emdash 1.0.1 → 1.2.0

package/dist/settings-GaZ5sVgg.mjs

@@ -0,0 +1,73 @@
+//#region src/transfer/format/settings.ts
+/**
+* Classification of `options` rows for site transfer.
+*
+* - `portable`: exported as `setting` records (explicit allowlist, never a
+*   prefix match).
+* - `targetLocal`: belongs to the target installation and is never exported
+*   or overwritten by an import.
+* - `excluded`: everything else (secrets, runtime state, plugin options).
+*/
+const PORTABLE_SETTING_NAMES = [
+	"emdash:locale",
+	"emdash:site_tagline",
+	"emdash:site_title",
+	"site:dateFormat",
+	"site:favicon",
+	"site:logo",
+	"site:postsPerPage",
+	"site:seo",
+	"site:social",
+	"site:tagline",
+	"site:timezone",
+	"site:title"
+];
+const PORTABLE_SETTINGS = new Set(PORTABLE_SETTING_NAMES);
+const TARGET_LOCAL_SETTING_NAMES = new Set([
+	"site:url",
+	"emdash:site_url",
+	"emdash:site_id"
+]);
+const TARGET_LOCAL_SETTING_PREFIXES = ["emdash:setup_", "emdash:backups"];
+/** Settings whose value is a plan decision rather than always taken from the package. */
+const DECIDED_SETTING_NAMES = {
+	title: ["site:title", "emdash:site_title"],
+	tagline: ["site:tagline", "emdash:site_tagline"]
+};
+/** Options the importer resets after writing settings. */
+const POST_IMPORT_OPTION_RESETS = {
+	bumpVersion: ["byline_fields_version"],
+	delete: ["_redirect_loop_ids"]
+};
+function isPortableSettingName(name) {
+	return PORTABLE_SETTINGS.has(name);
+}
+function classifySetting(name) {
+	if (PORTABLE_SETTINGS.has(name)) return "portable";
+	if (TARGET_LOCAL_SETTING_NAMES.has(name)) return "targetLocal";
+	if (TARGET_LOCAL_SETTING_PREFIXES.some((prefix) => name.startsWith(prefix))) return "targetLocal";
+	return "excluded";
+}
+/** Settings whose stored value is a `{ mediaId, alt? }` media reference, and where. */
+const SETTING_MEDIA_REFERENCE_PATHS = Object.freeze({
+	"site:logo": [["mediaId"]],
+	"site:favicon": [["mediaId"]],
+	"site:seo": [["defaultOgImage", "mediaId"]]
+});
+/** Media ids referenced by a portable setting's value. */
+function settingMediaIds(name, value) {
+	if (!isPortableSettingName(name)) return [];
+	const paths = SETTING_MEDIA_REFERENCE_PATHS[name];
+	if (!paths) return [];
+	const ids = [];
+	for (const path of paths) {
+		let current = value;
+		for (const segment of path) current = current !== null && typeof current === "object" && !Array.isArray(current) && Object.hasOwn(current, segment) ? Reflect.get(current, segment) : void 0;
+		if (typeof current === "string" && current.length > 0) ids.push(current);
+	}
+	return ids;
+}
+
+//#endregion
+export { settingMediaIds as a, classifySetting as i, PORTABLE_SETTING_NAMES as n, POST_IMPORT_OPTION_RESETS as r, DECIDED_SETTING_NAMES as t };
+//# sourceMappingURL=settings-GaZ5sVgg.mjs.map

package/dist/settings-GaZ5sVgg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-GaZ5sVgg.mjs","names":[],"sources":["../src/transfer/format/settings.ts"],"sourcesContent":["/**\n * Classification of `options` rows for site transfer.\n *\n * - `portable`: exported as `setting` records (explicit allowlist, never a\n *   prefix match).\n * - `targetLocal`: belongs to the target installation and is never exported\n *   or overwritten by an import.\n * - `excluded`: everything else (secrets, runtime state, plugin options).\n */\n\nexport const PORTABLE_SETTING_NAMES = [\n\t\"emdash:locale\",\n\t\"emdash:site_tagline\",\n\t\"emdash:site_title\",\n\t\"site:dateFormat\",\n\t\"site:favicon\",\n\t\"site:logo\",\n\t\"site:postsPerPage\",\n\t\"site:seo\",\n\t\"site:social\",\n\t\"site:tagline\",\n\t\"site:timezone\",\n\t\"site:title\",\n] as const;\n\nexport type PortableSettingName = (typeof PORTABLE_SETTING_NAMES)[number];\n\nconst PORTABLE_SETTINGS: ReadonlySet<string> = new Set(PORTABLE_SETTING_NAMES);\n\nconst TARGET_LOCAL_SETTING_NAMES: ReadonlySet<string> = new Set([\n\t\"site:url\",\n\t\"emdash:site_url\",\n\t\"emdash:site_id\",\n]);\n\nconst TARGET_LOCAL_SETTING_PREFIXES = [\"emdash:setup_\", \"emdash:backups\"] as const;\n\n/** Settings whose value is a plan decision rather than always taken from the package. */\nexport const DECIDED_SETTING_NAMES = {\n\ttitle: [\"site:title\", \"emdash:site_title\"],\n\ttagline: [\"site:tagline\", \"emdash:site_tagline\"],\n} as const satisfies Record<string, readonly PortableSettingName[]>;\n\n/** Options the importer resets after writing settings. */\nexport const POST_IMPORT_OPTION_RESETS = {\n\tbumpVersion: [\"byline_fields_version\"],\n\tdelete: [\"_redirect_loop_ids\"],\n} as const;\n\nexport type SettingClass = \"portable\" | \"targetLocal\" | \"excluded\";\n\nexport function isPortableSettingName(name: string): name is PortableSettingName {\n\treturn PORTABLE_SETTINGS.has(name);\n}\n\nexport function classifySetting(name: string): SettingClass {\n\tif (PORTABLE_SETTINGS.has(name)) return \"portable\";\n\tif (TARGET_LOCAL_SETTING_NAMES.has(name)) return \"targetLocal\";\n\tif (TARGET_LOCAL_SETTING_PREFIXES.some((prefix) => name.startsWith(prefix))) {\n\t\treturn \"targetLocal\";\n\t}\n\treturn \"excluded\";\n}\n\n/** Settings whose stored value is a `{ mediaId, alt? }` media reference, and where. */\nexport const SETTING_MEDIA_REFERENCE_PATHS: Readonly<\n\tPartial<Record<PortableSettingName, readonly (readonly string[])[]>>\n> = Object.freeze({\n\t\"site:logo\": [[\"mediaId\"]],\n\t\"site:favicon\": [[\"mediaId\"]],\n\t\"site:seo\": [[\"defaultOgImage\", \"mediaId\"]],\n});\n\n/** Media ids referenced by a portable setting's value. */\nexport function settingMediaIds(name: string, value: unknown): string[] {\n\tif (!isPortableSettingName(name)) return [];\n\tconst paths = SETTING_MEDIA_REFERENCE_PATHS[name];\n\tif (!paths) return [];\n\tconst ids: string[] = [];\n\tfor (const path of paths) {\n\t\tlet current: unknown = value;\n\t\tfor (const segment of path) {\n\t\t\tcurrent =\n\t\t\t\tcurrent !== null &&\n\t\t\t\ttypeof current === \"object\" &&\n\t\t\t\t!Array.isArray(current) &&\n\t\t\t\tObject.hasOwn(current, segment)\n\t\t\t\t\t? Reflect.get(current, segment)\n\t\t\t\t\t: undefined;\n\t\t}\n\t\tif (typeof current === \"string\" && current.length > 0) ids.push(current);\n\t}\n\treturn ids;\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAa,yBAAyB;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAM,oBAAyC,IAAI,IAAI,uBAAuB;AAE9E,MAAM,6BAAkD,IAAI,IAAI;CAC/D;CACA;CACA;CACA,CAAC;AAEF,MAAM,gCAAgC,CAAC,iBAAiB,iBAAiB;;AAGzE,MAAa,wBAAwB;CACpC,OAAO,CAAC,cAAc,oBAAoB;CAC1C,SAAS,CAAC,gBAAgB,sBAAsB;CAChD;;AAGD,MAAa,4BAA4B;CACxC,aAAa,CAAC,wBAAwB;CACtC,QAAQ,CAAC,qBAAqB;CAC9B;AAID,SAAgB,sBAAsB,MAA2C;AAChF,QAAO,kBAAkB,IAAI,KAAK;;AAGnC,SAAgB,gBAAgB,MAA4B;AAC3D,KAAI,kBAAkB,IAAI,KAAK,CAAE,QAAO;AACxC,KAAI,2BAA2B,IAAI,KAAK,CAAE,QAAO;AACjD,KAAI,8BAA8B,MAAM,WAAW,KAAK,WAAW,OAAO,CAAC,CAC1E,QAAO;AAER,QAAO;;;AAIR,MAAa,gCAET,OAAO,OAAO;CACjB,aAAa,CAAC,CAAC,UAAU,CAAC;CAC1B,gBAAgB,CAAC,CAAC,UAAU,CAAC;CAC7B,YAAY,CAAC,CAAC,kBAAkB,UAAU,CAAC;CAC3C,CAAC;;AAGF,SAAgB,gBAAgB,MAAc,OAA0B;AACvE,KAAI,CAAC,sBAAsB,KAAK,CAAE,QAAO,EAAE;CAC3C,MAAM,QAAQ,8BAA8B;AAC5C,KAAI,CAAC,MAAO,QAAO,EAAE;CACrB,MAAM,MAAgB,EAAE;AACxB,MAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,UAAmB;AACvB,OAAK,MAAM,WAAW,KACrB,WACC,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,QAAQ,IACvB,OAAO,OAAO,SAAS,QAAQ,GAC5B,QAAQ,IAAI,SAAS,QAAQ,GAC7B;AAEL,MAAI,OAAO,YAAY,YAAY,QAAQ,SAAS,EAAG,KAAI,KAAK,QAAQ;;AAEzE,QAAO"}

package/dist/setup-complete-DidMAWJS.mjs

@@ -0,0 +1,65 @@
+import { u as isPostgres } from "./dialect-helpers-7_IqPdh9.mjs";
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+import { Role } from "@emdash-cms/auth";
+
+//#region src/api/setup-complete.ts
+/**
+* Shared setup completion logic.
+*
+* Called by OAuth callbacks and the passkey verify step when the first user
+* is created during setup. Persists site title/tagline from setup state
+* and marks setup as complete.
+*/
+const FIRST_ADMIN_LOCK_KEY = 1168624764;
+/**
+* Create the first admin only while the users table is empty.
+*
+* Returns null when a user already exists, including one created by a
+* concurrent call after the caller's own zero-users check. On Postgres the
+* insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see
+* another transaction's uncommitted row under READ COMMITTED.
+*/
+async function createFirstAdmin(db, input) {
+	const admin = {
+		id: ulid(),
+		email: input.email.toLowerCase(),
+		name: input.name,
+		role: Role.ADMIN
+	};
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const insert = async (executor) => sql`
+			INSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)
+			SELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}
+			WHERE NOT EXISTS (SELECT 1 FROM users)
+			RETURNING id
+		`.execute(executor);
+	return (isPostgres(db) ? await db.transaction().execute(async (trx) => {
+		await sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);
+		return insert(trx);
+	}) : await insert(db)).rows.length > 0 ? admin : null;
+}
+/**
+* Finalize setup after the first admin user is created.
+*
+* Reads the setup_state option (written by the setup wizard's step 1),
+* persists site_title and site_tagline, then marks setup complete.
+*
+* Safe to call multiple times — checks setup_complete first and no-ops
+* if already done.
+*/
+async function finalizeSetup(db) {
+	const options = new OptionsRepository(db);
+	const setupComplete = await options.get("emdash:setup_complete");
+	if (setupComplete === true || setupComplete === "true") return;
+	const setupState = await options.get("emdash:setup_state");
+	if (setupState?.title && typeof setupState.title === "string") await options.set("emdash:site_title", setupState.title);
+	if (setupState?.tagline && typeof setupState.tagline === "string") await options.set("emdash:site_tagline", setupState.tagline);
+	await options.set("emdash:setup_complete", true);
+	await options.delete("emdash:setup_state");
+}
+
+//#endregion
+export { finalizeSetup as n, createFirstAdmin as t };
+//# sourceMappingURL=setup-complete-DidMAWJS.mjs.map

package/dist/setup-complete-DidMAWJS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-complete-DidMAWJS.mjs","names":[],"sources":["../src/api/setup-complete.ts"],"sourcesContent":["/**\n * Shared setup completion logic.\n *\n * Called by OAuth callbacks and the passkey verify step when the first user\n * is created during setup. Persists site title/tagline from setup state\n * and marks setup as complete.\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { sql, type Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { isPostgres } from \"../database/dialect-helpers.js\";\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\n\nexport const FIRST_ADMIN_LOCK_KEY = 1_168_624_764;\n\nexport interface FirstAdmin {\n\tid: string;\n\temail: string;\n\tname: string | null;\n\trole: typeof Role.ADMIN;\n}\n\n/**\n * Create the first admin only while the users table is empty.\n *\n * Returns null when a user already exists, including one created by a\n * concurrent call after the caller's own zero-users check. On Postgres the\n * insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see\n * another transaction's uncommitted row under READ COMMITTED.\n */\nexport async function createFirstAdmin(\n\tdb: Kysely<Database>,\n\tinput: { email: string; name: string | null },\n): Promise<FirstAdmin | null> {\n\tconst admin: FirstAdmin = {\n\t\tid: ulid(),\n\t\temail: input.email.toLowerCase(),\n\t\tname: input.name,\n\t\trole: Role.ADMIN,\n\t};\n\tconst now = new Date().toISOString();\n\tconst insert = async (executor: Kysely<Database>) =>\n\t\tsql<{ id: string }>`\n\t\t\tINSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)\n\t\t\tSELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}\n\t\t\tWHERE NOT EXISTS (SELECT 1 FROM users)\n\t\t\tRETURNING id\n\t\t`.execute(executor);\n\n\tconst result = isPostgres(db)\n\t\t? await db.transaction().execute(async (trx) => {\n\t\t\t\tawait sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);\n\t\t\t\treturn insert(trx);\n\t\t\t})\n\t\t: await insert(db);\n\treturn result.rows.length > 0 ? admin : null;\n}\n\n/**\n * Finalize setup after the first admin user is created.\n *\n * Reads the setup_state option (written by the setup wizard's step 1),\n * persists site_title and site_tagline, then marks setup complete.\n *\n * Safe to call multiple times — checks setup_complete first and no-ops\n * if already done.\n */\nexport async function finalizeSetup(db: Kysely<Database>): Promise<void> {\n\tconst options = new OptionsRepository(db);\n\n\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\tif (setupComplete === true || setupComplete === \"true\") return;\n\n\t// Persist site title/tagline from setup state (stored in step 1)\n\tconst setupState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\tif (setupState?.title && typeof setupState.title === \"string\") {\n\t\tawait options.set(\"emdash:site_title\", setupState.title);\n\t}\n\tif (setupState?.tagline && typeof setupState.tagline === \"string\") {\n\t\tawait options.set(\"emdash:site_tagline\", setupState.tagline);\n\t}\n\n\tawait options.set(\"emdash:setup_complete\", true);\n\tawait options.delete(\"emdash:setup_state\");\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAa,uBAAuB;;;;;;;;;AAiBpC,eAAsB,iBACrB,IACA,OAC6B;CAC7B,MAAM,QAAoB;EACzB,IAAI,MAAM;EACV,OAAO,MAAM,MAAM,aAAa;EAChC,MAAM,MAAM;EACZ,MAAM,KAAK;EACX;CACD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CACpC,MAAM,SAAS,OAAO,aACrB,GAAmB;;YAET,MAAM,GAAG,IAAI,MAAM,MAAM,IAAI,MAAM,KAAK,SAAS,MAAM,KAAK,mBAAmB,IAAI,IAAI,IAAI;;;IAGnG,QAAQ,SAAS;AAQpB,SANe,WAAW,GAAG,GAC1B,MAAM,GAAG,aAAa,CAAC,QAAQ,OAAO,QAAQ;AAC9C,QAAM,GAAG,gCAAgC,qBAAqB,GAAG,QAAQ,IAAI;AAC7E,SAAO,OAAO,IAAI;GACjB,GACD,MAAM,OAAO,GAAG,EACL,KAAK,SAAS,IAAI,QAAQ;;;;;;;;;;;AAYzC,eAAsB,cAAc,IAAqC;CACxE,MAAM,UAAU,IAAI,kBAAkB,GAAG;CAEzC,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAChE,KAAI,kBAAkB,QAAQ,kBAAkB,OAAQ;CAGxD,MAAM,aAAa,MAAM,QAAQ,IAA6B,qBAAqB;AACnF,KAAI,YAAY,SAAS,OAAO,WAAW,UAAU,SACpD,OAAM,QAAQ,IAAI,qBAAqB,WAAW,MAAM;AAEzD,KAAI,YAAY,WAAW,OAAO,WAAW,YAAY,SACxD,OAAM,QAAQ,IAAI,uBAAuB,WAAW,QAAQ;AAG7D,OAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,OAAM,QAAQ,OAAO,qBAAqB"}

package/dist/setup-nonce-DKl4S4c6.mjs

@@ -0,0 +1,25 @@
+//#region src/auth/setup-nonce.ts
+/**
+* Session binding for the first-setup admin-creation flow.
+*
+* Shared constants for the nonce cookie that ties /_emdash/api/setup/admin
+* and /_emdash/api/setup/admin/verify to the same browser. Without this
+* binding, any unauthenticated caller could POST /setup/admin during the
+* setup window and substitute their own email into the stored setup state
+* before the legitimate admin completes passkey verification.
+*
+* Implementation lives in the two route handlers; this module is just
+* the name / lifetime so both ends agree.
+*/
+/** Cookie name carrying the setup-admin session nonce. */
+const SETUP_NONCE_COOKIE = "emdash_setup_nonce";
+/**
+* Cookie max-age in seconds. One hour is plenty of time to complete
+* a passkey registration; if the user lingers longer the admin step
+* can simply be retried.
+*/
+const SETUP_NONCE_MAX_AGE_SECONDS = 3600;
+
+//#endregion
+export { SETUP_NONCE_MAX_AGE_SECONDS as n, SETUP_NONCE_COOKIE as t };
+//# sourceMappingURL=setup-nonce-DKl4S4c6.mjs.map

package/dist/setup-nonce-DKl4S4c6.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-nonce-DKl4S4c6.mjs","names":[],"sources":["../src/auth/setup-nonce.ts"],"sourcesContent":["/**\n * Session binding for the first-setup admin-creation flow.\n *\n * Shared constants for the nonce cookie that ties /_emdash/api/setup/admin\n * and /_emdash/api/setup/admin/verify to the same browser. Without this\n * binding, any unauthenticated caller could POST /setup/admin during the\n * setup window and substitute their own email into the stored setup state\n * before the legitimate admin completes passkey verification.\n *\n * Implementation lives in the two route handlers; this module is just\n * the name / lifetime so both ends agree.\n */\n\n/** Cookie name carrying the setup-admin session nonce. */\nexport const SETUP_NONCE_COOKIE = \"emdash_setup_nonce\";\n\n/**\n * Cookie max-age in seconds. One hour is plenty of time to complete\n * a passkey registration; if the user lingers longer the admin step\n * can simply be retried.\n */\nexport const SETUP_NONCE_MAX_AGE_SECONDS = 60 * 60;\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,qBAAqB;;;;;;AAOlC,MAAa,8BAA8B"}

package/dist/single-flight-cache-D0EaGbN1.mjs

@@ -0,0 +1,104 @@
+import { n as initWithLock, t as createInitLock } from "./init-lock-BGmew3r1.mjs";
+
+//#region src/utils/single-flight-cache.ts
+/**
+* Global-scope async value cache with single-flight and poison-immunity.
+*
+* Built for the "compute once for the lifetime of the JS global scope, read
+* on every request" caches (site settings, search-health verification, ...).
+* That global scope is the process on Node and the isolate on Cloudflare
+* Workers — this helper is platform-neutral; the hazard it defends against is
+* specific to workerd but the cache itself is not.
+*
+* These caches must coalesce concurrent cold reads into one query — but the
+* obvious way to do that, caching the in-flight *promise* on a global and
+* awaiting it from later requests, is unsafe on workerd: if the request that
+* created the promise is cancelled mid-await (client disconnect, context
+* teardown), its continuation never runs, so the promise neither resolves nor
+* rejects. Every later request that awaits that shared promise then hangs
+* until the isolate is evicted (observed as 524s at the 100s wall, near-zero
+* CPU). A `.catch`/`.finally` that clears the cache doesn't help — a cancelled
+* request settles neither way.
+*
+* This cache stores the resolved *value* (not a promise) and coalesces via
+* `initWithLock`: one request becomes the owner and runs `fetch`, everyone
+* else polls for the published value and never awaits the owner's promise.
+* A cancelled owner can therefore never strand a waiter — the worst case is
+* the lock looks held until `deadlineMs`, then the next caller reclaims. The
+* owner's `fetch` is also anchored (waitUntil) so a cancelled originator's
+* query still completes and populates the cache, and bounded by
+* `ownerTimeoutMs` so a genuinely stuck fetch reclaims instead of hanging.
+*
+* Invalidation bumps `version`; reads compare against the version captured at
+* call time and refetch on mismatch.
+*/
+function createSingleFlightCache() {
+	return {
+		value: null,
+		hasValue: false,
+		version: 0,
+		valueVersion: -1,
+		lock: createInitLock()
+	};
+}
+/**
+* Force the next `singleFlightCached` call to refetch. An in-flight owner
+* fetched at the old version will not publish into the new version, so its
+* result is ignored by subsequent reads.
+*/
+function invalidateSingleFlightCache(cache) {
+	cache.version++;
+	cache.hasValue = false;
+	cache.value = null;
+	cache.valueVersion = -1;
+	cache.lock.ownerStartedAt = null;
+}
+/**
+* Headroom between the owner's own timeout and the waiter reclaim deadline.
+* The reclaim deadline must sit *above* `ownerTimeoutMs` so a slow-but-live
+* owner times out (and releases the lock) before a waiter would reclaim it —
+* otherwise a fetch slower than the deadline is superseded before it can
+* publish, and steady traffic turns that into a self-sustaining stampede.
+*/
+const RECLAIM_HEADROOM_MS = 5e3;
+function withTimeout(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`singleFlightCached: owner fetch exceeded ${ms}ms`));
+		}, ms);
+		promise.then(resolve, reject).finally(() => {
+			clearTimeout(timer);
+		});
+	});
+}
+/**
+* Return the cached value for `cache`, computing it via `fetch` under a
+* single-flight lock on a miss. Concurrent callers coalesce onto one fetch;
+* a cancelled owner cannot poison later callers (see file header).
+*/
+function singleFlightCached(cache, fetch, options = {}) {
+	const versionAtCall = cache.version;
+	const ownerTimeoutMs = options.ownerTimeoutMs !== void 0 && Number.isFinite(options.ownerTimeoutMs) && options.ownerTimeoutMs > 0 ? options.ownerTimeoutMs : void 0;
+	const deadlineMs = ownerTimeoutMs === void 0 ? options.deadlineMs : Math.max(options.deadlineMs ?? 0, ownerTimeoutMs + RECLAIM_HEADROOM_MS);
+	return initWithLock(cache.lock, () => cache.hasValue && cache.valueVersion === versionAtCall ? { v: cache.value } : null, (isCurrentClaim) => {
+		const real = (async () => {
+			const value = await fetch();
+			if (isCurrentClaim()) {
+				cache.value = value;
+				cache.hasValue = true;
+				cache.valueVersion = versionAtCall;
+			}
+			return { v: value };
+		})();
+		options.anchor?.(real.then(() => void 0, () => void 0));
+		return ownerTimeoutMs === void 0 ? real : withTimeout(real, ownerTimeoutMs);
+	}, {
+		deadlineMs,
+		pollMs: options.pollMs,
+		maxWaitMs: options.maxWaitMs
+	}).then((box) => box.v);
+}
+
+//#endregion
+export { invalidateSingleFlightCache as n, singleFlightCached as r, createSingleFlightCache as t };
+//# sourceMappingURL=single-flight-cache-D0EaGbN1.mjs.map

package/dist/single-flight-cache-D0EaGbN1.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-flight-cache-D0EaGbN1.mjs","names":[],"sources":["../src/utils/single-flight-cache.ts"],"sourcesContent":["/**\n * Global-scope async value cache with single-flight and poison-immunity.\n *\n * Built for the \"compute once for the lifetime of the JS global scope, read\n * on every request\" caches (site settings, search-health verification, ...).\n * That global scope is the process on Node and the isolate on Cloudflare\n * Workers — this helper is platform-neutral; the hazard it defends against is\n * specific to workerd but the cache itself is not.\n *\n * These caches must coalesce concurrent cold reads into one query — but the\n * obvious way to do that, caching the in-flight *promise* on a global and\n * awaiting it from later requests, is unsafe on workerd: if the request that\n * created the promise is cancelled mid-await (client disconnect, context\n * teardown), its continuation never runs, so the promise neither resolves nor\n * rejects. Every later request that awaits that shared promise then hangs\n * until the isolate is evicted (observed as 524s at the 100s wall, near-zero\n * CPU). A `.catch`/`.finally` that clears the cache doesn't help — a cancelled\n * request settles neither way.\n *\n * This cache stores the resolved *value* (not a promise) and coalesces via\n * `initWithLock`: one request becomes the owner and runs `fetch`, everyone\n * else polls for the published value and never awaits the owner's promise.\n * A cancelled owner can therefore never strand a waiter — the worst case is\n * the lock looks held until `deadlineMs`, then the next caller reclaims. The\n * owner's `fetch` is also anchored (waitUntil) so a cancelled originator's\n * query still completes and populates the cache, and bounded by\n * `ownerTimeoutMs` so a genuinely stuck fetch reclaims instead of hanging.\n *\n * Invalidation bumps `version`; reads compare against the version captured at\n * call time and refetch on mismatch.\n */\n\nimport { createInitLock, type InitLock, initWithLock } from \"./init-lock.js\";\n\nexport interface SingleFlightCache<T> {\n\t/** Last resolved value, valid only when `hasValue` is true. */\n\tvalue: T | null;\n\t/**\n\t * Presence flag, separate from `value` so that falsy/`undefined`/`void`\n\t * results cache correctly (a plain null check can't distinguish \"cached\n\t * undefined\" from \"never fetched\").\n\t */\n\thasValue: boolean;\n\t/** Invalidation counter; bumped by `invalidateSingleFlightCache`. */\n\tversion: number;\n\t/** The `version` the cached value was fetched at. */\n\tvalueVersion: number;\n\t/** Reclaimable single-flight lock (see init-lock.ts). */\n\tlock: InitLock;\n}\n\nexport function createSingleFlightCache<T>(): SingleFlightCache<T> {\n\treturn { value: null, hasValue: false, version: 0, valueVersion: -1, lock: createInitLock() };\n}\n\n/**\n * Force the next `singleFlightCached` call to refetch. An in-flight owner\n * fetched at the old version will not publish into the new version, so its\n * result is ignored by subsequent reads.\n */\nexport function invalidateSingleFlightCache(cache: SingleFlightCache<unknown>): void {\n\tcache.version++;\n\tcache.hasValue = false;\n\tcache.value = null;\n\tcache.valueVersion = -1;\n\t// Free the single-flight lock so a reader at the new version starts the\n\t// refetch immediately instead of waiting out a stale owner's deadline. A\n\t// still-running old-version owner can neither publish into the new version\n\t// (version gate) nor clobber a new owner (claim gate), so releasing here\n\t// is safe; the worst case is one brief duplicate fetch.\n\tcache.lock.ownerStartedAt = null;\n}\n\n/**\n * Headroom between the owner's own timeout and the waiter reclaim deadline.\n * The reclaim deadline must sit *above* `ownerTimeoutMs` so a slow-but-live\n * owner times out (and releases the lock) before a waiter would reclaim it —\n * otherwise a fetch slower than the deadline is superseded before it can\n * publish, and steady traffic turns that into a self-sustaining stampede.\n */\nconst RECLAIM_HEADROOM_MS = 5_000;\n\nexport interface SingleFlightCachedOptions {\n\t/**\n\t * Hand the in-flight fetch to the host's lifetime extender (waitUntil via\n\t * `after()`), so a cancelled originating request still drives it to\n\t * completion and populates the cache.\n\t */\n\tanchor?: (promise: Promise<void>) => void;\n\t/** Reclaim the single-flight lock if the owner holds it past this. */\n\tdeadlineMs?: number;\n\t/** Waiter poll interval. */\n\tpollMs?: number;\n\t/** Waiter gives up and throws after this long rather than hanging. */\n\tmaxWaitMs?: number;\n\t/**\n\t * Bound the owner's own `fetch`: if it doesn't settle within this, the\n\t * owner rejects (and releases the lock) instead of waiting indefinitely.\n\t * The anchored copy keeps running, so a slow-but-live fetch can still\n\t * publish for a later caller. Omit to leave the owner unbounded.\n\t */\n\townerTimeoutMs?: number;\n}\n\n/** Boxed cache hit so a `void`/falsy value is still distinguishable from a miss. */\ninterface Box<T> {\n\tv: T;\n}\n\nfunction withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {\n\treturn new Promise<T>((resolve, reject) => {\n\t\tconst timer = setTimeout(() => {\n\t\t\treject(new Error(`singleFlightCached: owner fetch exceeded ${ms}ms`));\n\t\t}, ms);\n\t\t// Settle from the underlying promise (whichever wins the race with the\n\t\t// timer), and always clear the timer so a resolved fetch doesn't leave\n\t\t// a pending timeout holding the isolate alive.\n\t\tpromise.then(resolve, reject).finally(() => {\n\t\t\tclearTimeout(timer);\n\t\t});\n\t});\n}\n\n/**\n * Return the cached value for `cache`, computing it via `fetch` under a\n * single-flight lock on a miss. Concurrent callers coalesce onto one fetch;\n * a cancelled owner cannot poison later callers (see file header).\n */\nexport function singleFlightCached<T>(\n\tcache: SingleFlightCache<T>,\n\tfetch: () => Promise<T>,\n\toptions: SingleFlightCachedOptions = {},\n): Promise<T> {\n\t// Capture the version once: a value published at this version satisfies\n\t// this call; an invalidation that lands mid-fetch makes the published\n\t// value stale for *later* calls (which captured the newer version) but\n\t// still valid for this one.\n\tconst versionAtCall = cache.version;\n\n\t// Ignore a non-positive / non-finite owner timeout rather than letting it\n\t// degenerate into an instant-reject (setTimeout coerces NaN/0 to ~0ms).\n\tconst ownerTimeoutMs =\n\t\toptions.ownerTimeoutMs !== undefined &&\n\t\tNumber.isFinite(options.ownerTimeoutMs) &&\n\t\toptions.ownerTimeoutMs > 0\n\t\t\t? options.ownerTimeoutMs\n\t\t\t: undefined;\n\n\t// Keep the reclaim deadline above the owner timeout (see RECLAIM_HEADROOM_MS):\n\t// the owner's own timeout, not a waiter reclaim, is the primary release.\n\tconst deadlineMs =\n\t\townerTimeoutMs === undefined\n\t\t\t? options.deadlineMs\n\t\t\t: Math.max(options.deadlineMs ?? 0, ownerTimeoutMs + RECLAIM_HEADROOM_MS);\n\n\treturn initWithLock<Box<T>>(\n\t\tcache.lock,\n\t\t() =>\n\t\t\tcache.hasValue && cache.valueVersion === versionAtCall\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- hasValue gates that `value` holds a real T\n\t\t\t\t\t({ v: cache.value as T } satisfies Box<T>)\n\t\t\t\t: null,\n\t\t(isCurrentClaim) => {\n\t\t\t// The real work, anchored independently so a cancelled owner's\n\t\t\t// fetch still settles and publishes. Publication is gated on the\n\t\t\t// claim so a reclaimed slow owner can't clobber the reclaimer's\n\t\t\t// value (same contract as initWithLock's own callers).\n\t\t\tconst real = (async (): Promise<Box<T>> => {\n\t\t\t\tconst value = await fetch();\n\t\t\t\tif (isCurrentClaim()) {\n\t\t\t\t\tcache.value = value;\n\t\t\t\t\tcache.hasValue = true;\n\t\t\t\t\tcache.valueVersion = versionAtCall;\n\t\t\t\t}\n\t\t\t\treturn { v: value };\n\t\t\t})();\n\t\t\t// Anchor the real fetch (not the timeout race): this is what must\n\t\t\t// survive a cancelled owner and run to publication. initWithLock is\n\t\t\t// left to manage only the lock; we don't double-anchor.\n\t\t\toptions.anchor?.(\n\t\t\t\treal.then(\n\t\t\t\t\t() => undefined,\n\t\t\t\t\t() => undefined,\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn ownerTimeoutMs === undefined ? real : withTimeout(real, ownerTimeoutMs);\n\t\t},\n\t\t{\n\t\t\tdeadlineMs,\n\t\t\tpollMs: options.pollMs,\n\t\t\tmaxWaitMs: options.maxWaitMs,\n\t\t},\n\t).then((box) => box.v);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,0BAAmD;AAClE,QAAO;EAAE,OAAO;EAAM,UAAU;EAAO,SAAS;EAAG,cAAc;EAAI,MAAM,gBAAgB;EAAE;;;;;;;AAQ9F,SAAgB,4BAA4B,OAAyC;AACpF,OAAM;AACN,OAAM,WAAW;AACjB,OAAM,QAAQ;AACd,OAAM,eAAe;AAMrB,OAAM,KAAK,iBAAiB;;;;;;;;;AAU7B,MAAM,sBAAsB;AA6B5B,SAAS,YAAe,SAAqB,IAAwB;AACpE,QAAO,IAAI,SAAY,SAAS,WAAW;EAC1C,MAAM,QAAQ,iBAAiB;AAC9B,0BAAO,IAAI,MAAM,4CAA4C,GAAG,IAAI,CAAC;KACnE,GAAG;AAIN,UAAQ,KAAK,SAAS,OAAO,CAAC,cAAc;AAC3C,gBAAa,MAAM;IAClB;GACD;;;;;;;AAQH,SAAgB,mBACf,OACA,OACA,UAAqC,EAAE,EAC1B;CAKb,MAAM,gBAAgB,MAAM;CAI5B,MAAM,iBACL,QAAQ,mBAAmB,UAC3B,OAAO,SAAS,QAAQ,eAAe,IACvC,QAAQ,iBAAiB,IACtB,QAAQ,iBACR;CAIJ,MAAM,aACL,mBAAmB,SAChB,QAAQ,aACR,KAAK,IAAI,QAAQ,cAAc,GAAG,iBAAiB,oBAAoB;AAE3E,QAAO,aACN,MAAM,YAEL,MAAM,YAAY,MAAM,iBAAiB,gBAEtC,EAAE,GAAG,MAAM,OAAY,GACvB,OACH,mBAAmB;EAKnB,MAAM,QAAQ,YAA6B;GAC1C,MAAM,QAAQ,MAAM,OAAO;AAC3B,OAAI,gBAAgB,EAAE;AACrB,UAAM,QAAQ;AACd,UAAM,WAAW;AACjB,UAAM,eAAe;;AAEtB,UAAO,EAAE,GAAG,OAAO;MAChB;AAIJ,UAAQ,SACP,KAAK,WACE,cACA,OACN,CACD;AACD,SAAO,mBAAmB,SAAY,OAAO,YAAY,MAAM,eAAe;IAE/E;EACC;EACA,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,CACD,CAAC,MAAM,QAAQ,IAAI,EAAE"}

package/dist/site-domain-CbI51Pc2.mjs

@@ -0,0 +1,113 @@
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { a as encodeBase64url } from "./base64-BQBZwXCx.mjs";
+import { l as setSiteSettings } from "./settings-B1jOxAIl.mjs";
+import { r as resolveAndValidateExternalUrl } from "./ssrf-LM_0wpGA.mjs";
+
+//#region src/api/handlers/site-domain.ts
+const DOMAIN_PROOF_PATH = "/_emdash/api/site/domain-proof";
+const PROOF_OPTION = "emdash:domain_proof";
+const PROOF_TTL_MS = 6e4;
+const CHECK_TIMEOUT_MS = 1e4;
+const IPV4_RE = /^\d{1,3}(\.\d{1,3}){3}$/;
+/**
+* Parse a bare hostname or an `https://` origin into an origin. Paths,
+* ports, credentials, IP addresses, and single-label hosts are rejected.
+*/
+function parseSiteDomain(input) {
+	const trimmed = input.trim();
+	const candidate = trimmed.includes("://") ? trimmed : `https://${trimmed}`;
+	if (!URL.canParse(candidate)) return void 0;
+	const url = new URL(candidate);
+	if (url.protocol !== "https:") return void 0;
+	if (url.username || url.password || url.port || url.search || url.hash) return void 0;
+	if (url.pathname !== "/") return void 0;
+	const host = url.hostname;
+	if (!host.includes(".") || host.endsWith(".") || host.startsWith("[") || IPV4_RE.test(host)) return;
+	return url.origin;
+}
+function checkFailed(message) {
+	return {
+		success: false,
+		error: {
+			code: "DOMAIN_CHECK_FAILED",
+			message
+		}
+	};
+}
+/**
+* Verify that `input` serves this site and store it as the Site URL.
+*/
+async function handleSiteDomainChange(db, input) {
+	const origin = parseSiteDomain(input);
+	if (!origin) return {
+		success: false,
+		error: {
+			code: "VALIDATION_ERROR",
+			message: "Enter a domain such as example.com, without a path or port"
+		}
+	};
+	const options = new OptionsRepository(db);
+	const token = encodeBase64url(crypto.getRandomValues(new Uint8Array(24)));
+	const proof = {
+		token,
+		expiresAt: Date.now() + PROOF_TTL_MS
+	};
+	const revision = await options.setVersioned(PROOF_OPTION, proof);
+	try {
+		const proofUrl = `${origin}${DOMAIN_PROOF_PATH}`;
+		try {
+			await resolveAndValidateExternalUrl(proofUrl);
+		} catch {
+			return checkFailed(`${new URL(origin).hostname} does not resolve to a public address`);
+		}
+		let response;
+		try {
+			response = await fetch(proofUrl, {
+				method: "POST",
+				redirect: "manual",
+				headers: {
+					Accept: "application/json",
+					"X-EmDash-Request": "1"
+				},
+				signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+			});
+		} catch {
+			return checkFailed(`Could not reach ${origin}`);
+		}
+		if (response.status >= 300 && response.status < 400) {
+			const location = response.headers.get("Location");
+			const target = location && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;
+			return checkFailed(target ? `${origin} redirects to ${target.origin}. Enter that address instead.` : `${origin} redirects elsewhere`);
+		}
+		const body = response.ok ? await response.json().catch(() => null) : null;
+		if ((body && typeof body === "object" && "data" in body && body.data && typeof body.data === "object" ? body.data.token : void 0) !== token) return checkFailed(`${origin} does not serve this site yet`);
+		await setSiteSettings({ url: origin }, db);
+		return {
+			success: true,
+			data: { url: origin }
+		};
+	} finally {
+		await db.deleteFrom("options").where("name", "=", PROOF_OPTION).where("revision", "=", revision).execute();
+	}
+}
+/**
+* Return the pending domain proof token, if a check is in progress.
+*/
+async function handleDomainProof(db) {
+	const proof = await new OptionsRepository(db).get(PROOF_OPTION);
+	if (!proof || typeof proof.token !== "string" || proof.expiresAt < Date.now()) return {
+		success: false,
+		error: {
+			code: "NOT_FOUND",
+			message: "No domain check in progress"
+		}
+	};
+	return {
+		success: true,
+		data: { token: proof.token }
+	};
+}
+
+//#endregion
+export { handleSiteDomainChange as n, handleDomainProof as t };
+//# sourceMappingURL=site-domain-CbI51Pc2.mjs.map

package/dist/site-domain-CbI51Pc2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-domain-CbI51Pc2.mjs","names":[],"sources":["../src/api/handlers/site-domain.ts"],"sourcesContent":["/**\n * Site domain handlers\n *\n * Changing the site's domain stores the new origin as the Site URL, which\n * links in emails and plugins, sitemaps, and absolute URLs in search and\n * social metadata use. Before it is stored, EmDash fetches a one-time token\n * from the new domain to prove the domain serves this site.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../../database/repositories/options.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { resolveAndValidateExternalUrl } from \"../../security/ssrf.js\";\nimport { setSiteSettings } from \"../../settings/index.js\";\nimport { encodeBase64url } from \"../../utils/base64.js\";\nimport type { ApiResult } from \"../types.js\";\n\nexport const DOMAIN_PROOF_PATH = \"/_emdash/api/site/domain-proof\";\n\nconst PROOF_OPTION = \"emdash:domain_proof\";\nconst PROOF_TTL_MS = 60_000;\nconst CHECK_TIMEOUT_MS = 10_000;\nconst IPV4_RE = /^\\d{1,3}(\\.\\d{1,3}){3}$/;\n\ninterface DomainProof {\n\ttoken: string;\n\texpiresAt: number;\n}\n\n/**\n * Parse a bare hostname or an `https://` origin into an origin. Paths,\n * ports, credentials, IP addresses, and single-label hosts are rejected.\n */\nexport function parseSiteDomain(input: string): string | undefined {\n\tconst trimmed = input.trim();\n\tconst candidate = trimmed.includes(\"://\") ? trimmed : `https://${trimmed}`;\n\tif (!URL.canParse(candidate)) return undefined;\n\tconst url = new URL(candidate);\n\tif (url.protocol !== \"https:\") return undefined;\n\tif (url.username || url.password || url.port || url.search || url.hash) return undefined;\n\tif (url.pathname !== \"/\") return undefined;\n\tconst host = url.hostname;\n\tif (!host.includes(\".\") || host.endsWith(\".\") || host.startsWith(\"[\") || IPV4_RE.test(host)) {\n\t\treturn undefined;\n\t}\n\treturn url.origin;\n}\n\nfunction checkFailed(message: string): ApiResult<never> {\n\treturn { success: false, error: { code: \"DOMAIN_CHECK_FAILED\", message } };\n}\n\n/**\n * Verify that `input` serves this site and store it as the Site URL.\n */\nexport async function handleSiteDomainChange(\n\tdb: Kysely<Database>,\n\tinput: string,\n): Promise<ApiResult<{ url: string }>> {\n\tconst origin = parseSiteDomain(input);\n\tif (!origin) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\tmessage: \"Enter a domain such as example.com, without a path or port\",\n\t\t\t},\n\t\t};\n\t}\n\n\tconst options = new OptionsRepository(db);\n\tconst token = encodeBase64url(crypto.getRandomValues(new Uint8Array(24)));\n\tconst proof: DomainProof = { token, expiresAt: Date.now() + PROOF_TTL_MS };\n\tconst revision = await options.setVersioned(PROOF_OPTION, proof);\n\n\ttry {\n\t\tconst proofUrl = `${origin}${DOMAIN_PROOF_PATH}`;\n\t\ttry {\n\t\t\tawait resolveAndValidateExternalUrl(proofUrl);\n\t\t} catch {\n\t\t\treturn checkFailed(`${new URL(origin).hostname} does not resolve to a public address`);\n\t\t}\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(proofUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\theaders: { Accept: \"application/json\", \"X-EmDash-Request\": \"1\" },\n\t\t\t\tsignal: AbortSignal.timeout(CHECK_TIMEOUT_MS),\n\t\t\t});\n\t\t} catch {\n\t\t\treturn checkFailed(`Could not reach ${origin}`);\n\t\t}\n\n\t\tif (response.status >= 300 && response.status < 400) {\n\t\t\tconst location = response.headers.get(\"Location\");\n\t\t\tconst target =\n\t\t\t\tlocation && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;\n\t\t\treturn checkFailed(\n\t\t\t\ttarget\n\t\t\t\t\t? `${origin} redirects to ${target.origin}. Enter that address instead.`\n\t\t\t\t\t: `${origin} redirects elsewhere`,\n\t\t\t);\n\t\t}\n\n\t\tconst body: unknown = response.ok ? await response.json().catch(() => null) : null;\n\t\tconst received =\n\t\t\tbody &&\n\t\t\ttypeof body === \"object\" &&\n\t\t\t\"data\" in body &&\n\t\t\tbody.data &&\n\t\t\ttypeof body.data === \"object\"\n\t\t\t\t? (body.data as { token?: unknown }).token\n\t\t\t\t: undefined;\n\t\tif (received !== token) {\n\t\t\treturn checkFailed(`${origin} does not serve this site yet`);\n\t\t}\n\n\t\tawait setSiteSettings({ url: origin }, db);\n\t\treturn { success: true, data: { url: origin } };\n\t} finally {\n\t\tawait db\n\t\t\t.deleteFrom(\"options\")\n\t\t\t.where(\"name\", \"=\", PROOF_OPTION)\n\t\t\t.where(\"revision\", \"=\", revision)\n\t\t\t.execute();\n\t}\n}\n\n/**\n * Return the pending domain proof token, if a check is in progress.\n */\nexport async function handleDomainProof(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<{ token: string }>> {\n\tconst proof = await new OptionsRepository(db).get<DomainProof>(PROOF_OPTION);\n\tif (!proof || typeof proof.token !== \"string\" || proof.expiresAt < Date.now()) {\n\t\treturn { success: false, error: { code: \"NOT_FOUND\", message: \"No domain check in progress\" } };\n\t}\n\treturn { success: true, data: { token: proof.token } };\n}\n"],"mappings":";;;;;;AAkBA,MAAa,oBAAoB;AAEjC,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,mBAAmB;AACzB,MAAM,UAAU;;;;;AAWhB,SAAgB,gBAAgB,OAAmC;CAClE,MAAM,UAAU,MAAM,MAAM;CAC5B,MAAM,YAAY,QAAQ,SAAS,MAAM,GAAG,UAAU,WAAW;AACjE,KAAI,CAAC,IAAI,SAAS,UAAU,CAAE,QAAO;CACrC,MAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,KAAI,IAAI,aAAa,SAAU,QAAO;AACtC,KAAI,IAAI,YAAY,IAAI,YAAY,IAAI,QAAQ,IAAI,UAAU,IAAI,KAAM,QAAO;AAC/E,KAAI,IAAI,aAAa,IAAK,QAAO;CACjC,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,QAAQ,KAAK,KAAK,CAC1F;AAED,QAAO,IAAI;;AAGZ,SAAS,YAAY,SAAmC;AACvD,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAuB;GAAS;EAAE;;;;;AAM3E,eAAsB,uBACrB,IACA,OACsC;CACtC,MAAM,SAAS,gBAAgB,MAAM;AACrC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;CAGF,MAAM,UAAU,IAAI,kBAAkB,GAAG;CACzC,MAAM,QAAQ,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC,CAAC;CACzE,MAAM,QAAqB;EAAE;EAAO,WAAW,KAAK,KAAK,GAAG;EAAc;CAC1E,MAAM,WAAW,MAAM,QAAQ,aAAa,cAAc,MAAM;AAEhE,KAAI;EACH,MAAM,WAAW,GAAG,SAAS;AAC7B,MAAI;AACH,SAAM,8BAA8B,SAAS;UACtC;AACP,UAAO,YAAY,GAAG,IAAI,IAAI,OAAO,CAAC,SAAS,uCAAuC;;EAGvF,IAAI;AACJ,MAAI;AACH,cAAW,MAAM,MAAM,UAAU;IAChC,QAAQ;IACR,UAAU;IACV,SAAS;KAAE,QAAQ;KAAoB,oBAAoB;KAAK;IAChE,QAAQ,YAAY,QAAQ,iBAAiB;IAC7C,CAAC;UACK;AACP,UAAO,YAAY,mBAAmB,SAAS;;AAGhD,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;GACpD,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;GACjD,MAAM,SACL,YAAY,IAAI,SAAS,UAAU,SAAS,GAAG,IAAI,IAAI,UAAU,SAAS,GAAG;AAC9E,UAAO,YACN,SACG,GAAG,OAAO,gBAAgB,OAAO,OAAO,iCACxC,GAAG,OAAO,sBACb;;EAGF,MAAM,OAAgB,SAAS,KAAK,MAAM,SAAS,MAAM,CAAC,YAAY,KAAK,GAAG;AAS9E,OAPC,QACA,OAAO,SAAS,YAChB,UAAU,QACV,KAAK,QACL,OAAO,KAAK,SAAS,WACjB,KAAK,KAA6B,QACnC,YACa,MAChB,QAAO,YAAY,GAAG,OAAO,+BAA+B;AAG7D,QAAM,gBAAgB,EAAE,KAAK,QAAQ,EAAE,GAAG;AAC1C,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,KAAK,QAAQ;GAAE;WACtC;AACT,QAAM,GACJ,WAAW,UAAU,CACrB,MAAM,QAAQ,KAAK,aAAa,CAChC,MAAM,YAAY,KAAK,SAAS,CAChC,SAAS;;;;;;AAOb,eAAsB,kBACrB,IACwC;CACxC,MAAM,QAAQ,MAAM,IAAI,kBAAkB,GAAG,CAAC,IAAiB,aAAa;AAC5E,KAAI,CAAC,SAAS,OAAO,MAAM,UAAU,YAAY,MAAM,YAAY,KAAK,KAAK,CAC5E,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAa,SAAS;GAA+B;EAAE;AAEhG,QAAO;EAAE,SAAS;EAAM,MAAM,EAAE,OAAO,MAAM,OAAO;EAAE"}

package/dist/site-settings-CDdT4mVm.mjs

@@ -0,0 +1,50 @@
+import { a as settingMediaIds } from "./settings-GaZ5sVgg.mjs";
+
+//#region src/media/usage/site-settings.ts
+/**
+* Media references held by site settings.
+*
+* Usage reads parse these from the stored `site:*` options on every read, so
+* a change through any writer of those options shows up on the next read.
+*/
+const MEDIA_USAGE_SITE_SETTINGS = [
+	"logo",
+	"favicon",
+	"seo.defaultOgImage"
+];
+/**
+* One setting per option, which holds while each option has a single path in
+* `SETTING_MEDIA_REFERENCE_PATHS`. A second path needs a setting of its own.
+*/
+const SITE_SETTING_OPTIONS = [
+	["site:logo", "logo"],
+	["site:favicon", "favicon"],
+	["site:seo", "seo.defaultOgImage"]
+];
+const MEDIA_USAGE_SITE_SETTING_OPTIONS = SITE_SETTING_OPTIONS.map(([option]) => option);
+/**
+* Group the site settings that select each media item, in settings order.
+*
+* @param options Raw JSON option values keyed by option name.
+*/
+function groupSiteSettingMediaUsage(options) {
+	const usage = /* @__PURE__ */ new Map();
+	for (const [option, setting] of SITE_SETTING_OPTIONS) for (const mediaId of settingMediaIds(option, parseOption(options.get(option)))) {
+		const settings = usage.get(mediaId);
+		if (settings) settings.push(setting);
+		else usage.set(mediaId, [setting]);
+	}
+	return usage;
+}
+function parseOption(value) {
+	if (value == null) return void 0;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+export { MEDIA_USAGE_SITE_SETTING_OPTIONS as n, groupSiteSettingMediaUsage as r, MEDIA_USAGE_SITE_SETTINGS as t };
+//# sourceMappingURL=site-settings-CDdT4mVm.mjs.map

package/dist/site-settings-CDdT4mVm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-settings-CDdT4mVm.mjs","names":[],"sources":["../src/media/usage/site-settings.ts"],"sourcesContent":["/**\n * Media references held by site settings.\n *\n * Usage reads parse these from the stored `site:*` options on every read, so\n * a change through any writer of those options shows up on the next read.\n */\n\nimport { settingMediaIds, type PortableSettingName } from \"../../transfer/format/settings.js\";\n\nexport const MEDIA_USAGE_SITE_SETTINGS = [\"logo\", \"favicon\", \"seo.defaultOgImage\"] as const;\n\nexport type MediaUsageSiteSetting = (typeof MEDIA_USAGE_SITE_SETTINGS)[number];\n\n/**\n * One setting per option, which holds while each option has a single path in\n * `SETTING_MEDIA_REFERENCE_PATHS`. A second path needs a setting of its own.\n */\nconst SITE_SETTING_OPTIONS = [\n\t[\"site:logo\", \"logo\"],\n\t[\"site:favicon\", \"favicon\"],\n\t[\"site:seo\", \"seo.defaultOgImage\"],\n] as const satisfies readonly (readonly [PortableSettingName, MediaUsageSiteSetting])[];\n\nexport const MEDIA_USAGE_SITE_SETTING_OPTIONS = SITE_SETTING_OPTIONS.map(([option]) => option);\n\n/**\n * Group the site settings that select each media item, in settings order.\n *\n * @param options Raw JSON option values keyed by option name.\n */\nexport function groupSiteSettingMediaUsage(\n\toptions: ReadonlyMap<string, string | null>,\n): Map<string, MediaUsageSiteSetting[]> {\n\tconst usage = new Map<string, MediaUsageSiteSetting[]>();\n\tfor (const [option, setting] of SITE_SETTING_OPTIONS) {\n\t\tfor (const mediaId of settingMediaIds(option, parseOption(options.get(option)))) {\n\t\t\tconst settings = usage.get(mediaId);\n\t\t\tif (settings) settings.push(setting);\n\t\t\telse usage.set(mediaId, [setting]);\n\t\t}\n\t}\n\treturn usage;\n}\n\nfunction parseOption(value: string | null | undefined): unknown {\n\tif (value == null) return undefined;\n\ttry {\n\t\treturn JSON.parse(value);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"],"mappings":";;;;;;;;;AASA,MAAa,4BAA4B;CAAC;CAAQ;CAAW;CAAqB;;;;;AAQlF,MAAM,uBAAuB;CAC5B,CAAC,aAAa,OAAO;CACrB,CAAC,gBAAgB,UAAU;CAC3B,CAAC,YAAY,qBAAqB;CAClC;AAED,MAAa,mCAAmC,qBAAqB,KAAK,CAAC,YAAY,OAAO;;;;;;AAO9F,SAAgB,2BACf,SACuC;CACvC,MAAM,wBAAQ,IAAI,KAAsC;AACxD,MAAK,MAAM,CAAC,QAAQ,YAAY,qBAC/B,MAAK,MAAM,WAAW,gBAAgB,QAAQ,YAAY,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE;EAChF,MAAM,WAAW,MAAM,IAAI,QAAQ;AACnC,MAAI,SAAU,UAAS,KAAK,QAAQ;MAC/B,OAAM,IAAI,SAAS,CAAC,QAAQ,CAAC;;AAGpC,QAAO;;AAGR,SAAS,YAAY,OAA2C;AAC/D,KAAI,SAAS,KAAM,QAAO;AAC1B,KAAI;AACH,SAAO,KAAK,MAAM,MAAM;SACjB;AACP"}

package/dist/site-url-CrDZaAvo.mjs

@@ -0,0 +1,45 @@
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { t as getConfiguredOrigin } from "./public-url-uT1Ok2Tu.mjs";
+
+//#region src/api/site-url.ts
+const LOOPBACK_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/** Sign-in tokens travel in these links, so plain HTTP is only accepted for loopback hosts. */
+function siteUrlSettingOrigin(value) {
+	if (typeof value !== "string" || !URL.canParse(value)) return void 0;
+	const url = new URL(value);
+	if (url.protocol === "https:") return url.origin;
+	if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)) return url.origin;
+}
+/**
+* The site's public origin for outbound links, in the precedence order
+* described above. `siteUrlSetting` and `setupUrl` are the stored
+* `site:url` and `emdash:site_url` option values.
+*/
+function resolveSiteOrigin(config, siteUrlSetting, setupUrl) {
+	return getConfiguredOrigin(config) ?? siteUrlSettingOrigin(siteUrlSetting) ?? (typeof setupUrl === "string" && setupUrl ? setupUrl : void 0);
+}
+/**
+* The origin chosen for the site: the configured origin, then the **Site URL**.
+* Unlike `getSiteBaseUrl`, it never falls back to the origin recorded during
+* setup, which may be an address the site has since moved away from.
+*/
+async function getChosenSiteOrigin(db, config) {
+	return getConfiguredOrigin(config) ?? siteUrlSettingOrigin(await new OptionsRepository(db).get("site:url"));
+}
+async function getSiteBaseUrl(db, request, config) {
+	const configured = getConfiguredOrigin(config);
+	if (configured) return `${configured}/_emdash`;
+	const stored = await new OptionsRepository(db).getMany(["site:url", "emdash:site_url"]);
+	const storedUrl = resolveSiteOrigin(config, stored.get("site:url"), stored.get("emdash:site_url"));
+	if (storedUrl) return `${storedUrl}/_emdash`;
+	const url = new URL(request.url);
+	return `${url.protocol}//${url.host}/_emdash`;
+}
+
+//#endregion
+export { getSiteBaseUrl as n, resolveSiteOrigin as r, getChosenSiteOrigin as t };
+//# sourceMappingURL=site-url-CrDZaAvo.mjs.map

package/dist/site-url-CrDZaAvo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-url-CrDZaAvo.mjs","names":[],"sources":["../src/api/site-url.ts"],"sourcesContent":["/**\n * Resolve the canonical site base URL for use in outbound links (emails, etc.).\n *\n * Precedence: the operator-configured origin (`config.siteUrl`, then the\n * `EMDASH_SITE_URL`/`SITE_URL` env vars), then the **Site URL** an admin set\n * in Settings > General (`site:url`, origin only), then the `emdash:site_url` option\n * written once during setup, and only before setup completes the request URL.\n * A configured or stored value always beats the request, so Host header\n * spoofing cannot redirect users to attacker-controlled domains.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getConfiguredOrigin, type SiteUrlConfig } from \"./public-url.js\";\n\nconst LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** Sign-in tokens travel in these links, so plain HTTP is only accepted for loopback hosts. */\nfunction siteUrlSettingOrigin(value: unknown): string | undefined {\n\tif (typeof value !== \"string\" || !URL.canParse(value)) return undefined;\n\tconst url = new URL(value);\n\tif (url.protocol === \"https:\") return url.origin;\n\tif (url.protocol === \"http:\" && LOOPBACK_HOSTS.has(url.hostname)) return url.origin;\n\treturn undefined;\n}\n\n/**\n * The site's public origin for outbound links, in the precedence order\n * described above. `siteUrlSetting` and `setupUrl` are the stored\n * `site:url` and `emdash:site_url` option values.\n */\nexport function resolveSiteOrigin(\n\tconfig: SiteUrlConfig | undefined,\n\tsiteUrlSetting: unknown,\n\tsetupUrl: unknown,\n): string | undefined {\n\treturn (\n\t\tgetConfiguredOrigin(config) ??\n\t\tsiteUrlSettingOrigin(siteUrlSetting) ??\n\t\t(typeof setupUrl === \"string\" && setupUrl ? setupUrl : undefined)\n\t);\n}\n\n/**\n * The origin chosen for the site: the configured origin, then the **Site URL**.\n * Unlike `getSiteBaseUrl`, it never falls back to the origin recorded during\n * setup, which may be an address the site has since moved away from.\n */\nexport async function getChosenSiteOrigin(\n\tdb: Kysely<Database>,\n\tconfig?: SiteUrlConfig,\n): Promise<string | undefined> {\n\treturn (\n\t\tgetConfiguredOrigin(config) ??\n\t\tsiteUrlSettingOrigin(await new OptionsRepository(db).get(\"site:url\"))\n\t);\n}\n\nexport async function getSiteBaseUrl(\n\tdb: Kysely<Database>,\n\trequest: Request,\n\tconfig?: SiteUrlConfig,\n): Promise<string> {\n\tconst configured = getConfiguredOrigin(config);\n\tif (configured) {\n\t\treturn `${configured}/_emdash`;\n\t}\n\tconst options = new OptionsRepository(db);\n\tconst stored = await options.getMany([\"site:url\", \"emdash:site_url\"]);\n\tconst storedUrl = resolveSiteOrigin(\n\t\tconfig,\n\t\tstored.get(\"site:url\"),\n\t\tstored.get(\"emdash:site_url\"),\n\t);\n\tif (storedUrl) {\n\t\treturn `${storedUrl}/_emdash`;\n\t}\n\t// Fallback: derive from request (only reached before setup completes)\n\tconst url = new URL(request.url);\n\treturn `${url.protocol}//${url.host}/_emdash`;\n}\n"],"mappings":";;;;AAiBA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;CAAQ,CAAC;;AAGnE,SAAS,qBAAqB,OAAoC;AACjE,KAAI,OAAO,UAAU,YAAY,CAAC,IAAI,SAAS,MAAM,CAAE,QAAO;CAC9D,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,KAAI,IAAI,aAAa,SAAU,QAAO,IAAI;AAC1C,KAAI,IAAI,aAAa,WAAW,eAAe,IAAI,IAAI,SAAS,CAAE,QAAO,IAAI;;;;;;;AAS9E,SAAgB,kBACf,QACA,gBACA,UACqB;AACrB,QACC,oBAAoB,OAAO,IAC3B,qBAAqB,eAAe,KACnC,OAAO,aAAa,YAAY,WAAW,WAAW;;;;;;;AASzD,eAAsB,oBACrB,IACA,QAC8B;AAC9B,QACC,oBAAoB,OAAO,IAC3B,qBAAqB,MAAM,IAAI,kBAAkB,GAAG,CAAC,IAAI,WAAW,CAAC;;AAIvE,eAAsB,eACrB,IACA,SACA,QACkB;CAClB,MAAM,aAAa,oBAAoB,OAAO;AAC9C,KAAI,WACH,QAAO,GAAG,WAAW;CAGtB,MAAM,SAAS,MADC,IAAI,kBAAkB,GAAG,CACZ,QAAQ,CAAC,YAAY,kBAAkB,CAAC;CACrE,MAAM,YAAY,kBACjB,QACA,OAAO,IAAI,WAAW,EACtB,OAAO,IAAI,kBAAkB,CAC7B;AACD,KAAI,UACH,QAAO,GAAG,UAAU;CAGrB,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,QAAO,GAAG,IAAI,SAAS,IAAI,IAAI,KAAK"}

package/dist/sitemap-name-W3BTor6X.mjs

@@ -0,0 +1,26 @@
+import { r as isValidSchemaSlug } from "./slug-BJhHKoOH.mjs";
+
+//#region src/seo/sitemap-name.ts
+/**
+* The `{name}` in a per-collection sitemap path, `/sitemap-{name}.xml`.
+*/
+/** `{collection}` for page 1, `{collection}-{n}` for page n from 2 up. */
+const SITEMAP_NAME_RE = /^([a-z][a-z0-9_]*)(?:-([2-9]|[1-9]\d{1,5}))?$/;
+/**
+* The collection and page a sitemap name refers to, or null when the name
+* can't belong to any collection (its collection part must be a valid
+* collection slug).
+*/
+function parseCollectionSitemapName(name) {
+	const match = SITEMAP_NAME_RE.exec(name);
+	const collection = match?.[1];
+	if (!match || !isValidSchemaSlug(collection)) return null;
+	return {
+		collection,
+		page: match[2] ? Number(match[2]) : 1
+	};
+}
+
+//#endregion
+export { parseCollectionSitemapName as t };
+//# sourceMappingURL=sitemap-name-W3BTor6X.mjs.map

package/dist/sitemap-name-W3BTor6X.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sitemap-name-W3BTor6X.mjs","names":[],"sources":["../src/seo/sitemap-name.ts"],"sourcesContent":["/**\n * The `{name}` in a per-collection sitemap path, `/sitemap-{name}.xml`.\n */\n\nimport { isValidSchemaSlug } from \"../schema/slug.js\";\n\n/** `{collection}` for page 1, `{collection}-{n}` for page n from 2 up. */\nconst SITEMAP_NAME_RE = /^([a-z][a-z0-9_]*)(?:-([2-9]|[1-9]\\d{1,5}))?$/;\n\n/**\n * The collection and page a sitemap name refers to, or null when the name\n * can't belong to any collection (its collection part must be a valid\n * collection slug).\n */\nexport function parseCollectionSitemapName(\n\tname: string,\n): { collection: string; page: number } | null {\n\tconst match = SITEMAP_NAME_RE.exec(name);\n\tconst collection = match?.[1];\n\tif (!match || !isValidSchemaSlug(collection)) return null;\n\treturn { collection, page: match[2] ? Number(match[2]) : 1 };\n}\n"],"mappings":";;;;;;;AAOA,MAAM,kBAAkB;;;;;;AAOxB,SAAgB,2BACf,MAC8C;CAC9C,MAAM,QAAQ,gBAAgB,KAAK,KAAK;CACxC,MAAM,aAAa,QAAQ;AAC3B,KAAI,CAAC,SAAS,CAAC,kBAAkB,WAAW,CAAE,QAAO;AACrD,QAAO;EAAE;EAAY,MAAM,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG;EAAG"}

package/dist/slug-BJhHKoOH.mjs

@@ -0,0 +1,16 @@
+//#region src/schema/slug.ts
+/**
+* The collection and field slug rule.
+*/
+/** Lowercase letter first, then lowercase letters, digits, and underscores. */
+const SCHEMA_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
+/** Maximum length of a collection or field slug. */
+const MAX_SCHEMA_SLUG_LENGTH = 63;
+/** Whether `value` is a valid collection or field slug. */
+function isValidSchemaSlug(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= MAX_SCHEMA_SLUG_LENGTH && SCHEMA_SLUG_PATTERN.test(value);
+}
+
+//#endregion
+export { SCHEMA_SLUG_PATTERN as n, isValidSchemaSlug as r, MAX_SCHEMA_SLUG_LENGTH as t };
+//# sourceMappingURL=slug-BJhHKoOH.mjs.map

package/dist/slug-BJhHKoOH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-BJhHKoOH.mjs","names":[],"sources":["../src/schema/slug.ts"],"sourcesContent":["/**\n * The collection and field slug rule.\n */\n\n/** Lowercase letter first, then lowercase letters, digits, and underscores. */\nexport const SCHEMA_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;\n\n/** Maximum length of a collection or field slug. */\nexport const MAX_SCHEMA_SLUG_LENGTH = 63;\n\n/** Whether `value` is a valid collection or field slug. */\nexport function isValidSchemaSlug(value: unknown): value is string {\n\treturn (\n\t\ttypeof value === \"string\" &&\n\t\tvalue.length > 0 &&\n\t\tvalue.length <= MAX_SCHEMA_SLUG_LENGTH &&\n\t\tSCHEMA_SLUG_PATTERN.test(value)\n\t);\n}\n"],"mappings":";;;;;AAKA,MAAa,sBAAsB;;AAGnC,MAAa,yBAAyB;;AAGtC,SAAgB,kBAAkB,OAAiC;AAClE,QACC,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,0BAChB,oBAAoB,KAAK,MAAM"}