emdash 1.2.0 → 1.3.1

package/dist/checksum-BF4acJwn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum-BF4acJwn.mjs","names":[],"sources":["../../registry-verification/dist/auth-B730dpJ4.js","../../registry-verification/dist/errors-D3_zxvwe.js","../../registry-verification/dist/checksum.js"],"sourcesContent":["//#region src/auth.ts\nconst UNSUPPORTED_AUTH_MESSAGE = \"This release requires an authentication method the client does not support.\";\nfunction unsupportedAuthDetails(auth) {\n\tif (!isRecord(auth) || typeof auth.hint_url !== \"string\" || auth.hint_url.length > 2048) return;\n\ttry {\n\t\tconst url = new URL(auth.hint_url);\n\t\tif (url.protocol !== \"https:\" || url.username || url.password) return void 0;\n\t\treturn { hintUrl: url.href };\n\t} catch {\n\t\treturn;\n\t}\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n//#endregion\nexport { unsupportedAuthDetails as n, UNSUPPORTED_AUTH_MESSAGE as t };\n//# sourceMappingURL=auth-B730dpJ4.js.map","//#region src/errors.ts\n/** Stable, machine-readable failures returned by this package. */\nconst VERIFICATION_ERROR_CODES = [\n\t\"AUTH_METHOD_UNSUPPORTED\",\n\t\"BLOB_METADATA_MISMATCH\",\n\t\"BLOB_REF_INVALID\",\n\t\"BUNDLE_COMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_FILE_COUNT_EXCEEDED\",\n\t\"BUNDLE_FILE_SIZE_EXCEEDED\",\n\t\"BUNDLE_ID_MISMATCH\",\n\t\"BUNDLE_INVALID_ARCHIVE\",\n\t\"BUNDLE_INVALID_MANIFEST\",\n\t\"BUNDLE_INVALID_PATH\",\n\t\"BUNDLE_MISSING_BACKEND\",\n\t\"BUNDLE_MISSING_MANIFEST\",\n\t\"BUNDLE_PATH_COLLISION\",\n\t\"BUNDLE_UNSUPPORTED_ENTRY\",\n\t\"BUNDLE_VERSION_MISMATCH\",\n\t\"CHECKSUM_MISMATCH\",\n\t\"FETCH_FAILED\",\n\t\"HOST_REJECTED\",\n\t\"INVALID_MULTIHASH\",\n\t\"INVALID_URL\",\n\t\"PDS_RESOLUTION_FAILED\",\n\t\"PROFILE_EXTENSION_INVALID\",\n\t\"PROFILE_ID_MISMATCH\",\n\t\"PROFILE_LEXICON_INVALID\",\n\t\"PROFILE_POLICY_INVALID\",\n\t\"PROFILE_REPOSITORY_INVALID\",\n\t\"PROVENANCE_REQUIRED\",\n\t\"PROVENANCE_UNVERIFIABLE\",\n\t\"REDIRECT_LIMIT_EXCEEDED\",\n\t\"REDIRECT_LOCATION_MISSING\",\n\t\"RESOURCE_SIZE_EXCEEDED\",\n\t\"RESOURCE_STATUS_ERROR\",\n\t\"RESOURCE_TIMEOUT\",\n\t\"RELEASE_EXTENSION_INVALID\",\n\t\"RELEASE_EXTENSION_MISSING\",\n\t\"RELEASE_ARTIFACT_SOURCE_MISSING\",\n\t\"RELEASE_LEXICON_INVALID\",\n\t\"RELEASE_PACKAGE_MISMATCH\",\n\t\"RELEASE_RKEY_MISMATCH\",\n\t\"RELEASE_VERSION_INVALID\",\n\t\"RELEASE_VERSION_MISMATCH\",\n\t\"UNSUPPORTED_MULTIHASH\"\n];\nfunction verificationError(code, message, details) {\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode,\n\t\t\tmessage,\n\t\t\t...details === void 0 ? {} : { details }\n\t\t}\n\t};\n}\n\n//#endregion\nexport { verificationError as n, VERIFICATION_ERROR_CODES as t };\n//# sourceMappingURL=errors-D3_zxvwe.js.map","import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/checksum.ts\nconst SHA2_256_CODE = 18;\nconst SHA2_256_LENGTH = 32;\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\n/** Derive the required artifact checksum from a raw sha2-256 blob CID. */\nfunction multihashFromBlobCid(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"BLOB_REF_INVALID\", \"The blob reference CID is malformed.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\tconst checksum = `b${encodeBase32(bytes.slice(2))}`;\n\tif (!decodeMultihash(checksum).success) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: checksum\n\t};\n}\n/** Decodes a lowercase base32 multibase-encoded multihash. */\nfunction decodeMultihash(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"INVALID_MULTIHASH\", \"Checksums must be lowercase base32 multibase-encoded multihashes.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null) return verificationError(\"INVALID_MULTIHASH\", \"The multibase checksum is malformed.\");\n\tconst code = readVarint(bytes, 0);\n\tif (code === null) return verificationError(\"INVALID_MULTIHASH\", \"The multihash algorithm code is malformed.\");\n\tconst length = readVarint(bytes, code.nextOffset);\n\tif (length === null || length.value !== bytes.length - length.nextOffset) return verificationError(\"INVALID_MULTIHASH\", \"The multihash digest length is malformed.\");\n\tif (code.value !== SHA2_256_CODE) return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\tif (length.value !== SHA2_256_LENGTH) return verificationError(\"INVALID_MULTIHASH\", \"The sha2-256 digest must be 32 bytes.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\talgorithm: \"sha2-256\",\n\t\t\tdigest: bytes.slice(length.nextOffset)\n\t\t}\n\t};\n}\nasync function computeMultihash(bytes, algorithm = \"sha2-256\") {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\tconst digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)));\n\t\tconst multihash = new Uint8Array(2 + digest.length);\n\t\tmultihash[0] = SHA2_256_CODE;\n\t\tmultihash[1] = digest.length;\n\t\tmultihash.set(digest, 2);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: `b${encodeBase32(multihash)}`\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nasync function computeArtifactDigestCandidates(bytes) {\n\tconst [sha256, sha384, sha512] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-384\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-512\", new Uint8Array(bytes))\n\t]);\n\treturn [\n\t\tnew Uint8Array(sha256),\n\t\tnew Uint8Array(sha384),\n\t\tnew Uint8Array(sha512)\n\t];\n}\nasync function verifyMultihash(bytes, expected) {\n\tconst decoded = decodeMultihash(expected);\n\tif (!decoded.success) return decoded;\n\tconst actual = await computeDigest(bytes, decoded.value.algorithm);\n\tif (!actual.success) return actual;\n\tif (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError(\"CHECKSUM_MISMATCH\", \"The resource bytes do not match the expected checksum.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: true\n\t};\n}\n/**\n* Compare public checksum digest bytes without early exit. Digests are public\n* integrity metadata, so a portable byte loop is preferable to a Node-only\n* timing primitive while still avoiding an ordinary equality short circuit.\n*/\nfunction compareDigestBytes(left, right) {\n\tlet difference = left.length ^ right.length;\n\tconst maximumLength = Math.max(left.length, right.length);\n\tfor (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);\n\treturn difference === 0;\n}\nasync function computeDigest(bytes, algorithm) {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)))\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nfunction readVarint(bytes, offset) {\n\tlet value = 0;\n\tlet shift = 0;\n\tfor (let index = offset; index < bytes.length && index < offset + 5; index += 1) {\n\t\tconst byte = bytes[index];\n\t\tif (byte === void 0) return null;\n\t\tvalue |= (byte & 127) << shift;\n\t\tif ((byte & 128) === 0) return {\n\t\t\tvalue,\n\t\t\tnextOffset: index + 1\n\t\t};\n\t\tshift += 7;\n\t}\n\treturn null;\n}\nfunction encodeBase32(bytes) {\n\tlet result = \"\";\n\tlet buffer = 0;\n\tlet bits = 0;\n\tfor (const byte of bytes) {\n\t\tbuffer = buffer << 8 | byte;\n\t\tbits += 8;\n\t\twhile (bits >= 5) {\n\t\t\tresult += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? \"\";\n\t\t\tbits -= 5;\n\t\t}\n\t}\n\tif (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? \"\";\n\treturn result;\n}\nfunction decodeBase32(value) {\n\tif (value.length === 0) return null;\n\tlet buffer = 0;\n\tlet bits = 0;\n\tconst output = [];\n\tfor (const character of value) {\n\t\tconst digit = BASE32_ALPHABET.indexOf(character);\n\t\tif (digit === -1) return null;\n\t\tbuffer = buffer << 5 | digit;\n\t\tbits += 5;\n\t\tif (bits >= 8) {\n\t\t\toutput.push(buffer >>> bits - 8 & 255);\n\t\t\tbits -= 8;\n\t\t}\n\t}\n\tif (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;\n\treturn new Uint8Array(output);\n}\n\n//#endregion\nexport { compareDigestBytes, computeArtifactDigestCandidates, computeMultihash, decodeMultihash, multihashFromBlobCid, verifyMultihash };\n//# sourceMappingURL=checksum.js.map"],"mappings":";AACA,MAAM,2BAA2B;AACjC,SAAS,uBAAuB,MAAM;AACrC,KAAI,CAAC,SAAS,KAAK,IAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAM;AACzF,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,KAAK,SAAS;AAClC,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,SAAU,QAAO,KAAK;AAC3E,SAAO,EAAE,SAAS,IAAI,MAAM;SACrB;AACP;;;AAGF,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;;;;ACkC5E,SAAS,kBAAkB,MAAM,SAAS,SAAS;AAClD,QAAO;EACN,SAAS;EACT,OAAO;GACN;GACA;GACA,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;GACxC;EACD;;;;;ACpDF,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;;AAExB,SAAS,qBAAqB,OAAO;AACpC,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,oBAAoB,uCAAuC;CAChH,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,QAAQ,MAAM,WAAW,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,GAAI,QAAO,kBAAkB,oBAAoB,qDAAqD;CAClL,MAAM,WAAW,IAAI,aAAa,MAAM,MAAM,EAAE,CAAC;AACjD,KAAI,CAAC,gBAAgB,SAAS,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,qDAAqD;AAC1I,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;AAGF,SAAS,gBAAgB,OAAO;AAC/B,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,qBAAqB,oEAAoE;CAC9I,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,KAAM,QAAO,kBAAkB,qBAAqB,uCAAuC;CACzG,MAAM,OAAO,WAAW,OAAO,EAAE;AACjC,KAAI,SAAS,KAAM,QAAO,kBAAkB,qBAAqB,6CAA6C;CAC9G,MAAM,SAAS,WAAW,OAAO,KAAK,WAAW;AACjD,KAAI,WAAW,QAAQ,OAAO,UAAU,MAAM,SAAS,OAAO,WAAY,QAAO,kBAAkB,qBAAqB,4CAA4C;AACpK,KAAI,KAAK,UAAU,cAAe,QAAO,kBAAkB,yBAAyB,4CAA4C;AAChI,KAAI,OAAO,UAAU,gBAAiB,QAAO,kBAAkB,qBAAqB,wCAAwC;AAC5H,QAAO;EACN,SAAS;EACT,OAAO;GACN,WAAW;GACX,QAAQ,MAAM,MAAM,OAAO,WAAW;GACtC;EACD;;AAkBF,eAAe,gCAAgC,OAAO;CACrD,MAAM,CAAC,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI;EAClD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,CAAC;AACF,QAAO;EACN,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB;;AAEF,eAAe,gBAAgB,OAAO,UAAU;CAC/C,MAAM,UAAU,gBAAgB,SAAS;AACzC,KAAI,CAAC,QAAQ,QAAS,QAAO;CAC7B,MAAM,SAAS,MAAM,cAAc,OAAO,QAAQ,MAAM,UAAU;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,KAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,MAAM,OAAO,CAAE,QAAO,kBAAkB,qBAAqB,yDAAyD;AACpK,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;;;;;AAOF,SAAS,mBAAmB,MAAM,OAAO;CACxC,IAAI,aAAa,KAAK,SAAS,MAAM;CACrC,MAAM,gBAAgB,KAAK,IAAI,KAAK,QAAQ,MAAM,OAAO;AACzD,MAAK,IAAI,QAAQ,GAAG,QAAQ,eAAe,SAAS,EAAG,gBAAe,KAAK,UAAU,MAAM,MAAM,UAAU;AAC3G,QAAO,eAAe;;AAEvB,eAAe,cAAc,OAAO,WAAW;AAC9C,KAAI,cAAc,WAAY,QAAO,kBAAkB,yBAAyB,4CAA4C;AAC5H,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC,CAAC;GACnF;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,WAAW,OAAO,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;AACZ,MAAK,IAAI,QAAQ,QAAQ,QAAQ,MAAM,UAAU,QAAQ,SAAS,GAAG,SAAS,GAAG;EAChF,MAAM,OAAO,MAAM;AACnB,MAAI,SAAS,KAAK,EAAG,QAAO;AAC5B,YAAU,OAAO,QAAQ;AACzB,OAAK,OAAO,SAAS,EAAG,QAAO;GAC9B;GACA,YAAY,QAAQ;GACpB;AACD,WAAS;;AAEV,QAAO;;AAER,SAAS,aAAa,OAAO;CAC5B,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI,OAAO;AACX,MAAK,MAAM,QAAQ,OAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,SAAO,QAAQ,GAAG;AACjB,aAAU,gBAAgB,WAAW,OAAO,IAAI,OAAO;AACvD,WAAQ;;;AAGV,KAAI,OAAO,EAAG,WAAU,gBAAgB,UAAU,IAAI,OAAO,OAAO;AACpE,QAAO;;AAER,SAAS,aAAa,OAAO;AAC5B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,IAAI,SAAS;CACb,IAAI,OAAO;CACX,MAAM,SAAS,EAAE;AACjB,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,QAAQ,gBAAgB,QAAQ,UAAU;AAChD,MAAI,UAAU,GAAI,QAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,MAAI,QAAQ,GAAG;AACd,UAAO,KAAK,WAAW,OAAO,IAAI,IAAI;AACtC,WAAQ;;;AAGV,KAAI,OAAO,MAAM,UAAU,KAAK,QAAQ,OAAO,EAAG,QAAO;AACzD,QAAO,IAAI,WAAW,OAAO"}

package/dist/chrome-tags-BDs29G3g.mjs

@@ -0,0 +1,24 @@
+//#region src/cache/chrome-tags.ts
+/**
+* Stable cache tags for EmDash chrome (settings, menus, taxonomies, widget areas).
+*
+* These tags are used by both the public read helpers (cacheHint) and the
+* admin write routes (cache.invalidate), closing the Workers edge cache loop.
+*/
+const PREFIX = "emdash";
+function siteSettingsTag() {
+	return `${PREFIX}:settings`;
+}
+function menuTag(name) {
+	return `${PREFIX}:menu:${name}`;
+}
+function taxonomyTag(name) {
+	return `${PREFIX}:taxonomy:${name}`;
+}
+function widgetAreaTag(name) {
+	return `${PREFIX}:widget-area:${name}`;
+}
+
+//#endregion
+export { widgetAreaTag as i, siteSettingsTag as n, taxonomyTag as r, menuTag as t };
+//# sourceMappingURL=chrome-tags-BDs29G3g.mjs.map

package/dist/chrome-tags-BDs29G3g.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chrome-tags-BDs29G3g.mjs","names":[],"sources":["../src/cache/chrome-tags.ts"],"sourcesContent":["/**\n * Stable cache tags for EmDash chrome (settings, menus, taxonomies, widget areas).\n *\n * These tags are used by both the public read helpers (cacheHint) and the\n * admin write routes (cache.invalidate), closing the Workers edge cache loop.\n */\n\nconst PREFIX = \"emdash\";\n\nexport function siteSettingsTag(): string {\n\treturn `${PREFIX}:settings`;\n}\n\nexport function menuTag(name: string): string {\n\treturn `${PREFIX}:menu:${name}`;\n}\n\nexport function taxonomyTag(name: string): string {\n\treturn `${PREFIX}:taxonomy:${name}`;\n}\n\nexport function widgetAreaTag(name: string): string {\n\treturn `${PREFIX}:widget-area:${name}`;\n}\n"],"mappings":";;;;;;;AAOA,MAAM,SAAS;AAEf,SAAgB,kBAA0B;AACzC,QAAO,GAAG,OAAO;;AAGlB,SAAgB,QAAQ,MAAsB;AAC7C,QAAO,GAAG,OAAO,QAAQ;;AAG1B,SAAgB,YAAY,MAAsB;AACjD,QAAO,GAAG,OAAO,YAAY;;AAG9B,SAAgB,cAAc,MAAsB;AACnD,QAAO,GAAG,OAAO,eAAe"}

package/dist/chunks-CYBOL-zn.mjs

@@ -0,0 +1,25 @@
+import { f as __exportAll } from "./runner-CLorw5vo.mjs";
+
+//#region src/utils/chunks.ts
+var chunks_exports = /* @__PURE__ */ __exportAll({
+	SQL_BATCH_SIZE: () => SQL_BATCH_SIZE,
+	chunks: () => chunks
+});
+/**
+* Split an array into chunks of at most `size` elements.
+*
+* Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's
+* bound-parameter limit (~100 per statement).
+*/
+function chunks(arr, size) {
+	if (arr.length === 0) return [];
+	const result = [];
+	for (let i = 0; i < arr.length; i += size) result.push(arr.slice(i, i + size));
+	return result;
+}
+/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */
+const SQL_BATCH_SIZE = 50;
+
+//#endregion
+export { chunks as n, chunks_exports as r, SQL_BATCH_SIZE as t };
+//# sourceMappingURL=chunks-CYBOL-zn.mjs.map

package/dist/chunks-CYBOL-zn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunks-CYBOL-zn.mjs","names":[],"sources":["../src/utils/chunks.ts"],"sourcesContent":["/**\n * Split an array into chunks of at most `size` elements.\n *\n * Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's\n * bound-parameter limit (~100 per statement).\n */\nexport function chunks<T>(arr: T[], size: number): T[][] {\n\tif (arr.length === 0) return [];\n\tconst result: T[][] = [];\n\tfor (let i = 0; i < arr.length; i += size) {\n\t\tresult.push(arr.slice(i, i + size));\n\t}\n\treturn result;\n}\n\n/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */\nexport const SQL_BATCH_SIZE = 50;\n"],"mappings":";;;;;;;;;;;;;AAMA,SAAgB,OAAU,KAAU,MAAqB;AACxD,KAAI,IAAI,WAAW,EAAG,QAAO,EAAE;CAC/B,MAAM,SAAgB,EAAE;AACxB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,KACpC,QAAO,KAAK,IAAI,MAAM,GAAG,IAAI,KAAK,CAAC;AAEpC,QAAO;;;AAIR,MAAa,iBAAiB"}

package/dist/cli/index.mjs

@@ -1,76 +1,83 @@
 #!/usr/bin/env node
-import { a as getExactMigrationStatus, c as runMigrations, l as formatDatetimeStorageReport, o as getMigrationStatus, u as scanDatetimeStorage } from "../runner-wqt4BrIW.mjs";
-import { n as isMissingTableError } from "../db-errors-CBD5yMro.mjs";
+import { d as scanDatetimeStorage, l as runMigrations, o as getExactMigrationStatus, s as getMigrationStatus, u as formatDatetimeStorageReport } from "../runner-CLorw5vo.mjs";
+import { r as isMissingTableError } from "../db-errors-unnO6yiZ.mjs";
 import { busyLockHeldSince, migrationLockHeldMessage } from "../database/migration-lock.mjs";
 import { t as validateIdentifier } from "../validate-DANX1-Qi.mjs";
 import { m as listTablesLike } from "../dialect-helpers-7_IqPdh9.mjs";
-import { i as isI18nEnabled, r as getI18nConfig } from "../config-CvmjJcVw.mjs";
+import { r as getI18nConfig, s as isI18nEnabled } from "../config-Cs_AwWXI.mjs";
 import "../datetime-normalization-PeiEdcRY.mjs";
 import "../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../options-DhrI7eMv.mjs";
 import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-Cc_O3Kp-.mjs";
 import "../base64-BQBZwXCx.mjs";
-import { t as ContentRepository } from "../content-CcHrqkgp.mjs";
-import "../object-cache-Bo6DGaC9.mjs";
-import { n as slugify } from "../slugify-bu2-jKia.mjs";
-import "../request-cache-C4CIo5ad.mjs";
-import "../url-Dn3IStq8.mjs";
-import "../types-C-Xp0CcN.mjs";
-import "../revision-BWEH2qQB.mjs";
-import { t as MediaRepository } from "../media-IT8hQleU.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-QrNmTfIZ.mjs";
-import "../resolve-D-kqyKns.mjs";
-import "../redirect-B39kTQ_0.mjs";
-import "../byline-registry-dvt4N3xV.mjs";
-import "../field-defs-cache-zoow36nz.mjs";
-import { t as BylineRepository } from "../byline-BmVKOQ8l.mjs";
-import "../staged-DboEaWsV.mjs";
-import "../dist-Cfu8mMBs.mjs";
-import "../fts-manager-WJCN8uU6.mjs";
-import { g as selectTaxonomyDefs, m as parseTaxonomyCollections } from "../loader-CetY659y.mjs";
-import "../collection-slugs-cache-B2Gs9Jwx.mjs";
-import "../capture-triggers-C9JKoIdT.mjs";
-import "../activation-xomsCMJg.mjs";
-import "../media-usage-work-cgDYGvrt.mjs";
-import { L as BlockTypeRegistry, n as SchemaRegistry } from "../registry-DeZ27gVi.mjs";
-import "../hash-C4DFoJ7Z.mjs";
-import "../zod-generator-BQilAboC.mjs";
-import { r as isTransferError, t as TransferError } from "../errors-CjtE5aWF.mjs";
-import "../canonical-BUcKRYpG.mjs";
-import { d as sha256Hex, i as createSha256, s as packageDigest } from "../digest-xJmyPv2r.mjs";
-import "../block-values-C4N_F2-G.mjs";
-import "../query-C_CWlifp.mjs";
-import "../schema-I74JwYte.mjs";
-import "../relations-DBB1bRJW.mjs";
-import { i as classifySetting } from "../settings-GaZ5sVgg.mjs";
-import "../schema-BXIW-JHi.mjs";
-import "../settings-B1jOxAIl.mjs";
-import "../ssrf-LM_0wpGA.mjs";
-import { t as applySeed } from "../apply-Cx48saFC.mjs";
-import "../ssrf-BvNItdxk.mjs";
-import { n as validateSeed } from "../validate-BSZbSUDk.mjs";
-import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-BOFCd9rX.mjs";
-import "../identity-BwBKM1fH.mjs";
-import { n as claimExplicitSeedOwnership } from "../ownership-COPyVysP.mjs";
+import { t as ContentRepository } from "../content-Dt0Os_WQ.mjs";
+import "../query-BFHjCzSh.mjs";
+import "../object-cache-EjasjtoQ.mjs";
+import { n as slugify } from "../slugify-BDEG9pLk.mjs";
+import "../request-cache-5z2WzWmh.mjs";
+import "../url-DTfGDJhI.mjs";
+import "../types-DwhEvIVb.mjs";
+import "../revision-Dx7Uth1X.mjs";
+import { t as MediaRepository } from "../media-B_x5B9EA.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-BG_xu2Qf.mjs";
+import "../resolve-DdNXBJSr.mjs";
+import "../redirect-DcmNMvOs.mjs";
+import "../byline-registry-BhzpO41z.mjs";
+import "../field-defs-cache-C7sR7ZeU.mjs";
+import { t as BylineRepository } from "../byline-CzGZC2Zs.mjs";
+import "../staged-B5vQGeSf.mjs";
+import { r as getMediaCaption } from "../normalize-Ip_hFAm8.mjs";
+import "../dist-DY0aOmAP.mjs";
+import "../version-BOFfLiVT.mjs";
+import "../fts-manager-BzFo0xx6.mjs";
+import { g as selectTaxonomyDefs, m as parseTaxonomyCollections } from "../loader-D4w4XE7q.mjs";
+import "../json-recordset-BjYIWFkV.mjs";
+import "../collection-slugs-cache-B2J5aESO.mjs";
+import "../media-usage-work-L8-Au4j-.mjs";
+import "../capture-triggers-D7g3fOZj.mjs";
+import "../activation-sGF9br3X.mjs";
+import { L as BlockTypeRegistry, n as SchemaRegistry } from "../registry-DymfZkAN.mjs";
+import "../hash-A-o2ZX8O.mjs";
+import "../zod-generator-VxCPVDpo.mjs";
+import { r as isTransferError, t as TransferError } from "../errors-DlJwot7q.mjs";
+import "../canonical-DjF_z6GI.mjs";
+import { d as sha256Hex, i as createSha256, s as packageDigest } from "../digest-DlBa7kJl.mjs";
+import "../block-values-CgbMtSGU.mjs";
+import "../query-DuwyFr5Z.mjs";
+import "../schema-Bss8qImF.mjs";
+import "../relations-DrEs3Sc1.mjs";
+import "../errors-BMaCpLeS.mjs";
+import { i as classifySetting } from "../settings-B3ZmPF_8.mjs";
+import "../schema-C036pqEw.mjs";
+import "../settings-yIqoN-Ok.mjs";
+import "../error-CT2SsX5S.mjs";
+import "../fence-BOD3SxZG.mjs";
+import "../ssrf-mcCKMH6B.mjs";
+import { t as applySeed } from "../apply-CLjfxvyH.mjs";
+import "../ssrf-BBXcxG-f.mjs";
+import { n as validateSeed } from "../validate-BxLvcDYh.mjs";
+import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-CGF5kujD.mjs";
+import "../identity-BivQ8wkV.mjs";
+import { n as claimExplicitSeedOwnership } from "../ownership-DCk5NutQ.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { t as createDatabase } from "../connection-UpzYxtE2.mjs";
-import { t as convertDataForRead } from "../portable-text-Dc2YAusw.mjs";
+import { t as createDatabase } from "../connection-CiXgZyCY.mjs";
+import { t as convertDataForRead } from "../portable-text-RCMpCj47.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
 import { EmDashApiError, EmDashClient } from "../client/index.mjs";
-import { a as parseIndexLine, n as unpackSitePackage, o as parseManifest, r as decodeUtf8, t as packSitePackage } from "../tar-K40edFMt.mjs";
-import "../kinds-DT1W4T4Y.mjs";
-import { t as MANIFEST_PATH } from "../paths-BmcAdBo9.mjs";
-import "../transformations-De44wqV_.mjs";
-import "../version-jhs2BRtl.mjs";
-import { r as verifyReceiptDigest } from "../receipt-BmQGzquP.mjs";
+import { a as parseIndexLine, n as unpackSitePackage, o as parseManifest, r as decodeUtf8, t as packSitePackage } from "../tar-DWzcUZ_Q.mjs";
+import "../kinds-DogmNB6n.mjs";
+import { t as MANIFEST_PATH } from "../paths-CQA62503.mjs";
+import "../transformations-DczubD4j.mjs";
+import "../version-DzTJ3gD7.mjs";
+import { r as verifyReceiptDigest } from "../receipt-CmUpyuW5.mjs";
 import { createRequire } from "node:module";
 import { sql } from "kysely";
 import { z } from "zod";
 import { ulid } from "ulidx";
 import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
+import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { access, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { Readable, Writable } from "node:stream";
 import { defineCommand, runMain } from "citty";
 import consola, { consola as consola$1 } from "consola";
@@ -1774,7 +1781,7 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 				url: `${mediaUrlPrefix}${media.storageKey}`,
 				filename: media.filename,
 				alt: media.alt || void 0,
-				caption: media.caption || void 0
+				caption: typeof media.caption === "string" ? media.caption : null
 			});
 			cursor = result.nextCursor;
 		} while (cursor);
@@ -1924,7 +1931,8 @@ function toSeedMedia(value, mediaMap, mediaCounter) {
 		url: mediaInfo.url,
 		filename: mediaInfo.filename,
 		alt: typeof mediaValue.alt === "string" && mediaValue.alt || mediaInfo.alt,
-		caption: mediaInfo.caption
+		caption: getMediaCaption(mediaValue) ?? mediaInfo.caption,
+		libraryCaption: mediaInfo.caption ?? null
 	} };
 }
 /** Slugs of a repeater field's `image` sub-fields. */
@@ -2196,8 +2204,7 @@ const loginCommand = defineCommand({
 		url: {
 			type: "string",
 			alias: "u",
-			description: "EmDash instance URL",
-			default: "http://localhost:4321"
+			description: "EmDash instance URL"
 		},
 		header: {
 			type: "string",
@@ -2206,7 +2213,7 @@ const loginCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
-		const baseUrl = args.url || "http://localhost:4321";
+		const baseUrl = resolveBaseUrl(args);
 		consola$1.start(`Connecting to ${baseUrl}...`);
 		const customHeaders = resolveCustomHeaders();
 		let headerFetch = createHeaderAwareFetch(customHeaders);
@@ -2322,11 +2329,10 @@ const logoutCommand = defineCommand({
 	args: { url: {
 		type: "string",
 		alias: "u",
-		description: "EmDash instance URL",
-		default: "http://localhost:4321"
+		description: "EmDash instance URL"
 	} },
 	async run({ args }) {
-		const baseUrl = args.url || "http://localhost:4321";
+		const baseUrl = resolveBaseUrl(args);
 		const cred = getCredentials(baseUrl);
 		if (!cred) {
 			consola$1.info("No stored credentials found for this instance.");
@@ -2349,88 +2355,74 @@ const whoamiCommand = defineCommand({
 		name: "whoami",
 		description: "Show current user and auth method"
 	},
-	args: {
-		url: {
-			type: "string",
-			alias: "u",
-			description: "EmDash instance URL",
-			default: "http://localhost:4321"
-		},
-		token: {
-			type: "string",
-			alias: "t",
-			description: "Auth token"
-		},
-		json: {
-			type: "boolean",
-			description: "Output as JSON"
-		}
-	},
+	args: { ...connectionArgs },
 	async run({ args }) {
 		configureOutputMode(args);
-		const baseUrl = args.url || "http://localhost:4321";
+		const baseUrl = resolveBaseUrl(args);
 		let token = args.token || process.env["EMDASH_TOKEN"];
 		let authMethod = token ? "token" : "none";
-		let storedHeaders = {};
+		const cred = token ? null : getCredentials(baseUrl);
+		const headerFetch = createHeaderAwareFetch({
+			...cred?.customHeaders,
+			...resolveCustomHeaders()
+		});
 		if (!token) {
-			const cred = getCredentials(baseUrl);
 			if (cred) {
 				token = cred.accessToken;
 				authMethod = "stored";
-				storedHeaders = cred.customHeaders ?? {};
-				if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) {
-					const headerFetch = createHeaderAwareFetch(storedHeaders);
-					try {
-						const refreshRes = await headerFetch(new URL("/_emdash/api/oauth/token/refresh", baseUrl), {
-							method: "POST",
-							headers: { "Content-Type": "application/json" },
-							body: JSON.stringify({
-								refresh_token: cred.refreshToken,
-								grant_type: "refresh_token"
-							})
+				if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) try {
+					const refreshRes = await headerFetch(new URL("/_emdash/api/oauth/token/refresh", baseUrl), {
+						method: "POST",
+						headers: { "Content-Type": "application/json" },
+						body: JSON.stringify({
+							refresh_token: cred.refreshToken,
+							grant_type: "refresh_token"
+						})
+					});
+					if (refreshRes.ok) {
+						const json = await refreshRes.json();
+						const refreshed = json.data && typeof json.data === "object" && "access_token" in json.data ? json.data : json;
+						token = refreshed.access_token;
+						saveCredentials(baseUrl, {
+							...cred,
+							accessToken: refreshed.access_token,
+							expiresAt: new Date(Date.now() + refreshed.expires_in * 1e3).toISOString()
 						});
-						if (refreshRes.ok) {
-							const json = await refreshRes.json();
-							const refreshed = json.data && typeof json.data === "object" && "access_token" in json.data ? json.data : json;
-							token = refreshed.access_token;
-							saveCredentials(baseUrl, {
-								...cred,
-								accessToken: refreshed.access_token,
-								expiresAt: new Date(Date.now() + refreshed.expires_in * 1e3).toISOString()
-							});
-						} else {
-							consola$1.warn("Stored token expired and refresh failed. Run: emdash login");
-							process.exit(2);
-						}
-					} catch {
-						consola$1.warn("Stored token expired. Run: emdash login");
+					} else {
+						consola$1.warn("Stored token expired and refresh failed. Run: emdash login");
 						process.exit(2);
 					}
+				} catch {
+					consola$1.warn("Stored token expired. Run: emdash login");
+					process.exit(2);
 				}
 			}
 		}
-		if (!token) {
-			if (baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1")) {
-				authMethod = "dev-bypass";
-				consola$1.info(`Auth method: ${pc.cyan("dev-bypass")}`);
-				consola$1.info("No stored credentials. Client will use dev bypass for localhost.");
-				return;
-			}
+		if (!token) if (baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1")) authMethod = "dev-bypass";
+		else {
 			consola$1.error("Not logged in. Run: emdash login");
 			process.exit(2);
 		}
-		const headerFetch = createHeaderAwareFetch(storedHeaders);
 		try {
-			const meRes = await headerFetch(new URL("/_emdash/api/auth/me", baseUrl), { headers: { Authorization: `Bearer ${token}` } });
+			const meRes = token ? await headerFetch(new URL("/_emdash/api/auth/me", baseUrl), { headers: { Authorization: `Bearer ${token}` } }) : await headerFetch(new URL("/_emdash/api/auth/dev-bypass", baseUrl), { redirect: "manual" });
 			if (!meRes.ok) {
-				if (meRes.status === 401) {
+				if (token && meRes.status === 401) {
 					consola$1.error("Token is invalid or expired. Run: emdash login");
 					process.exit(1);
 				}
+				if (!token && meRes.status === 403) {
+					consola$1.error("The dev bypass only works under `astro dev`. Run: emdash login");
+					process.exit(1);
+				}
+				if (!token && meRes.status === 404) {
+					consola$1.error("The dev bypass is not available on this site. Run: emdash login");
+					process.exit(1);
+				}
 				consola$1.error(`Failed to fetch user info: ${meRes.status}`);
 				process.exit(1);
 			}
-			const me = (await meRes.json()).data;
+			const raw = await meRes.json();
+			const me = "user" in raw.data ? raw.data.user : raw.data;
 			const roleNames = {
 				10: "subscriber",
 				20: "contributor",
@@ -2988,6 +2980,10 @@ function validateOptions(options) {
 		if (options.check || options.status) throw new MigrateCommandError("--release-lock cannot be used with --check or --status.");
 		if (!LOCK_ID_PATTERN.test(options.releaseLock)) throw new MigrateCommandError("--release-lock requires the lock id shown by --status.");
 	}
+	if (options.takeOverLock !== void 0) {
+		if (options.check || options.status || options.releaseLock !== void 0) throw new MigrateCommandError("--take-over-lock cannot be used with --check, --status, or --release-lock.");
+		if (!LOCK_ID_PATTERN.test(options.takeOverLock)) throw new MigrateCommandError("--take-over-lock requires the lock id shown by --status.");
+	}
 	if (options.expectedTargetFingerprint && !FINGERPRINT_PATTERN.test(options.expectedTargetFingerprint)) throw new MigrateCommandError("--expected-target-fingerprint must be a SHA-256 fingerprint.");
 }
 function hasControlCharacter(value) {
@@ -3145,10 +3141,11 @@ async function runMigrateCommand(options, dependencies = defaultDependencies) {
 			};
 			removeSignalHandlers.push(dependencies.onSignal("SIGINT", onSignal), dependencies.onSignal("SIGTERM", onSignal));
 			const releasing = options.releaseLock !== void 0;
+			const takingOver = options.takeOverLock !== void 0;
 			const applying = !options.check && !options.status && !releasing;
 			if (applying || releasing) {
-				const operation = releasing ? "lock release" : "apply";
-				const question = releasing ? `Release migration lock ${options.releaseLock} on ${target.label}? Release it only when no migration is running.` : `Apply EmDash migrations to ${target.label}?`;
+				const operation = releasing ? "lock release" : takingOver ? "lock take-over" : "apply";
+				const question = releasing ? `Release migration lock ${options.releaseLock} on ${target.label}? Release it only when no migration is running.` : takingOver ? `Take over migration lock ${options.takeOverLock} on ${target.label} and apply EmDash migrations? Take it over only when no migration is running.` : `Apply EmDash migrations to ${target.label}?`;
 				if (options.expectedTargetFingerprint) {
 					if (options.expectedTargetFingerprint !== target.fingerprint) {
 						dependencies.writeStderr("Expected target fingerprint does not match the target.");
@@ -3160,7 +3157,7 @@ async function runMigrateCommand(options, dependencies = defaultDependencies) {
 					exitCode = MIGRATE_EXIT_CODES.confirmation;
 					return exitCode;
 				} else if (!await dependencies.confirm(question)) {
-					dependencies.writeStderr(releasing ? "Lock release cancelled." : "Migration cancelled.");
+					dependencies.writeStderr(releasing ? "Lock release cancelled." : takingOver ? "Lock take-over cancelled." : "Migration cancelled.");
 					exitCode = MIGRATE_EXIT_CODES.confirmation;
 					return exitCode;
 				}
@@ -3174,6 +3171,10 @@ async function runMigrateCommand(options, dependencies = defaultDependencies) {
 				}
 			};
 			if (applying) request.action = "apply";
+			if (takingOver) {
+				request.action = "take-over-lock";
+				request.lockId = options.takeOverLock;
+			}
 			if (releasing) {
 				request.action = "release-lock";
 				request.lockId = options.releaseLock;
@@ -3187,6 +3188,7 @@ async function runMigrateCommand(options, dependencies = defaultDependencies) {
 			if (options.json) dependencies.writeStdout(JSON.stringify(report));
 			else {
 				if (releasing) dependencies.writeStdout(`Released migration lock ${options.releaseLock}.`);
+				if (takingOver) dependencies.writeStdout(`Took over migration lock ${options.takeOverLock}.`);
 				printHumanReport(report, dependencies.writeStdout);
 			}
 			exitCode = reportExitCode(options, report);
@@ -3243,12 +3245,16 @@ const migrateCommand = defineCommand({
 		},
 		"expected-target-fingerprint": {
 			type: "string",
-			description: "Required target fingerprint for noninteractive apply or lock release"
+			description: "Required target fingerprint for noninteractive apply, lock release, or take-over"
 		},
 		"release-lock": {
 			type: "string",
 			description: "Release the migration lock with the id shown by --status"
 		},
+		"take-over-lock": {
+			type: "string",
+			description: "Apply migrations, taking over the migration lock with the id shown by --status"
+		},
 		database: {
 			type: "string",
 			description: "Override the SQLite database path"
@@ -3284,6 +3290,7 @@ const migrateCommand = defineCommand({
 			json: args.json,
 			expectedTargetFingerprint: args["expected-target-fingerprint"],
 			releaseLock: args["release-lock"],
+			takeOverLock: args["take-over-lock"],
 			database: args.database,
 			databaseUrlEnv: args["database-url-env"],
 			d1: args.d1,
@@ -3780,6 +3787,11 @@ const seedCommand = defineCommand({
 			type: "string",
 			description: "Base URL for media files",
 			default: "/_emdash/api/media/file"
+		},
+		"skip-media": {
+			type: "boolean",
+			description: "Resolve $media references to external URLs instead of downloading and storing files",
+			default: false
 		}
 	},
 	async run({ args }) {
@@ -3826,12 +3838,15 @@ const seedCommand = defineCommand({
 			await db.destroy();
 			process.exit(1);
 		}
-		const uploadsDir = resolve(cwd, args["uploads-dir"]);
-		await mkdir(uploadsDir, { recursive: true });
-		const storage = new LocalStorage({
-			directory: uploadsDir,
-			baseUrl: args["media-base-url"]
-		});
+		let storage;
+		if (!args["skip-media"]) {
+			const uploadsDir = resolve(cwd, args["uploads-dir"]);
+			await mkdir(uploadsDir, { recursive: true });
+			storage = new LocalStorage({
+				directory: uploadsDir,
+				baseUrl: args["media-base-url"]
+			});
+		}
 		const onConflictRaw = args["on-conflict"];
 		if (onConflictRaw !== "skip" && onConflictRaw !== "update" && onConflictRaw !== "error") {
 			consola.error(`Invalid --on-conflict value: ${onConflictRaw}`);
@@ -3842,7 +3857,8 @@ const seedCommand = defineCommand({
 		const options = {
 			includeContent: args.content,
 			onConflict: onConflictRaw,
-			storage
+			storage,
+			skipMediaDownload: args["skip-media"]
 		};
 		consola.start("Applying seed...");
 		try {