emdash 1.0.1 → 1.1.0

package/src/redirects/cache.ts

@@ -3,19 +3,19 @@
  *
  * Worker-isolate cache for enabled redirect rules. The middleware populates
  * this on first request; route handlers invalidate it on writes. Cached rules
- * expire so writes handled by another isolate become visible here too.
+ * are revalidated after they expire so writes handled by another isolate
+ * become visible here too.
  *
- * Both exact-match and pattern rules are loaded from one query and cached
- * together: exact rules indexed by source path in a Map, pattern rules
- * pre-compiled into an array. A single warm request issues zero database
- * queries; a cold or expired isolate issues one.
+ * A cold isolate loads the rules from its source and waits for them. Once
+ * warm, requests never wait: an expired cache keeps serving while one
+ * background revalidation asks the source whether the loaded version is still
+ * current and reloads only when it is not.
  *
  * This module deliberately has NO Astro imports so it can be safely imported
  * from handlers, seed, CLI, and tests without dragging in `astro:middleware`.
  */
 
 import { after } from "../after.js";
-import type { Redirect } from "../database/repositories/redirect.js";
 import {
 	createSingleFlightCache,
 	type SingleFlightCache,
@@ -30,15 +30,38 @@ import {
 	validatePattern,
 } from "./patterns.js";
 
+export interface RedirectRule {
+	id: string;
+	source: string;
+	destination: string;
+	type: number;
+}
+
+export interface RedirectRuleSet {
+	/** Identifies the loaded rules for revalidation, or null when they can only be reloaded. */
+	version: string | null;
+	/** Exact rules; a later rule for the same source replaces an earlier one. */
+	exact: RedirectRule[];
+	/** Pattern rules in precedence order. */
+	patterns: RedirectRule[];
+}
+
+export interface RedirectSource {
+	load(): Promise<RedirectRuleSet>;
+	/** Whether `version` is still the source's current rule set. */
+	isCurrent(version: string): Promise<boolean>;
+}
+
 export interface CachedRedirectRule {
-	redirect: Redirect;
+	redirect: RedirectRule;
 	compiled: CompiledPattern;
 }
 
 export interface CachedRedirects {
-	/** Exact-match rules indexed by source path (`source` -> `Redirect`). */
-	exact: Map<string, Redirect>;
-	/** Pattern rules with their compiled regexes, preserving insertion order. */
+	version: string | null;
+	/** Exact-match rules indexed by source path. */
+	exact: Map<string, RedirectRule>;
+	/** Pattern rules with their compiled regexes, in precedence order. */
 	patterns: CachedRedirectRule[];
 }
 
@@ -47,6 +70,7 @@ interface RedirectCacheState {
 	expiresAt: number;
 	generation: number;
 	refresh: SingleFlightCache<CachedRedirects>;
+	revalidatingUntil: number;
 }
 
 const REDIRECT_CACHE_TTL_MS = 30_000;
@@ -62,6 +86,7 @@ const cacheState: RedirectCacheState =
 			expiresAt: 0,
 			generation: 0,
 			refresh: createSingleFlightCache<CachedRedirects>(),
+			revalidatingUntil: 0,
 		};
 		g[REDIRECT_CACHE_KEY] = state;
 		return state;
@@ -75,36 +100,24 @@ export function invalidateRedirectCache(): void {
 	cacheState.generation++;
 	cacheState.redirects = null;
 	cacheState.expiresAt = 0;
+	cacheState.revalidatingUntil = 0;
 	invalidateSingleFlightCache(cacheState.refresh);
 }
 
-/**
- * Get the cached redirects, or null if the cache is cold.
- */
-function getCachedRedirects(): CachedRedirects | null {
-	if (cacheState.redirects && Date.now() >= cacheState.expiresAt) {
-		invalidateRedirectCache();
-	}
-	return cacheState.redirects;
-}
-
-/** Compile enabled database rows into the in-memory lookup structures. */
-function compileRedirects(redirects: Redirect[]): CachedRedirects {
-	const exact = new Map<string, Redirect>();
+/** Compile a rule set into the in-memory lookup structures. */
+function compileRedirects(rules: RedirectRuleSet): CachedRedirects {
+	const exact = new Map<string, RedirectRule>();
+	for (const rule of rules.exact) exact.set(rule.source, rule);
 	const patterns: CachedRedirectRule[] = [];
-	for (const r of redirects) {
-		if (r.isPattern) {
-			const patternError = validatePattern(r.source);
-			if (patternError) {
-				console.warn(`[emdash:redirects] Skipping redirect ${r.id}: ${patternError}`);
-				continue;
-			}
-			patterns.push({ redirect: r, compiled: compilePattern(r.source) });
-		} else {
-			exact.set(r.source, r);
+	for (const rule of rules.patterns) {
+		const patternError = validatePattern(rule.source);
+		if (patternError) {
+			console.warn(`[emdash:redirects] Skipping redirect ${rule.id}: ${patternError}`);
+			continue;
 		}
+		patterns.push({ redirect: rule, compiled: compilePattern(rule.source) });
 	}
-	return { exact, patterns };
+	return { version: rules.version, exact, patterns };
 }
 
 function installCachedRedirects(redirects: CachedRedirects): CachedRedirects {
@@ -113,17 +126,39 @@ function installCachedRedirects(redirects: CachedRedirects): CachedRedirects {
 	return cacheState.redirects;
 }
 
-export async function loadCachedRedirects(
-	load: () => Promise<Redirect[]>,
-): Promise<CachedRedirects> {
+function revalidateInBackground(source: RedirectSource, cached: CachedRedirects): void {
+	const now = Date.now();
+	if (cacheState.revalidatingUntil > now) return;
+	cacheState.revalidatingUntil = now + REDIRECT_CACHE_TTL_MS;
+	const generation = cacheState.generation;
+	after(async () => {
+		try {
+			if (cached.version !== null && (await source.isCurrent(cached.version))) {
+				if (generation === cacheState.generation) {
+					cacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;
+				}
+				return;
+			}
+			const loaded = compileRedirects(await source.load());
+			if (generation === cacheState.generation) installCachedRedirects(loaded);
+		} catch (error) {
+			console.error("[emdash:redirects] revalidating redirects failed:", error);
+		}
+	});
+}
+
+export async function loadCachedRedirects(source: RedirectSource): Promise<CachedRedirects> {
 	for (let attempt = 0; attempt < REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS; attempt++) {
-		const cached = getCachedRedirects();
-		if (cached) return cached;
+		const cached = cacheState.redirects;
+		if (cached) {
+			if (Date.now() >= cacheState.expiresAt) revalidateInBackground(source, cached);
+			return cached;
+		}
 
 		const generation = cacheState.generation;
 		const loaded = await singleFlightCached(
 			cacheState.refresh,
-			async () => compileRedirects(await load()),
+			async () => compileRedirects(await source.load()),
 			{ anchor: (promise) => after(() => promise), ownerTimeoutMs: 30_000 },
 		);
 
@@ -146,7 +181,7 @@ export async function loadCachedRedirects(
 export function matchCachedPatterns(
 	rules: CachedRedirectRule[],
 	pathname: string,
-): { redirect: Redirect; destination: string } | null {
+): { redirect: RedirectRule; destination: string } | null {
 	for (const { redirect, compiled } of rules) {
 		const params = matchPattern(compiled, pathname);
 		if (params) {

package/src/request-context.ts

@@ -100,7 +100,7 @@ export interface EmDashRequestContext {
 	 */
 	dbIsIsolated?: boolean;
 	/**
-	 * Query recorder attached by middleware when EMDASH_QUERY_LOG_FILE is set.
+	 * Query recorder attached by middleware when EMDASH_QUERY_LOG=1 is set.
 	 * The Kysely `log` hook appends an event per query; middleware flushes
 	 * to NDJSON after the response.
 	 */

package/src/seed/apply.ts

@@ -40,7 +40,7 @@ import type { MediaValue } from "../fields/types.js";
 import { getI18nConfig, resolveConfiguredLocale } from "../i18n/config.js";
 import { ssrfSafeFetch, validateExternalUrl } from "../import/ssrf.js";
 import { markContentMediaUsageCollectionStaleSafely } from "../media/usage/content-refresh.js";
-import { coalesceObjectCacheWrites } from "../object-cache/index.js";
+import { coalesceObjectCacheWrites, invalidateMenuObjectCache } from "../object-cache/index.js";
 import { BlockTypeRegistry } from "../schema/block-type-registry.js";
 import { normalizeBlocksData, resolveBlockTypes } from "../schema/block-values.js";
 import { SchemaError, SchemaRegistry } from "../schema/registry.js";
@@ -1086,64 +1086,68 @@ async function applySeedWrites(
 		// Shared across menus: translated items reference anchor items in sibling menus.
 		const itemSeedIdMap = new Map<string, { id: string; translationGroup: string }>();
 
-		for (const menu of seed.menus) {
-			const locale = resolveConfiguredLocale(menu.locale ?? defaultLocale);
-			let lookup = db
-				.selectFrom("_emdash_menus")
-				.selectAll()
-				.where("name", "=", menu.name)
-				.where("locale", "=", locale);
-			const existingMenu = await lookup.executeTakeFirst();
-
-			let menuId: string;
-			let translationGroup: string;
-
-			if (existingMenu) {
-				menuId = existingMenu.id;
-				translationGroup = existingMenu.translation_group ?? existingMenu.id;
-				// Clear existing items (menus are recreated)
-				await db.deleteFrom("_emdash_menu_items").where("menu_id", "=", menuId).execute();
-			} else {
-				menuId = ulid();
-				// Resolve translationOf to the source menu's translation_group.
-				translationGroup = menuId;
-				if (menu.translationOf) {
-					const source = menuSeedIdMap.get(menu.translationOf);
-					if (source) translationGroup = source.translationGroup;
-					else
-						console.warn(
-							`menu "${menu.name}" (${locale}): translationOf "${menu.translationOf}" not found yet; minting a fresh group.`,
-						);
+		try {
+			for (const menu of seed.menus) {
+				const locale = resolveConfiguredLocale(menu.locale ?? defaultLocale);
+				let lookup = db
+					.selectFrom("_emdash_menus")
+					.selectAll()
+					.where("name", "=", menu.name)
+					.where("locale", "=", locale);
+				const existingMenu = await lookup.executeTakeFirst();
+
+				let menuId: string;
+				let translationGroup: string;
+
+				if (existingMenu) {
+					menuId = existingMenu.id;
+					translationGroup = existingMenu.translation_group ?? existingMenu.id;
+					// Clear existing items (menus are recreated)
+					await db.deleteFrom("_emdash_menu_items").where("menu_id", "=", menuId).execute();
+				} else {
+					menuId = ulid();
+					// Resolve translationOf to the source menu's translation_group.
+					translationGroup = menuId;
+					if (menu.translationOf) {
+						const source = menuSeedIdMap.get(menu.translationOf);
+						if (source) translationGroup = source.translationGroup;
+						else
+							console.warn(
+								`menu "${menu.name}" (${locale}): translationOf "${menu.translationOf}" not found yet; minting a fresh group.`,
+							);
+					}
+					await db
+						.insertInto("_emdash_menus")
+						.values({
+							id: menuId,
+							name: menu.name,
+							label: menu.label,
+							created_at: new Date().toISOString(),
+							updated_at: new Date().toISOString(),
+							locale,
+							translation_group: translationGroup,
+						})
+						.execute();
+					result.menus.created++;
 				}
-				await db
-					.insertInto("_emdash_menus")
-					.values({
-						id: menuId,
-						name: menu.name,
-						label: menu.label,
-						created_at: new Date().toISOString(),
-						updated_at: new Date().toISOString(),
-						locale,
-						translation_group: translationGroup,
-					})
-					.execute();
-				result.menus.created++;
-			}
 
-			if (menu.id) menuSeedIdMap.set(menu.id, { id: menuId, translationGroup });
-
-			// Create menu items
-			const itemCount = await applyMenuItems(
-				db,
-				menuId,
-				locale,
-				menu.items,
-				null, // parent_id
-				0, // sort_order
-				seedIdMap,
-				itemSeedIdMap,
-			);
-			result.menus.items += itemCount;
+				if (menu.id) menuSeedIdMap.set(menu.id, { id: menuId, translationGroup });
+
+				// Create menu items
+				const itemCount = await applyMenuItems(
+					db,
+					menuId,
+					locale,
+					menu.items,
+					null, // parent_id
+					0, // sort_order
+					seedIdMap,
+					itemSeedIdMap,
+				);
+				result.menus.items += itemCount;
+			}
+		} finally {
+			invalidateMenuObjectCache();
 		}
 	}
 
@@ -1306,6 +1310,10 @@ async function applySeedWrites(
 		}
 	}
 
+	if (result.redirects.created + result.redirects.updated > 0) {
+		const { publishRedirectChanges } = await import("../redirects/artifacts.js");
+		await publishRedirectChanges(db);
+	}
 	await invalidateSeedCaches();
 
 	return { result, complete, progress };

package/src/settings/index.ts

@@ -16,6 +16,7 @@ import { withTransaction } from "../database/transaction.js";
 import type { Database } from "../database/types.js";
 import { getDb } from "../loader.js";
 import { cachedQuery, invalidateObjectCache } from "../object-cache/index.js";
+import { isRecord } from "../plugin-utils.js";
 import {
 	PluginSettingEncryptionError,
 	decryptPluginSetting,
@@ -44,6 +45,9 @@ import type {
 /** Prefix for site settings in the options table */
 const SETTINGS_PREFIX = "site:";
 
+/** Settings stored as one object whose fields are updated individually. */
+const NESTED_SETTING_KEYS = new Set(["seo", "social"]);
+
 function isPluginSettingEnvelopeRecord(value: unknown): value is Record<string, unknown> {
 	return (
 		typeof value === "object" &&
@@ -336,7 +340,8 @@ export async function getSiteSettingsWithDb(
 /**
  * Set site settings (internal function used by admin API)
  *
- * Merges provided settings with existing ones. Only provided fields are updated.
+ * Merges provided settings with existing ones. Only provided fields are updated,
+ * including fields inside `seo` and `social`; `seo.defaultOgImage: null` removes the default image.
  * Media references should include just the mediaId; URLs are resolved on read.
  *
  * @param settings - Partial settings object with values to update
@@ -361,11 +366,12 @@ export async function setSiteSettings(
 ): Promise<void> {
 	const updates: Record<string, unknown> = {};
 	const deletions: string[] = [];
-	const seo = settings.seo;
+	const nestedPatches: [key: string, patch: Record<string, unknown>][] = [];
 
 	for (const [key, value] of Object.entries(settings)) {
-		if (value === undefined || (key === "seo" && seo?.defaultOgImage === null)) continue;
+		if (value === undefined) continue;
 		if (value === null) deletions.push(`${SETTINGS_PREFIX}${key}`);
+		else if (NESTED_SETTING_KEYS.has(key) && isRecord(value)) nestedPatches.push([key, value]);
 		else updates[`${SETTINGS_PREFIX}${key}`] = value;
 	}
 
@@ -375,16 +381,15 @@ export async function setSiteSettings(
 			await transactionOptions.setMany(updates);
 			await transactionOptions.deleteMany(deletions);
 
-			if (seo?.defaultOgImage === null) {
-				const existingSeo =
-					(await transactionOptions.get<SeoSettings>(`${SETTINGS_PREFIX}seo`)) ?? {};
-				const nextSeo = { ...existingSeo, ...seo };
-				delete nextSeo.defaultOgImage;
-				if (Object.keys(nextSeo).length === 0) {
-					await transactionOptions.delete(`${SETTINGS_PREFIX}seo`);
-				} else {
-					await transactionOptions.set(`${SETTINGS_PREFIX}seo`, nextSeo);
+			for (const [key, patch] of nestedPatches) {
+				const optionName = `${SETTINGS_PREFIX}${key}`;
+				const next = { ...(await transactionOptions.get<Record<string, unknown>>(optionName)) };
+				for (const [field, fieldValue] of Object.entries(patch)) {
+					if (fieldValue === null) delete next[field];
+					else if (fieldValue !== undefined) next[field] = fieldValue;
 				}
+				if (Object.keys(next).length === 0) await transactionOptions.delete(optionName);
+				else await transactionOptions.set(optionName, next);
 			}
 		});
 	} finally {

package/src/transfer/format/columns.ts

@@ -544,6 +544,9 @@ export const NON_PORTABLE_TABLES: Readonly<Record<string, string>> = Object.free
 	_emdash_entry_locks: "runtime",
 	_emdash_cron_tasks: "runtime",
 	_emdash_redirect_write_lock: "runtime",
+	_emdash_redirect_state: "derived",
+	_emdash_redirect_artifacts: "derived",
+	_emdash_redirect_generation_artifacts: "derived",
 	_emdash_404_log: "runtime",
 	_emdash_revision_prune_queue: "runtime",
 	_emdash_media_upload_attempts: "runtime",

package/src/transfer/import/rebuild.ts

@@ -29,6 +29,7 @@ import { FTSManager } from "../../search/fts-manager.js";
 import type { SearchTokenizer } from "../../search/types.js";
 import { SEARCH_TOKENIZERS } from "../../search/types.js";
 import { invalidateSiteSettingsCache } from "../../settings/index.js";
+import { isMissingTableError } from "../../utils/db-errors.js";
 import { TransferError } from "../errors.js";
 import { compareIds, type CollectionRecord } from "../format/kinds.js";
 import { POST_IMPORT_OPTION_RESETS } from "../format/settings.js";
@@ -43,8 +44,8 @@ const FTS_POPULATE_STATEMENTS = 4;
 const STALE_STATEMENTS = 4;
 const OPTION_STATEMENTS = 4;
 const TAXONOMY_STATEMENTS = 4;
-/** Cache invalidation runs no queries; its checkpoint does. */
-const CACHE_STATEMENTS = 1;
+/** Unpublishing the redirect generation, plus the checkpoint. */
+const CACHE_STATEMENTS = 2;
 
 export interface RebuildPosition {
 	step: RebuildStep;
@@ -280,6 +281,7 @@ async function taxonomyUnit(
 }
 
 async function invalidateCaches(context: ImportContext): Promise<void> {
+	await unpublishRedirectArtifacts(context);
 	for (const namespace of Object.values(CacheNamespace)) invalidateObjectCache(namespace);
 	for (const collection of await collections(context)) {
 		invalidateCollectionCache(collection.slug);
@@ -298,3 +300,16 @@ async function invalidateCaches(context: ImportContext): Promise<void> {
 	invalidateRedirectCache();
 	invalidateUrlPatternCache();
 }
+
+/** Point redirect readers at the imported rules table until a repair republishes. */
+async function unpublishRedirectArtifacts(context: ImportContext): Promise<void> {
+	try {
+		await context.db
+			.updateTable("_emdash_redirect_state")
+			.set({ generation: null, generation_revision: -1 })
+			.where("id", "=", 1)
+			.execute();
+	} catch (error) {
+		if (!isMissingTableError(error)) throw error;
+	}
+}

package/src/transfer/import/scaffold.ts

@@ -8,6 +8,7 @@
 import { sql } from "kysely";
 
 import { processDueMediaUsageCollectionDeletions } from "../../media/usage/collection-deletion-processor.js";
+import { invalidateMenuObjectCache } from "../../object-cache/index.js";
 import { SchemaError, SchemaRegistry } from "../../schema/registry.js";
 import { TransferError } from "../errors.js";
 import type { ImportTransformation } from "../format/transformations.js";
@@ -44,16 +45,22 @@ export async function clearScaffold(
 ): Promise<ScaffoldProgress> {
 	const items = declaredScaffold(context);
 	let next = step;
-	while (next < items.length) {
-		const item = items[next];
-		if (!item) break;
-		if (!context.budget.canStart({ queries: ITEM_STATEMENTS })) {
-			return { state: "continue", step: next };
+	let removedMenus = false;
+	try {
+		while (next < items.length) {
+			const item = items[next];
+			if (!item) break;
+			if (!context.budget.canStart({ queries: ITEM_STATEMENTS })) {
+				return { state: "continue", step: next };
+			}
+			context.budget.start();
+			await removeItem(context, item);
+			if (item.type === "menu" || item.type === "menu_item") removedMenus = true;
+			next++;
+			await checkpoint(next);
 		}
-		context.budget.start();
-		await removeItem(context, item);
-		next++;
-		await checkpoint(next);
+	} finally {
+		if (removedMenus) invalidateMenuObjectCache();
 	}
 
 	const collectionIds = items.flatMap((item) => (item.type === "collection" ? [item.id] : []));

package/src/ui.ts

@@ -78,6 +78,7 @@ export {
 	Columns,
 	Break,
 	HtmlBlock,
+	Iframe,
 	// Marks
 	Superscript,
 	Subscript,

package/src/utils/sanitize.ts

@@ -1,20 +1,25 @@
+import {
+	SITE_HTML_ALLOWED_ATTRIBUTES,
+	SITE_HTML_ALLOWED_SCHEMES,
+	SITE_HTML_ALLOWED_TAGS,
+	SITE_HTML_IFRAME_HOSTS,
+} from "@emdash-cms/admin/html-block";
 import sanitizeHtml from "sanitize-html";
 
 /**
  * Sanitize HTML content to prevent XSS attacks.
  *
  * Allows standard formatting tags, images, iframes (from specific providers),
- * and basic attributes.
+ * and basic attributes. The admin's inline HTML block preview uses the same
+ * allowlist.
  */
 export function sanitizeContent(html: string): string {
 	return sanitizeHtml(html, {
-		allowedTags: [...sanitizeHtml.defaults.allowedTags, "img", "span", "iframe"],
-		allowedAttributes: {
-			...sanitizeHtml.defaults.allowedAttributes,
-			"*": ["class", "id", "data-*"],
-			iframe: ["src", "width", "height", "frameborder", "allow", "allowfullscreen"],
-			img: ["src", "srcset", "alt", "title", "width", "height", "loading"],
-		},
-		allowedIframeHostnames: ["www.youtube.com", "player.vimeo.com"],
+		allowedTags: [...SITE_HTML_ALLOWED_TAGS],
+		allowedAttributes: Object.fromEntries(
+			Object.entries(SITE_HTML_ALLOWED_ATTRIBUTES).map(([tag, names]) => [tag, [...names]]),
+		),
+		allowedSchemes: [...SITE_HTML_ALLOWED_SCHEMES],
+		allowedIframeHostnames: [...SITE_HTML_IFRAME_HOSTS],
 	});
 }

package/src/virtual-modules.d.ts

@@ -29,6 +29,8 @@ declare module "virtual:emdash/config" {
 		siteUrl?: string;
 		astroCspEnabled?: boolean;
 		trailingSlash?: "always" | "never" | "ignore";
+		/** `routePattern` of the image endpoint EmDash installed; absent when it installed none. */
+		imageEndpointRoute?: string;
 	}
 
 	const config: VirtualConfig;
@@ -81,6 +83,7 @@ declare module "virtual:emdash/dialect" {
 		lastContentWriteAt?: number;
 	}
 	export interface RequestScopedDb {
+		/** A per-request handle on the configured database, never a different one. */
 		db: Kysely<unknown>;
 		commit: () => void;
 		/**

package/dist/action-token-D2KE1Rqf.mjs

@@ -1,26 +0,0 @@
-import { r as verifyPreviewToken, t as generatePreviewToken } from "./tokens-B_ffPF1q.mjs";
-
-//#region src/visual-editing/action-token.ts
-const VISUAL_ACTION_SECRET_DOMAIN = "emdash:visual-editing-action:v1:";
-const VISUAL_ACTION_TOKEN_INVALID = "VISUAL_ACTION_TOKEN_INVALID";
-function visualActionSecret(previewSecret) {
-	return `${VISUAL_ACTION_SECRET_DOMAIN}${previewSecret}`;
-}
-function generateVisualEditingActionToken(previewSecret, userId) {
-	return generatePreviewToken({
-		contentId: `visual-editing:${userId}`,
-		expiresIn: "5m",
-		secret: visualActionSecret(previewSecret)
-	});
-}
-async function verifyVisualEditingActionToken(token, previewSecret, userId) {
-	const verification = await verifyPreviewToken({
-		token,
-		secret: visualActionSecret(previewSecret)
-	});
-	return verification.valid && verification.payload.cid === `visual-editing:${userId}`;
-}
-
-//#endregion
-export { generateVisualEditingActionToken as n, verifyVisualEditingActionToken as r, VISUAL_ACTION_TOKEN_INVALID as t };
-//# sourceMappingURL=action-token-D2KE1Rqf.mjs.map

package/dist/action-token-D2KE1Rqf.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"action-token-D2KE1Rqf.mjs","names":[],"sources":["../src/visual-editing/action-token.ts"],"sourcesContent":["import { generatePreviewToken, verifyPreviewToken } from \"../preview/tokens.js\";\n\nconst VISUAL_ACTION_SECRET_DOMAIN = \"emdash:visual-editing-action:v1:\";\nexport const VISUAL_ACTION_TOKEN_INVALID = \"VISUAL_ACTION_TOKEN_INVALID\";\n\nfunction visualActionSecret(previewSecret: string): string {\n\treturn `${VISUAL_ACTION_SECRET_DOMAIN}${previewSecret}`;\n}\n\nexport function generateVisualEditingActionToken(\n\tpreviewSecret: string,\n\tuserId: string,\n): Promise<string> {\n\treturn generatePreviewToken({\n\t\tcontentId: `visual-editing:${userId}`,\n\t\texpiresIn: \"5m\",\n\t\tsecret: visualActionSecret(previewSecret),\n\t});\n}\n\nexport async function verifyVisualEditingActionToken(\n\ttoken: string,\n\tpreviewSecret: string,\n\tuserId: string,\n): Promise<boolean> {\n\tconst verification = await verifyPreviewToken({\n\t\ttoken,\n\t\tsecret: visualActionSecret(previewSecret),\n\t});\n\treturn verification.valid && verification.payload.cid === `visual-editing:${userId}`;\n}\n"],"mappings":";;;AAEA,MAAM,8BAA8B;AACpC,MAAa,8BAA8B;AAE3C,SAAS,mBAAmB,eAA+B;AAC1D,QAAO,GAAG,8BAA8B;;AAGzC,SAAgB,iCACf,eACA,QACkB;AAClB,QAAO,qBAAqB;EAC3B,WAAW,kBAAkB;EAC7B,WAAW;EACX,QAAQ,mBAAmB,cAAc;EACzC,CAAC;;AAGH,eAAsB,+BACrB,OACA,eACA,QACmB;CACnB,MAAM,eAAe,MAAM,mBAAmB;EAC7C;EACA,QAAQ,mBAAmB,cAAc;EACzC,CAAC;AACF,QAAO,aAAa,SAAS,aAAa,QAAQ,QAAQ,kBAAkB"}