emdash 1.0.1 → 1.1.0

package/dist/single-flight-cache-D0EaGbN1.mjs

@@ -0,0 +1,104 @@
+import { n as initWithLock, t as createInitLock } from "./init-lock-BGmew3r1.mjs";
+
+//#region src/utils/single-flight-cache.ts
+/**
+* Global-scope async value cache with single-flight and poison-immunity.
+*
+* Built for the "compute once for the lifetime of the JS global scope, read
+* on every request" caches (site settings, search-health verification, ...).
+* That global scope is the process on Node and the isolate on Cloudflare
+* Workers — this helper is platform-neutral; the hazard it defends against is
+* specific to workerd but the cache itself is not.
+*
+* These caches must coalesce concurrent cold reads into one query — but the
+* obvious way to do that, caching the in-flight *promise* on a global and
+* awaiting it from later requests, is unsafe on workerd: if the request that
+* created the promise is cancelled mid-await (client disconnect, context
+* teardown), its continuation never runs, so the promise neither resolves nor
+* rejects. Every later request that awaits that shared promise then hangs
+* until the isolate is evicted (observed as 524s at the 100s wall, near-zero
+* CPU). A `.catch`/`.finally` that clears the cache doesn't help — a cancelled
+* request settles neither way.
+*
+* This cache stores the resolved *value* (not a promise) and coalesces via
+* `initWithLock`: one request becomes the owner and runs `fetch`, everyone
+* else polls for the published value and never awaits the owner's promise.
+* A cancelled owner can therefore never strand a waiter — the worst case is
+* the lock looks held until `deadlineMs`, then the next caller reclaims. The
+* owner's `fetch` is also anchored (waitUntil) so a cancelled originator's
+* query still completes and populates the cache, and bounded by
+* `ownerTimeoutMs` so a genuinely stuck fetch reclaims instead of hanging.
+*
+* Invalidation bumps `version`; reads compare against the version captured at
+* call time and refetch on mismatch.
+*/
+function createSingleFlightCache() {
+	return {
+		value: null,
+		hasValue: false,
+		version: 0,
+		valueVersion: -1,
+		lock: createInitLock()
+	};
+}
+/**
+* Force the next `singleFlightCached` call to refetch. An in-flight owner
+* fetched at the old version will not publish into the new version, so its
+* result is ignored by subsequent reads.
+*/
+function invalidateSingleFlightCache(cache) {
+	cache.version++;
+	cache.hasValue = false;
+	cache.value = null;
+	cache.valueVersion = -1;
+	cache.lock.ownerStartedAt = null;
+}
+/**
+* Headroom between the owner's own timeout and the waiter reclaim deadline.
+* The reclaim deadline must sit *above* `ownerTimeoutMs` so a slow-but-live
+* owner times out (and releases the lock) before a waiter would reclaim it —
+* otherwise a fetch slower than the deadline is superseded before it can
+* publish, and steady traffic turns that into a self-sustaining stampede.
+*/
+const RECLAIM_HEADROOM_MS = 5e3;
+function withTimeout(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`singleFlightCached: owner fetch exceeded ${ms}ms`));
+		}, ms);
+		promise.then(resolve, reject).finally(() => {
+			clearTimeout(timer);
+		});
+	});
+}
+/**
+* Return the cached value for `cache`, computing it via `fetch` under a
+* single-flight lock on a miss. Concurrent callers coalesce onto one fetch;
+* a cancelled owner cannot poison later callers (see file header).
+*/
+function singleFlightCached(cache, fetch, options = {}) {
+	const versionAtCall = cache.version;
+	const ownerTimeoutMs = options.ownerTimeoutMs !== void 0 && Number.isFinite(options.ownerTimeoutMs) && options.ownerTimeoutMs > 0 ? options.ownerTimeoutMs : void 0;
+	const deadlineMs = ownerTimeoutMs === void 0 ? options.deadlineMs : Math.max(options.deadlineMs ?? 0, ownerTimeoutMs + RECLAIM_HEADROOM_MS);
+	return initWithLock(cache.lock, () => cache.hasValue && cache.valueVersion === versionAtCall ? { v: cache.value } : null, (isCurrentClaim) => {
+		const real = (async () => {
+			const value = await fetch();
+			if (isCurrentClaim()) {
+				cache.value = value;
+				cache.hasValue = true;
+				cache.valueVersion = versionAtCall;
+			}
+			return { v: value };
+		})();
+		options.anchor?.(real.then(() => void 0, () => void 0));
+		return ownerTimeoutMs === void 0 ? real : withTimeout(real, ownerTimeoutMs);
+	}, {
+		deadlineMs,
+		pollMs: options.pollMs,
+		maxWaitMs: options.maxWaitMs
+	}).then((box) => box.v);
+}
+
+//#endregion
+export { invalidateSingleFlightCache as n, singleFlightCached as r, createSingleFlightCache as t };
+//# sourceMappingURL=single-flight-cache-D0EaGbN1.mjs.map

package/dist/single-flight-cache-D0EaGbN1.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-flight-cache-D0EaGbN1.mjs","names":[],"sources":["../src/utils/single-flight-cache.ts"],"sourcesContent":["/**\n * Global-scope async value cache with single-flight and poison-immunity.\n *\n * Built for the \"compute once for the lifetime of the JS global scope, read\n * on every request\" caches (site settings, search-health verification, ...).\n * That global scope is the process on Node and the isolate on Cloudflare\n * Workers — this helper is platform-neutral; the hazard it defends against is\n * specific to workerd but the cache itself is not.\n *\n * These caches must coalesce concurrent cold reads into one query — but the\n * obvious way to do that, caching the in-flight *promise* on a global and\n * awaiting it from later requests, is unsafe on workerd: if the request that\n * created the promise is cancelled mid-await (client disconnect, context\n * teardown), its continuation never runs, so the promise neither resolves nor\n * rejects. Every later request that awaits that shared promise then hangs\n * until the isolate is evicted (observed as 524s at the 100s wall, near-zero\n * CPU). A `.catch`/`.finally` that clears the cache doesn't help — a cancelled\n * request settles neither way.\n *\n * This cache stores the resolved *value* (not a promise) and coalesces via\n * `initWithLock`: one request becomes the owner and runs `fetch`, everyone\n * else polls for the published value and never awaits the owner's promise.\n * A cancelled owner can therefore never strand a waiter — the worst case is\n * the lock looks held until `deadlineMs`, then the next caller reclaims. The\n * owner's `fetch` is also anchored (waitUntil) so a cancelled originator's\n * query still completes and populates the cache, and bounded by\n * `ownerTimeoutMs` so a genuinely stuck fetch reclaims instead of hanging.\n *\n * Invalidation bumps `version`; reads compare against the version captured at\n * call time and refetch on mismatch.\n */\n\nimport { createInitLock, type InitLock, initWithLock } from \"./init-lock.js\";\n\nexport interface SingleFlightCache<T> {\n\t/** Last resolved value, valid only when `hasValue` is true. */\n\tvalue: T | null;\n\t/**\n\t * Presence flag, separate from `value` so that falsy/`undefined`/`void`\n\t * results cache correctly (a plain null check can't distinguish \"cached\n\t * undefined\" from \"never fetched\").\n\t */\n\thasValue: boolean;\n\t/** Invalidation counter; bumped by `invalidateSingleFlightCache`. */\n\tversion: number;\n\t/** The `version` the cached value was fetched at. */\n\tvalueVersion: number;\n\t/** Reclaimable single-flight lock (see init-lock.ts). */\n\tlock: InitLock;\n}\n\nexport function createSingleFlightCache<T>(): SingleFlightCache<T> {\n\treturn { value: null, hasValue: false, version: 0, valueVersion: -1, lock: createInitLock() };\n}\n\n/**\n * Force the next `singleFlightCached` call to refetch. An in-flight owner\n * fetched at the old version will not publish into the new version, so its\n * result is ignored by subsequent reads.\n */\nexport function invalidateSingleFlightCache(cache: SingleFlightCache<unknown>): void {\n\tcache.version++;\n\tcache.hasValue = false;\n\tcache.value = null;\n\tcache.valueVersion = -1;\n\t// Free the single-flight lock so a reader at the new version starts the\n\t// refetch immediately instead of waiting out a stale owner's deadline. A\n\t// still-running old-version owner can neither publish into the new version\n\t// (version gate) nor clobber a new owner (claim gate), so releasing here\n\t// is safe; the worst case is one brief duplicate fetch.\n\tcache.lock.ownerStartedAt = null;\n}\n\n/**\n * Headroom between the owner's own timeout and the waiter reclaim deadline.\n * The reclaim deadline must sit *above* `ownerTimeoutMs` so a slow-but-live\n * owner times out (and releases the lock) before a waiter would reclaim it —\n * otherwise a fetch slower than the deadline is superseded before it can\n * publish, and steady traffic turns that into a self-sustaining stampede.\n */\nconst RECLAIM_HEADROOM_MS = 5_000;\n\nexport interface SingleFlightCachedOptions {\n\t/**\n\t * Hand the in-flight fetch to the host's lifetime extender (waitUntil via\n\t * `after()`), so a cancelled originating request still drives it to\n\t * completion and populates the cache.\n\t */\n\tanchor?: (promise: Promise<void>) => void;\n\t/** Reclaim the single-flight lock if the owner holds it past this. */\n\tdeadlineMs?: number;\n\t/** Waiter poll interval. */\n\tpollMs?: number;\n\t/** Waiter gives up and throws after this long rather than hanging. */\n\tmaxWaitMs?: number;\n\t/**\n\t * Bound the owner's own `fetch`: if it doesn't settle within this, the\n\t * owner rejects (and releases the lock) instead of waiting indefinitely.\n\t * The anchored copy keeps running, so a slow-but-live fetch can still\n\t * publish for a later caller. Omit to leave the owner unbounded.\n\t */\n\townerTimeoutMs?: number;\n}\n\n/** Boxed cache hit so a `void`/falsy value is still distinguishable from a miss. */\ninterface Box<T> {\n\tv: T;\n}\n\nfunction withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {\n\treturn new Promise<T>((resolve, reject) => {\n\t\tconst timer = setTimeout(() => {\n\t\t\treject(new Error(`singleFlightCached: owner fetch exceeded ${ms}ms`));\n\t\t}, ms);\n\t\t// Settle from the underlying promise (whichever wins the race with the\n\t\t// timer), and always clear the timer so a resolved fetch doesn't leave\n\t\t// a pending timeout holding the isolate alive.\n\t\tpromise.then(resolve, reject).finally(() => {\n\t\t\tclearTimeout(timer);\n\t\t});\n\t});\n}\n\n/**\n * Return the cached value for `cache`, computing it via `fetch` under a\n * single-flight lock on a miss. Concurrent callers coalesce onto one fetch;\n * a cancelled owner cannot poison later callers (see file header).\n */\nexport function singleFlightCached<T>(\n\tcache: SingleFlightCache<T>,\n\tfetch: () => Promise<T>,\n\toptions: SingleFlightCachedOptions = {},\n): Promise<T> {\n\t// Capture the version once: a value published at this version satisfies\n\t// this call; an invalidation that lands mid-fetch makes the published\n\t// value stale for *later* calls (which captured the newer version) but\n\t// still valid for this one.\n\tconst versionAtCall = cache.version;\n\n\t// Ignore a non-positive / non-finite owner timeout rather than letting it\n\t// degenerate into an instant-reject (setTimeout coerces NaN/0 to ~0ms).\n\tconst ownerTimeoutMs =\n\t\toptions.ownerTimeoutMs !== undefined &&\n\t\tNumber.isFinite(options.ownerTimeoutMs) &&\n\t\toptions.ownerTimeoutMs > 0\n\t\t\t? options.ownerTimeoutMs\n\t\t\t: undefined;\n\n\t// Keep the reclaim deadline above the owner timeout (see RECLAIM_HEADROOM_MS):\n\t// the owner's own timeout, not a waiter reclaim, is the primary release.\n\tconst deadlineMs =\n\t\townerTimeoutMs === undefined\n\t\t\t? options.deadlineMs\n\t\t\t: Math.max(options.deadlineMs ?? 0, ownerTimeoutMs + RECLAIM_HEADROOM_MS);\n\n\treturn initWithLock<Box<T>>(\n\t\tcache.lock,\n\t\t() =>\n\t\t\tcache.hasValue && cache.valueVersion === versionAtCall\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- hasValue gates that `value` holds a real T\n\t\t\t\t\t({ v: cache.value as T } satisfies Box<T>)\n\t\t\t\t: null,\n\t\t(isCurrentClaim) => {\n\t\t\t// The real work, anchored independently so a cancelled owner's\n\t\t\t// fetch still settles and publishes. Publication is gated on the\n\t\t\t// claim so a reclaimed slow owner can't clobber the reclaimer's\n\t\t\t// value (same contract as initWithLock's own callers).\n\t\t\tconst real = (async (): Promise<Box<T>> => {\n\t\t\t\tconst value = await fetch();\n\t\t\t\tif (isCurrentClaim()) {\n\t\t\t\t\tcache.value = value;\n\t\t\t\t\tcache.hasValue = true;\n\t\t\t\t\tcache.valueVersion = versionAtCall;\n\t\t\t\t}\n\t\t\t\treturn { v: value };\n\t\t\t})();\n\t\t\t// Anchor the real fetch (not the timeout race): this is what must\n\t\t\t// survive a cancelled owner and run to publication. initWithLock is\n\t\t\t// left to manage only the lock; we don't double-anchor.\n\t\t\toptions.anchor?.(\n\t\t\t\treal.then(\n\t\t\t\t\t() => undefined,\n\t\t\t\t\t() => undefined,\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn ownerTimeoutMs === undefined ? real : withTimeout(real, ownerTimeoutMs);\n\t\t},\n\t\t{\n\t\t\tdeadlineMs,\n\t\t\tpollMs: options.pollMs,\n\t\t\tmaxWaitMs: options.maxWaitMs,\n\t\t},\n\t).then((box) => box.v);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,0BAAmD;AAClE,QAAO;EAAE,OAAO;EAAM,UAAU;EAAO,SAAS;EAAG,cAAc;EAAI,MAAM,gBAAgB;EAAE;;;;;;;AAQ9F,SAAgB,4BAA4B,OAAyC;AACpF,OAAM;AACN,OAAM,WAAW;AACjB,OAAM,QAAQ;AACd,OAAM,eAAe;AAMrB,OAAM,KAAK,iBAAiB;;;;;;;;;AAU7B,MAAM,sBAAsB;AA6B5B,SAAS,YAAe,SAAqB,IAAwB;AACpE,QAAO,IAAI,SAAY,SAAS,WAAW;EAC1C,MAAM,QAAQ,iBAAiB;AAC9B,0BAAO,IAAI,MAAM,4CAA4C,GAAG,IAAI,CAAC;KACnE,GAAG;AAIN,UAAQ,KAAK,SAAS,OAAO,CAAC,cAAc;AAC3C,gBAAa,MAAM;IAClB;GACD;;;;;;;AAQH,SAAgB,mBACf,OACA,OACA,UAAqC,EAAE,EAC1B;CAKb,MAAM,gBAAgB,MAAM;CAI5B,MAAM,iBACL,QAAQ,mBAAmB,UAC3B,OAAO,SAAS,QAAQ,eAAe,IACvC,QAAQ,iBAAiB,IACtB,QAAQ,iBACR;CAIJ,MAAM,aACL,mBAAmB,SAChB,QAAQ,aACR,KAAK,IAAI,QAAQ,cAAc,GAAG,iBAAiB,oBAAoB;AAE3E,QAAO,aACN,MAAM,YAEL,MAAM,YAAY,MAAM,iBAAiB,gBAEtC,EAAE,GAAG,MAAM,OAAY,GACvB,OACH,mBAAmB;EAKnB,MAAM,QAAQ,YAA6B;GAC1C,MAAM,QAAQ,MAAM,OAAO;AAC3B,OAAI,gBAAgB,EAAE;AACrB,UAAM,QAAQ;AACd,UAAM,WAAW;AACjB,UAAM,eAAe;;AAEtB,UAAO,EAAE,GAAG,OAAO;MAChB;AAIJ,UAAQ,SACP,KAAK,WACE,cACA,OACN,CACD;AACD,SAAO,mBAAmB,SAAY,OAAO,YAAY,MAAM,eAAe;IAE/E;EACC;EACA,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,CACD,CAAC,MAAM,QAAQ,IAAI,EAAE"}

package/dist/site-settings-KJOqJW6W.mjs

@@ -0,0 +1,50 @@
+import { i as settingMediaIds } from "./settings-WHr45II1.mjs";
+
+//#region src/media/usage/site-settings.ts
+/**
+* Media references held by site settings.
+*
+* Usage reads parse these from the stored `site:*` options on every read, so
+* a change through any writer of those options shows up on the next read.
+*/
+const MEDIA_USAGE_SITE_SETTINGS = [
+	"logo",
+	"favicon",
+	"seo.defaultOgImage"
+];
+/**
+* One setting per option, which holds while each option has a single path in
+* `SETTING_MEDIA_REFERENCE_PATHS`. A second path needs a setting of its own.
+*/
+const SITE_SETTING_OPTIONS = [
+	["site:logo", "logo"],
+	["site:favicon", "favicon"],
+	["site:seo", "seo.defaultOgImage"]
+];
+const MEDIA_USAGE_SITE_SETTING_OPTIONS = SITE_SETTING_OPTIONS.map(([option]) => option);
+/**
+* Group the site settings that select each media item, in settings order.
+*
+* @param options Raw JSON option values keyed by option name.
+*/
+function groupSiteSettingMediaUsage(options) {
+	const usage = /* @__PURE__ */ new Map();
+	for (const [option, setting] of SITE_SETTING_OPTIONS) for (const mediaId of settingMediaIds(option, parseOption(options.get(option)))) {
+		const settings = usage.get(mediaId);
+		if (settings) settings.push(setting);
+		else usage.set(mediaId, [setting]);
+	}
+	return usage;
+}
+function parseOption(value) {
+	if (value == null) return void 0;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+export { MEDIA_USAGE_SITE_SETTING_OPTIONS as n, groupSiteSettingMediaUsage as r, MEDIA_USAGE_SITE_SETTINGS as t };
+//# sourceMappingURL=site-settings-KJOqJW6W.mjs.map

package/dist/site-settings-KJOqJW6W.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-settings-KJOqJW6W.mjs","names":[],"sources":["../src/media/usage/site-settings.ts"],"sourcesContent":["/**\n * Media references held by site settings.\n *\n * Usage reads parse these from the stored `site:*` options on every read, so\n * a change through any writer of those options shows up on the next read.\n */\n\nimport { settingMediaIds, type PortableSettingName } from \"../../transfer/format/settings.js\";\n\nexport const MEDIA_USAGE_SITE_SETTINGS = [\"logo\", \"favicon\", \"seo.defaultOgImage\"] as const;\n\nexport type MediaUsageSiteSetting = (typeof MEDIA_USAGE_SITE_SETTINGS)[number];\n\n/**\n * One setting per option, which holds while each option has a single path in\n * `SETTING_MEDIA_REFERENCE_PATHS`. A second path needs a setting of its own.\n */\nconst SITE_SETTING_OPTIONS = [\n\t[\"site:logo\", \"logo\"],\n\t[\"site:favicon\", \"favicon\"],\n\t[\"site:seo\", \"seo.defaultOgImage\"],\n] as const satisfies readonly (readonly [PortableSettingName, MediaUsageSiteSetting])[];\n\nexport const MEDIA_USAGE_SITE_SETTING_OPTIONS = SITE_SETTING_OPTIONS.map(([option]) => option);\n\n/**\n * Group the site settings that select each media item, in settings order.\n *\n * @param options Raw JSON option values keyed by option name.\n */\nexport function groupSiteSettingMediaUsage(\n\toptions: ReadonlyMap<string, string | null>,\n): Map<string, MediaUsageSiteSetting[]> {\n\tconst usage = new Map<string, MediaUsageSiteSetting[]>();\n\tfor (const [option, setting] of SITE_SETTING_OPTIONS) {\n\t\tfor (const mediaId of settingMediaIds(option, parseOption(options.get(option)))) {\n\t\t\tconst settings = usage.get(mediaId);\n\t\t\tif (settings) settings.push(setting);\n\t\t\telse usage.set(mediaId, [setting]);\n\t\t}\n\t}\n\treturn usage;\n}\n\nfunction parseOption(value: string | null | undefined): unknown {\n\tif (value == null) return undefined;\n\ttry {\n\t\treturn JSON.parse(value);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"],"mappings":";;;;;;;;;AASA,MAAa,4BAA4B;CAAC;CAAQ;CAAW;CAAqB;;;;;AAQlF,MAAM,uBAAuB;CAC5B,CAAC,aAAa,OAAO;CACrB,CAAC,gBAAgB,UAAU;CAC3B,CAAC,YAAY,qBAAqB;CAClC;AAED,MAAa,mCAAmC,qBAAqB,KAAK,CAAC,YAAY,OAAO;;;;;;AAO9F,SAAgB,2BACf,SACuC;CACvC,MAAM,wBAAQ,IAAI,KAAsC;AACxD,MAAK,MAAM,CAAC,QAAQ,YAAY,qBAC/B,MAAK,MAAM,WAAW,gBAAgB,QAAQ,YAAY,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE;EAChF,MAAM,WAAW,MAAM,IAAI,QAAQ;AACnC,MAAI,SAAU,UAAS,KAAK,QAAQ;MAC/B,OAAM,IAAI,SAAS,CAAC,QAAQ,CAAC;;AAGpC,QAAO;;AAGR,SAAS,YAAY,OAA2C;AAC/D,KAAI,SAAS,KAAM,QAAO;AAC1B,KAAI;AACH,SAAO,KAAK,MAAM,MAAM;SACjB;AACP"}

package/dist/site-url-Ceq_AUK0.mjs

@@ -0,0 +1,16 @@
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { t as getConfiguredOrigin } from "./public-url-B5a0QAh6.mjs";
+
+//#region src/api/site-url.ts
+async function getSiteBaseUrl(db, request, config) {
+	const configured = getConfiguredOrigin(config);
+	if (configured) return `${configured}/_emdash`;
+	const storedUrl = await new OptionsRepository(db).get("emdash:site_url");
+	if (storedUrl) return `${storedUrl}/_emdash`;
+	const url = new URL(request.url);
+	return `${url.protocol}//${url.host}/_emdash`;
+}
+
+//#endregion
+export { getSiteBaseUrl as t };
+//# sourceMappingURL=site-url-Ceq_AUK0.mjs.map

package/dist/site-url-Ceq_AUK0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-url-Ceq_AUK0.mjs","names":[],"sources":["../src/api/site-url.ts"],"sourcesContent":["/**\n * Resolve the canonical site base URL for use in outbound links (emails, etc.).\n *\n * Precedence mirrors `getPublicOrigin`: the operator-configured origin\n * (`config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars) wins,\n * then the stored `emdash:site_url` option (written once during setup on the\n * real domain), and only before setup completes does the request URL fill in.\n * A configured or stored value always beats the request, so Host header\n * spoofing cannot redirect users to attacker-controlled domains.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getConfiguredOrigin, type SiteUrlConfig } from \"./public-url.js\";\n\nexport async function getSiteBaseUrl(\n\tdb: Kysely<Database>,\n\trequest: Request,\n\tconfig?: SiteUrlConfig,\n): Promise<string> {\n\tconst configured = getConfiguredOrigin(config);\n\tif (configured) {\n\t\treturn `${configured}/_emdash`;\n\t}\n\tconst options = new OptionsRepository(db);\n\tconst storedUrl = await options.get<string>(\"emdash:site_url\");\n\tif (storedUrl) {\n\t\treturn `${storedUrl}/_emdash`;\n\t}\n\t// Fallback: derive from request (only reached before setup completes)\n\tconst url = new URL(request.url);\n\treturn `${url.protocol}//${url.host}/_emdash`;\n}\n"],"mappings":";;;;AAiBA,eAAsB,eACrB,IACA,SACA,QACkB;CAClB,MAAM,aAAa,oBAAoB,OAAO;AAC9C,KAAI,WACH,QAAO,GAAG,WAAW;CAGtB,MAAM,YAAY,MADF,IAAI,kBAAkB,GAAG,CACT,IAAY,kBAAkB;AAC9D,KAAI,UACH,QAAO,GAAG,UAAU;CAGrB,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,QAAO,GAAG,IAAI,SAAS,IAAI,IAAI,KAAK"}

package/dist/snapshot-Dzsn3NZa.mjs

@@ -0,0 +1,414 @@
+import { m as listTablesLike, p as listTableColumns } from "./dialect-helpers-7_IqPdh9.mjs";
+import { sql } from "kysely";
+
+//#region src/api/handlers/snapshot.ts
+/**
+* Verify HMAC-SHA256 preview signature using crypto.subtle.
+* Returns true if the signature is valid and not expired.
+*/
+async function verifyPreviewSignature(source, exp, sig, secret) {
+	if (exp < Date.now() / 1e3) return false;
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["verify"]);
+	const sigBytes = new Uint8Array(sig.length / 2);
+	for (let i = 0; i < sig.length; i += 2) sigBytes[i / 2] = parseInt(sig.substring(i, i + 2), 16);
+	return crypto.subtle.verify("HMAC", key, sigBytes, encoder.encode(`${source}:${exp}`));
+}
+/**
+* Parse an X-Preview-Signature header value into its components.
+*
+* Format: "source:exp:sig" where source is a URL (contains colons),
+* exp is a unix timestamp, and sig is 64 hex chars.
+*
+* Parses from the right since source URLs contain colons.
+*
+* @returns Parsed components, or null if the format is invalid
+*/
+function parsePreviewSignatureHeader(header) {
+	const lastColon = header.lastIndexOf(":");
+	if (lastColon <= 0) return null;
+	const sig = header.substring(lastColon + 1);
+	if (sig.length !== 64) return null;
+	const rest = header.substring(0, lastColon);
+	const secondLastColon = rest.lastIndexOf(":");
+	if (secondLastColon <= 0) return null;
+	const source = rest.substring(0, secondLastColon);
+	const exp = parseInt(rest.substring(secondLastColon + 1), 10);
+	if (isNaN(exp) || source.length === 0) return null;
+	return {
+		source,
+		exp,
+		sig
+	};
+}
+const MEDIA_FILE_PREFIX = "/_emdash/api/media/file/";
+const MEDIA_FILE_SUFFIX = /[?#]/;
+const EXTERNAL_OR_ROOT_URL = /^(?:[a-z][a-z0-9+.-]*:|\/)/i;
+/**
+* Parse a JSON string value and inject `src` for local media objects.
+* Returns the original string if it's not a local media value.
+*/
+function injectMediaSrc(jsonStr, origin) {
+	try {
+		const obj = JSON.parse(jsonStr);
+		if (typeof obj !== "object" || obj === null || Array.isArray(obj)) return jsonStr;
+		if (injectMediaSrcInto(obj, origin)) return JSON.stringify(obj);
+		return jsonStr;
+	} catch {
+		return jsonStr;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Recursively walk an object and inject `src` into local media values.
+* Returns true if any modifications were made.
+*/
+function injectMediaSrcInto(obj, origin) {
+	let modified = false;
+	if ((obj.provider === "local" || !obj.provider && obj.id && obj.meta) && !obj.src) {
+		const storageKey = (isRecord(obj.meta) ? obj.meta : void 0)?.storageKey ?? obj.id;
+		if (typeof storageKey === "string" && storageKey) {
+			obj.src = `${origin}${MEDIA_FILE_PREFIX}${storageKey}`;
+			modified = true;
+		}
+	}
+	for (const value of Object.values(obj)) if (Array.isArray(value)) {
+		for (const item of value) if (isRecord(item)) {
+			if (injectMediaSrcInto(item, origin)) modified = true;
+		}
+	} else if (isRecord(value)) {
+		if (injectMediaSrcInto(value, origin)) modified = true;
+	}
+	return modified;
+}
+/**
+* Safe identifier pattern for snapshot table names.
+* More permissive than validateIdentifier() — allows leading underscores
+* (needed for system tables like _emdash_collections).
+*/
+const SAFE_TABLE_NAME = /^[a-z_][a-z0-9_]*$/;
+/**
+* System tables included in snapshots.
+* Content tables (ec_*) are discovered dynamically.
+*/
+const SYSTEM_TABLES = [
+	"_emdash_block_types",
+	"_emdash_block_type_versions",
+	"_emdash_collections",
+	"_emdash_fields",
+	"_emdash_taxonomy_defs",
+	"_emdash_taxonomy_def_groups",
+	"_emdash_menus",
+	"_emdash_menu_items",
+	"_emdash_sections",
+	"_emdash_widget_areas",
+	"_emdash_widgets",
+	"_emdash_seo",
+	"_emdash_migrations",
+	"content_taxonomies",
+	"taxonomies",
+	"options",
+	"media",
+	"revisions"
+];
+/**
+* Published snapshots are available to preview-signature callers, so every
+* system table must be classified explicitly. Adding a snapshot table without
+* choosing a policy is a type error rather than an accidental data export.
+*/
+const PUBLISHED_TABLE_POLICIES = {
+	_emdash_block_types: "full",
+	_emdash_block_type_versions: "full",
+	_emdash_collections: "full",
+	_emdash_fields: "full",
+	_emdash_taxonomy_defs: "full",
+	_emdash_taxonomy_def_groups: "full",
+	_emdash_menus: "full",
+	_emdash_menu_items: "content-linked",
+	_emdash_sections: "full",
+	_emdash_widget_areas: "full",
+	_emdash_widgets: "full",
+	_emdash_seo: "content-linked",
+	_emdash_migrations: "full",
+	content_taxonomies: "content-linked",
+	taxonomies: "content-linked",
+	options: "content-linked",
+	media: "content-linked",
+	revisions: "omit"
+};
+const SYSTEM_TABLE_SET = new Set(SYSTEM_TABLES);
+function isSystemTable(tableName) {
+	return SYSTEM_TABLE_SET.has(tableName);
+}
+/**
+* Table name prefixes excluded from snapshots (auth/security data).
+*/
+const EXCLUDED_PREFIXES = [
+	"_emdash_api_tokens",
+	"_emdash_oauth_tokens",
+	"_emdash_authorization_codes",
+	"_emdash_device_codes",
+	"_emdash_migrations_lock",
+	"_emdash_transfer_",
+	"_plugin_",
+	"users",
+	"sessions",
+	"credentials",
+	"challenges"
+];
+/**
+* Options key prefixes safe for inclusion in snapshots.
+*
+* The options table contains plugin secrets (plugin:*), passkey challenges
+* (emdash:passkey_pending:*), and setup state that must not leak to
+* preview databases. Only site-level rendering settings are needed.
+*/
+const SAFE_OPTIONS_PREFIXES = ["site:"];
+function isExcluded(tableName) {
+	return EXCLUDED_PREFIXES.some((prefix) => tableName.startsWith(prefix));
+}
+function normalizeColumnType(type) {
+	switch (type.toLowerCase()) {
+		case "smallint":
+		case "integer":
+		case "bigint":
+		case "boolean": return "INTEGER";
+		case "real":
+		case "double precision":
+		case "numeric":
+		case "decimal": return "REAL";
+		case "blob":
+		case "bytea": return "BLOB";
+		case "json":
+		case "jsonb": return "JSON";
+		default: return "TEXT";
+	}
+}
+function normalizeRows(rows, types) {
+	for (const row of rows) for (const [column, type] of Object.entries(types)) {
+		const value = row[column];
+		if (type === "JSON" && value !== null && value !== void 0 && typeof value !== "string") row[column] = JSON.stringify(value);
+	}
+	return rows;
+}
+function createPublishedProjection() {
+	return {
+		content: /* @__PURE__ */ new Map(),
+		taxonomyGroups: /* @__PURE__ */ new Set(),
+		mediaIds: /* @__PURE__ */ new Set(),
+		mediaStorageKeys: /* @__PURE__ */ new Set()
+	};
+}
+function readString(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function recordPublishedContent(projection, tableName, rows) {
+	const references = {
+		ids: /* @__PURE__ */ new Set(),
+		translationGroups: /* @__PURE__ */ new Set()
+	};
+	for (const row of rows) {
+		const id = readString(row.id);
+		const translationGroup = readString(row.translation_group);
+		if (id) references.ids.add(id);
+		if (translationGroup) references.translationGroups.add(translationGroup);
+	}
+	projection.content.set(tableName.slice(3), references);
+}
+function isPublishedContentReference(projection, collection, reference) {
+	const collectionName = readString(collection);
+	const id = readString(reference);
+	if (!collectionName || !id) return false;
+	const references = projection.content.get(collectionName);
+	return references?.ids.has(id) === true || references?.translationGroups.has(id) === true;
+}
+function collectMediaReferences(value, projection) {
+	if (typeof value === "string") {
+		if (value.startsWith(MEDIA_FILE_PREFIX)) {
+			const storageKey = value.slice(24).split(MEDIA_FILE_SUFFIX, 1)[0];
+			if (storageKey) projection.mediaStorageKeys.add(storageKey);
+			return;
+		}
+		const trimmed = value.trimStart();
+		if (trimmed.startsWith("{") || trimmed.startsWith("[")) try {
+			collectMediaReferences(JSON.parse(value), projection);
+		} catch {}
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const item of value) collectMediaReferences(item, projection);
+		return;
+	}
+	if (!isRecord(value)) return;
+	const mediaId = readString(value.mediaId);
+	if (mediaId) projection.mediaIds.add(mediaId);
+	const provider = readString(value.provider);
+	const meta = isRecord(value.meta) ? value.meta : null;
+	const localMediaId = readString(value.id);
+	if ((provider === "local" || !provider && meta) && localMediaId) projection.mediaIds.add(localMediaId);
+	const storageKey = readString(value.storageKey) ?? readString(meta?.storageKey);
+	if (storageKey) projection.mediaStorageKeys.add(storageKey);
+	const assetRef = readString((isRecord(value.asset) ? value.asset : null)?._ref);
+	if (assetRef) {
+		projection.mediaIds.add(assetRef);
+		projection.mediaStorageKeys.add(assetRef);
+	}
+	for (const child of Object.values(value)) collectMediaReferences(child, projection);
+}
+function projectTaxonomyRows(rows, projection) {
+	const includedGroups = new Set(projection.taxonomyGroups);
+	const includedIds = new Set(projection.taxonomyGroups);
+	let changed = true;
+	while (changed) {
+		changed = false;
+		for (const row of rows) {
+			const id = readString(row.id);
+			const group = readString(row.translation_group);
+			if (!id) continue;
+			if (includedIds.has(id) || group && includedGroups.has(group)) {
+				if (!includedIds.has(id)) {
+					includedIds.add(id);
+					changed = true;
+				}
+				if (group && !includedGroups.has(group)) {
+					includedGroups.add(group);
+					changed = true;
+				}
+				const parentId = readString(row.parent_id);
+				if (parentId && !includedIds.has(parentId)) {
+					includedIds.add(parentId);
+					changed = true;
+				}
+			}
+		}
+	}
+	return rows.filter((row) => {
+		const id = readString(row.id);
+		const group = readString(row.translation_group);
+		return id && includedIds.has(id) || group && includedGroups.has(group);
+	});
+}
+function projectPublishedRows(tableName, rows, projection) {
+	switch (tableName) {
+		case "_emdash_seo": return rows.filter((row) => {
+			if (!isPublishedContentReference(projection, row.collection, row.content_id)) return false;
+			const image = readString(row.seo_image);
+			if (image) {
+				collectMediaReferences(image, projection);
+				if (!EXTERNAL_OR_ROOT_URL.test(image)) {
+					projection.mediaIds.add(image);
+					projection.mediaStorageKeys.add(image);
+				}
+			}
+			return true;
+		});
+		case "content_taxonomies": return rows.filter((row) => {
+			const published = isPublishedContentReference(projection, row.collection, row.entry_id);
+			const taxonomyGroup = readString(row.taxonomy_id);
+			if (published && taxonomyGroup) projection.taxonomyGroups.add(taxonomyGroup);
+			return published;
+		});
+		case "taxonomies": return projectTaxonomyRows(rows, projection);
+		case "_emdash_menu_items": return rows.filter((row) => {
+			const type = readString(row.type);
+			const referenceId = readString(row.reference_id);
+			if (!referenceId || type === "custom") return true;
+			if (type === "taxonomy") {
+				projection.taxonomyGroups.add(referenceId);
+				return true;
+			}
+			if (type === "collection" && !row.reference_id) return true;
+			return isPublishedContentReference(projection, readString(row.reference_collection) ?? (type === "post" || type === "page" ? `${type}s` : null), referenceId);
+		});
+		case "media": return rows.filter((row) => {
+			const id = readString(row.id);
+			const storageKey = readString(row.storage_key);
+			return id !== null && projection.mediaIds.has(id) || storageKey !== null && projection.mediaStorageKeys.has(storageKey);
+		});
+		case "options": return rows;
+		default: return [];
+	}
+}
+/**
+* Generate a portable database snapshot.
+*
+* Discovers ec_* content tables dynamically, exports system tables
+* needed for rendering, and includes schema info for table recreation.
+*/
+async function generateSnapshot(db, options) {
+	const includeDrafts = options?.includeDrafts ?? false;
+	const includeTrashed = options?.includeTrashed ?? false;
+	const optionPrefixes = options?.optionPrefixes ?? SAFE_OPTIONS_PREFIXES;
+	const optionKeys = new Set(options?.optionKeys);
+	const publishedOnly = !includeDrafts && !includeTrashed;
+	const publishedProjection = createPublishedProjection();
+	const allTables = [...await listTablesLike(db, "ec_%"), ...SYSTEM_TABLES];
+	const tables = {};
+	const schema = {};
+	for (const tableName of allTables) {
+		if (isExcluded(tableName)) continue;
+		if (!SAFE_TABLE_NAME.test(tableName)) continue;
+		const columnInfo = await listTableColumns(db, tableName);
+		if (columnInfo.length === 0) continue;
+		const columns = columnInfo.map((column) => column.name);
+		const types = {};
+		for (const column of columnInfo) types[column.name] = normalizeColumnType(column.type);
+		schema[tableName] = {
+			columns,
+			types
+		};
+		let rows;
+		if (tableName.startsWith("ec_")) if (includeTrashed) rows = (await sql`
+						SELECT * FROM ${sql.ref(tableName)}
+					`.execute(db)).rows;
+		else if (includeDrafts) rows = (await sql`
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+					`.execute(db)).rows;
+		else rows = (await sql`
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+						AND status = 'published'
+					`.execute(db)).rows;
+		else if (publishedOnly && isSystemTable(tableName) && PUBLISHED_TABLE_POLICIES[tableName] === "omit") rows = [];
+		else if (tableName === "options") rows = (await sql`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)).rows.filter((row) => {
+			const name = typeof row.name === "string" ? row.name : "";
+			return optionKeys.has(name) || optionPrefixes.some((prefix) => name.startsWith(prefix));
+		});
+		else rows = (await sql`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)).rows;
+		if (publishedOnly) {
+			if (tableName.startsWith("ec_")) recordPublishedContent(publishedProjection, tableName, rows);
+			else if (isSystemTable(tableName) && PUBLISHED_TABLE_POLICIES[tableName] === "content-linked") rows = projectPublishedRows(tableName, rows, publishedProjection);
+			for (const row of rows) collectMediaReferences(row, publishedProjection);
+		}
+		if (rows.length > 0) tables[tableName] = normalizeRows(rows, types);
+	}
+	if (options?.origin) {
+		const origin = options.origin;
+		for (const [tableName, rows] of Object.entries(tables)) {
+			if (!tableName.startsWith("ec_")) continue;
+			for (const row of rows) for (const [col, value] of Object.entries(row)) {
+				if (typeof value !== "string" || !value.startsWith("{")) continue;
+				row[col] = injectMediaSrc(value, origin);
+			}
+		}
+	}
+	return {
+		tables,
+		schema,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+
+//#endregion
+export { parsePreviewSignatureHeader as n, verifyPreviewSignature as r, generateSnapshot as t };
+//# sourceMappingURL=snapshot-Dzsn3NZa.mjs.map