emdash 1.2.0 → 1.3.0

package/dist/challenge-store-BHgdPVze.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"challenge-store-BHgdPVze.mjs","names":[],"sources":["../src/auth/challenge-store.ts"],"sourcesContent":["/**\n * Challenge store for WebAuthn\n *\n * Stores WebAuthn challenges in a dedicated table with automatic expiration.\n */\n\nimport type { ChallengeStore, ChallengeData } from \"@emdash-cms/auth/passkey\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nexport function createChallengeStore(db: Kysely<Database>): ChallengeStore {\n\treturn {\n\t\tasync set(challenge: string, data: ChallengeData): Promise<void> {\n\t\t\tconst expiresAt = new Date(data.expiresAt).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge,\n\t\t\t\t\ttype: data.type,\n\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\tdata: data.context ?? null,\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: data.type,\n\t\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\t\tdata: data.context ?? null,\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(challenge: string): Promise<ChallengeData | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", challenge)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(challenge);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\ttype: row.type === \"registration\" ? \"registration\" : \"authentication\",\n\t\t\t\tuserId: row.user_id ?? undefined,\n\t\t\t\texpiresAt,\n\t\t\t\t...(row.data === null ? {} : { context: row.data }),\n\t\t\t};\n\t\t},\n\n\t\tasync delete(challenge: string): Promise<void> {\n\t\t\tawait db.deleteFrom(\"auth_challenges\").where(\"challenge\", \"=\", challenge).execute();\n\t\t},\n\t};\n}\n\n/**\n * Clean up expired challenges.\n * Should be called periodically (e.g., on startup, or via cron).\n */\nexport async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {\n\tconst now = new Date().toISOString();\n\n\tconst result = await db\n\t\t.deleteFrom(\"auth_challenges\")\n\t\t.where(\"expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows ?? 0);\n}\n"],"mappings":";AAWA,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,IAAI,WAAmB,MAAoC;GAChE,MAAM,YAAY,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa;AAExD,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP;IACA,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM,KAAK,WAAW;IACtB,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM,KAAK,WAAW;IACtB,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,WAAkD;GAC3D,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,UAAU,CAClC,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;GAEjB,MAAM,YAAY,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS;AAGpD,OAAI,YAAY,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;;AAGR,UAAO;IACN,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;IACrD,QAAQ,IAAI,WAAW;IACvB;IACA,GAAI,IAAI,SAAS,OAAO,EAAE,GAAG,EAAE,SAAS,IAAI,MAAM;IAClD;;EAGF,MAAM,OAAO,WAAkC;AAC9C,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,UAAU,CAAC,SAAS;;EAEpF;;;;;;AAOF,eAAsB,yBAAyB,IAAuC;CACrF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,SAAS,MAAM,GACnB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,IAAI,CAC7B,kBAAkB;AAEpB,QAAO,OAAO,OAAO,kBAAkB,EAAE"}

package/dist/checksum-BYR5i7qe.mjs

@@ -1,162 +0,0 @@
-//#region ../registry-verification/dist/auth-B730dpJ4.js
-const UNSUPPORTED_AUTH_MESSAGE = "This release requires an authentication method the client does not support.";
-function unsupportedAuthDetails(auth) {
-	if (!isRecord(auth) || typeof auth.hint_url !== "string" || auth.hint_url.length > 2048) return;
-	try {
-		const url = new URL(auth.hint_url);
-		if (url.protocol !== "https:" || url.username || url.password) return void 0;
-		return { hintUrl: url.href };
-	} catch {
-		return;
-	}
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
-//#endregion
-//#region ../registry-verification/dist/errors-D3_zxvwe.js
-function verificationError(code, message, details) {
-	return {
-		success: false,
-		error: {
-			code,
-			message,
-			...details === void 0 ? {} : { details }
-		}
-	};
-}
-
-//#endregion
-//#region ../registry-verification/dist/checksum.js
-const SHA2_256_CODE = 18;
-const SHA2_256_LENGTH = 32;
-const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
-/** Derive the required artifact checksum from a raw sha2-256 blob CID. */
-function multihashFromBlobCid(value) {
-	if (!value.startsWith("b")) return verificationError("BLOB_REF_INVALID", "The blob reference CID is malformed.");
-	const bytes = decodeBase32(value.slice(1));
-	if (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
-	const checksum = `b${encodeBase32(bytes.slice(2))}`;
-	if (!decodeMultihash(checksum).success) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
-	return {
-		success: true,
-		value: checksum
-	};
-}
-/** Decodes a lowercase base32 multibase-encoded multihash. */
-function decodeMultihash(value) {
-	if (!value.startsWith("b")) return verificationError("INVALID_MULTIHASH", "Checksums must be lowercase base32 multibase-encoded multihashes.");
-	const bytes = decodeBase32(value.slice(1));
-	if (bytes === null) return verificationError("INVALID_MULTIHASH", "The multibase checksum is malformed.");
-	const code = readVarint(bytes, 0);
-	if (code === null) return verificationError("INVALID_MULTIHASH", "The multihash algorithm code is malformed.");
-	const length = readVarint(bytes, code.nextOffset);
-	if (length === null || length.value !== bytes.length - length.nextOffset) return verificationError("INVALID_MULTIHASH", "The multihash digest length is malformed.");
-	if (code.value !== SHA2_256_CODE) return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
-	if (length.value !== SHA2_256_LENGTH) return verificationError("INVALID_MULTIHASH", "The sha2-256 digest must be 32 bytes.");
-	return {
-		success: true,
-		value: {
-			algorithm: "sha2-256",
-			digest: bytes.slice(length.nextOffset)
-		}
-	};
-}
-async function computeArtifactDigestCandidates(bytes) {
-	const [sha256, sha384, sha512] = await Promise.all([
-		crypto.subtle.digest("SHA-256", new Uint8Array(bytes)),
-		crypto.subtle.digest("SHA-384", new Uint8Array(bytes)),
-		crypto.subtle.digest("SHA-512", new Uint8Array(bytes))
-	]);
-	return [
-		new Uint8Array(sha256),
-		new Uint8Array(sha384),
-		new Uint8Array(sha512)
-	];
-}
-async function verifyMultihash(bytes, expected) {
-	const decoded = decodeMultihash(expected);
-	if (!decoded.success) return decoded;
-	const actual = await computeDigest(bytes, decoded.value.algorithm);
-	if (!actual.success) return actual;
-	if (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError("CHECKSUM_MISMATCH", "The resource bytes do not match the expected checksum.");
-	return {
-		success: true,
-		value: true
-	};
-}
-/**
-* Compare public checksum digest bytes without early exit. Digests are public
-* integrity metadata, so a portable byte loop is preferable to a Node-only
-* timing primitive while still avoiding an ordinary equality short circuit.
-*/
-function compareDigestBytes(left, right) {
-	let difference = left.length ^ right.length;
-	const maximumLength = Math.max(left.length, right.length);
-	for (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
-	return difference === 0;
-}
-async function computeDigest(bytes, algorithm) {
-	if (algorithm !== "sha2-256") return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
-	try {
-		return {
-			success: true,
-			value: new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)))
-		};
-	} catch {
-		return verificationError("UNSUPPORTED_MULTIHASH", "The sha2-256 algorithm is unavailable.");
-	}
-}
-function readVarint(bytes, offset) {
-	let value = 0;
-	let shift = 0;
-	for (let index = offset; index < bytes.length && index < offset + 5; index += 1) {
-		const byte = bytes[index];
-		if (byte === void 0) return null;
-		value |= (byte & 127) << shift;
-		if ((byte & 128) === 0) return {
-			value,
-			nextOffset: index + 1
-		};
-		shift += 7;
-	}
-	return null;
-}
-function encodeBase32(bytes) {
-	let result = "";
-	let buffer = 0;
-	let bits = 0;
-	for (const byte of bytes) {
-		buffer = buffer << 8 | byte;
-		bits += 8;
-		while (bits >= 5) {
-			result += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? "";
-			bits -= 5;
-		}
-	}
-	if (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? "";
-	return result;
-}
-function decodeBase32(value) {
-	if (value.length === 0) return null;
-	let buffer = 0;
-	let bits = 0;
-	const output = [];
-	for (const character of value) {
-		const digit = BASE32_ALPHABET.indexOf(character);
-		if (digit === -1) return null;
-		buffer = buffer << 5 | digit;
-		bits += 5;
-		if (bits >= 8) {
-			output.push(buffer >>> bits - 8 & 255);
-			bits -= 8;
-		}
-	}
-	if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;
-	return new Uint8Array(output);
-}
-
-//#endregion
-export { UNSUPPORTED_AUTH_MESSAGE as a, verificationError as i, multihashFromBlobCid as n, unsupportedAuthDetails as o, verifyMultihash as r, computeArtifactDigestCandidates as t };
-//# sourceMappingURL=checksum-BYR5i7qe.mjs.map

package/dist/checksum-BYR5i7qe.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"checksum-BYR5i7qe.mjs","names":[],"sources":["../../registry-verification/dist/auth-B730dpJ4.js","../../registry-verification/dist/errors-D3_zxvwe.js","../../registry-verification/dist/checksum.js"],"sourcesContent":["//#region src/auth.ts\nconst UNSUPPORTED_AUTH_MESSAGE = \"This release requires an authentication method the client does not support.\";\nfunction unsupportedAuthDetails(auth) {\n\tif (!isRecord(auth) || typeof auth.hint_url !== \"string\" || auth.hint_url.length > 2048) return;\n\ttry {\n\t\tconst url = new URL(auth.hint_url);\n\t\tif (url.protocol !== \"https:\" || url.username || url.password) return void 0;\n\t\treturn { hintUrl: url.href };\n\t} catch {\n\t\treturn;\n\t}\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n//#endregion\nexport { unsupportedAuthDetails as n, UNSUPPORTED_AUTH_MESSAGE as t };\n//# sourceMappingURL=auth-B730dpJ4.js.map","//#region src/errors.ts\n/** Stable, machine-readable failures returned by this package. */\nconst VERIFICATION_ERROR_CODES = [\n\t\"AUTH_METHOD_UNSUPPORTED\",\n\t\"BLOB_METADATA_MISMATCH\",\n\t\"BLOB_REF_INVALID\",\n\t\"BUNDLE_COMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_FILE_COUNT_EXCEEDED\",\n\t\"BUNDLE_FILE_SIZE_EXCEEDED\",\n\t\"BUNDLE_ID_MISMATCH\",\n\t\"BUNDLE_INVALID_ARCHIVE\",\n\t\"BUNDLE_INVALID_MANIFEST\",\n\t\"BUNDLE_INVALID_PATH\",\n\t\"BUNDLE_MISSING_BACKEND\",\n\t\"BUNDLE_MISSING_MANIFEST\",\n\t\"BUNDLE_PATH_COLLISION\",\n\t\"BUNDLE_UNSUPPORTED_ENTRY\",\n\t\"BUNDLE_VERSION_MISMATCH\",\n\t\"CHECKSUM_MISMATCH\",\n\t\"FETCH_FAILED\",\n\t\"HOST_REJECTED\",\n\t\"INVALID_MULTIHASH\",\n\t\"INVALID_URL\",\n\t\"PDS_RESOLUTION_FAILED\",\n\t\"PROFILE_EXTENSION_INVALID\",\n\t\"PROFILE_ID_MISMATCH\",\n\t\"PROFILE_LEXICON_INVALID\",\n\t\"PROFILE_POLICY_INVALID\",\n\t\"PROFILE_REPOSITORY_INVALID\",\n\t\"PROVENANCE_REQUIRED\",\n\t\"PROVENANCE_UNVERIFIABLE\",\n\t\"REDIRECT_LIMIT_EXCEEDED\",\n\t\"REDIRECT_LOCATION_MISSING\",\n\t\"RESOURCE_SIZE_EXCEEDED\",\n\t\"RESOURCE_STATUS_ERROR\",\n\t\"RESOURCE_TIMEOUT\",\n\t\"RELEASE_EXTENSION_INVALID\",\n\t\"RELEASE_EXTENSION_MISSING\",\n\t\"RELEASE_ARTIFACT_SOURCE_MISSING\",\n\t\"RELEASE_LEXICON_INVALID\",\n\t\"RELEASE_PACKAGE_MISMATCH\",\n\t\"RELEASE_RKEY_MISMATCH\",\n\t\"RELEASE_VERSION_INVALID\",\n\t\"RELEASE_VERSION_MISMATCH\",\n\t\"UNSUPPORTED_MULTIHASH\"\n];\nfunction verificationError(code, message, details) {\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode,\n\t\t\tmessage,\n\t\t\t...details === void 0 ? {} : { details }\n\t\t}\n\t};\n}\n\n//#endregion\nexport { verificationError as n, VERIFICATION_ERROR_CODES as t };\n//# sourceMappingURL=errors-D3_zxvwe.js.map","import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/checksum.ts\nconst SHA2_256_CODE = 18;\nconst SHA2_256_LENGTH = 32;\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\n/** Derive the required artifact checksum from a raw sha2-256 blob CID. */\nfunction multihashFromBlobCid(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"BLOB_REF_INVALID\", \"The blob reference CID is malformed.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\tconst checksum = `b${encodeBase32(bytes.slice(2))}`;\n\tif (!decodeMultihash(checksum).success) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: checksum\n\t};\n}\n/** Decodes a lowercase base32 multibase-encoded multihash. */\nfunction decodeMultihash(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"INVALID_MULTIHASH\", \"Checksums must be lowercase base32 multibase-encoded multihashes.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null) return verificationError(\"INVALID_MULTIHASH\", \"The multibase checksum is malformed.\");\n\tconst code = readVarint(bytes, 0);\n\tif (code === null) return verificationError(\"INVALID_MULTIHASH\", \"The multihash algorithm code is malformed.\");\n\tconst length = readVarint(bytes, code.nextOffset);\n\tif (length === null || length.value !== bytes.length - length.nextOffset) return verificationError(\"INVALID_MULTIHASH\", \"The multihash digest length is malformed.\");\n\tif (code.value !== SHA2_256_CODE) return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\tif (length.value !== SHA2_256_LENGTH) return verificationError(\"INVALID_MULTIHASH\", \"The sha2-256 digest must be 32 bytes.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\talgorithm: \"sha2-256\",\n\t\t\tdigest: bytes.slice(length.nextOffset)\n\t\t}\n\t};\n}\nasync function computeMultihash(bytes, algorithm = \"sha2-256\") {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\tconst digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)));\n\t\tconst multihash = new Uint8Array(2 + digest.length);\n\t\tmultihash[0] = SHA2_256_CODE;\n\t\tmultihash[1] = digest.length;\n\t\tmultihash.set(digest, 2);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: `b${encodeBase32(multihash)}`\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nasync function computeArtifactDigestCandidates(bytes) {\n\tconst [sha256, sha384, sha512] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-384\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-512\", new Uint8Array(bytes))\n\t]);\n\treturn [\n\t\tnew Uint8Array(sha256),\n\t\tnew Uint8Array(sha384),\n\t\tnew Uint8Array(sha512)\n\t];\n}\nasync function verifyMultihash(bytes, expected) {\n\tconst decoded = decodeMultihash(expected);\n\tif (!decoded.success) return decoded;\n\tconst actual = await computeDigest(bytes, decoded.value.algorithm);\n\tif (!actual.success) return actual;\n\tif (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError(\"CHECKSUM_MISMATCH\", \"The resource bytes do not match the expected checksum.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: true\n\t};\n}\n/**\n* Compare public checksum digest bytes without early exit. Digests are public\n* integrity metadata, so a portable byte loop is preferable to a Node-only\n* timing primitive while still avoiding an ordinary equality short circuit.\n*/\nfunction compareDigestBytes(left, right) {\n\tlet difference = left.length ^ right.length;\n\tconst maximumLength = Math.max(left.length, right.length);\n\tfor (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);\n\treturn difference === 0;\n}\nasync function computeDigest(bytes, algorithm) {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)))\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nfunction readVarint(bytes, offset) {\n\tlet value = 0;\n\tlet shift = 0;\n\tfor (let index = offset; index < bytes.length && index < offset + 5; index += 1) {\n\t\tconst byte = bytes[index];\n\t\tif (byte === void 0) return null;\n\t\tvalue |= (byte & 127) << shift;\n\t\tif ((byte & 128) === 0) return {\n\t\t\tvalue,\n\t\t\tnextOffset: index + 1\n\t\t};\n\t\tshift += 7;\n\t}\n\treturn null;\n}\nfunction encodeBase32(bytes) {\n\tlet result = \"\";\n\tlet buffer = 0;\n\tlet bits = 0;\n\tfor (const byte of bytes) {\n\t\tbuffer = buffer << 8 | byte;\n\t\tbits += 8;\n\t\twhile (bits >= 5) {\n\t\t\tresult += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? \"\";\n\t\t\tbits -= 5;\n\t\t}\n\t}\n\tif (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? \"\";\n\treturn result;\n}\nfunction decodeBase32(value) {\n\tif (value.length === 0) return null;\n\tlet buffer = 0;\n\tlet bits = 0;\n\tconst output = [];\n\tfor (const character of value) {\n\t\tconst digit = BASE32_ALPHABET.indexOf(character);\n\t\tif (digit === -1) return null;\n\t\tbuffer = buffer << 5 | digit;\n\t\tbits += 5;\n\t\tif (bits >= 8) {\n\t\t\toutput.push(buffer >>> bits - 8 & 255);\n\t\t\tbits -= 8;\n\t\t}\n\t}\n\tif (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;\n\treturn new Uint8Array(output);\n}\n\n//#endregion\nexport { compareDigestBytes, computeArtifactDigestCandidates, computeMultihash, decodeMultihash, multihashFromBlobCid, verifyMultihash };\n//# sourceMappingURL=checksum.js.map"],"mappings":";AACA,MAAM,2BAA2B;AACjC,SAAS,uBAAuB,MAAM;AACrC,KAAI,CAAC,SAAS,KAAK,IAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAM;AACzF,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,KAAK,SAAS;AAClC,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,SAAU,QAAO,KAAK;AAC3E,SAAO,EAAE,SAAS,IAAI,MAAM;SACrB;AACP;;;AAGF,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;;;;ACkC5E,SAAS,kBAAkB,MAAM,SAAS,SAAS;AAClD,QAAO;EACN,SAAS;EACT,OAAO;GACN;GACA;GACA,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;GACxC;EACD;;;;;ACpDF,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;;AAExB,SAAS,qBAAqB,OAAO;AACpC,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,oBAAoB,uCAAuC;CAChH,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,QAAQ,MAAM,WAAW,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,GAAI,QAAO,kBAAkB,oBAAoB,qDAAqD;CAClL,MAAM,WAAW,IAAI,aAAa,MAAM,MAAM,EAAE,CAAC;AACjD,KAAI,CAAC,gBAAgB,SAAS,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,qDAAqD;AAC1I,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;AAGF,SAAS,gBAAgB,OAAO;AAC/B,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,qBAAqB,oEAAoE;CAC9I,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,KAAM,QAAO,kBAAkB,qBAAqB,uCAAuC;CACzG,MAAM,OAAO,WAAW,OAAO,EAAE;AACjC,KAAI,SAAS,KAAM,QAAO,kBAAkB,qBAAqB,6CAA6C;CAC9G,MAAM,SAAS,WAAW,OAAO,KAAK,WAAW;AACjD,KAAI,WAAW,QAAQ,OAAO,UAAU,MAAM,SAAS,OAAO,WAAY,QAAO,kBAAkB,qBAAqB,4CAA4C;AACpK,KAAI,KAAK,UAAU,cAAe,QAAO,kBAAkB,yBAAyB,4CAA4C;AAChI,KAAI,OAAO,UAAU,gBAAiB,QAAO,kBAAkB,qBAAqB,wCAAwC;AAC5H,QAAO;EACN,SAAS;EACT,OAAO;GACN,WAAW;GACX,QAAQ,MAAM,MAAM,OAAO,WAAW;GACtC;EACD;;AAkBF,eAAe,gCAAgC,OAAO;CACrD,MAAM,CAAC,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI;EAClD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,CAAC;AACF,QAAO;EACN,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB;;AAEF,eAAe,gBAAgB,OAAO,UAAU;CAC/C,MAAM,UAAU,gBAAgB,SAAS;AACzC,KAAI,CAAC,QAAQ,QAAS,QAAO;CAC7B,MAAM,SAAS,MAAM,cAAc,OAAO,QAAQ,MAAM,UAAU;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,KAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,MAAM,OAAO,CAAE,QAAO,kBAAkB,qBAAqB,yDAAyD;AACpK,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;;;;;AAOF,SAAS,mBAAmB,MAAM,OAAO;CACxC,IAAI,aAAa,KAAK,SAAS,MAAM;CACrC,MAAM,gBAAgB,KAAK,IAAI,KAAK,QAAQ,MAAM,OAAO;AACzD,MAAK,IAAI,QAAQ,GAAG,QAAQ,eAAe,SAAS,EAAG,gBAAe,KAAK,UAAU,MAAM,MAAM,UAAU;AAC3G,QAAO,eAAe;;AAEvB,eAAe,cAAc,OAAO,WAAW;AAC9C,KAAI,cAAc,WAAY,QAAO,kBAAkB,yBAAyB,4CAA4C;AAC5H,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC,CAAC;GACnF;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,WAAW,OAAO,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;AACZ,MAAK,IAAI,QAAQ,QAAQ,QAAQ,MAAM,UAAU,QAAQ,SAAS,GAAG,SAAS,GAAG;EAChF,MAAM,OAAO,MAAM;AACnB,MAAI,SAAS,KAAK,EAAG,QAAO;AAC5B,YAAU,OAAO,QAAQ;AACzB,OAAK,OAAO,SAAS,EAAG,QAAO;GAC9B;GACA,YAAY,QAAQ;GACpB;AACD,WAAS;;AAEV,QAAO;;AAER,SAAS,aAAa,OAAO;CAC5B,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI,OAAO;AACX,MAAK,MAAM,QAAQ,OAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,SAAO,QAAQ,GAAG;AACjB,aAAU,gBAAgB,WAAW,OAAO,IAAI,OAAO;AACvD,WAAQ;;;AAGV,KAAI,OAAO,EAAG,WAAU,gBAAgB,UAAU,IAAI,OAAO,OAAO;AACpE,QAAO;;AAER,SAAS,aAAa,OAAO;AAC5B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,IAAI,SAAS;CACb,IAAI,OAAO;CACX,MAAM,SAAS,EAAE;AACjB,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,QAAQ,gBAAgB,QAAQ,UAAU;AAChD,MAAI,UAAU,GAAI,QAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,MAAI,QAAQ,GAAG;AACd,UAAO,KAAK,WAAW,OAAO,IAAI,IAAI;AACtC,WAAQ;;;AAGV,KAAI,OAAO,MAAM,UAAU,KAAK,QAAQ,OAAO,EAAG,QAAO;AACzD,QAAO,IAAI,WAAW,OAAO"}

package/dist/chunks-Dr5Vr0zA.mjs

@@ -1,25 +0,0 @@
-import { d as __exportAll } from "./runner-wqt4BrIW.mjs";
-
-//#region src/utils/chunks.ts
-var chunks_exports = /* @__PURE__ */ __exportAll({
-	SQL_BATCH_SIZE: () => SQL_BATCH_SIZE,
-	chunks: () => chunks
-});
-/**
-* Split an array into chunks of at most `size` elements.
-*
-* Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's
-* bound-parameter limit (~100 per statement).
-*/
-function chunks(arr, size) {
-	if (arr.length === 0) return [];
-	const result = [];
-	for (let i = 0; i < arr.length; i += size) result.push(arr.slice(i, i + size));
-	return result;
-}
-/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */
-const SQL_BATCH_SIZE = 50;
-
-//#endregion
-export { chunks as n, chunks_exports as r, SQL_BATCH_SIZE as t };
-//# sourceMappingURL=chunks-Dr5Vr0zA.mjs.map

package/dist/chunks-Dr5Vr0zA.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunks-Dr5Vr0zA.mjs","names":[],"sources":["../src/utils/chunks.ts"],"sourcesContent":["/**\n * Split an array into chunks of at most `size` elements.\n *\n * Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's\n * bound-parameter limit (~100 per statement).\n */\nexport function chunks<T>(arr: T[], size: number): T[][] {\n\tif (arr.length === 0) return [];\n\tconst result: T[][] = [];\n\tfor (let i = 0; i < arr.length; i += size) {\n\t\tresult.push(arr.slice(i, i + size));\n\t}\n\treturn result;\n}\n\n/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */\nexport const SQL_BATCH_SIZE = 50;\n"],"mappings":";;;;;;;;;;;;;AAMA,SAAgB,OAAU,KAAU,MAAqB;AACxD,KAAI,IAAI,WAAW,EAAG,QAAO,EAAE;CAC/B,MAAM,SAAgB,EAAE;AACxB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,KACpC,QAAO,KAAK,IAAI,MAAM,GAAG,IAAI,KAAK,CAAC;AAEpC,QAAO;;;AAIR,MAAa,iBAAiB"}

package/dist/collection-slugs-cache-B2Gs9Jwx.mjs

@@ -1,85 +0,0 @@
-import { getRequestContext } from "./request-context.mjs";
-import { r as requestCached } from "./request-cache-C4CIo5ad.mjs";
-
-//#region src/schema/collection-slugs-cache.ts
-const HOLDER_KEY = Symbol.for("emdash:collection-slugs");
-const g = globalThis;
-const holder = g[HOLDER_KEY] ?? (() => {
-	const h = {
-		promise: null,
-		fetchedAt: 0
-	};
-	g[HOLDER_KEY] = h;
-	return h;
-})();
-const REVALIDATE_WINDOW_MS = 6e4;
-let revalidateWindowMs = REVALIDATE_WINDOW_MS;
-async function fetchSlugs(db) {
-	const rows = await db.selectFrom("_emdash_collections").select("slug").execute();
-	return new Set(rows.map((row) => row.slug));
-}
-function loadSlugs(db) {
-	if (holder.promise) return holder.promise;
-	const promise = fetchSlugs(db).catch((error) => {
-		if (holder.promise === promise) holder.promise = null;
-		throw error;
-	});
-	holder.promise = promise;
-	holder.fetchedAt = Date.now();
-	return promise;
-}
-/**
-* Keep only the collections that have a `_emdash_collections` row, i.e. whose
-* `ec_*` table the registry has created. When the filter would drop a
-* collection and the cached set is older than the revalidation window, the
-* set is re-fetched once so a collection created by another isolate becomes
-* visible without waiting for an isolate recycle.
-*/
-async function filterToRegisteredCollections(db, collections) {
-	if (collections.length === 0) return [];
-	if (getRequestContext()?.dbIsIsolated === true) {
-		const slugs = await requestCached("collection-slugs", () => fetchSlugs(db));
-		return collections.filter((slug) => slugs.has(slug));
-	}
-	let slugs = await loadSlugs(db);
-	let present = collections.filter((slug) => slugs.has(slug));
-	if (present.length < collections.length && Date.now() - holder.fetchedAt > revalidateWindowMs) {
-		holder.promise = null;
-		slugs = await loadSlugs(db);
-		present = collections.filter((slug) => slugs.has(slug));
-	}
-	return present;
-}
-/**
-* Seed the cache with slugs an init-time read already fetched, so the first
-* render on a cold isolate pays no extra query. Called by the runtime's
-* auto-seed gate.
-*/
-function primeRegisteredCollections(slugs) {
-	holder.promise = Promise.resolve(new Set(slugs));
-	holder.fetchedAt = Date.now();
-}
-/**
-* Drop the cached slug set so the next reader re-fetches. Called from every
-* schema-mutation path (`invalidateUrlPatternCache`, `SchemaRegistry`
-* create/delete). Other isolates converge through bounded revalidation.
-*/
-function resetRegisteredCollectionsCache() {
-	holder.promise = null;
-	holder.fetchedAt = 0;
-}
-/**
-* Note that a query hit a missing `ec_*` table despite the slug filter: the
-* cached set is stale (the collection was deleted on another isolate) or the
-* registry has drifted from the physical schema. Drops the cached set at most
-* once per revalidation window, so the delete case converges like the create
-* case while genuine drift costs one slug re-fetch per window instead of one
-* per render.
-*/
-function noteStaleRegisteredCollections() {
-	if (Date.now() - holder.fetchedAt > revalidateWindowMs) resetRegisteredCollectionsCache();
-}
-
-//#endregion
-export { resetRegisteredCollectionsCache as i, noteStaleRegisteredCollections as n, primeRegisteredCollections as r, filterToRegisteredCollections as t };
-//# sourceMappingURL=collection-slugs-cache-B2Gs9Jwx.mjs.map

package/dist/collection-slugs-cache-B2Gs9Jwx.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"collection-slugs-cache-B2Gs9Jwx.mjs","names":[],"sources":["../src/schema/collection-slugs-cache.ts"],"sourcesContent":["/**\n * Per-isolate cache of registered collection slugs (`_emdash_collections`).\n *\n * Term counting scopes its per-collection UNION to a taxonomy's declared\n * collections, but a declared collection is not necessarily a created one:\n * the migration-seeded defaults declare `posts` whether or not that\n * collection ever exists. Querying optimistically and catching the\n * missing-table error keeps results correct, yet the failed statement itself\n * is logged by the database — on D1 it surfaces as a `no such table` error\n * span per taxonomy per uncached render. Filtering declared collections\n * against the registry up front means the failing statement is never sent.\n *\n * Stored on globalThis behind a Symbol key (same pattern as the taxonomy-defs\n * cache in `taxonomies/index.ts`) so bundler chunk duplication cannot produce\n * two independent caches. The promise is cached, so concurrent cold readers\n * share one in-flight query; a rejection evicts the entry.\n *\n * Freshness:\n * - Primed for free at isolate boot: runtime init's auto-seed gate already\n *   reads `_emdash_collections` and hands the slugs to\n *   `primeRegisteredCollections`, so cold isolates pay no extra query.\n * - Every schema-mutation path resets it: `invalidateUrlPatternCache()`\n *   (admin API, MCP, WordPress import, seed application) and\n *   `SchemaRegistry.createCollection`/`deleteCollection` for direct callers.\n * - Creations on *other* isolates surface through bounded revalidation: the\n *   set is re-fetched only when the filter would actually drop a declared\n *   collection and the cached copy is older than the revalidation window.\n *   Sites whose declared collections all exist — the steady state — never\n *   revalidate; a site with a genuinely absent collection pays one slug read\n *   per window instead of one failing statement per render, and a collection\n *   created elsewhere starts counting within the window.\n *\n * Isolated databases bypass the cache (playground / DO preview requests set\n * `requestContext.dbIsIsolated`): they point at a divergent schema, so the\n * slug set is fetched per request instead, deduped by the request cache.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\nimport { requestCached } from \"../request-cache.js\";\nimport { getRequestContext } from \"../request-context.js\";\n\ninterface SlugsHolder {\n\tpromise: Promise<Set<string>> | null;\n\t/** When the cached promise was created; gates bounded revalidation. */\n\tfetchedAt: number;\n}\n\nconst HOLDER_KEY = Symbol.for(\"emdash:collection-slugs\");\nconst g = globalThis as Record<symbol, unknown>;\nconst holder: SlugsHolder =\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-cache.ts)\n\t(g[HOLDER_KEY] as SlugsHolder | undefined) ??\n\t(() => {\n\t\tconst h: SlugsHolder = { promise: null, fetchedAt: 0 };\n\t\tg[HOLDER_KEY] = h;\n\t\treturn h;\n\t})();\n\nconst REVALIDATE_WINDOW_MS = 60_000;\nlet revalidateWindowMs = REVALIDATE_WINDOW_MS;\n\nasync function fetchSlugs(db: Kysely<Database>): Promise<Set<string>> {\n\tconst rows = await db.selectFrom(\"_emdash_collections\").select(\"slug\").execute();\n\treturn new Set(rows.map((row) => row.slug));\n}\n\nfunction loadSlugs(db: Kysely<Database>): Promise<Set<string>> {\n\tif (holder.promise) return holder.promise;\n\tconst promise = fetchSlugs(db).catch((error: unknown) => {\n\t\tif (holder.promise === promise) holder.promise = null;\n\t\tthrow error;\n\t});\n\tholder.promise = promise;\n\tholder.fetchedAt = Date.now();\n\treturn promise;\n}\n\n/**\n * Keep only the collections that have a `_emdash_collections` row, i.e. whose\n * `ec_*` table the registry has created. When the filter would drop a\n * collection and the cached set is older than the revalidation window, the\n * set is re-fetched once so a collection created by another isolate becomes\n * visible without waiting for an isolate recycle.\n */\nexport async function filterToRegisteredCollections(\n\tdb: Kysely<Database>,\n\tcollections: readonly string[],\n): Promise<string[]> {\n\tif (collections.length === 0) return [];\n\tif (getRequestContext()?.dbIsIsolated === true) {\n\t\tconst slugs = await requestCached(\"collection-slugs\", () => fetchSlugs(db));\n\t\treturn collections.filter((slug) => slugs.has(slug));\n\t}\n\tlet slugs = await loadSlugs(db);\n\tlet present = collections.filter((slug) => slugs.has(slug));\n\tif (present.length < collections.length && Date.now() - holder.fetchedAt > revalidateWindowMs) {\n\t\tholder.promise = null;\n\t\tslugs = await loadSlugs(db);\n\t\tpresent = collections.filter((slug) => slugs.has(slug));\n\t}\n\treturn present;\n}\n\n/**\n * Seed the cache with slugs an init-time read already fetched, so the first\n * render on a cold isolate pays no extra query. Called by the runtime's\n * auto-seed gate.\n */\nexport function primeRegisteredCollections(slugs: readonly string[]): void {\n\tholder.promise = Promise.resolve(new Set(slugs));\n\tholder.fetchedAt = Date.now();\n}\n\n/**\n * Drop the cached slug set so the next reader re-fetches. Called from every\n * schema-mutation path (`invalidateUrlPatternCache`, `SchemaRegistry`\n * create/delete). Other isolates converge through bounded revalidation.\n */\nexport function resetRegisteredCollectionsCache(): void {\n\tholder.promise = null;\n\tholder.fetchedAt = 0;\n}\n\n/**\n * Note that a query hit a missing `ec_*` table despite the slug filter: the\n * cached set is stale (the collection was deleted on another isolate) or the\n * registry has drifted from the physical schema. Drops the cached set at most\n * once per revalidation window, so the delete case converges like the create\n * case while genuine drift costs one slug re-fetch per window instead of one\n * per render.\n */\nexport function noteStaleRegisteredCollections(): void {\n\tif (Date.now() - holder.fetchedAt > revalidateWindowMs) {\n\t\tresetRegisteredCollectionsCache();\n\t}\n}\n\n/**\n * Test/internal helper: reset the cache and restore the production\n * revalidation window.\n */\nexport function resetRegisteredCollectionsCacheForTests(): void {\n\tresetRegisteredCollectionsCache();\n\trevalidateWindowMs = REVALIDATE_WINDOW_MS;\n}\n\n/**\n * Test-only: shorten the revalidation window so the cross-isolate refresh\n * path can be exercised without waiting out the production window.\n *\n * @internal\n */\nexport function setRegisteredCollectionsRevalidateWindowForTests(ms: number): void {\n\trevalidateWindowMs = ms;\n}\n"],"mappings":";;;;AAiDA,MAAM,aAAa,OAAO,IAAI,0BAA0B;AACxD,MAAM,IAAI;AACV,MAAM,SAEJ,EAAE,sBACI;CACN,MAAM,IAAiB;EAAE,SAAS;EAAM,WAAW;EAAG;AACtD,GAAE,cAAc;AAChB,QAAO;IACJ;AAEL,MAAM,uBAAuB;AAC7B,IAAI,qBAAqB;AAEzB,eAAe,WAAW,IAA4C;CACrE,MAAM,OAAO,MAAM,GAAG,WAAW,sBAAsB,CAAC,OAAO,OAAO,CAAC,SAAS;AAChF,QAAO,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC;;AAG5C,SAAS,UAAU,IAA4C;AAC9D,KAAI,OAAO,QAAS,QAAO,OAAO;CAClC,MAAM,UAAU,WAAW,GAAG,CAAC,OAAO,UAAmB;AACxD,MAAI,OAAO,YAAY,QAAS,QAAO,UAAU;AACjD,QAAM;GACL;AACF,QAAO,UAAU;AACjB,QAAO,YAAY,KAAK,KAAK;AAC7B,QAAO;;;;;;;;;AAUR,eAAsB,8BACrB,IACA,aACoB;AACpB,KAAI,YAAY,WAAW,EAAG,QAAO,EAAE;AACvC,KAAI,mBAAmB,EAAE,iBAAiB,MAAM;EAC/C,MAAM,QAAQ,MAAM,cAAc,0BAA0B,WAAW,GAAG,CAAC;AAC3E,SAAO,YAAY,QAAQ,SAAS,MAAM,IAAI,KAAK,CAAC;;CAErD,IAAI,QAAQ,MAAM,UAAU,GAAG;CAC/B,IAAI,UAAU,YAAY,QAAQ,SAAS,MAAM,IAAI,KAAK,CAAC;AAC3D,KAAI,QAAQ,SAAS,YAAY,UAAU,KAAK,KAAK,GAAG,OAAO,YAAY,oBAAoB;AAC9F,SAAO,UAAU;AACjB,UAAQ,MAAM,UAAU,GAAG;AAC3B,YAAU,YAAY,QAAQ,SAAS,MAAM,IAAI,KAAK,CAAC;;AAExD,QAAO;;;;;;;AAQR,SAAgB,2BAA2B,OAAgC;AAC1E,QAAO,UAAU,QAAQ,QAAQ,IAAI,IAAI,MAAM,CAAC;AAChD,QAAO,YAAY,KAAK,KAAK;;;;;;;AAQ9B,SAAgB,kCAAwC;AACvD,QAAO,UAAU;AACjB,QAAO,YAAY;;;;;;;;;;AAWpB,SAAgB,iCAAuC;AACtD,KAAI,KAAK,KAAK,GAAG,OAAO,YAAY,mBACnC,kCAAiC"}

package/dist/comment-CWla6OHV.mjs

@@ -1,325 +0,0 @@
-import { u as invalidateCommentObjectCache } from "./object-cache-Bo6DGaC9.mjs";
-import { c as encodeCursor, s as decodeCursor } from "./types-C-Xp0CcN.mjs";
-import { sql } from "kysely";
-import { ulid } from "ulidx";
-
-//#region src/database/repositories/comment.ts
-/** Matches LIKE wildcard characters and the escape character itself */
-const LIKE_ESCAPE_RE = /[%_\\]/g;
-const DEFAULT_COMMENT_LIMIT = 50;
-const MAX_COMMENT_LIMIT = 100;
-/**
-* Normalize a caller-supplied page size to a whole number in [1, MAX].
-* A fractional value reaching SQLite's `LIMIT` errors, and a negative one
-* disables the cap; non-finite input falls back to the default.
-*/
-function clampLimit(limit) {
-	const n = Math.floor(Number(limit));
-	if (!Number.isFinite(n)) return DEFAULT_COMMENT_LIMIT;
-	return Math.min(Math.max(n, 1), MAX_COMMENT_LIMIT);
-}
-var CommentRepository = class CommentRepository {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Create a new comment
-	*/
-	async create(input) {
-		const id = ulid();
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		await this.db.insertInto("_emdash_comments").values({
-			id,
-			collection: input.collection,
-			content_id: input.contentId,
-			parent_id: input.parentId ?? null,
-			author_name: input.authorName,
-			author_email: input.authorEmail,
-			author_user_id: input.authorUserId ?? null,
-			body: input.body,
-			status: input.status ?? "pending",
-			ip_hash: input.ipHash ?? null,
-			user_agent: input.userAgent ?? null,
-			moderation_metadata: input.moderationMetadata ? JSON.stringify(input.moderationMetadata) : null,
-			created_at: now,
-			updated_at: now
-		}).execute();
-		invalidateCommentObjectCache();
-		const comment = await this.findById(id);
-		if (!comment) throw new Error("Failed to create comment");
-		return comment;
-	}
-	/**
-	* Find comment by ID
-	*/
-	async findById(id) {
-		const row = await this.db.selectFrom("_emdash_comments").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? this.rowToComment(row) : null;
-	}
-	/**
-	* Find comments for a content item with optional status filter.
-	* Results are ordered by created_at ASC (oldest first) for display.
-	*/
-	async findByContent(collection, contentId, options = {}) {
-		const limit = clampLimit(options.limit);
-		let query = this.db.selectFrom("_emdash_comments").selectAll().where("collection", "=", collection).where("content_id", "=", contentId);
-		if (options.status) query = query.where("status", "=", options.status);
-		if (options.cursor) {
-			const decoded = decodeCursor(options.cursor);
-			query = query.where((eb) => eb.or([eb("created_at", ">", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", ">", decoded.id)])]));
-		}
-		query = query.orderBy("created_at", "asc").orderBy("id", "asc").limit(limit + 1);
-		const rows = await query.execute();
-		const hasMore = rows.length > limit;
-		const items = rows.slice(0, limit).map((r) => this.rowToComment(r));
-		const result = { items };
-		if (hasMore && items.length > 0) {
-			const last = items.at(-1);
-			result.nextCursor = encodeCursor(last.createdAt, last.id);
-		}
-		return result;
-	}
-	/**
-	* Find comments by status (moderation inbox).
-	* Results are ordered by created_at DESC (newest first).
-	*/
-	async findByStatus(status, options = {}) {
-		const limit = clampLimit(options.limit);
-		let query = this.db.selectFrom("_emdash_comments").selectAll().where("status", "=", status);
-		if (options.collection) query = query.where("collection", "=", options.collection);
-		if (options.search) {
-			const term = `%${options.search.replace(LIKE_ESCAPE_RE, (ch) => `\\${ch}`)}%`;
-			query = query.where((eb) => eb.or([
-				sql`author_name LIKE ${term} ESCAPE '\\'`,
-				sql`author_email LIKE ${term} ESCAPE '\\'`,
-				sql`body LIKE ${term} ESCAPE '\\'`
-			]));
-		}
-		if (options.cursor) {
-			const decoded = decodeCursor(options.cursor);
-			query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
-		}
-		query = query.orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
-		const rows = await query.execute();
-		const hasMore = rows.length > limit;
-		const items = rows.slice(0, limit).map((r) => this.rowToComment(r));
-		const result = { items };
-		if (hasMore && items.length > 0) {
-			const last = items.at(-1);
-			result.nextCursor = encodeCursor(last.createdAt, last.id);
-		}
-		return result;
-	}
-	/** List non-trashed comments for capability-gated plugin administration. */
-	async findForPlugin(options = {}) {
-		const limit = clampLimit(options.limit);
-		let query = this.db.selectFrom("_emdash_comments").selectAll().where("status", "!=", "trash");
-		if (options.status) query = query.where("status", "=", options.status);
-		if (options.collection) query = query.where("collection", "=", options.collection);
-		if (options.contentId) query = query.where("content_id", "=", options.contentId);
-		if (options.cursor) {
-			const decoded = decodeCursor(options.cursor);
-			query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
-		}
-		const rows = await query.orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1).execute();
-		const items = rows.slice(0, limit).map((row) => this.rowToComment(row));
-		const result = { items };
-		if (rows.length > limit && items.length > 0) {
-			const last = items.at(-1);
-			result.nextCursor = encodeCursor(last.createdAt, last.id);
-		}
-		return result;
-	}
-	async countForPlugin(options = {}) {
-		let query = this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "!=", "trash");
-		if (options.status) query = query.where("status", "=", options.status);
-		if (options.collection) query = query.where("collection", "=", options.collection);
-		if (options.contentId) query = query.where("content_id", "=", options.contentId);
-		const result = await query.executeTakeFirst();
-		return Number(result?.count ?? 0);
-	}
-	/**
-	* Update comment status
-	*/
-	async updateStatus(id, status) {
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		await this.db.updateTable("_emdash_comments").set({
-			status,
-			updated_at: now
-		}).where("id", "=", id).execute();
-		invalidateCommentObjectCache();
-		return this.findById(id);
-	}
-	/** Atomically change status only when the caller's observed state is current. */
-	async updateStatusIf(id, status, expectedStatus) {
-		const existing = await this.findById(id);
-		if (!existing) return { state: "not_found" };
-		if (existing.status !== expectedStatus) return {
-			state: "conflict",
-			comment: existing
-		};
-		if (status === expectedStatus) return {
-			state: "unchanged",
-			comment: existing
-		};
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const result = await this.db.updateTable("_emdash_comments").set({
-			status,
-			updated_at: now
-		}).where("id", "=", id).where("status", "=", expectedStatus).returningAll().executeTakeFirst();
-		if (result) {
-			invalidateCommentObjectCache();
-			return {
-				state: "updated",
-				comment: this.rowToComment(result)
-			};
-		}
-		const current = await this.findById(id);
-		return !current ? { state: "not_found" } : {
-			state: "conflict",
-			comment: current
-		};
-	}
-	/**
-	* Bulk update comment statuses
-	*/
-	async bulkUpdateStatus(ids, status) {
-		if (ids.length === 0) return 0;
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const result = await this.db.updateTable("_emdash_comments").set({
-			status,
-			updated_at: now
-		}).where("id", "in", ids).executeTakeFirst();
-		invalidateCommentObjectCache();
-		return Number(result.numUpdatedRows ?? 0);
-	}
-	/**
-	* Hard-delete a single comment. Replies cascade via FK.
-	*/
-	async delete(id) {
-		const result = await this.db.deleteFrom("_emdash_comments").where("id", "=", id).executeTakeFirst();
-		invalidateCommentObjectCache();
-		return (result.numDeletedRows ?? 0) > 0;
-	}
-	/**
-	* Bulk hard-delete comments
-	*/
-	async bulkDelete(ids) {
-		if (ids.length === 0) return 0;
-		const result = await this.db.deleteFrom("_emdash_comments").where("id", "in", ids).executeTakeFirst();
-		invalidateCommentObjectCache();
-		return Number(result.numDeletedRows ?? 0);
-	}
-	/**
-	* Delete all comments for a content item (cascade on content deletion)
-	*/
-	async deleteByContent(collection, contentId) {
-		const result = await this.db.deleteFrom("_emdash_comments").where("collection", "=", collection).where("content_id", "=", contentId).executeTakeFirst();
-		invalidateCommentObjectCache();
-		return Number(result.numDeletedRows ?? 0);
-	}
-	/**
-	* Count comments for a content item, optionally filtered by status
-	*/
-	async countByContent(collection, contentId, status) {
-		let query = this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("collection", "=", collection).where("content_id", "=", contentId);
-		if (status) query = query.where("status", "=", status);
-		const result = await query.executeTakeFirst();
-		return Number(result?.count ?? 0);
-	}
-	/**
-	* Count comments grouped by status (for inbox badges)
-	*
-	* Uses four parallel COUNT queries with WHERE filters to leverage partial indexes
-	* (idx_comments_pending, idx_comments_approved, idx_comments_spam, idx_comments_trash)
-	* instead of a full table GROUP BY scan.
-	*/
-	async countByStatus() {
-		const [pending, approved, spam, trash] = await Promise.all([
-			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "pending").executeTakeFirst(),
-			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "approved").executeTakeFirst(),
-			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "spam").executeTakeFirst(),
-			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "trash").executeTakeFirst()
-		]);
-		return {
-			pending: Number(pending?.count ?? 0),
-			approved: Number(approved?.count ?? 0),
-			spam: Number(spam?.count ?? 0),
-			trash: Number(trash?.count ?? 0)
-		};
-	}
-	/**
-	* Count approved comments from a given email address.
-	* Used for "first time commenter" moderation logic.
-	*/
-	async countApprovedByEmail(email) {
-		const result = await this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("author_email", "=", email).where("status", "=", "approved").executeTakeFirst();
-		return Number(result?.count ?? 0);
-	}
-	/**
-	* Update the moderation metadata JSON on a comment
-	*/
-	async updateModerationMetadata(id, metadata) {
-		await this.db.updateTable("_emdash_comments").set({ moderation_metadata: JSON.stringify(metadata) }).where("id", "=", id).execute();
-	}
-	/**
-	* Assemble a flat list of comments into a threaded structure (1-level nesting)
-	*/
-	static assembleThreads(comments) {
-		const roots = [];
-		const childrenMap = /* @__PURE__ */ new Map();
-		for (const comment of comments) if (comment.parentId) {
-			const siblings = childrenMap.get(comment.parentId) ?? [];
-			siblings.push(comment);
-			childrenMap.set(comment.parentId, siblings);
-		} else roots.push(comment);
-		return roots.map((root) => ({
-			...root,
-			_replies: childrenMap.get(root.id) ?? []
-		}));
-	}
-	/**
-	* Convert a Comment to its public-facing shape
-	*/
-	static toPublicComment(comment) {
-		const pub = {
-			id: comment.id,
-			parentId: comment.parentId,
-			authorName: comment.authorName,
-			isRegisteredUser: comment.authorUserId !== null,
-			body: comment.body,
-			createdAt: comment.createdAt
-		};
-		if (comment._replies && comment._replies.length > 0) pub.replies = comment._replies.map((r) => CommentRepository.toPublicComment(r));
-		return pub;
-	}
-	rowToComment(row) {
-		return {
-			id: row.id,
-			collection: row.collection,
-			contentId: row.content_id,
-			parentId: row.parent_id,
-			authorName: row.author_name,
-			authorEmail: row.author_email,
-			authorUserId: row.author_user_id,
-			body: row.body,
-			status: row.status,
-			ipHash: row.ip_hash,
-			userAgent: row.user_agent,
-			moderationMetadata: row.moderation_metadata ? safeJsonParse(row.moderation_metadata) : null,
-			createdAt: row.created_at,
-			updatedAt: row.updated_at
-		};
-	}
-};
-function safeJsonParse(value) {
-	try {
-		return JSON.parse(value);
-	} catch {
-		return null;
-	}
-}
-
-//#endregion
-export { CommentRepository as t };
-//# sourceMappingURL=comment-CWla6OHV.mjs.map