emdash 0.41.0 → 0.42.0

package/dist/oauth-state-store-CM5ZEYQS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state-store-CM5ZEYQS.mjs","names":[],"sources":["../src/auth/oauth-state-store.ts"],"sourcesContent":["/**\n * OAuth state store\n *\n * Stores OAuth state in the auth_challenges table with automatic expiration.\n * Uses the existing table but with type=\"oauth\" to distinguish from WebAuthn challenges.\n */\n\nimport type { StateStore, OAuthState } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nconst OAUTH_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes\n\nexport function createOAuthStateStore(db: Kysely<Database>): StateStore {\n\treturn {\n\t\tasync set(state: string, data: OAuthState): Promise<void> {\n\t\t\tconst expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge: state,\n\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\tuser_id: null,\n\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(state: string): Promise<OAuthState | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(state);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tif (!row.data) return null;\n\n\t\t\ttry {\n\t\t\t\tconst parsed: unknown = JSON.parse(row.data);\n\t\t\t\tif (\n\t\t\t\t\ttypeof parsed !== \"object\" ||\n\t\t\t\t\tparsed === null ||\n\t\t\t\t\t!(\"provider\" in parsed) ||\n\t\t\t\t\ttypeof parsed.provider !== \"string\" ||\n\t\t\t\t\t!(\"redirectUri\" in parsed) ||\n\t\t\t\t\ttypeof parsed.redirectUri !== \"string\"\n\t\t\t\t) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tconst oauthState: OAuthState = {\n\t\t\t\t\tprovider: parsed.provider,\n\t\t\t\t\tredirectUri: parsed.redirectUri,\n\t\t\t\t};\n\t\t\t\tif (\"codeVerifier\" in parsed && typeof parsed.codeVerifier === \"string\") {\n\t\t\t\t\toauthState.codeVerifier = parsed.codeVerifier;\n\t\t\t\t}\n\t\t\t\tif (\"nonce\" in parsed && typeof parsed.nonce === \"string\") {\n\t\t\t\t\toauthState.nonce = parsed.nonce;\n\t\t\t\t}\n\t\t\t\tif (\"inviteToken\" in parsed && typeof parsed.inviteToken === \"string\") {\n\t\t\t\t\toauthState.inviteToken = parsed.inviteToken;\n\t\t\t\t}\n\t\t\t\treturn oauthState;\n\t\t\t} catch {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\n\t\tasync delete(state: string): Promise<void> {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"auth_challenges\")\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.execute();\n\t\t},\n\t};\n}\n"],"mappings":";AAYA,MAAM,qBAAqB,MAAU;AAErC,SAAgB,sBAAsB,IAAkC;AACvE,QAAO;EACN,MAAM,IAAI,OAAe,MAAiC;GACzD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,mBAAmB,CAAC,aAAa;AAEzE,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM;IACN,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,OAA2C;GACpD,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;AAKjB,OAHkB,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS,GAGpC,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,MAAM;AACxB,WAAO;;AAGR,OAAI,CAAC,IAAI,KAAM,QAAO;AAEtB,OAAI;IACH,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK;AAC5C,QACC,OAAO,WAAW,YAClB,WAAW,QACX,EAAE,cAAc,WAChB,OAAO,OAAO,aAAa,YAC3B,EAAE,iBAAiB,WACnB,OAAO,OAAO,gBAAgB,SAE9B,QAAO;IAER,MAAM,aAAyB;KAC9B,UAAU,OAAO;KACjB,aAAa,OAAO;KACpB;AACD,QAAI,kBAAkB,UAAU,OAAO,OAAO,iBAAiB,SAC9D,YAAW,eAAe,OAAO;AAElC,QAAI,WAAW,UAAU,OAAO,OAAO,UAAU,SAChD,YAAW,QAAQ,OAAO;AAE3B,QAAI,iBAAiB,UAAU,OAAO,OAAO,gBAAgB,SAC5D,YAAW,cAAc,OAAO;AAEjC,WAAO;WACA;AACP,WAAO;;;EAIT,MAAM,OAAO,OAA8B;AAC1C,SAAM,GACJ,WAAW,kBAAkB,CAC7B,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,SAAS;;EAEZ"}

package/dist/oauth-user-lookup-DrrqvTZC.mjs

@@ -0,0 +1,26 @@
+import { toRoleLevel } from "@emdash-cms/auth";
+
+//#region src/api/handlers/oauth-user-lookup.ts
+/**
+* Shared user lookup for OAuth token operations.
+*
+* Extracts user role and disabled status from the database. Used by
+* handleTokenRefresh() to revalidate scopes against the user's current
+* role and reject disabled users.
+*/
+/**
+* Look up a user's current role and disabled status.
+* Returns null if the user doesn't exist.
+*/
+async function lookupUserRoleAndStatus(db, userId) {
+	const row = await db.selectFrom("users").select(["role", "disabled"]).where("id", "=", userId).executeTakeFirst();
+	if (!row) return null;
+	return {
+		role: toRoleLevel(row.role),
+		disabled: row.disabled === 1
+	};
+}
+
+//#endregion
+export { lookupUserRoleAndStatus as t };
+//# sourceMappingURL=oauth-user-lookup-DrrqvTZC.mjs.map

package/dist/oauth-user-lookup-DrrqvTZC.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-user-lookup-DrrqvTZC.mjs","names":[],"sources":["../src/api/handlers/oauth-user-lookup.ts"],"sourcesContent":["/**\n * Shared user lookup for OAuth token operations.\n *\n * Extracts user role and disabled status from the database. Used by\n * handleTokenRefresh() to revalidate scopes against the user's current\n * role and reject disabled users.\n */\n\nimport { toRoleLevel, type RoleLevel } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\n\nexport interface UserRoleAndStatus {\n\trole: RoleLevel;\n\tdisabled: boolean;\n}\n\n/**\n * Look up a user's current role and disabled status.\n * Returns null if the user doesn't exist.\n */\nexport async function lookupUserRoleAndStatus(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<UserRoleAndStatus | null> {\n\tconst row = await db\n\t\t.selectFrom(\"users\")\n\t\t.select([\"role\", \"disabled\"])\n\t\t.where(\"id\", \"=\", userId)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\treturn {\n\t\trole: toRoleLevel(row.role),\n\t\tdisabled: row.disabled === 1,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,eAAsB,wBACrB,IACA,QACoC;CACpC,MAAM,MAAM,MAAM,GAChB,WAAW,QAAQ,CACnB,OAAO,CAAC,QAAQ,WAAW,CAAC,CAC5B,MAAM,MAAM,KAAK,OAAO,CACxB,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAEjB,QAAO;EACN,MAAM,YAAY,IAAI,KAAK;EAC3B,UAAU,IAAI,aAAa;EAC3B"}

package/dist/object-cache/memory.d.mts

@@ -1,4 +1,4 @@
-import { t as CreateObjectCacheBackendFn } from "../types-uxLoPBio.mjs";
+import { t as CreateObjectCacheBackendFn } from "../types-2V_MVPYy.mjs";
 
 //#region src/object-cache/memory.d.ts
 /**

package/dist/object-cache-Bo6DGaC9.mjs

@@ -0,0 +1,586 @@
+import { t as after } from "./after-PcEvMY_6.mjs";
+import { getRequestContext } from "./request-context.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+
+//#region src/object-cache/codec.ts
+/**
+* Object-cache serialization codec.
+*
+* Cached values are JSON, with one extension: `Date` instances are preserved
+* across the round-trip. EmDash content entries carry `Date` objects for the
+* system timestamp columns (`createdAt`, `updatedAt`, `publishedAt`,
+* `scheduledAt`) and on `cacheHint.lastModified`; plain `JSON.stringify` would
+* silently flatten those to ISO strings, so a value read from cache would no
+* longer be `=== instanceof Date` and downstream `value instanceof Date`
+* branches (cursor encoding, scheduled-visibility checks) would diverge from a
+* fresh database read.
+*
+* Functions and symbol-keyed properties are NOT preserved — callers that cache
+* values carrying either (e.g. content entries with their `.edit` proxy and
+* the non-enumerable `CURSOR_RAW_VALUES` symbol) must reduce to a serializable
+* snapshot before caching and rebuild the non-serializable parts on read. See
+* `query.ts` content snapshot helpers.
+*/
+/** Tag used to mark a serialized `Date`. Deliberately unlikely to collide. */
+const DATE_TAG = "$$emdashDate";
+function isTaggedDate(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return Object.keys(value).length === 1 && typeof value[DATE_TAG] === "string";
+}
+/**
+* Serialize a value to a cache string, preserving `Date` instances.
+*
+* Uses the JSON replacer's `this` binding to inspect the *original* property
+* value: `JSON.stringify` invokes `Date.prototype.toJSON` before the replacer
+* sees it, so by the time `value` arrives it is already an ISO string. Reading
+* `this[key]` recovers the live `Date` so we can tag it.
+*/
+function encode(value) {
+	return JSON.stringify(value, function(key, val) {
+		const original = this[key];
+		if (original instanceof Date) return { [DATE_TAG]: original.toISOString() };
+		return val;
+	});
+}
+/**
+* Parse a cache string produced by {@link encode}, rehydrating tagged `Date`s.
+*
+* Returns `undefined` if the input is not valid JSON (treated as a cache miss
+* by the read-through layer rather than throwing).
+*/
+function decode(raw) {
+	try {
+		return JSON.parse(raw, (_key, value) => {
+			if (isTaggedDate(value)) return new Date(value[DATE_TAG]);
+			return value;
+		});
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/object-cache/index.ts
+/**
+* Object cache — distributed read-through query cache.
+*
+* Layering (per query):
+*
+*   requestCached   → in-request dedupe (per render, WeakMap on ALS context)
+*   cachedQuery     → THIS layer: distributed L2 (KV / memory), epoch-keyed
+*   database        → source of truth
+*
+* Optional and off by default: when no `objectCache` descriptor is configured,
+* `virtual:emdash/object-cache` exports `createObjectCache = undefined`,
+* {@link getBackend} resolves to `null`, and {@link cachedQuery} is a
+* transparent passthrough to its `load` function. Configure with
+* `memoryCache()` (Node) or `kvCache()` from `@emdash-cms/cloudflare`.
+*
+* Invalidation is epoch-based: each cache key embeds a per-namespace epoch
+* ("last changed" marker) read from the backend. A write calls
+* {@link invalidateObjectCache}, which stamps the namespace epoch to
+* `Date.now()`; every previously-stored key for that namespace is instantly
+* orphaned and reclaimed by its TTL. This is O(1) and needs no key
+* enumeration (KV has no prefix delete).
+*
+* The singleton backend/config and the per-isolate epoch cache live on
+* `globalThis` behind `Symbol.for` keys so Vite SSR chunk duplication can't
+* fork them (same pattern as `request-context.ts`).
+*/
+const DEFAULT_KEY_PREFIX = "em";
+const DEFAULT_TTL_SECONDS = 3600;
+const DEFAULT_REVALIDATE_MS = 1e3;
+const DEFAULT_TIMEOUT_MS = 2e3;
+/**
+* Race a backend operation against a timeout so a stalled call (e.g. a KV read
+* that never resolves *and* never rejects — a cold cross-region read, or one
+* queued behind the Workers simultaneous-connection limit) degrades to a
+* rejection instead of hanging the isolate. A rejection is benign: callers
+* already treat a failed read as a cache miss / last-known epoch.
+*/
+function withTimeout(promise, ms, label) {
+	if (!(ms > 0)) return promise;
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`object-cache ${label} timed out after ${ms}ms`));
+		}, ms);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+/**
+* Extra time past the configured read timeout before an in-flight epoch read
+* is presumed dead. A live owner's read settles within `timeout` (enforced by
+* {@link withTimeout}), so the grace only needs to absorb scheduling jitter.
+*/
+const EPOCH_READ_GRACE_MS = 1e3;
+/**
+* How long an in-flight epoch read may be trusted. A read older than this can
+* only exist because its owning request was cancelled mid-await — on workerd
+* a cancelled request's continuations never run, *including the timeout's own
+* `setTimeout` callback*, so the shared promise never settles and is never
+* replaced. With the timeout disabled (`timeout: 0`) the default is used as
+* the deadline; the worst case of guessing too short is one duplicate
+* backend read.
+*/
+function epochReadDeadline() {
+	return (holder.config.timeout > 0 ? holder.config.timeout : DEFAULT_TIMEOUT_MS) + EPOCH_READ_GRACE_MS;
+}
+/**
+* Await another request's in-flight epoch read, bounded by the waiter's own
+* timer. The bare promise must never be awaited across requests: if the
+* owning request is cancelled, the promise never settles (see
+* {@link epochReadDeadline}) and an unguarded waiter hangs until the isolate
+* is evicted. The race timer below belongs to the *waiter's* request context
+* and therefore always fires; on timeout the waiter degrades to `fallback`
+* (the last known epoch), the same contract as a failed backend read.
+*/
+function raceInFlightEpochRead(promise, ms, fallback) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(resolve, Math.max(ms, 1), fallback);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+/** Bound a waiter on another request's backend initialization. */
+function raceInFlightBackendInit(promise, ms) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(resolve, Math.max(ms, 1), null);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+const BACKEND_KEY = Symbol.for("emdash:object-cache:backend");
+const EPOCH_KEY = Symbol.for("emdash:object-cache:epochs");
+const PENDING_KEY = Symbol.for("emdash:object-cache:pending-bumps");
+const LAST_CONTENT_WRITE_KEY = Symbol.for("emdash:object-cache:last-content-write");
+const PENDING_CONTENT_WRITE_KEY = Symbol.for("emdash:object-cache:pending-content-write");
+const WRITE_SCOPE_KEY = Symbol.for("emdash:object-cache:write-scope");
+const g = globalThis;
+const holder = g[BACKEND_KEY] ?? (() => {
+	const h = {
+		initialized: false,
+		backend: null,
+		initPromise: null,
+		config: {
+			keyPrefix: DEFAULT_KEY_PREFIX,
+			defaultTtl: DEFAULT_TTL_SECONDS,
+			revalidate: DEFAULT_REVALIDATE_MS,
+			timeout: DEFAULT_TIMEOUT_MS
+		}
+	};
+	g[BACKEND_KEY] = h;
+	return h;
+})();
+const epochCache = g[EPOCH_KEY] ?? (() => {
+	const m = /* @__PURE__ */ new Map();
+	g[EPOCH_KEY] = m;
+	return m;
+})();
+/** Namespaces with a backend epoch write already scheduled this tick. */
+const pendingBumps = g[PENDING_KEY] ?? (() => {
+	const s = /* @__PURE__ */ new Set();
+	g[PENDING_KEY] = s;
+	return s;
+})();
+const lastContentWrite = g[LAST_CONTENT_WRITE_KEY] ?? (() => {
+	const s = {
+		value: 0,
+		at: 0
+	};
+	g[LAST_CONTENT_WRITE_KEY] = s;
+	return s;
+})();
+/** Whether a backend persist of the content-write stamp is already scheduled. */
+const contentWritePersist = g[PENDING_CONTENT_WRITE_KEY] ?? (() => {
+	const s = { pending: false };
+	g[PENDING_CONTENT_WRITE_KEY] = s;
+	return s;
+})();
+const writeScopes = g[WRITE_SCOPE_KEY] ?? (() => {
+	const als = new AsyncLocalStorage();
+	g[WRITE_SCOPE_KEY] = als;
+	return als;
+})();
+/**
+* Resolve (once per isolate) the configured object-cache backend.
+*
+* Loads `virtual:emdash/object-cache`, which exports `createObjectCache`
+* (`undefined` when no cache is configured) and the serialized
+* `objectCacheConfig`. Returns `null` when the cache is disabled.
+*/
+async function getBackend() {
+	if (holder.initialized) return holder.backend;
+	if (holder.initPromise) {
+		const age = Date.now() - (holder.initPromiseAt ?? 0);
+		const deadline = epochReadDeadline();
+		if (age < deadline) return raceInFlightBackendInit(holder.initPromise, deadline - age);
+	}
+	holder.initPromiseAt = Date.now();
+	holder.initPromise = (async () => {
+		try {
+			const mod = await import("virtual:emdash/object-cache");
+			const config = mod.objectCacheConfig ?? {};
+			holder.config = {
+				keyPrefix: typeof config.keyPrefix === "string" && config.keyPrefix.length > 0 ? config.keyPrefix : DEFAULT_KEY_PREFIX,
+				defaultTtl: typeof config.defaultTtl === "number" && config.defaultTtl > 0 ? config.defaultTtl : DEFAULT_TTL_SECONDS,
+				revalidate: typeof config.revalidate === "number" && config.revalidate >= 0 ? config.revalidate : DEFAULT_REVALIDATE_MS,
+				timeout: typeof config.timeout === "number" && config.timeout >= 0 ? config.timeout : DEFAULT_TIMEOUT_MS
+			};
+			holder.backend = typeof mod.createObjectCache === "function" ? mod.createObjectCache(config) : null;
+		} catch (error) {
+			if (import.meta.env?.DEV) console.warn("[object-cache] backend unavailable:", error);
+			holder.backend = null;
+		}
+		holder.initialized = true;
+		holder.initPromise = null;
+		holder.initPromiseAt = void 0;
+		return holder.backend;
+	})();
+	const started = holder.initPromise;
+	after(() => started.then(() => void 0, () => void 0));
+	return started;
+}
+/** Build the backend key for a namespace's epoch anchor. */
+function epochKey(namespace) {
+	return `${holder.config.keyPrefix}:epoch:${namespace}`;
+}
+/** Backend key for the shared "last content write" stamp (no short TTL). */
+function lastContentWriteKey() {
+	return `${holder.config.keyPrefix}:last-content-write-at`;
+}
+function isContentNamespace(namespace) {
+	return namespace.startsWith("content:");
+}
+/**
+* Build the (epoch-independent) backend key for a cached value.
+*
+* The key is stable across invalidations — the namespace epochs are stored
+* *inside* the value envelope and validated on read, not baked into the key.
+* This lets the value and the epochs be fetched in one parallel round-trip
+* (instead of "read epoch, then read value"), and means an invalidated value
+* is overwritten in place rather than orphaned under a dead epoch-keyed name.
+*/
+function valueKey(namespaces, key) {
+	return `${holder.config.keyPrefix}:${namespaces.join(",")}:${key}`;
+}
+function epochsMatch(stored, current) {
+	if (stored.length !== current.length) return false;
+	for (let i = 0; i < stored.length; i++) if (stored[i] !== current[i]) return false;
+	return true;
+}
+/**
+* Requests that must always read live data and never populate the cache:
+* visual edit mode, preview tokens, isolated databases (playground / DO
+* preview, whose schema and content diverge from the configured site), and
+* Astro route-cache fills that must not rebuild a purged page from a stale
+* object-cache snapshot.
+*/
+function shouldBypass() {
+	const ctx = getRequestContext();
+	if (!ctx) return false;
+	return ctx.editMode === true || ctx.preview !== void 0 || ctx.dbIsIsolated === true || ctx.routeCacheFill === true;
+}
+/**
+* Read the current epoch for `namespace`, reusing an isolate-cached value for
+* up to `revalidate` ms. A missing epoch (never bumped) is treated as `0`.
+*
+* Backend errors and stalls are non-fatal: the read is bounded by a timeout,
+* and on failure we fall back to the last known epoch (or `0`), so a flaky or
+* hung cache degrades to "serve whatever's keyed" rather than throwing or
+* hanging.
+*/
+async function getEpoch(namespace, backend) {
+	const now = Date.now();
+	const cached = epochCache.get(namespace);
+	if (cached && now - cached.at < holder.config.revalidate) return cached.value;
+	if (cached?.promise) {
+		const age = now - (cached.promiseAt ?? 0);
+		const deadline = epochReadDeadline();
+		if (age < deadline) return raceInFlightEpochRead(cached.promise, deadline - age, cached.value);
+	}
+	const promise = (async () => {
+		let value;
+		try {
+			const raw = await withTimeout(backend.get(epochKey(namespace)), holder.config.timeout, "epoch read");
+			const parsed = raw === null ? 0 : Number(raw);
+			value = Number.isFinite(parsed) ? parsed : 0;
+		} catch {
+			value = cached?.value ?? 0;
+		}
+		const merged = Math.max(value, epochCache.get(namespace)?.value ?? 0);
+		epochCache.set(namespace, {
+			value: merged,
+			at: Date.now()
+		});
+		return merged;
+	})();
+	after(() => promise.then(() => void 0, () => void 0));
+	epochCache.set(namespace, {
+		value: cached?.value ?? 0,
+		at: cached?.at ?? 0,
+		promise,
+		promiseAt: now
+	});
+	return promise;
+}
+/**
+* Distributed read-through cache around `load`.
+*
+* `T` must be the value as it should be *stored* — i.e. JSON-serializable with
+* the codec's `Date` support, carrying no functions or symbol-keyed props.
+* Callers caching richer objects (content entries) reduce to a serializable
+* snapshot here and rebuild on the way out; see `query.ts`.
+*
+* On a miss or when the cache is disabled/bypassed, this is equivalent to
+* `await load()`. Backend errors never propagate: a failing `get` is a miss, a
+* failing `set` is dropped.
+*/
+async function cachedQuery(options) {
+	const backend = await getBackend();
+	if (!backend || shouldBypass()) return options.load();
+	const namespaces = typeof options.namespace === "string" ? [options.namespace] : options.namespace;
+	const fullKey = valueKey(namespaces, options.key);
+	const epochsPromise = Promise.all(namespaces.map((ns) => getEpoch(ns, backend)));
+	const rawPromise = withTimeout(backend.get(fullKey), holder.config.timeout, "read").catch(() => null);
+	const currentEpochs = await epochsPromise;
+	const raw = await rawPromise;
+	if (raw !== null) {
+		const decoded = decode(raw);
+		if (decoded !== void 0) {
+			const envelope = decoded;
+			if (epochsMatch(envelope.e, currentEpochs)) return envelope.v;
+		}
+	}
+	const value = await options.load();
+	if (options.cacheable ? options.cacheable(value) : true) {
+		const ttl = options.ttl ?? holder.config.defaultTtl;
+		after(async () => {
+			try {
+				const encoded = encode({
+					e: currentEpochs,
+					v: value
+				});
+				await backend.set(fullKey, encoded, ttl);
+			} catch (error) {
+				if (import.meta.env?.DEV) console.warn("[object-cache] set failed:", error);
+			}
+		});
+	}
+	return value;
+}
+/** Whether object-cache reads are active for the current request. */
+async function isObjectCacheActive() {
+	return await getBackend() !== null && !shouldBypass();
+}
+/**
+* Stamp the isolate-local + backend "last content write" marker when a
+* content collection namespace is invalidated. Used by DB adapters (Hyperdrive)
+* to briefly prefer uncached SQL after a publish so edge/object caches are not
+* reseeded from a stale query-cache hit.
+*/
+function stampLastContentWrite() {
+	const stamp = Math.max(lastContentWrite.value + 1, Date.now());
+	lastContentWrite.value = stamp;
+	lastContentWrite.at = stamp;
+	lastContentWrite.promise = void 0;
+	lastContentWrite.promiseAt = void 0;
+	scheduleBackendWrite("last-content-write", persistLastContentWrite);
+}
+function persistLastContentWrite() {
+	if (contentWritePersist.pending) return;
+	contentWritePersist.pending = true;
+	after(async () => {
+		contentWritePersist.pending = false;
+		try {
+			const backend = await getBackend();
+			if (!backend) return;
+			const latest = lastContentWrite.value;
+			await backend.set(lastContentWriteKey(), String(latest));
+		} catch (error) {
+			console.error("[object-cache] last-content-write stamp failed:", error);
+		}
+	});
+}
+/**
+* ms-epoch of the last content-namespace invalidation (`content:*`), or `0`
+* if unknown. Returns `max(local, backend)` so a warm isolate that just
+* published is immediately correct, and cold isolates learn within their
+* `revalidate` window after another isolate stamped the backend.
+*/
+async function getLastContentWriteAt() {
+	const local = lastContentWrite.value;
+	const now = Date.now();
+	if (now - lastContentWrite.at < holder.config.revalidate) return local;
+	const backend = await getBackend();
+	if (!backend) return local;
+	if (lastContentWrite.promise) {
+		const age = now - (lastContentWrite.promiseAt ?? 0);
+		const deadline = epochReadDeadline();
+		if (age < deadline) return raceInFlightEpochRead(lastContentWrite.promise, deadline - age, local);
+	}
+	const promise = (async () => {
+		let value;
+		try {
+			const raw = await withTimeout(backend.get(lastContentWriteKey()), holder.config.timeout, "last-content-write read");
+			const parsed = raw === null ? 0 : Number(raw);
+			value = Number.isFinite(parsed) ? parsed : 0;
+		} catch {
+			value = lastContentWrite.value;
+		}
+		const merged = Math.max(value, lastContentWrite.value);
+		lastContentWrite.value = merged;
+		lastContentWrite.at = Date.now();
+		lastContentWrite.promise = void 0;
+		lastContentWrite.promiseAt = void 0;
+		return merged;
+	})();
+	after(() => promise.then(() => void 0, () => void 0));
+	lastContentWrite.promise = promise;
+	lastContentWrite.promiseAt = now;
+	return promise;
+}
+/**
+* Invalidate every cached value in `namespace` by bumping its epoch.
+*
+* Sync and non-blocking: the local epoch is stamped immediately (so the
+* writing isolate is instantly consistent) and the backend write is deferred
+* via `after`, or held until the work ends inside
+* {@link coalesceObjectCacheWrites}. Other isolates pick up the new epoch
+* within their `revalidate` window after that write. No-ops when the cache is
+* disabled.
+*
+* Content namespaces (`content:*`) also stamp {@link getLastContentWriteAt}.
+*/
+function invalidateObjectCache(namespace) {
+	const prev = epochCache.get(namespace)?.value ?? 0;
+	const stamp = Math.max(prev + 1, Date.now());
+	epochCache.set(namespace, {
+		value: stamp,
+		at: stamp
+	});
+	if (isContentNamespace(namespace)) stampLastContentWrite();
+	scheduleBackendWrite(`epoch:${namespace}`, () => persistEpoch(namespace, stamp));
+}
+function persistEpoch(namespace, stamp) {
+	if (pendingBumps.has(namespace)) return;
+	pendingBumps.add(namespace);
+	after(async () => {
+		pendingBumps.delete(namespace);
+		try {
+			const backend = await getBackend();
+			if (!backend) return;
+			const latest = epochCache.get(namespace)?.value ?? stamp;
+			await backend.set(epochKey(namespace), String(latest));
+		} catch (error) {
+			console.error("[object-cache] epoch bump failed for", namespace, error);
+		}
+	});
+}
+function scheduleBackendWrite(key, write) {
+	const scope = writeScopes.getStore();
+	if (scope && !scope.closed) {
+		scope.held.set(key, write);
+		return;
+	}
+	write();
+}
+/**
+* Run a bulk write, such as applying a seed, with its backend epoch writes held
+* until it settles. Invalidations inside `fn` still stamp the local epochs
+* immediately; the backend then receives one write per namespace, carrying the
+* latest epoch, whether `fn` resolves or throws. Without this, every entry
+* rewrites the same few keys, and KV accepts about one write per second per key.
+*
+* Other isolates see none of these invalidations until `fn` ends, so don't wrap
+* work that purges edge-cached pages part-way through: a page rebuilt after
+* such a purge would still read the old epoch. If the invocation is killed
+* before `fn` settles, the held writes are lost with it, and other isolates
+* keep their cached values until those expire.
+*/
+async function coalesceObjectCacheWrites(fn) {
+	const scope = {
+		held: /* @__PURE__ */ new Map(),
+		closed: false
+	};
+	try {
+		return await writeScopes.run(scope, fn);
+	} finally {
+		scope.closed = true;
+		for (const write of scope.held.values()) write();
+	}
+}
+/**
+* Fixed namespaces for data shared across collections. Content reads fold the
+* `BYLINES` and `TAXONOMIES` epochs into their keys (via {@link cachedQuery})
+* because entries hydrate byline and taxonomy-term data — so renaming an
+* author or a category correctly invalidates every cached entry that displays
+* it, without tracking which collections reference it.
+*/
+const CacheNamespace = {
+	SETTINGS: "settings",
+	MENUS: "menus",
+	TAXONOMIES: "taxonomies",
+	BYLINES: "bylines",
+	SCHEMA: "schema",
+	COMMENTS: "comments"
+};
+/** Namespace for a content collection's cached queries. */
+function contentNamespace(collection) {
+	return `content:v2:${collection}`;
+}
+function legacyContentNamespace(collection) {
+	return `content:${collection}`;
+}
+/**
+* Content epochs carried by current cache entries. The versioned namespace
+* makes snapshots written before the current cache format unreachable.
+*/
+function contentCacheNamespaces(collection) {
+	return [contentNamespace(collection)];
+}
+function contentInvalidationNamespaces(collection) {
+	return [contentNamespace(collection), legacyContentNamespace(collection)];
+}
+/**
+* Namespaces a content read depends on: the collection itself plus the shared
+* byline/taxonomy data folded into each entry.
+*/
+function contentNamespaces(collection) {
+	return [
+		...contentCacheNamespaces(collection),
+		CacheNamespace.BYLINES,
+		CacheNamespace.TAXONOMIES
+	];
+}
+/**
+* Invalidate all cached reads (list + entry) for a content collection.
+* Call from every write path that mutates rows in `ec_<collection>`.
+*/
+function invalidateCollectionCache(collection) {
+	for (const namespace of contentInvalidationNamespaces(collection)) invalidateObjectCache(namespace);
+}
+/** Invalidate cached taxonomy definitions/terms and all content that hydrates them. */
+function invalidateTaxonomyObjectCache() {
+	invalidateObjectCache(CacheNamespace.TAXONOMIES);
+}
+/** Invalidate cached bylines and all content that hydrates them. */
+function invalidateBylineObjectCache() {
+	invalidateObjectCache(CacheNamespace.BYLINES);
+}
+/** Invalidate cached navigation menus. */
+function invalidateMenuObjectCache() {
+	invalidateObjectCache(CacheNamespace.MENUS);
+}
+/** Invalidate cached collection schema/metadata reads (e.g. getCollectionInfo). */
+function invalidateSchemaObjectCache() {
+	invalidateObjectCache(CacheNamespace.SCHEMA);
+}
+/** Invalidate cached public comment reads. */
+function invalidateCommentObjectCache() {
+	invalidateObjectCache(CacheNamespace.COMMENTS);
+}
+
+//#endregion
+export { contentNamespace as a, invalidateBylineObjectCache as c, invalidateMenuObjectCache as d, invalidateObjectCache as f, isObjectCacheActive as h, contentCacheNamespaces as i, invalidateCollectionCache as l, invalidateTaxonomyObjectCache as m, cachedQuery as n, contentNamespaces as o, invalidateSchemaObjectCache as p, coalesceObjectCacheWrites as r, getLastContentWriteAt as s, CacheNamespace as t, invalidateCommentObjectCache as u };
+//# sourceMappingURL=object-cache-Bo6DGaC9.mjs.map