emdash 1.0.0 → 1.0.1-rc.0

package/dist/capture-triggers-CdZfvHtF.mjs

@@ -0,0 +1,362 @@
+import { t as validateIdentifier } from "./validate-DANX1-Qi.mjs";
+import { u as isPostgres, y as tableExists } from "./dialect-helpers-7_IqPdh9.mjs";
+import { sql } from "kysely";
+
+//#region src/media/usage/capture-triggers.ts
+const POSTGRES_TRIGGER_FUNCTION = "emdash_media_usage_capture_work";
+const POSTGRES_IDENTIFIER_LIMIT = 63;
+const CAPTURE_TRIGGER_VERSION = 1;
+const OWNED_TRIGGER_PREFIX = "emdash_mu_";
+const MAX_OWNED_CAPTURE_TRIGGERS = 100;
+const WHITESPACE_PATTERN = /\s+/g;
+const TRAILING_SEMICOLON_PATTERN = /;$/;
+async function installMediaUsageCaptureTriggers(db, identity, options = {}) {
+	const identifiers = await captureIdentifiers(identity);
+	if (isPostgres(db)) await installPostgresFunction(db);
+	const installedNames = await listOwnedCaptureTriggers(db, identifiers.tableName, MAX_OWNED_CAPTURE_TRIGGERS + 1);
+	if (installedNames.length > MAX_OWNED_CAPTURE_TRIGGERS) throw new Error("Media usage capture trigger set exceeds the activation limit");
+	if (await hasExactCaptureTriggers(db, identifiers, identity, installedNames)) return;
+	await assertCaptureLifecycle(db, identity, ["installing"]);
+	const expectedNames = new Set(Object.values(identifiers.triggerNames));
+	const retainedNames = new Set(options.replaceExisting === false ? installedNames.filter((name) => expectedNames.has(name)) : []);
+	await removeCaptureTriggers(db, identifiers.tableName, installedNames.filter((name) => !retainedNames.has(name)));
+	for (const operation of captureOperations) {
+		if (retainedNames.has(identifiers.triggerNames[operation])) continue;
+		if (isPostgres(db)) await postgresCreateTrigger(db, identifiers.tableName, identifiers.triggerNames[operation], operation, identity);
+		else await sqliteCreateTrigger(db, identifiers.tableName, identifiers.triggerNames[operation], operation, identity);
+	}
+	await assertExpectedTriggerSet(db, identifiers, identity);
+}
+async function verifyMediaUsageCaptureTriggers(db, identity) {
+	const identifiers = await captureIdentifiers(identity);
+	if (!await tableExists(db, identifiers.tableName)) return false;
+	return hasExactCaptureTriggers(db, identifiers, identity, await listOwnedCaptureTriggers(db, identifiers.tableName, MAX_OWNED_CAPTURE_TRIGGERS + 1));
+}
+const captureOperations = [
+	"insert",
+	"update",
+	"delete"
+];
+async function captureIdentifiers(identity) {
+	validateIdentifier(identity.collectionSlug, "collection slug");
+	const tableName = `ec_${identity.collectionSlug}`;
+	validateIdentifier(tableName, "content table");
+	const digest = await identityDigest(`${CAPTURE_TRIGGER_VERSION}:${identity.collectionId}:${identity.collectionSlug}`);
+	const triggerNames = {
+		insert: `emdash_mu_${digest}_ai`,
+		update: `emdash_mu_${digest}_au`,
+		delete: `emdash_mu_${digest}_ad`
+	};
+	for (const triggerName of Object.values(triggerNames)) {
+		validateIdentifier(triggerName, "media usage trigger");
+		if (triggerName.length > POSTGRES_IDENTIFIER_LIMIT) throw new Error(`Media usage trigger name exceeds ${POSTGRES_IDENTIFIER_LIMIT} bytes`);
+	}
+	return {
+		tableName,
+		triggerNames
+	};
+}
+async function identityDigest(value) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+	return Array.from(new Uint8Array(digest).slice(0, 16), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function removeCaptureTriggers(db, tableName, triggerNames) {
+	for (const triggerName of triggerNames) {
+		validateIdentifier(triggerName, "media usage trigger");
+		if (isPostgres(db)) await sql`
+				DROP TRIGGER IF EXISTS ${sql.ref(triggerName)} ON ${sql.ref(tableName)}
+			`.execute(db);
+		else await sql`DROP TRIGGER IF EXISTS ${sql.ref(triggerName)}`.execute(db);
+	}
+}
+async function listOwnedCaptureTriggers(db, tableName, limit) {
+	const limitClause = limit === void 0 ? sql`` : sql`LIMIT ${limit}`;
+	if (isPostgres(db)) return (await sql`
+			SELECT trigger.tgname AS name
+			FROM pg_trigger AS trigger
+			INNER JOIN pg_class AS relation ON relation.oid = trigger.tgrelid
+			INNER JOIN pg_namespace AS namespace ON namespace.oid = relation.relnamespace
+			WHERE namespace.nspname = current_schema()
+				AND relation.relname = ${tableName}
+				AND NOT trigger.tgisinternal
+				AND left(trigger.tgname, 10) = ${OWNED_TRIGGER_PREFIX}
+			${limitClause}
+		`.execute(db)).rows.map((row) => row.name);
+	return (await sql`
+		SELECT name
+		FROM sqlite_master
+		WHERE type = 'trigger'
+			AND tbl_name = ${tableName}
+			AND substr(name, 1, 10) = ${OWNED_TRIGGER_PREFIX}
+		${limitClause}
+	`.execute(db)).rows.map((row) => row.name);
+}
+async function hasExactCaptureTriggers(db, identifiers, identity, installedNames) {
+	const expectedNames = new Set(Object.values(identifiers.triggerNames));
+	if (installedNames.length !== expectedNames.size || installedNames.some((name) => !expectedNames.has(name))) return false;
+	if (isPostgres(db)) {
+		const result = await sql`
+			SELECT
+				trigger.tgname AS name,
+				trigger.tgtype AS trigger_type,
+				procedure.proname AS function_name,
+				encode(trigger.tgargs, 'hex') AS arguments_hex,
+				trigger.tgenabled AS enabled,
+				trigger.tgqual IS NOT NULL AS has_when
+			FROM pg_trigger AS trigger
+			INNER JOIN pg_class AS relation ON relation.oid = trigger.tgrelid
+			INNER JOIN pg_namespace AS namespace ON namespace.oid = relation.relnamespace
+			INNER JOIN pg_proc AS procedure ON procedure.oid = trigger.tgfoid
+			INNER JOIN pg_namespace AS function_namespace ON function_namespace.oid = procedure.pronamespace
+			WHERE namespace.nspname = current_schema()
+				AND function_namespace.nspname = current_schema()
+				AND relation.relname = ${identifiers.tableName}
+				AND NOT trigger.tgisinternal
+				AND trigger.tgconstraint = 0
+				AND NOT trigger.tgdeferrable
+				AND NOT trigger.tginitdeferred
+				AND trigger.tgattr = ''::int2vector
+				AND left(trigger.tgname, 10) = ${OWNED_TRIGGER_PREFIX}
+		`.execute(db);
+		const expectedArguments = triggerArgumentsHex(identity);
+		return captureOperations.every((operation) => {
+			const row = result.rows.find((candidate) => candidate.name === identifiers.triggerNames[operation]);
+			return row?.function_name === POSTGRES_TRIGGER_FUNCTION && Number(row.trigger_type) === postgresTriggerType(operation) && row.arguments_hex === expectedArguments && row.enabled === "O" && row.has_when === false;
+		});
+	}
+	const result = await sql`
+		SELECT name, sql AS definition
+		FROM sqlite_master
+		WHERE type = 'trigger'
+			AND tbl_name = ${identifiers.tableName}
+			AND substr(name, 1, 10) = ${OWNED_TRIGGER_PREFIX}
+	`.execute(db);
+	return captureOperations.every((operation) => {
+		const row = result.rows.find((candidate) => candidate.name === identifiers.triggerNames[operation]);
+		const contentId = operation === "delete" ? sql`OLD.id` : sql`NEW.id`;
+		const expected = sqliteTriggerSql(identifiers.tableName, identifiers.triggerNames[operation], operationSql(operation), contentId, identity).compile(db).sql;
+		return row ? normalizeDdl(row.definition) === normalizeDdl(expected) : false;
+	});
+}
+function triggerArgumentsHex(identity) {
+	const bytes = new TextEncoder().encode(`${identity.collectionId}\0${identity.collectionSlug}\0`);
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function postgresTriggerType(operation) {
+	switch (operation) {
+		case "insert": return 5;
+		case "update": return 17;
+		case "delete": return 9;
+	}
+}
+function normalizeDdl(definition) {
+	return definition.replace(WHITESPACE_PATTERN, " ").trim().replace(TRAILING_SEMICOLON_PATTERN, "");
+}
+async function assertCaptureLifecycle(db, identity, allowedStates) {
+	const lifecycle = await db.selectFrom("_emdash_media_usage_index_status").select("capture_state").where("adapter_id", "=", "content-media").where("scope_type", "=", "collection").where("scope_key", "=", identity.collectionSlug).where("collection_id", "=", identity.collectionId).executeTakeFirst();
+	if (!lifecycle?.capture_state || !allowedStates.includes(lifecycle.capture_state)) throw new Error("Media usage capture trigger changes require a fenced collection lifecycle");
+}
+async function assertExpectedTriggerSet(db, identifiers, identity) {
+	if (!await hasExactCaptureTriggers(db, identifiers, identity, await listOwnedCaptureTriggers(db, identifiers.tableName, MAX_OWNED_CAPTURE_TRIGGERS + 1))) throw new Error("Media usage capture trigger installation is incomplete");
+}
+async function installPostgresFunction(db) {
+	await sql`
+		CREATE OR REPLACE FUNCTION ${sql.ref(POSTGRES_TRIGGER_FUNCTION)}()
+		RETURNS trigger
+		LANGUAGE plpgsql
+		AS $function$
+		DECLARE
+			v_collection_id text := TG_ARGV[0];
+			v_collection_slug text := TG_ARGV[1];
+			v_content_id text;
+			v_epoch bigint;
+			v_now text := to_char(
+				clock_timestamp() AT TIME ZONE 'UTC',
+				'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
+			);
+		BEGIN
+			IF TG_OP = 'DELETE' THEN
+				v_content_id := OLD.id;
+			ELSE
+				v_content_id := NEW.id;
+			END IF;
+
+			UPDATE _emdash_media_usage_index_status
+			SET change_epoch = change_epoch + 1,
+				status = CASE WHEN status = 'complete' THEN 'stale' ELSE status END,
+				completed_at = CASE WHEN status = 'complete' THEN NULL ELSE completed_at END,
+				updated_at = v_now
+			WHERE adapter_id = 'content-media'
+				AND scope_type = 'collection'
+				AND scope_key = v_collection_slug
+				AND collection_id = v_collection_id
+				AND capture_state = 'active'
+				AND EXISTS (
+					SELECT 1
+					FROM _emdash_collections AS collection
+					WHERE collection.id = v_collection_id
+						AND collection.slug = v_collection_slug
+				)
+			RETURNING change_epoch INTO v_epoch;
+
+			IF NOT FOUND THEN
+				RAISE EXCEPTION USING
+					ERRCODE = 'P0001',
+					MESSAGE = 'media usage capture inactive';
+			END IF;
+
+			INSERT INTO _emdash_media_usage_work (
+				collection_id,
+				collection_slug,
+				content_id,
+				change_epoch,
+				work_version,
+				state,
+				attempt_count,
+				next_attempt_at,
+				lease_token,
+				lease_expires_at,
+				last_attempted_at,
+				last_error_code,
+				created_at,
+				updated_at
+			)
+			VALUES (
+				v_collection_id,
+				v_collection_slug,
+				v_content_id,
+				v_epoch,
+				1,
+				'pending',
+				0,
+				v_now,
+				NULL,
+				NULL,
+				NULL,
+				NULL,
+				v_now,
+				v_now
+			)
+			ON CONFLICT (collection_id, content_id) DO UPDATE SET
+				collection_slug = EXCLUDED.collection_slug,
+				change_epoch = EXCLUDED.change_epoch,
+				work_version = _emdash_media_usage_work.work_version + 1,
+				state = 'pending',
+				attempt_count = 0,
+				next_attempt_at = EXCLUDED.next_attempt_at,
+				lease_token = NULL,
+				lease_expires_at = NULL,
+				last_attempted_at = NULL,
+				last_error_code = NULL,
+				updated_at = EXCLUDED.updated_at;
+
+			RETURN NULL;
+		END;
+		$function$
+	`.execute(db);
+}
+async function postgresCreateTrigger(db, tableName, triggerName, operation, identity) {
+	await sql`
+		CREATE TRIGGER ${sql.ref(triggerName)}
+		AFTER ${operationSql(operation)} ON ${sql.ref(tableName)}
+		FOR EACH ROW
+		EXECUTE FUNCTION ${sql.ref(POSTGRES_TRIGGER_FUNCTION)}(
+			${sql.lit(identity.collectionId)},
+			${sql.lit(identity.collectionSlug)}
+		)
+	`.execute(db);
+}
+async function sqliteCreateTrigger(db, tableName, triggerName, operation, identity) {
+	const contentId = operation === "delete" ? sql`OLD.id` : sql`NEW.id`;
+	await sqliteTriggerSql(tableName, triggerName, operationSql(operation), contentId, identity).execute(db);
+}
+function sqliteTriggerSql(tableName, triggerName, operation, contentId, identity) {
+	return sql`
+		CREATE TRIGGER ${sql.ref(triggerName)}
+		AFTER ${operation} ON ${sql.ref(tableName)}
+		FOR EACH ROW
+		BEGIN
+			UPDATE _emdash_media_usage_index_status
+			SET change_epoch = change_epoch + 1,
+				status = CASE WHEN status = 'complete' THEN 'stale' ELSE status END,
+				completed_at = CASE WHEN status = 'complete' THEN NULL ELSE completed_at END,
+				updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+			WHERE adapter_id = 'content-media'
+				AND scope_type = 'collection'
+				AND scope_key = ${sql.lit(identity.collectionSlug)}
+				AND collection_id = ${sql.lit(identity.collectionId)}
+				AND capture_state = 'active'
+				AND EXISTS (
+					SELECT 1
+					FROM _emdash_collections AS collection
+					WHERE collection.id = ${sql.lit(identity.collectionId)}
+						AND collection.slug = ${sql.lit(identity.collectionSlug)}
+				);
+
+			SELECT CASE
+				WHEN changes() <> 1 THEN RAISE(ABORT, 'media usage capture inactive')
+			END;
+
+			INSERT INTO _emdash_media_usage_work (
+				collection_id,
+				collection_slug,
+				content_id,
+				change_epoch,
+				work_version,
+				state,
+				attempt_count,
+				next_attempt_at,
+				lease_token,
+				lease_expires_at,
+				last_attempted_at,
+				last_error_code,
+				created_at,
+				updated_at
+			)
+			SELECT
+				${sql.lit(identity.collectionId)},
+				${sql.lit(identity.collectionSlug)},
+				${contentId},
+				change_epoch,
+				1,
+				'pending',
+				0,
+				strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+				NULL,
+				NULL,
+				NULL,
+				NULL,
+				strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+				strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+			FROM _emdash_media_usage_index_status
+			WHERE adapter_id = 'content-media'
+				AND scope_type = 'collection'
+				AND scope_key = ${sql.lit(identity.collectionSlug)}
+				AND collection_id = ${sql.lit(identity.collectionId)}
+				AND capture_state = 'active'
+			ON CONFLICT (collection_id, content_id) DO UPDATE SET
+				collection_slug = excluded.collection_slug,
+				change_epoch = excluded.change_epoch,
+				work_version = _emdash_media_usage_work.work_version + 1,
+				state = 'pending',
+				attempt_count = 0,
+				next_attempt_at = excluded.next_attempt_at,
+				lease_token = NULL,
+				lease_expires_at = NULL,
+				last_attempted_at = NULL,
+				last_error_code = NULL,
+				updated_at = excluded.updated_at;
+		END
+	`;
+}
+function operationSql(operation) {
+	switch (operation) {
+		case "insert": return sql`INSERT`;
+		case "update": return sql`UPDATE`;
+		case "delete": return sql`DELETE`;
+	}
+}
+
+//#endregion
+export { verifyMediaUsageCaptureTriggers as n, installMediaUsageCaptureTriggers as t };
+//# sourceMappingURL=capture-triggers-CdZfvHtF.mjs.map

package/dist/capture-triggers-CdZfvHtF.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-triggers-CdZfvHtF.mjs","names":[],"sources":["../src/media/usage/capture-triggers.ts"],"sourcesContent":["import { sql, type Kysely, type RawBuilder } from \"kysely\";\n\nimport { isPostgres, tableExists } from \"../../database/dialect-helpers.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { validateIdentifier } from \"../../database/validate.js\";\n\nconst POSTGRES_TRIGGER_FUNCTION = \"emdash_media_usage_capture_work\";\nconst POSTGRES_IDENTIFIER_LIMIT = 63;\nconst CAPTURE_TRIGGER_VERSION = 1;\nconst OWNED_TRIGGER_PREFIX = \"emdash_mu_\";\nconst MAX_OWNED_CAPTURE_TRIGGERS = 100;\nconst WHITESPACE_PATTERN = /\\s+/g;\nconst TRAILING_SEMICOLON_PATTERN = /;$/;\n\nexport interface MediaUsageCaptureIdentity {\n\tcollectionId: string;\n\tcollectionSlug: string;\n}\n\ntype CaptureOperation = \"insert\" | \"update\" | \"delete\";\n\nexport async function installMediaUsageCaptureTriggers(\n\tdb: Kysely<Database>,\n\tidentity: MediaUsageCaptureIdentity,\n\toptions: { replaceExisting?: boolean } = {},\n): Promise<void> {\n\tconst identifiers = await captureIdentifiers(identity);\n\tif (isPostgres(db)) await installPostgresFunction(db);\n\tconst installedNames = await listOwnedCaptureTriggers(\n\t\tdb,\n\t\tidentifiers.tableName,\n\t\tMAX_OWNED_CAPTURE_TRIGGERS + 1,\n\t);\n\tif (installedNames.length > MAX_OWNED_CAPTURE_TRIGGERS) {\n\t\tthrow new Error(\"Media usage capture trigger set exceeds the activation limit\");\n\t}\n\tif (await hasExactCaptureTriggers(db, identifiers, identity, installedNames)) {\n\t\treturn;\n\t}\n\n\tawait assertCaptureLifecycle(db, identity, [\"installing\"]);\n\tconst expectedNames = new Set(Object.values(identifiers.triggerNames));\n\tconst retainedNames = new Set(\n\t\toptions.replaceExisting === false\n\t\t\t? installedNames.filter((name) => expectedNames.has(name))\n\t\t\t: [],\n\t);\n\tawait removeCaptureTriggers(\n\t\tdb,\n\t\tidentifiers.tableName,\n\t\tinstalledNames.filter((name) => !retainedNames.has(name)),\n\t);\n\n\tfor (const operation of captureOperations) {\n\t\tif (retainedNames.has(identifiers.triggerNames[operation])) continue;\n\t\tif (isPostgres(db)) {\n\t\t\tawait postgresCreateTrigger(\n\t\t\t\tdb,\n\t\t\t\tidentifiers.tableName,\n\t\t\t\tidentifiers.triggerNames[operation],\n\t\t\t\toperation,\n\t\t\t\tidentity,\n\t\t\t);\n\t\t} else {\n\t\t\tawait sqliteCreateTrigger(\n\t\t\t\tdb,\n\t\t\t\tidentifiers.tableName,\n\t\t\t\tidentifiers.triggerNames[operation],\n\t\t\t\toperation,\n\t\t\t\tidentity,\n\t\t\t);\n\t\t}\n\t}\n\n\tawait assertExpectedTriggerSet(db, identifiers, identity);\n}\n\nexport async function verifyMediaUsageCaptureTriggers(\n\tdb: Kysely<Database>,\n\tidentity: MediaUsageCaptureIdentity,\n): Promise<boolean> {\n\tconst identifiers = await captureIdentifiers(identity);\n\tif (!(await tableExists(db, identifiers.tableName))) return false;\n\treturn hasExactCaptureTriggers(\n\t\tdb,\n\t\tidentifiers,\n\t\tidentity,\n\t\tawait listOwnedCaptureTriggers(db, identifiers.tableName, MAX_OWNED_CAPTURE_TRIGGERS + 1),\n\t);\n}\n\nexport async function removeMediaUsageCaptureTriggers(\n\tdb: Kysely<Database>,\n\tidentity: MediaUsageCaptureIdentity,\n): Promise<void> {\n\tconst identifiers = await captureIdentifiers(identity);\n\tif (!(await tableExists(db, identifiers.tableName))) return;\n\tawait assertCaptureLifecycle(db, identity, [\"installing\", \"deleting\"]);\n\tawait removeCaptureTriggers(\n\t\tdb,\n\t\tidentifiers.tableName,\n\t\tawait listOwnedCaptureTriggers(db, identifiers.tableName),\n\t);\n}\n\nconst captureOperations: readonly CaptureOperation[] = [\"insert\", \"update\", \"delete\"];\n\nasync function captureIdentifiers(identity: MediaUsageCaptureIdentity): Promise<{\n\ttableName: string;\n\ttriggerNames: Record<CaptureOperation, string>;\n}> {\n\tvalidateIdentifier(identity.collectionSlug, \"collection slug\");\n\tconst tableName = `ec_${identity.collectionSlug}`;\n\tvalidateIdentifier(tableName, \"content table\");\n\n\tconst digest = await identityDigest(\n\t\t`${CAPTURE_TRIGGER_VERSION}:${identity.collectionId}:${identity.collectionSlug}`,\n\t);\n\tconst triggerNames = {\n\t\tinsert: `emdash_mu_${digest}_ai`,\n\t\tupdate: `emdash_mu_${digest}_au`,\n\t\tdelete: `emdash_mu_${digest}_ad`,\n\t};\n\tfor (const triggerName of Object.values(triggerNames)) {\n\t\tvalidateIdentifier(triggerName, \"media usage trigger\");\n\t\tif (triggerName.length > POSTGRES_IDENTIFIER_LIMIT) {\n\t\t\tthrow new Error(`Media usage trigger name exceeds ${POSTGRES_IDENTIFIER_LIMIT} bytes`);\n\t\t}\n\t}\n\n\treturn { tableName, triggerNames };\n}\n\nasync function identityDigest(value: string): Promise<string> {\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n\treturn Array.from(new Uint8Array(digest).slice(0, 16), (byte) =>\n\t\tbyte.toString(16).padStart(2, \"0\"),\n\t).join(\"\");\n}\n\nasync function removeCaptureTriggers(\n\tdb: Kysely<Database>,\n\ttableName: string,\n\ttriggerNames: readonly string[],\n): Promise<void> {\n\tfor (const triggerName of triggerNames) {\n\t\tvalidateIdentifier(triggerName, \"media usage trigger\");\n\t\tif (isPostgres(db)) {\n\t\t\tawait sql`\n\t\t\t\tDROP TRIGGER IF EXISTS ${sql.ref(triggerName)} ON ${sql.ref(tableName)}\n\t\t\t`.execute(db);\n\t\t} else {\n\t\t\tawait sql`DROP TRIGGER IF EXISTS ${sql.ref(triggerName)}`.execute(db);\n\t\t}\n\t}\n}\n\nasync function listOwnedCaptureTriggers(\n\tdb: Kysely<Database>,\n\ttableName: string,\n\tlimit?: number,\n): Promise<string[]> {\n\tconst limitClause = limit === undefined ? sql`` : sql`LIMIT ${limit}`;\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{ name: string }>`\n\t\t\tSELECT trigger.tgname AS name\n\t\t\tFROM pg_trigger AS trigger\n\t\t\tINNER JOIN pg_class AS relation ON relation.oid = trigger.tgrelid\n\t\t\tINNER JOIN pg_namespace AS namespace ON namespace.oid = relation.relnamespace\n\t\t\tWHERE namespace.nspname = current_schema()\n\t\t\t\tAND relation.relname = ${tableName}\n\t\t\t\tAND NOT trigger.tgisinternal\n\t\t\t\tAND left(trigger.tgname, 10) = ${OWNED_TRIGGER_PREFIX}\n\t\t\t${limitClause}\n\t\t`.execute(db);\n\t\treturn result.rows.map((row) => row.name);\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name\n\t\tFROM sqlite_master\n\t\tWHERE type = 'trigger'\n\t\t\tAND tbl_name = ${tableName}\n\t\t\tAND substr(name, 1, 10) = ${OWNED_TRIGGER_PREFIX}\n\t\t${limitClause}\n\t`.execute(db);\n\treturn result.rows.map((row) => row.name);\n}\n\nasync function hasExactCaptureTriggers(\n\tdb: Kysely<Database>,\n\tidentifiers: {\n\t\ttableName: string;\n\t\ttriggerNames: Record<CaptureOperation, string>;\n\t},\n\tidentity: MediaUsageCaptureIdentity,\n\tinstalledNames: readonly string[],\n): Promise<boolean> {\n\tconst expectedNames = new Set(Object.values(identifiers.triggerNames));\n\tif (\n\t\tinstalledNames.length !== expectedNames.size ||\n\t\tinstalledNames.some((name) => !expectedNames.has(name))\n\t) {\n\t\treturn false;\n\t}\n\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{\n\t\t\tname: string;\n\t\t\ttrigger_type: number;\n\t\t\tfunction_name: string;\n\t\t\targuments_hex: string;\n\t\t\tenabled: string;\n\t\t\thas_when: boolean;\n\t\t}>`\n\t\t\tSELECT\n\t\t\t\ttrigger.tgname AS name,\n\t\t\t\ttrigger.tgtype AS trigger_type,\n\t\t\t\tprocedure.proname AS function_name,\n\t\t\t\tencode(trigger.tgargs, 'hex') AS arguments_hex,\n\t\t\t\ttrigger.tgenabled AS enabled,\n\t\t\t\ttrigger.tgqual IS NOT NULL AS has_when\n\t\t\tFROM pg_trigger AS trigger\n\t\t\tINNER JOIN pg_class AS relation ON relation.oid = trigger.tgrelid\n\t\t\tINNER JOIN pg_namespace AS namespace ON namespace.oid = relation.relnamespace\n\t\t\tINNER JOIN pg_proc AS procedure ON procedure.oid = trigger.tgfoid\n\t\t\tINNER JOIN pg_namespace AS function_namespace ON function_namespace.oid = procedure.pronamespace\n\t\t\tWHERE namespace.nspname = current_schema()\n\t\t\t\tAND function_namespace.nspname = current_schema()\n\t\t\t\tAND relation.relname = ${identifiers.tableName}\n\t\t\t\tAND NOT trigger.tgisinternal\n\t\t\t\tAND trigger.tgconstraint = 0\n\t\t\t\tAND NOT trigger.tgdeferrable\n\t\t\t\tAND NOT trigger.tginitdeferred\n\t\t\t\tAND trigger.tgattr = ''::int2vector\n\t\t\t\tAND left(trigger.tgname, 10) = ${OWNED_TRIGGER_PREFIX}\n\t\t`.execute(db);\n\t\tconst expectedArguments = triggerArgumentsHex(identity);\n\t\treturn captureOperations.every((operation) => {\n\t\t\tconst row = result.rows.find(\n\t\t\t\t(candidate) => candidate.name === identifiers.triggerNames[operation],\n\t\t\t);\n\t\t\treturn (\n\t\t\t\trow?.function_name === POSTGRES_TRIGGER_FUNCTION &&\n\t\t\t\tNumber(row.trigger_type) === postgresTriggerType(operation) &&\n\t\t\t\trow.arguments_hex === expectedArguments &&\n\t\t\t\trow.enabled === \"O\" &&\n\t\t\t\trow.has_when === false\n\t\t\t);\n\t\t});\n\t}\n\n\tconst result = await sql<{ name: string; definition: string }>`\n\t\tSELECT name, sql AS definition\n\t\tFROM sqlite_master\n\t\tWHERE type = 'trigger'\n\t\t\tAND tbl_name = ${identifiers.tableName}\n\t\t\tAND substr(name, 1, 10) = ${OWNED_TRIGGER_PREFIX}\n\t`.execute(db);\n\treturn captureOperations.every((operation) => {\n\t\tconst row = result.rows.find(\n\t\t\t(candidate) => candidate.name === identifiers.triggerNames[operation],\n\t\t);\n\t\tconst contentId = operation === \"delete\" ? sql`OLD.id` : sql`NEW.id`;\n\t\tconst expected = sqliteTriggerSql(\n\t\t\tidentifiers.tableName,\n\t\t\tidentifiers.triggerNames[operation],\n\t\t\toperationSql(operation),\n\t\t\tcontentId,\n\t\t\tidentity,\n\t\t).compile(db).sql;\n\t\treturn row ? normalizeDdl(row.definition) === normalizeDdl(expected) : false;\n\t});\n}\n\nfunction triggerArgumentsHex(identity: MediaUsageCaptureIdentity): string {\n\tconst bytes = new TextEncoder().encode(`${identity.collectionId}\\0${identity.collectionSlug}\\0`);\n\treturn Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction postgresTriggerType(operation: CaptureOperation): number {\n\tswitch (operation) {\n\t\tcase \"insert\":\n\t\t\treturn 5;\n\t\tcase \"update\":\n\t\t\treturn 17;\n\t\tcase \"delete\":\n\t\t\treturn 9;\n\t}\n}\n\nfunction normalizeDdl(definition: string): string {\n\treturn definition.replace(WHITESPACE_PATTERN, \" \").trim().replace(TRAILING_SEMICOLON_PATTERN, \"\");\n}\n\nasync function assertCaptureLifecycle(\n\tdb: Kysely<Database>,\n\tidentity: MediaUsageCaptureIdentity,\n\tallowedStates: readonly string[],\n): Promise<void> {\n\tconst lifecycle = await db\n\t\t.selectFrom(\"_emdash_media_usage_index_status\")\n\t\t.select(\"capture_state\")\n\t\t.where(\"adapter_id\", \"=\", \"content-media\")\n\t\t.where(\"scope_type\", \"=\", \"collection\")\n\t\t.where(\"scope_key\", \"=\", identity.collectionSlug)\n\t\t.where(\"collection_id\", \"=\", identity.collectionId)\n\t\t.executeTakeFirst();\n\tif (!lifecycle?.capture_state || !allowedStates.includes(lifecycle.capture_state)) {\n\t\tthrow new Error(\"Media usage capture trigger changes require a fenced collection lifecycle\");\n\t}\n}\n\nasync function assertExpectedTriggerSet(\n\tdb: Kysely<Database>,\n\tidentifiers: {\n\t\ttableName: string;\n\t\ttriggerNames: Record<CaptureOperation, string>;\n\t},\n\tidentity: MediaUsageCaptureIdentity,\n): Promise<void> {\n\tconst actual = await listOwnedCaptureTriggers(\n\t\tdb,\n\t\tidentifiers.tableName,\n\t\tMAX_OWNED_CAPTURE_TRIGGERS + 1,\n\t);\n\tif (!(await hasExactCaptureTriggers(db, identifiers, identity, actual))) {\n\t\tthrow new Error(\"Media usage capture trigger installation is incomplete\");\n\t}\n}\n\nasync function installPostgresFunction(db: Kysely<Database>): Promise<void> {\n\tawait sql`\n\t\tCREATE OR REPLACE FUNCTION ${sql.ref(POSTGRES_TRIGGER_FUNCTION)}()\n\t\tRETURNS trigger\n\t\tLANGUAGE plpgsql\n\t\tAS $function$\n\t\tDECLARE\n\t\t\tv_collection_id text := TG_ARGV[0];\n\t\t\tv_collection_slug text := TG_ARGV[1];\n\t\t\tv_content_id text;\n\t\t\tv_epoch bigint;\n\t\t\tv_now text := to_char(\n\t\t\t\tclock_timestamp() AT TIME ZONE 'UTC',\n\t\t\t\t'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'\n\t\t\t);\n\t\tBEGIN\n\t\t\tIF TG_OP = 'DELETE' THEN\n\t\t\t\tv_content_id := OLD.id;\n\t\t\tELSE\n\t\t\t\tv_content_id := NEW.id;\n\t\t\tEND IF;\n\n\t\t\tUPDATE _emdash_media_usage_index_status\n\t\t\tSET change_epoch = change_epoch + 1,\n\t\t\t\tstatus = CASE WHEN status = 'complete' THEN 'stale' ELSE status END,\n\t\t\t\tcompleted_at = CASE WHEN status = 'complete' THEN NULL ELSE completed_at END,\n\t\t\t\tupdated_at = v_now\n\t\t\tWHERE adapter_id = 'content-media'\n\t\t\t\tAND scope_type = 'collection'\n\t\t\t\tAND scope_key = v_collection_slug\n\t\t\t\tAND collection_id = v_collection_id\n\t\t\t\tAND capture_state = 'active'\n\t\t\t\tAND EXISTS (\n\t\t\t\t\tSELECT 1\n\t\t\t\t\tFROM _emdash_collections AS collection\n\t\t\t\t\tWHERE collection.id = v_collection_id\n\t\t\t\t\t\tAND collection.slug = v_collection_slug\n\t\t\t\t)\n\t\t\tRETURNING change_epoch INTO v_epoch;\n\n\t\t\tIF NOT FOUND THEN\n\t\t\t\tRAISE EXCEPTION USING\n\t\t\t\t\tERRCODE = 'P0001',\n\t\t\t\t\tMESSAGE = 'media usage capture inactive';\n\t\t\tEND IF;\n\n\t\t\tINSERT INTO _emdash_media_usage_work (\n\t\t\t\tcollection_id,\n\t\t\t\tcollection_slug,\n\t\t\t\tcontent_id,\n\t\t\t\tchange_epoch,\n\t\t\t\twork_version,\n\t\t\t\tstate,\n\t\t\t\tattempt_count,\n\t\t\t\tnext_attempt_at,\n\t\t\t\tlease_token,\n\t\t\t\tlease_expires_at,\n\t\t\t\tlast_attempted_at,\n\t\t\t\tlast_error_code,\n\t\t\t\tcreated_at,\n\t\t\t\tupdated_at\n\t\t\t)\n\t\t\tVALUES (\n\t\t\t\tv_collection_id,\n\t\t\t\tv_collection_slug,\n\t\t\t\tv_content_id,\n\t\t\t\tv_epoch,\n\t\t\t\t1,\n\t\t\t\t'pending',\n\t\t\t\t0,\n\t\t\t\tv_now,\n\t\t\t\tNULL,\n\t\t\t\tNULL,\n\t\t\t\tNULL,\n\t\t\t\tNULL,\n\t\t\t\tv_now,\n\t\t\t\tv_now\n\t\t\t)\n\t\t\tON CONFLICT (collection_id, content_id) DO UPDATE SET\n\t\t\t\tcollection_slug = EXCLUDED.collection_slug,\n\t\t\t\tchange_epoch = EXCLUDED.change_epoch,\n\t\t\t\twork_version = _emdash_media_usage_work.work_version + 1,\n\t\t\t\tstate = 'pending',\n\t\t\t\tattempt_count = 0,\n\t\t\t\tnext_attempt_at = EXCLUDED.next_attempt_at,\n\t\t\t\tlease_token = NULL,\n\t\t\t\tlease_expires_at = NULL,\n\t\t\t\tlast_attempted_at = NULL,\n\t\t\t\tlast_error_code = NULL,\n\t\t\t\tupdated_at = EXCLUDED.updated_at;\n\n\t\t\tRETURN NULL;\n\t\tEND;\n\t\t$function$\n\t`.execute(db);\n}\n\nasync function postgresCreateTrigger(\n\tdb: Kysely<Database>,\n\ttableName: string,\n\ttriggerName: string,\n\toperation: CaptureOperation,\n\tidentity: MediaUsageCaptureIdentity,\n): Promise<void> {\n\tawait sql`\n\t\tCREATE TRIGGER ${sql.ref(triggerName)}\n\t\tAFTER ${operationSql(operation)} ON ${sql.ref(tableName)}\n\t\tFOR EACH ROW\n\t\tEXECUTE FUNCTION ${sql.ref(POSTGRES_TRIGGER_FUNCTION)}(\n\t\t\t${sql.lit(identity.collectionId)},\n\t\t\t${sql.lit(identity.collectionSlug)}\n\t\t)\n\t`.execute(db);\n}\n\nasync function sqliteCreateTrigger(\n\tdb: Kysely<Database>,\n\ttableName: string,\n\ttriggerName: string,\n\toperation: CaptureOperation,\n\tidentity: MediaUsageCaptureIdentity,\n): Promise<void> {\n\tconst contentId = operation === \"delete\" ? sql`OLD.id` : sql`NEW.id`;\n\tawait sqliteTriggerSql(\n\t\ttableName,\n\t\ttriggerName,\n\t\toperationSql(operation),\n\t\tcontentId,\n\t\tidentity,\n\t).execute(db);\n}\n\nfunction sqliteTriggerSql(\n\ttableName: string,\n\ttriggerName: string,\n\toperation: RawBuilder<unknown>,\n\tcontentId: RawBuilder<unknown>,\n\tidentity: MediaUsageCaptureIdentity,\n): RawBuilder<unknown> {\n\treturn sql`\n\t\tCREATE TRIGGER ${sql.ref(triggerName)}\n\t\tAFTER ${operation} ON ${sql.ref(tableName)}\n\t\tFOR EACH ROW\n\t\tBEGIN\n\t\t\tUPDATE _emdash_media_usage_index_status\n\t\t\tSET change_epoch = change_epoch + 1,\n\t\t\t\tstatus = CASE WHEN status = 'complete' THEN 'stale' ELSE status END,\n\t\t\t\tcompleted_at = CASE WHEN status = 'complete' THEN NULL ELSE completed_at END,\n\t\t\t\tupdated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')\n\t\t\tWHERE adapter_id = 'content-media'\n\t\t\t\tAND scope_type = 'collection'\n\t\t\t\tAND scope_key = ${sql.lit(identity.collectionSlug)}\n\t\t\t\tAND collection_id = ${sql.lit(identity.collectionId)}\n\t\t\t\tAND capture_state = 'active'\n\t\t\t\tAND EXISTS (\n\t\t\t\t\tSELECT 1\n\t\t\t\t\tFROM _emdash_collections AS collection\n\t\t\t\t\tWHERE collection.id = ${sql.lit(identity.collectionId)}\n\t\t\t\t\t\tAND collection.slug = ${sql.lit(identity.collectionSlug)}\n\t\t\t\t);\n\n\t\t\tSELECT CASE\n\t\t\t\tWHEN changes() <> 1 THEN RAISE(ABORT, 'media usage capture inactive')\n\t\t\tEND;\n\n\t\t\tINSERT INTO _emdash_media_usage_work (\n\t\t\t\tcollection_id,\n\t\t\t\tcollection_slug,\n\t\t\t\tcontent_id,\n\t\t\t\tchange_epoch,\n\t\t\t\twork_version,\n\t\t\t\tstate,\n\t\t\t\tattempt_count,\n\t\t\t\tnext_attempt_at,\n\t\t\t\tlease_token,\n\t\t\t\tlease_expires_at,\n\t\t\t\tlast_attempted_at,\n\t\t\t\tlast_error_code,\n\t\t\t\tcreated_at,\n\t\t\t\tupdated_at\n\t\t\t)\n\t\t\tSELECT\n\t\t\t\t${sql.lit(identity.collectionId)},\n\t\t\t\t${sql.lit(identity.collectionSlug)},\n\t\t\t\t${contentId},\n\t\t\t\tchange_epoch,\n\t\t\t\t1,\n\t\t\t\t'pending',\n\t\t\t\t0,\n\t\t\t\tstrftime('%Y-%m-%dT%H:%M:%fZ', 'now'),\n\t\t\t\tNULL,\n\t\t\t\tNULL,\n\t\t\t\tNULL,\n\t\t\t\tNULL,\n\t\t\t\tstrftime('%Y-%m-%dT%H:%M:%fZ', 'now'),\n\t\t\t\tstrftime('%Y-%m-%dT%H:%M:%fZ', 'now')\n\t\t\tFROM _emdash_media_usage_index_status\n\t\t\tWHERE adapter_id = 'content-media'\n\t\t\t\tAND scope_type = 'collection'\n\t\t\t\tAND scope_key = ${sql.lit(identity.collectionSlug)}\n\t\t\t\tAND collection_id = ${sql.lit(identity.collectionId)}\n\t\t\t\tAND capture_state = 'active'\n\t\t\tON CONFLICT (collection_id, content_id) DO UPDATE SET\n\t\t\t\tcollection_slug = excluded.collection_slug,\n\t\t\t\tchange_epoch = excluded.change_epoch,\n\t\t\t\twork_version = _emdash_media_usage_work.work_version + 1,\n\t\t\t\tstate = 'pending',\n\t\t\t\tattempt_count = 0,\n\t\t\t\tnext_attempt_at = excluded.next_attempt_at,\n\t\t\t\tlease_token = NULL,\n\t\t\t\tlease_expires_at = NULL,\n\t\t\t\tlast_attempted_at = NULL,\n\t\t\t\tlast_error_code = NULL,\n\t\t\t\tupdated_at = excluded.updated_at;\n\t\tEND\n\t`;\n}\n\nfunction operationSql(operation: CaptureOperation): RawBuilder<unknown> {\n\tswitch (operation) {\n\t\tcase \"insert\":\n\t\t\treturn sql`INSERT`;\n\t\tcase \"update\":\n\t\t\treturn sql`UPDATE`;\n\t\tcase \"delete\":\n\t\t\treturn sql`DELETE`;\n\t}\n}\n"],"mappings":";;;;;AAMA,MAAM,4BAA4B;AAClC,MAAM,4BAA4B;AAClC,MAAM,0BAA0B;AAChC,MAAM,uBAAuB;AAC7B,MAAM,6BAA6B;AACnC,MAAM,qBAAqB;AAC3B,MAAM,6BAA6B;AASnC,eAAsB,iCACrB,IACA,UACA,UAAyC,EAAE,EAC3B;CAChB,MAAM,cAAc,MAAM,mBAAmB,SAAS;AACtD,KAAI,WAAW,GAAG,CAAE,OAAM,wBAAwB,GAAG;CACrD,MAAM,iBAAiB,MAAM,yBAC5B,IACA,YAAY,WACZ,6BAA6B,EAC7B;AACD,KAAI,eAAe,SAAS,2BAC3B,OAAM,IAAI,MAAM,+DAA+D;AAEhF,KAAI,MAAM,wBAAwB,IAAI,aAAa,UAAU,eAAe,CAC3E;AAGD,OAAM,uBAAuB,IAAI,UAAU,CAAC,aAAa,CAAC;CAC1D,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO,YAAY,aAAa,CAAC;CACtE,MAAM,gBAAgB,IAAI,IACzB,QAAQ,oBAAoB,QACzB,eAAe,QAAQ,SAAS,cAAc,IAAI,KAAK,CAAC,GACxD,EAAE,CACL;AACD,OAAM,sBACL,IACA,YAAY,WACZ,eAAe,QAAQ,SAAS,CAAC,cAAc,IAAI,KAAK,CAAC,CACzD;AAED,MAAK,MAAM,aAAa,mBAAmB;AAC1C,MAAI,cAAc,IAAI,YAAY,aAAa,WAAW,CAAE;AAC5D,MAAI,WAAW,GAAG,CACjB,OAAM,sBACL,IACA,YAAY,WACZ,YAAY,aAAa,YACzB,WACA,SACA;MAED,OAAM,oBACL,IACA,YAAY,WACZ,YAAY,aAAa,YACzB,WACA,SACA;;AAIH,OAAM,yBAAyB,IAAI,aAAa,SAAS;;AAG1D,eAAsB,gCACrB,IACA,UACmB;CACnB,MAAM,cAAc,MAAM,mBAAmB,SAAS;AACtD,KAAI,CAAE,MAAM,YAAY,IAAI,YAAY,UAAU,CAAG,QAAO;AAC5D,QAAO,wBACN,IACA,aACA,UACA,MAAM,yBAAyB,IAAI,YAAY,WAAW,6BAA6B,EAAE,CACzF;;AAiBF,MAAM,oBAAiD;CAAC;CAAU;CAAU;CAAS;AAErF,eAAe,mBAAmB,UAG/B;AACF,oBAAmB,SAAS,gBAAgB,kBAAkB;CAC9D,MAAM,YAAY,MAAM,SAAS;AACjC,oBAAmB,WAAW,gBAAgB;CAE9C,MAAM,SAAS,MAAM,eACpB,GAAG,wBAAwB,GAAG,SAAS,aAAa,GAAG,SAAS,iBAChE;CACD,MAAM,eAAe;EACpB,QAAQ,aAAa,OAAO;EAC5B,QAAQ,aAAa,OAAO;EAC5B,QAAQ,aAAa,OAAO;EAC5B;AACD,MAAK,MAAM,eAAe,OAAO,OAAO,aAAa,EAAE;AACtD,qBAAmB,aAAa,sBAAsB;AACtD,MAAI,YAAY,SAAS,0BACxB,OAAM,IAAI,MAAM,oCAAoC,0BAA0B,QAAQ;;AAIxF,QAAO;EAAE;EAAW;EAAc;;AAGnC,eAAe,eAAe,OAAgC;CAC7D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC;AACrF,QAAO,MAAM,KAAK,IAAI,WAAW,OAAO,CAAC,MAAM,GAAG,GAAG,GAAG,SACvD,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAClC,CAAC,KAAK,GAAG;;AAGX,eAAe,sBACd,IACA,WACA,cACgB;AAChB,MAAK,MAAM,eAAe,cAAc;AACvC,qBAAmB,aAAa,sBAAsB;AACtD,MAAI,WAAW,GAAG,CACjB,OAAM,GAAG;6BACiB,IAAI,IAAI,YAAY,CAAC,MAAM,IAAI,IAAI,UAAU,CAAC;KACtE,QAAQ,GAAG;MAEb,OAAM,GAAG,0BAA0B,IAAI,IAAI,YAAY,GAAG,QAAQ,GAAG;;;AAKxE,eAAe,yBACd,IACA,WACA,OACoB;CACpB,MAAM,cAAc,UAAU,SAAY,GAAG,KAAK,GAAG,SAAS;AAC9D,KAAI,WAAW,GAAG,CAYjB,SAXe,MAAM,GAAqB;;;;;;6BAMf,UAAU;;qCAEF,qBAAqB;KACrD,YAAY;IACb,QAAQ,GAAG,EACC,KAAK,KAAK,QAAQ,IAAI,KAAK;AAW1C,SARe,MAAM,GAAqB;;;;oBAIvB,UAAU;+BACC,qBAAqB;IAChD,YAAY;GACb,QAAQ,GAAG,EACC,KAAK,KAAK,QAAQ,IAAI,KAAK;;AAG1C,eAAe,wBACd,IACA,aAIA,UACA,gBACmB;CACnB,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO,YAAY,aAAa,CAAC;AACtE,KACC,eAAe,WAAW,cAAc,QACxC,eAAe,MAAM,SAAS,CAAC,cAAc,IAAI,KAAK,CAAC,CAEvD,QAAO;AAGR,KAAI,WAAW,GAAG,EAAE;EACnB,MAAM,SAAS,MAAM,GAOnB;;;;;;;;;;;;;;;6BAeyB,YAAY,UAAU;;;;;;qCAMd,qBAAqB;IACtD,QAAQ,GAAG;EACb,MAAM,oBAAoB,oBAAoB,SAAS;AACvD,SAAO,kBAAkB,OAAO,cAAc;GAC7C,MAAM,MAAM,OAAO,KAAK,MACtB,cAAc,UAAU,SAAS,YAAY,aAAa,WAC3D;AACD,UACC,KAAK,kBAAkB,6BACvB,OAAO,IAAI,aAAa,KAAK,oBAAoB,UAAU,IAC3D,IAAI,kBAAkB,qBACtB,IAAI,YAAY,OAChB,IAAI,aAAa;IAEjB;;CAGH,MAAM,SAAS,MAAM,GAAyC;;;;oBAI3C,YAAY,UAAU;+BACX,qBAAqB;GACjD,QAAQ,GAAG;AACb,QAAO,kBAAkB,OAAO,cAAc;EAC7C,MAAM,MAAM,OAAO,KAAK,MACtB,cAAc,UAAU,SAAS,YAAY,aAAa,WAC3D;EACD,MAAM,YAAY,cAAc,WAAW,GAAG,WAAW,GAAG;EAC5D,MAAM,WAAW,iBAChB,YAAY,WACZ,YAAY,aAAa,YACzB,aAAa,UAAU,EACvB,WACA,SACA,CAAC,QAAQ,GAAG,CAAC;AACd,SAAO,MAAM,aAAa,IAAI,WAAW,KAAK,aAAa,SAAS,GAAG;GACtE;;AAGH,SAAS,oBAAoB,UAA6C;CACzE,MAAM,QAAQ,IAAI,aAAa,CAAC,OAAO,GAAG,SAAS,aAAa,IAAI,SAAS,eAAe,IAAI;AAChG,QAAO,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;AAGhF,SAAS,oBAAoB,WAAqC;AACjE,SAAQ,WAAR;EACC,KAAK,SACJ,QAAO;EACR,KAAK,SACJ,QAAO;EACR,KAAK,SACJ,QAAO;;;AAIV,SAAS,aAAa,YAA4B;AACjD,QAAO,WAAW,QAAQ,oBAAoB,IAAI,CAAC,MAAM,CAAC,QAAQ,4BAA4B,GAAG;;AAGlG,eAAe,uBACd,IACA,UACA,eACgB;CAChB,MAAM,YAAY,MAAM,GACtB,WAAW,mCAAmC,CAC9C,OAAO,gBAAgB,CACvB,MAAM,cAAc,KAAK,gBAAgB,CACzC,MAAM,cAAc,KAAK,aAAa,CACtC,MAAM,aAAa,KAAK,SAAS,eAAe,CAChD,MAAM,iBAAiB,KAAK,SAAS,aAAa,CAClD,kBAAkB;AACpB,KAAI,CAAC,WAAW,iBAAiB,CAAC,cAAc,SAAS,UAAU,cAAc,CAChF,OAAM,IAAI,MAAM,4EAA4E;;AAI9F,eAAe,yBACd,IACA,aAIA,UACgB;AAMhB,KAAI,CAAE,MAAM,wBAAwB,IAAI,aAAa,UALtC,MAAM,yBACpB,IACA,YAAY,WACZ,6BAA6B,EAC7B,CACqE,CACrE,OAAM,IAAI,MAAM,yDAAyD;;AAI3E,eAAe,wBAAwB,IAAqC;AAC3E,OAAM,GAAG;+BACqB,IAAI,IAAI,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4F/D,QAAQ,GAAG;;AAGd,eAAe,sBACd,IACA,WACA,aACA,WACA,UACgB;AAChB,OAAM,GAAG;mBACS,IAAI,IAAI,YAAY,CAAC;UAC9B,aAAa,UAAU,CAAC,MAAM,IAAI,IAAI,UAAU,CAAC;;qBAEtC,IAAI,IAAI,0BAA0B,CAAC;KACnD,IAAI,IAAI,SAAS,aAAa,CAAC;KAC/B,IAAI,IAAI,SAAS,eAAe,CAAC;;GAEnC,QAAQ,GAAG;;AAGd,eAAe,oBACd,IACA,WACA,aACA,WACA,UACgB;CAChB,MAAM,YAAY,cAAc,WAAW,GAAG,WAAW,GAAG;AAC5D,OAAM,iBACL,WACA,aACA,aAAa,UAAU,EACvB,WACA,SACA,CAAC,QAAQ,GAAG;;AAGd,SAAS,iBACR,WACA,aACA,WACA,WACA,UACsB;AACtB,QAAO,GAAG;mBACQ,IAAI,IAAI,YAAY,CAAC;UAC9B,UAAU,MAAM,IAAI,IAAI,UAAU,CAAC;;;;;;;;;;sBAUvB,IAAI,IAAI,SAAS,eAAe,CAAC;0BAC7B,IAAI,IAAI,SAAS,aAAa,CAAC;;;;;6BAK5B,IAAI,IAAI,SAAS,aAAa,CAAC;8BAC9B,IAAI,IAAI,SAAS,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;MAwBzD,IAAI,IAAI,SAAS,aAAa,CAAC;MAC/B,IAAI,IAAI,SAAS,eAAe,CAAC;MACjC,UAAU;;;;;;;;;;;;;;;sBAeM,IAAI,IAAI,SAAS,eAAe,CAAC;0BAC7B,IAAI,IAAI,SAAS,aAAa,CAAC;;;;;;;;;;;;;;;;;AAkBzD,SAAS,aAAa,WAAkD;AACvE,SAAQ,WAAR;EACC,KAAK,SACJ,QAAO,GAAG;EACX,KAAK,SACJ,QAAO,GAAG;EACX,KAAK,SACJ,QAAO,GAAG"}

package/dist/challenge-store-CxZxPqaw.mjs

@@ -0,0 +1,51 @@
+//#region src/auth/challenge-store.ts
+function createChallengeStore(db) {
+	return {
+		async set(challenge, data) {
+			const expiresAt = new Date(data.expiresAt).toISOString();
+			await db.insertInto("auth_challenges").values({
+				challenge,
+				type: data.type,
+				user_id: data.userId ?? null,
+				data: data.context ?? null,
+				expires_at: expiresAt
+			}).onConflict((oc) => oc.column("challenge").doUpdateSet({
+				type: data.type,
+				user_id: data.userId ?? null,
+				data: data.context ?? null,
+				expires_at: expiresAt
+			})).execute();
+		},
+		async get(challenge) {
+			const row = await db.selectFrom("auth_challenges").selectAll().where("challenge", "=", challenge).executeTakeFirst();
+			if (!row) return null;
+			const expiresAt = new Date(row.expires_at).getTime();
+			if (expiresAt < Date.now()) {
+				await this.delete(challenge);
+				return null;
+			}
+			return {
+				type: row.type === "registration" ? "registration" : "authentication",
+				userId: row.user_id ?? void 0,
+				expiresAt,
+				...row.data === null ? {} : { context: row.data }
+			};
+		},
+		async delete(challenge) {
+			await db.deleteFrom("auth_challenges").where("challenge", "=", challenge).execute();
+		}
+	};
+}
+/**
+* Clean up expired challenges.
+* Should be called periodically (e.g., on startup, or via cron).
+*/
+async function cleanupExpiredChallenges(db) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const result = await db.deleteFrom("auth_challenges").where("expires_at", "<", now).executeTakeFirst();
+	return Number(result.numDeletedRows ?? 0);
+}
+
+//#endregion
+export { createChallengeStore as n, cleanupExpiredChallenges as t };
+//# sourceMappingURL=challenge-store-CxZxPqaw.mjs.map

package/dist/challenge-store-CxZxPqaw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-store-CxZxPqaw.mjs","names":[],"sources":["../src/auth/challenge-store.ts"],"sourcesContent":["/**\n * Challenge store for WebAuthn\n *\n * Stores WebAuthn challenges in a dedicated table with automatic expiration.\n */\n\nimport type { ChallengeStore, ChallengeData } from \"@emdash-cms/auth/passkey\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nexport function createChallengeStore(db: Kysely<Database>): ChallengeStore {\n\treturn {\n\t\tasync set(challenge: string, data: ChallengeData): Promise<void> {\n\t\t\tconst expiresAt = new Date(data.expiresAt).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge,\n\t\t\t\t\ttype: data.type,\n\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\tdata: data.context ?? null,\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: data.type,\n\t\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\t\tdata: data.context ?? null,\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(challenge: string): Promise<ChallengeData | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", challenge)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(challenge);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\ttype: row.type === \"registration\" ? \"registration\" : \"authentication\",\n\t\t\t\tuserId: row.user_id ?? undefined,\n\t\t\t\texpiresAt,\n\t\t\t\t...(row.data === null ? {} : { context: row.data }),\n\t\t\t};\n\t\t},\n\n\t\tasync delete(challenge: string): Promise<void> {\n\t\t\tawait db.deleteFrom(\"auth_challenges\").where(\"challenge\", \"=\", challenge).execute();\n\t\t},\n\t};\n}\n\n/**\n * Clean up expired challenges.\n * Should be called periodically (e.g., on startup, or via cron).\n */\nexport async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {\n\tconst now = new Date().toISOString();\n\n\tconst result = await db\n\t\t.deleteFrom(\"auth_challenges\")\n\t\t.where(\"expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows ?? 0);\n}\n"],"mappings":";AAWA,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,IAAI,WAAmB,MAAoC;GAChE,MAAM,YAAY,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa;AAExD,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP;IACA,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM,KAAK,WAAW;IACtB,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM,KAAK,WAAW;IACtB,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,WAAkD;GAC3D,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,UAAU,CAClC,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;GAEjB,MAAM,YAAY,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS;AAGpD,OAAI,YAAY,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;;AAGR,UAAO;IACN,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;IACrD,QAAQ,IAAI,WAAW;IACvB;IACA,GAAI,IAAI,SAAS,OAAO,EAAE,GAAG,EAAE,SAAS,IAAI,MAAM;IAClD;;EAGF,MAAM,OAAO,WAAkC;AAC9C,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,UAAU,CAAC,SAAS;;EAEpF;;;;;;AAOF,eAAsB,yBAAyB,IAAuC;CACrF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,SAAS,MAAM,GACnB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,IAAI,CAC7B,kBAAkB;AAEpB,QAAO,OAAO,OAAO,kBAAkB,EAAE"}

package/dist/checksum-DtH6m5uk.mjs

@@ -0,0 +1,162 @@
+//#region ../registry-verification/dist/auth-B730dpJ4.js
+const UNSUPPORTED_AUTH_MESSAGE = "This release requires an authentication method the client does not support.";
+function unsupportedAuthDetails(auth) {
+	if (!isRecord(auth) || typeof auth.hint_url !== "string" || auth.hint_url.length > 2048) return;
+	try {
+		const url = new URL(auth.hint_url);
+		if (url.protocol !== "https:" || url.username || url.password) return void 0;
+		return { hintUrl: url.href };
+	} catch {
+		return;
+	}
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+//#endregion
+//#region ../registry-verification/dist/errors-D3_zxvwe.js
+function verificationError(code, message, details) {
+	return {
+		success: false,
+		error: {
+			code,
+			message,
+			...details === void 0 ? {} : { details }
+		}
+	};
+}
+
+//#endregion
+//#region ../registry-verification/dist/checksum.js
+const SHA2_256_CODE = 18;
+const SHA2_256_LENGTH = 32;
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+/** Derive the required artifact checksum from a raw sha2-256 blob CID. */
+function multihashFromBlobCid(value) {
+	if (!value.startsWith("b")) return verificationError("BLOB_REF_INVALID", "The blob reference CID is malformed.");
+	const bytes = decodeBase32(value.slice(1));
+	if (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
+	const checksum = `b${encodeBase32(bytes.slice(2))}`;
+	if (!decodeMultihash(checksum).success) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
+	return {
+		success: true,
+		value: checksum
+	};
+}
+/** Decodes a lowercase base32 multibase-encoded multihash. */
+function decodeMultihash(value) {
+	if (!value.startsWith("b")) return verificationError("INVALID_MULTIHASH", "Checksums must be lowercase base32 multibase-encoded multihashes.");
+	const bytes = decodeBase32(value.slice(1));
+	if (bytes === null) return verificationError("INVALID_MULTIHASH", "The multibase checksum is malformed.");
+	const code = readVarint(bytes, 0);
+	if (code === null) return verificationError("INVALID_MULTIHASH", "The multihash algorithm code is malformed.");
+	const length = readVarint(bytes, code.nextOffset);
+	if (length === null || length.value !== bytes.length - length.nextOffset) return verificationError("INVALID_MULTIHASH", "The multihash digest length is malformed.");
+	if (code.value !== SHA2_256_CODE) return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
+	if (length.value !== SHA2_256_LENGTH) return verificationError("INVALID_MULTIHASH", "The sha2-256 digest must be 32 bytes.");
+	return {
+		success: true,
+		value: {
+			algorithm: "sha2-256",
+			digest: bytes.slice(length.nextOffset)
+		}
+	};
+}
+async function computeArtifactDigestCandidates(bytes) {
+	const [sha256, sha384, sha512] = await Promise.all([
+		crypto.subtle.digest("SHA-256", new Uint8Array(bytes)),
+		crypto.subtle.digest("SHA-384", new Uint8Array(bytes)),
+		crypto.subtle.digest("SHA-512", new Uint8Array(bytes))
+	]);
+	return [
+		new Uint8Array(sha256),
+		new Uint8Array(sha384),
+		new Uint8Array(sha512)
+	];
+}
+async function verifyMultihash(bytes, expected) {
+	const decoded = decodeMultihash(expected);
+	if (!decoded.success) return decoded;
+	const actual = await computeDigest(bytes, decoded.value.algorithm);
+	if (!actual.success) return actual;
+	if (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError("CHECKSUM_MISMATCH", "The resource bytes do not match the expected checksum.");
+	return {
+		success: true,
+		value: true
+	};
+}
+/**
+* Compare public checksum digest bytes without early exit. Digests are public
+* integrity metadata, so a portable byte loop is preferable to a Node-only
+* timing primitive while still avoiding an ordinary equality short circuit.
+*/
+function compareDigestBytes(left, right) {
+	let difference = left.length ^ right.length;
+	const maximumLength = Math.max(left.length, right.length);
+	for (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+	return difference === 0;
+}
+async function computeDigest(bytes, algorithm) {
+	if (algorithm !== "sha2-256") return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
+	try {
+		return {
+			success: true,
+			value: new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)))
+		};
+	} catch {
+		return verificationError("UNSUPPORTED_MULTIHASH", "The sha2-256 algorithm is unavailable.");
+	}
+}
+function readVarint(bytes, offset) {
+	let value = 0;
+	let shift = 0;
+	for (let index = offset; index < bytes.length && index < offset + 5; index += 1) {
+		const byte = bytes[index];
+		if (byte === void 0) return null;
+		value |= (byte & 127) << shift;
+		if ((byte & 128) === 0) return {
+			value,
+			nextOffset: index + 1
+		};
+		shift += 7;
+	}
+	return null;
+}
+function encodeBase32(bytes) {
+	let result = "";
+	let buffer = 0;
+	let bits = 0;
+	for (const byte of bytes) {
+		buffer = buffer << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			result += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? "";
+			bits -= 5;
+		}
+	}
+	if (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? "";
+	return result;
+}
+function decodeBase32(value) {
+	if (value.length === 0) return null;
+	let buffer = 0;
+	let bits = 0;
+	const output = [];
+	for (const character of value) {
+		const digit = BASE32_ALPHABET.indexOf(character);
+		if (digit === -1) return null;
+		buffer = buffer << 5 | digit;
+		bits += 5;
+		if (bits >= 8) {
+			output.push(buffer >>> bits - 8 & 255);
+			bits -= 8;
+		}
+	}
+	if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;
+	return new Uint8Array(output);
+}
+
+//#endregion
+export { UNSUPPORTED_AUTH_MESSAGE as a, verificationError as i, multihashFromBlobCid as n, unsupportedAuthDetails as o, verifyMultihash as r, computeArtifactDigestCandidates as t };
+//# sourceMappingURL=checksum-DtH6m5uk.mjs.map

package/dist/checksum-DtH6m5uk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum-DtH6m5uk.mjs","names":[],"sources":["../../registry-verification/dist/auth-B730dpJ4.js","../../registry-verification/dist/errors-D3_zxvwe.js","../../registry-verification/dist/checksum.js"],"sourcesContent":["//#region src/auth.ts\nconst UNSUPPORTED_AUTH_MESSAGE = \"This release requires an authentication method the client does not support.\";\nfunction unsupportedAuthDetails(auth) {\n\tif (!isRecord(auth) || typeof auth.hint_url !== \"string\" || auth.hint_url.length > 2048) return;\n\ttry {\n\t\tconst url = new URL(auth.hint_url);\n\t\tif (url.protocol !== \"https:\" || url.username || url.password) return void 0;\n\t\treturn { hintUrl: url.href };\n\t} catch {\n\t\treturn;\n\t}\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n//#endregion\nexport { unsupportedAuthDetails as n, UNSUPPORTED_AUTH_MESSAGE as t };\n//# sourceMappingURL=auth-B730dpJ4.js.map","//#region src/errors.ts\n/** Stable, machine-readable failures returned by this package. */\nconst VERIFICATION_ERROR_CODES = [\n\t\"AUTH_METHOD_UNSUPPORTED\",\n\t\"BLOB_METADATA_MISMATCH\",\n\t\"BLOB_REF_INVALID\",\n\t\"BUNDLE_COMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_FILE_COUNT_EXCEEDED\",\n\t\"BUNDLE_FILE_SIZE_EXCEEDED\",\n\t\"BUNDLE_ID_MISMATCH\",\n\t\"BUNDLE_INVALID_ARCHIVE\",\n\t\"BUNDLE_INVALID_MANIFEST\",\n\t\"BUNDLE_INVALID_PATH\",\n\t\"BUNDLE_MISSING_BACKEND\",\n\t\"BUNDLE_MISSING_MANIFEST\",\n\t\"BUNDLE_PATH_COLLISION\",\n\t\"BUNDLE_UNSUPPORTED_ENTRY\",\n\t\"BUNDLE_VERSION_MISMATCH\",\n\t\"CHECKSUM_MISMATCH\",\n\t\"FETCH_FAILED\",\n\t\"HOST_REJECTED\",\n\t\"INVALID_MULTIHASH\",\n\t\"INVALID_URL\",\n\t\"PDS_RESOLUTION_FAILED\",\n\t\"PROFILE_EXTENSION_INVALID\",\n\t\"PROFILE_ID_MISMATCH\",\n\t\"PROFILE_LEXICON_INVALID\",\n\t\"PROFILE_POLICY_INVALID\",\n\t\"PROFILE_REPOSITORY_INVALID\",\n\t\"PROVENANCE_REQUIRED\",\n\t\"PROVENANCE_UNVERIFIABLE\",\n\t\"REDIRECT_LIMIT_EXCEEDED\",\n\t\"REDIRECT_LOCATION_MISSING\",\n\t\"RESOURCE_SIZE_EXCEEDED\",\n\t\"RESOURCE_STATUS_ERROR\",\n\t\"RESOURCE_TIMEOUT\",\n\t\"RELEASE_EXTENSION_INVALID\",\n\t\"RELEASE_EXTENSION_MISSING\",\n\t\"RELEASE_ARTIFACT_SOURCE_MISSING\",\n\t\"RELEASE_LEXICON_INVALID\",\n\t\"RELEASE_PACKAGE_MISMATCH\",\n\t\"RELEASE_RKEY_MISMATCH\",\n\t\"RELEASE_VERSION_INVALID\",\n\t\"RELEASE_VERSION_MISMATCH\",\n\t\"UNSUPPORTED_MULTIHASH\"\n];\nfunction verificationError(code, message, details) {\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode,\n\t\t\tmessage,\n\t\t\t...details === void 0 ? {} : { details }\n\t\t}\n\t};\n}\n\n//#endregion\nexport { verificationError as n, VERIFICATION_ERROR_CODES as t };\n//# sourceMappingURL=errors-D3_zxvwe.js.map","import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/checksum.ts\nconst SHA2_256_CODE = 18;\nconst SHA2_256_LENGTH = 32;\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\n/** Derive the required artifact checksum from a raw sha2-256 blob CID. */\nfunction multihashFromBlobCid(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"BLOB_REF_INVALID\", \"The blob reference CID is malformed.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\tconst checksum = `b${encodeBase32(bytes.slice(2))}`;\n\tif (!decodeMultihash(checksum).success) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: checksum\n\t};\n}\n/** Decodes a lowercase base32 multibase-encoded multihash. */\nfunction decodeMultihash(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"INVALID_MULTIHASH\", \"Checksums must be lowercase base32 multibase-encoded multihashes.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null) return verificationError(\"INVALID_MULTIHASH\", \"The multibase checksum is malformed.\");\n\tconst code = readVarint(bytes, 0);\n\tif (code === null) return verificationError(\"INVALID_MULTIHASH\", \"The multihash algorithm code is malformed.\");\n\tconst length = readVarint(bytes, code.nextOffset);\n\tif (length === null || length.value !== bytes.length - length.nextOffset) return verificationError(\"INVALID_MULTIHASH\", \"The multihash digest length is malformed.\");\n\tif (code.value !== SHA2_256_CODE) return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\tif (length.value !== SHA2_256_LENGTH) return verificationError(\"INVALID_MULTIHASH\", \"The sha2-256 digest must be 32 bytes.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\talgorithm: \"sha2-256\",\n\t\t\tdigest: bytes.slice(length.nextOffset)\n\t\t}\n\t};\n}\nasync function computeMultihash(bytes, algorithm = \"sha2-256\") {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\tconst digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)));\n\t\tconst multihash = new Uint8Array(2 + digest.length);\n\t\tmultihash[0] = SHA2_256_CODE;\n\t\tmultihash[1] = digest.length;\n\t\tmultihash.set(digest, 2);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: `b${encodeBase32(multihash)}`\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nasync function computeArtifactDigestCandidates(bytes) {\n\tconst [sha256, sha384, sha512] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-384\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-512\", new Uint8Array(bytes))\n\t]);\n\treturn [\n\t\tnew Uint8Array(sha256),\n\t\tnew Uint8Array(sha384),\n\t\tnew Uint8Array(sha512)\n\t];\n}\nasync function verifyMultihash(bytes, expected) {\n\tconst decoded = decodeMultihash(expected);\n\tif (!decoded.success) return decoded;\n\tconst actual = await computeDigest(bytes, decoded.value.algorithm);\n\tif (!actual.success) return actual;\n\tif (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError(\"CHECKSUM_MISMATCH\", \"The resource bytes do not match the expected checksum.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: true\n\t};\n}\n/**\n* Compare public checksum digest bytes without early exit. Digests are public\n* integrity metadata, so a portable byte loop is preferable to a Node-only\n* timing primitive while still avoiding an ordinary equality short circuit.\n*/\nfunction compareDigestBytes(left, right) {\n\tlet difference = left.length ^ right.length;\n\tconst maximumLength = Math.max(left.length, right.length);\n\tfor (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);\n\treturn difference === 0;\n}\nasync function computeDigest(bytes, algorithm) {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)))\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nfunction readVarint(bytes, offset) {\n\tlet value = 0;\n\tlet shift = 0;\n\tfor (let index = offset; index < bytes.length && index < offset + 5; index += 1) {\n\t\tconst byte = bytes[index];\n\t\tif (byte === void 0) return null;\n\t\tvalue |= (byte & 127) << shift;\n\t\tif ((byte & 128) === 0) return {\n\t\t\tvalue,\n\t\t\tnextOffset: index + 1\n\t\t};\n\t\tshift += 7;\n\t}\n\treturn null;\n}\nfunction encodeBase32(bytes) {\n\tlet result = \"\";\n\tlet buffer = 0;\n\tlet bits = 0;\n\tfor (const byte of bytes) {\n\t\tbuffer = buffer << 8 | byte;\n\t\tbits += 8;\n\t\twhile (bits >= 5) {\n\t\t\tresult += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? \"\";\n\t\t\tbits -= 5;\n\t\t}\n\t}\n\tif (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? \"\";\n\treturn result;\n}\nfunction decodeBase32(value) {\n\tif (value.length === 0) return null;\n\tlet buffer = 0;\n\tlet bits = 0;\n\tconst output = [];\n\tfor (const character of value) {\n\t\tconst digit = BASE32_ALPHABET.indexOf(character);\n\t\tif (digit === -1) return null;\n\t\tbuffer = buffer << 5 | digit;\n\t\tbits += 5;\n\t\tif (bits >= 8) {\n\t\t\toutput.push(buffer >>> bits - 8 & 255);\n\t\t\tbits -= 8;\n\t\t}\n\t}\n\tif (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;\n\treturn new Uint8Array(output);\n}\n\n//#endregion\nexport { compareDigestBytes, computeArtifactDigestCandidates, computeMultihash, decodeMultihash, multihashFromBlobCid, verifyMultihash };\n//# sourceMappingURL=checksum.js.map"],"mappings":";AACA,MAAM,2BAA2B;AACjC,SAAS,uBAAuB,MAAM;AACrC,KAAI,CAAC,SAAS,KAAK,IAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAM;AACzF,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,KAAK,SAAS;AAClC,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,SAAU,QAAO,KAAK;AAC3E,SAAO,EAAE,SAAS,IAAI,MAAM;SACrB;AACP;;;AAGF,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;;;;ACkC5E,SAAS,kBAAkB,MAAM,SAAS,SAAS;AAClD,QAAO;EACN,SAAS;EACT,OAAO;GACN;GACA;GACA,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;GACxC;EACD;;;;;ACpDF,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;;AAExB,SAAS,qBAAqB,OAAO;AACpC,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,oBAAoB,uCAAuC;CAChH,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,QAAQ,MAAM,WAAW,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,GAAI,QAAO,kBAAkB,oBAAoB,qDAAqD;CAClL,MAAM,WAAW,IAAI,aAAa,MAAM,MAAM,EAAE,CAAC;AACjD,KAAI,CAAC,gBAAgB,SAAS,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,qDAAqD;AAC1I,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;AAGF,SAAS,gBAAgB,OAAO;AAC/B,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,qBAAqB,oEAAoE;CAC9I,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,KAAM,QAAO,kBAAkB,qBAAqB,uCAAuC;CACzG,MAAM,OAAO,WAAW,OAAO,EAAE;AACjC,KAAI,SAAS,KAAM,QAAO,kBAAkB,qBAAqB,6CAA6C;CAC9G,MAAM,SAAS,WAAW,OAAO,KAAK,WAAW;AACjD,KAAI,WAAW,QAAQ,OAAO,UAAU,MAAM,SAAS,OAAO,WAAY,QAAO,kBAAkB,qBAAqB,4CAA4C;AACpK,KAAI,KAAK,UAAU,cAAe,QAAO,kBAAkB,yBAAyB,4CAA4C;AAChI,KAAI,OAAO,UAAU,gBAAiB,QAAO,kBAAkB,qBAAqB,wCAAwC;AAC5H,QAAO;EACN,SAAS;EACT,OAAO;GACN,WAAW;GACX,QAAQ,MAAM,MAAM,OAAO,WAAW;GACtC;EACD;;AAkBF,eAAe,gCAAgC,OAAO;CACrD,MAAM,CAAC,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI;EAClD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,CAAC;AACF,QAAO;EACN,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB;;AAEF,eAAe,gBAAgB,OAAO,UAAU;CAC/C,MAAM,UAAU,gBAAgB,SAAS;AACzC,KAAI,CAAC,QAAQ,QAAS,QAAO;CAC7B,MAAM,SAAS,MAAM,cAAc,OAAO,QAAQ,MAAM,UAAU;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,KAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,MAAM,OAAO,CAAE,QAAO,kBAAkB,qBAAqB,yDAAyD;AACpK,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;;;;;AAOF,SAAS,mBAAmB,MAAM,OAAO;CACxC,IAAI,aAAa,KAAK,SAAS,MAAM;CACrC,MAAM,gBAAgB,KAAK,IAAI,KAAK,QAAQ,MAAM,OAAO;AACzD,MAAK,IAAI,QAAQ,GAAG,QAAQ,eAAe,SAAS,EAAG,gBAAe,KAAK,UAAU,MAAM,MAAM,UAAU;AAC3G,QAAO,eAAe;;AAEvB,eAAe,cAAc,OAAO,WAAW;AAC9C,KAAI,cAAc,WAAY,QAAO,kBAAkB,yBAAyB,4CAA4C;AAC5H,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC,CAAC;GACnF;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,WAAW,OAAO,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;AACZ,MAAK,IAAI,QAAQ,QAAQ,QAAQ,MAAM,UAAU,QAAQ,SAAS,GAAG,SAAS,GAAG;EAChF,MAAM,OAAO,MAAM;AACnB,MAAI,SAAS,KAAK,EAAG,QAAO;AAC5B,YAAU,OAAO,QAAQ;AACzB,OAAK,OAAO,SAAS,EAAG,QAAO;GAC9B;GACA,YAAY,QAAQ;GACpB;AACD,WAAS;;AAEV,QAAO;;AAER,SAAS,aAAa,OAAO;CAC5B,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI,OAAO;AACX,MAAK,MAAM,QAAQ,OAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,SAAO,QAAQ,GAAG;AACjB,aAAU,gBAAgB,WAAW,OAAO,IAAI,OAAO;AACvD,WAAQ;;;AAGV,KAAI,OAAO,EAAG,WAAU,gBAAgB,UAAU,IAAI,OAAO,OAAO;AACpE,QAAO;;AAER,SAAS,aAAa,OAAO;AAC5B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,IAAI,SAAS;CACb,IAAI,OAAO;CACX,MAAM,SAAS,EAAE;AACjB,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,QAAQ,gBAAgB,QAAQ,UAAU;AAChD,MAAI,UAAU,GAAI,QAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,MAAI,QAAQ,GAAG;AACd,UAAO,KAAK,WAAW,OAAO,IAAI,IAAI;AACtC,WAAQ;;;AAGV,KAAI,OAAO,MAAM,UAAU,KAAK,QAAQ,OAAO,EAAG,QAAO;AACzD,QAAO,IAAI,WAAW,OAAO"}