
-/**
- * Adds X-EmDash-Request: 1 and Origin headers to mutation requests
- * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;
- * the Origin header satisfies Astro's built-in origin verification which
- * rejects server-side POST requests that lack a matching Origin.
- */
-declare function csrfInterceptor(): Interceptor;
-/**
- * Adds Authorization: Bearer header from a static token.
- */
-declare function tokenInterceptor(token: string): Interceptor;
-/**
- * Dev bypass interceptor. Calls the dev-bypass endpoint on first request
- * to establish a session, then forwards the session cookie on subsequent
- * requests.
- */
-declare function devBypassInterceptor(baseUrl: string): Interceptor;
-//#endregion
-export { tokenInterceptor as a, devBypassInterceptor as i, createTransport as n, csrfInterceptor as r, Interceptor as t };
-//# sourceMappingURL=transport-BIfH7_hx.d.mts.map

package/dist/transport-BIfH7_hx.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport-BIfH7_hx.d.mts","names":[],"sources":["../src/client/transport.ts"],"mappings":";;AAeA;;;;;;;;;;KAAY,WAAA,IACX,OAAA,EAAS,OAAA,EACT,IAAA,GAAO,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA,MAChC,OAAA,CAAQ,QAAA;AAAA,UAEI,gBAAA;EAChB,YAAA,GAAe,WAAA;AAAA;;;;iBAUA,eAAA,CAAgB,OAAA,GAAS,gBAAA;EACxC,KAAA,GAAQ,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;AAAA;;;AAZtC;;;;iBAqCgB,eAAA,CAAA,GAAmB,WAAA;AA1BnC;;;AAAA,iBA8CgB,gBAAA,CAAiB,KAAA,WAAgB,WAAA;;;;;;iBAajC,oBAAA,CAAqB,OAAA,WAAkB,WAAA"}

package/dist/transport-DKWIq53q.mjs

@@ -1,136 +0,0 @@
-//#region src/client/transport.ts
-/**
-* Transport layer for the EmDash client.
-*
-* Implements a composable interceptor pipeline that modifies requests
-* and responses. The client calls `transport.fetch(request)` — everything
-* else (auth, CSRF, retry) is handled by interceptors.
-*/
-const COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;
-function baseFetch(request) {
-	return globalThis.fetch(request);
-}
-/**
-* Creates a fetch function that runs requests through an interceptor pipeline.
-*/
-function createTransport(options = {}) {
-	const interceptors = options.interceptors ?? [];
-	let chain = baseFetch;
-	for (let i = interceptors.length - 1; i >= 0; i--) {
-		const interceptor = interceptors[i];
-		const next = chain;
-		chain = (req) => interceptor(req, next);
-	}
-	return { fetch: chain };
-}
-/**
-* Adds X-EmDash-Request: 1 and Origin headers to mutation requests
-* (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;
-* the Origin header satisfies Astro's built-in origin verification which
-* rejects server-side POST requests that lack a matching Origin.
-*/
-function csrfInterceptor() {
-	const MUTATION_METHODS = new Set([
-		"POST",
-		"PUT",
-		"DELETE",
-		"PATCH"
-	]);
-	return (request, next) => {
-		if (MUTATION_METHODS.has(request.method)) {
-			const headers = new Headers(request.headers);
-			headers.set("X-EmDash-Request", "1");
-			if (!headers.has("Origin")) {
-				const url = new URL(request.url);
-				headers.set("Origin", url.origin);
-			}
-			return next(new Request(request, { headers }));
-		}
-		return next(request);
-	};
-}
-/**
-* Adds Authorization: Bearer header from a static token.
-*/
-function tokenInterceptor(token) {
-	return (request, next) => {
-		const headers = new Headers(request.headers);
-		headers.set("Authorization", `Bearer ${token}`);
-		return next(new Request(request, { headers }));
-	};
-}
-/**
-* Dev bypass interceptor. Calls the dev-bypass endpoint on first request
-* to establish a session, then forwards the session cookie on subsequent
-* requests.
-*/
-function devBypassInterceptor(baseUrl) {
-	let sessionCookie = null;
-	let initializing = null;
-	async function init() {
-		const bypassUrl = new URL("/_emdash/api/auth/dev-bypass", baseUrl);
-		const res = await globalThis.fetch(bypassUrl, { redirect: "manual" });
-		const setCookie = res.headers.get("set-cookie");
-		if (setCookie) {
-			const match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);
-			if (match) sessionCookie = match[1];
-		}
-		if (res.body) await res.text().catch(() => {});
-	}
-	return async (request, next) => {
-		if (!sessionCookie) {
-			if (!initializing) initializing = init();
-			await initializing;
-		}
-		if (sessionCookie) {
-			const headers = new Headers(request.headers);
-			const existing = headers.get("cookie");
-			headers.set("cookie", existing ? `${existing}; ${sessionCookie}` : sessionCookie);
-			return next(new Request(request, { headers }));
-		}
-		return next(request);
-	};
-}
-/**
-* Auto-refreshes expired OAuth tokens on 401 responses.
-* Requires a refresh token and the token endpoint URL.
-*/
-function refreshInterceptor(options) {
-	let refreshing = null;
-	async function refresh() {
-		const res = await globalThis.fetch(options.tokenEndpoint, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({
-				grant_type: "refresh_token",
-				refresh_token: options.refreshToken
-			})
-		});
-		if (!res.ok) return null;
-		const json = await res.json();
-		const tokenData = json.data && typeof json.data === "object" && "access_token" in json.data ? json.data : json;
-		const expiresAt = tokenData.expires_in ? new Date(Date.now() + tokenData.expires_in * 1e3).toISOString() : new Date(Date.now() + 36e5).toISOString();
-		if (options.onTokenRefreshed) options.onTokenRefreshed(tokenData.access_token, tokenData.refresh_token ?? options.refreshToken, expiresAt);
-		return tokenData.access_token;
-	}
-	return async (request, next) => {
-		const retryTemplate = request.body ? request.clone() : request;
-		const response = await next(request);
-		if (response.status === 401) {
-			if (!refreshing) refreshing = refresh().finally(() => {
-				refreshing = null;
-			});
-			const newToken = await refreshing;
-			if (newToken) {
-				const headers = new Headers(retryTemplate.headers);
-				headers.set("Authorization", `Bearer ${newToken}`);
-				return next(new Request(retryTemplate, { headers }));
-			}
-		}
-		return response;
-	};
-}
-
-//#endregion
-export { tokenInterceptor as a, refreshInterceptor as i, csrfInterceptor as n, devBypassInterceptor as r, createTransport as t };
-//# sourceMappingURL=transport-DKWIq53q.mjs.map

package/dist/transport-DKWIq53q.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport-DKWIq53q.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n}): Interceptor {\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await globalThis.fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t}),\n\t\t});\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { success, data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\t// A request body can only be read once; clone before sending so the\n\t\t// 401 retry has an unconsumed request to rebuild from.\n\t\tconst retryTemplate = request.body ? request.clone() : request;\n\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(retryTemplate.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(retryTemplate, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAInB;CACf,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,WAAW,MAAM,QAAQ,eAAe;GACzD,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAG/B,MAAM,gBAAgB,QAAQ,OAAO,QAAQ,OAAO,GAAG;EAEvD,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,cAAc,QAAQ;AAClD,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,eAAe,EAAE,SAAS,CAAC,CAAC;;;AAItD,SAAO"}

package/dist/trusted-proxy-tKiVtyTD.mjs

@@ -1,51 +0,0 @@
-//#region src/auth/trusted-proxy.ts
-/**
-* RFC 7230 token — valid characters for an HTTP header name. Invalid names
-* passed to `Headers.get()` throw a TypeError at runtime, which would
-* otherwise surface as a 500 from every auth route.
-*/
-const HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
-/**
-* Normalise a list of header names the way both the config path and any
-* caller passing a pre-resolved list should do: trim, lowercase, drop
-* empty, drop anything that isn't a valid RFC 7230 token. Invalid names
-* would crash `Headers.get()` at runtime.
-*/
-function normalizeTrustedHeaders(names) {
-	return names.map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));
-}
-function isValidHeaderName(name) {
-	return HEADER_NAME_PATTERN.test(name);
-}
-/** Cache for the env-derived value. `null` means "not yet parsed". */
-let _envCache = null;
-function getEnvTrustedHeaders() {
-	if (_envCache !== null) return _envCache;
-	let raw;
-	try {
-		const importMetaEnv = import.meta.env;
-		raw = (typeof process !== "undefined" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : void 0) || importMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;
-	} catch {
-		raw = void 0;
-	}
-	if (!raw) {
-		_envCache = [];
-		return _envCache;
-	}
-	_envCache = raw.split(",").map((s) => s.trim().toLowerCase()).filter((s) => s.length > 0 && isValidHeaderName(s));
-	return _envCache;
-}
-/**
-* Return the lowercased list of headers to trust for client-IP resolution.
-*
-* When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it
-* wins. Otherwise fall through to the env var, then to `[]`.
-*/
-function getTrustedProxyHeaders(config) {
-	if (config && config.trustedProxyHeaders !== void 0) return config.trustedProxyHeaders.map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0 && isValidHeaderName(h));
-	return getEnvTrustedHeaders();
-}
-
-//#endregion
-export { normalizeTrustedHeaders as n, getTrustedProxyHeaders as t };
-//# sourceMappingURL=trusted-proxy-tKiVtyTD.mjs.map

package/dist/trusted-proxy-tKiVtyTD.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"trusted-proxy-tKiVtyTD.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}

package/dist/turnstile-DpsoyOfg.mjs

@@ -1,53 +0,0 @@
-//#region src/comments/turnstile.ts
-/**
-* Server-side Turnstile verification for public comment submissions.
-*
-* The comment form widget (`CommentForm.astro`) submits a `turnstileToken`;
-* this verifies it against Cloudflare's siteverify API. Enforcement is
-* opt-in: it only runs when the operator configures the Turnstile secret
-* key (`EMDASH_TURNSTILE_SECRET_KEY` or `TURNSTILE_SECRET_KEY`), so
-* existing non-Turnstile sites are unaffected.
-*
-* Mirrors `verifyTurnstile` in `@emdash-cms/plugin-forms` (not imported —
-* core doesn't depend on plugin packages).
-*/
-const SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
-/**
-* Resolve the configured Turnstile secret key, or `""` when Turnstile
-* enforcement is not configured.
-*/
-function getTurnstileSecretKey() {
-	return import.meta.env.EMDASH_TURNSTILE_SECRET_KEY || import.meta.env.TURNSTILE_SECRET_KEY || "";
-}
-/**
-* Verify a Turnstile response token via siteverify.
-*
-* Fails closed: a missing token, a failed verification, and a siteverify
-* transport error all return `false` — when the operator has configured a
-* secret, an unverifiable submission must not be persisted.
-*/
-async function verifyTurnstileToken(token, secretKey, remoteIp) {
-	if (!token) return false;
-	const body = {
-		secret: secretKey,
-		response: token
-	};
-	if (remoteIp) body.remoteip = remoteIp;
-	try {
-		const data = await (await fetch(SITEVERIFY_URL, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify(body),
-			signal: AbortSignal.timeout(1e4)
-		})).json();
-		if (!data.success) console.warn("[comments] Turnstile verification failed:", data["error-codes"] ?? []);
-		return data.success === true;
-	} catch (error) {
-		console.error("[comments] Turnstile siteverify request failed:", error instanceof Error ? error.message : error);
-		return false;
-	}
-}
-
-//#endregion
-export { getTurnstileSecretKey, verifyTurnstileToken };
-//# sourceMappingURL=turnstile-DpsoyOfg.mjs.map

package/dist/turnstile-DpsoyOfg.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"turnstile-DpsoyOfg.mjs","names":[],"sources":["../src/comments/turnstile.ts"],"sourcesContent":["/**\n * Server-side Turnstile verification for public comment submissions.\n *\n * The comment form widget (`CommentForm.astro`) submits a `turnstileToken`;\n * this verifies it against Cloudflare's siteverify API. Enforcement is\n * opt-in: it only runs when the operator configures the Turnstile secret\n * key (`EMDASH_TURNSTILE_SECRET_KEY` or `TURNSTILE_SECRET_KEY`), so\n * existing non-Turnstile sites are unaffected.\n *\n * Mirrors `verifyTurnstile` in `@emdash-cms/plugin-forms` (not imported —\n * core doesn't depend on plugin packages).\n */\n\nconst SITEVERIFY_URL = \"https://challenges.cloudflare.com/turnstile/v0/siteverify\";\n\n/**\n * Resolve the configured Turnstile secret key, or `\"\"` when Turnstile\n * enforcement is not configured.\n */\nexport function getTurnstileSecretKey(): string {\n\treturn import.meta.env.EMDASH_TURNSTILE_SECRET_KEY || import.meta.env.TURNSTILE_SECRET_KEY || \"\";\n}\n\n/**\n * Verify a Turnstile response token via siteverify.\n *\n * Fails closed: a missing token, a failed verification, and a siteverify\n * transport error all return `false` — when the operator has configured a\n * secret, an unverifiable submission must not be persisted.\n */\nexport async function verifyTurnstileToken(\n\ttoken: string | undefined,\n\tsecretKey: string,\n\tremoteIp?: string | null,\n): Promise<boolean> {\n\tif (!token) return false;\n\n\tconst body: Record<string, string> = { secret: secretKey, response: token };\n\tif (remoteIp) {\n\t\tbody.remoteip = remoteIp;\n\t}\n\n\ttry {\n\t\tconst res = await fetch(SITEVERIFY_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify(body),\n\t\t\t// Fail closed *quickly* if siteverify is slow — without a timeout\n\t\t\t// the comment POST would hang until the runtime kills it\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\t\tconst data: { success?: boolean; \"error-codes\"?: string[] } = await res.json();\n\t\tif (!data.success) {\n\t\t\tconsole.warn(\"[comments] Turnstile verification failed:\", data[\"error-codes\"] ?? []);\n\t\t}\n\t\treturn data.success === true;\n\t} catch (error) {\n\t\tconsole.error(\n\t\t\t\"[comments] Turnstile siteverify request failed:\",\n\t\t\terror instanceof Error ? error.message : error,\n\t\t);\n\t\treturn false;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAM,iBAAiB;;;;;AAMvB,SAAgB,wBAAgC;AAC/C,QAAO,OAAO,KAAK,IAAI,+BAA+B,OAAO,KAAK,IAAI,wBAAwB;;;;;;;;;AAU/F,eAAsB,qBACrB,OACA,WACA,UACmB;AACnB,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,OAA+B;EAAE,QAAQ;EAAW,UAAU;EAAO;AAC3E,KAAI,SACH,MAAK,WAAW;AAGjB,KAAI;EASH,MAAM,OAAwD,OARlD,MAAM,MAAM,gBAAgB;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU,KAAK;GAG1B,QAAQ,YAAY,QAAQ,IAAO;GACnC,CAAC,EACsE,MAAM;AAC9E,MAAI,CAAC,KAAK,QACT,SAAQ,KAAK,6CAA6C,KAAK,kBAAkB,EAAE,CAAC;AAErF,SAAO,KAAK,YAAY;UAChB,OAAO;AACf,UAAQ,MACP,mDACA,iBAAiB,QAAQ,MAAM,UAAU,MACzC;AACD,SAAO"}