emdash 1.3.0 → 1.3.1

package/dist/transport-DtIrjEFO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-DtIrjEFO.mjs","names":[],"sources":["../src/client/transport.ts"],"sourcesContent":["/**\n * Transport layer for the EmDash client.\n *\n * Implements a composable interceptor pipeline that modifies requests\n * and responses. The client calls `transport.fetch(request)` — everything\n * else (auth, CSRF, retry) is handled by interceptors.\n */\n\n// Regex patterns for transport utilities\nconst COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;\n\n/**\n * An interceptor can modify the request, call next(), inspect\n * the response, and optionally retry.\n */\nexport type Interceptor = (\n\trequest: Request,\n\tnext: (request: Request) => Promise<Response>,\n) => Promise<Response>;\n\nexport interface TransportOptions {\n\tinterceptors?: Interceptor[];\n}\n\nfunction baseFetch(request: Request): Promise<Response> {\n\treturn globalThis.fetch(request);\n}\n\n/**\n * Creates a fetch function that runs requests through an interceptor pipeline.\n */\nexport function createTransport(options: TransportOptions = {}): {\n\tfetch: (request: Request) => Promise<Response>;\n} {\n\tconst interceptors = options.interceptors ?? [];\n\n\t// Build the chain once — interceptors don't change after construction\n\tlet chain: (request: Request) => Promise<Response> = baseFetch;\n\tfor (let i = interceptors.length - 1; i >= 0; i--) {\n\t\tconst interceptor = interceptors[i];\n\t\tconst next = chain;\n\t\tchain = (req) => interceptor(req, next);\n\t}\n\n\treturn { fetch: chain };\n}\n\n// ---------------------------------------------------------------------------\n// Built-in interceptors\n// ---------------------------------------------------------------------------\n\n/**\n * Adds X-EmDash-Request: 1 and Origin headers to mutation requests\n * (POST, PUT, DELETE). The custom header satisfies EmDash's CSRF check;\n * the Origin header satisfies Astro's built-in origin verification which\n * rejects server-side POST requests that lack a matching Origin.\n */\nexport function csrfInterceptor(): Interceptor {\n\tconst MUTATION_METHODS = new Set([\"POST\", \"PUT\", \"DELETE\", \"PATCH\"]);\n\n\treturn (request, next) => {\n\t\tif (MUTATION_METHODS.has(request.method)) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set(\"X-EmDash-Request\", \"1\");\n\t\t\tif (!headers.has(\"Origin\")) {\n\t\t\t\tconst url = new URL(request.url);\n\t\t\t\theaders.set(\"Origin\", url.origin);\n\t\t\t}\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Adds Authorization: Bearer header from a static token.\n */\nexport function tokenInterceptor(token: string): Interceptor {\n\treturn (request, next) => {\n\t\tconst headers = new Headers(request.headers);\n\t\theaders.set(\"Authorization\", `Bearer ${token}`);\n\t\treturn next(new Request(request, { headers }));\n\t};\n}\n\n/**\n * Dev bypass interceptor. Calls the dev-bypass endpoint on first request\n * to establish a session, then forwards the session cookie on subsequent\n * requests.\n */\nexport function devBypassInterceptor(baseUrl: string): Interceptor {\n\tlet sessionCookie: string | null = null;\n\tlet initializing: Promise<void> | null = null;\n\n\tasync function init(): Promise<void> {\n\t\tconst bypassUrl = new URL(\"/_emdash/api/auth/dev-bypass\", baseUrl);\n\t\tconst res = await globalThis.fetch(bypassUrl, { redirect: \"manual\" });\n\n\t\t// Extract session cookie from Set-Cookie header\n\t\tconst setCookie = res.headers.get(\"set-cookie\");\n\t\tif (setCookie) {\n\t\t\t// Extract just the cookie name=value part\n\t\t\tconst match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);\n\t\t\tif (match) {\n\t\t\t\tsessionCookie = match[1]!;\n\t\t\t}\n\t\t}\n\n\t\t// Consume the response body\n\t\tif (res.body) {\n\t\t\tawait res.text().catch(() => {});\n\t\t}\n\t}\n\n\treturn async (request, next) => {\n\t\t// Ensure we've initialized (only once, even with concurrent requests)\n\t\tif (!sessionCookie) {\n\t\t\tif (!initializing) {\n\t\t\t\tinitializing = init();\n\t\t\t}\n\t\t\tawait initializing;\n\t\t}\n\n\t\tif (sessionCookie) {\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\tconst existing = headers.get(\"cookie\");\n\t\t\theaders.set(\"cookie\", existing ? `${existing}; ${sessionCookie}` : sessionCookie);\n\t\t\treturn next(new Request(request, { headers }));\n\t\t}\n\n\t\treturn next(request);\n\t};\n}\n\n/**\n * Auto-refreshes expired OAuth tokens on 401 responses.\n * Requires a refresh token and the token endpoint URL.\n */\nexport function refreshInterceptor(options: {\n\trefreshToken: string;\n\ttokenEndpoint: string;\n\tonTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;\n\tfetch?: (request: Request) => Promise<Response>;\n}): Interceptor {\n\tconst send = options.fetch ?? baseFetch;\n\tlet refreshing: Promise<string | null> | null = null;\n\n\tasync function refresh(): Promise<string | null> {\n\t\tconst res = await send(\n\t\t\tnew Request(options.tokenEndpoint, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\t\trefresh_token: options.refreshToken,\n\t\t\t\t}),\n\t\t\t}),\n\t\t);\n\n\t\tif (!res.ok) return null;\n\n\t\tinterface TokenFields {\n\t\t\taccess_token: string;\n\t\t\trefresh_token?: string;\n\t\t\texpires_in?: number;\n\t\t}\n\n\t\tconst json = (await res.json()) as Record<string, unknown>;\n\n\t\t// The token endpoint wraps the response in { success, data: ... } via apiSuccess.\n\t\t// Handle both wrapped and bare shapes for robustness.\n\t\tconst tokenData: TokenFields =\n\t\t\tjson.data && typeof json.data === \"object\" && \"access_token\" in json.data\n\t\t\t\t? (json.data as TokenFields)\n\t\t\t\t: (json as unknown as TokenFields);\n\n\t\tconst expiresAt = tokenData.expires_in\n\t\t\t? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()\n\t\t\t: new Date(Date.now() + 3600_000).toISOString();\n\n\t\tif (options.onTokenRefreshed) {\n\t\t\toptions.onTokenRefreshed(\n\t\t\t\ttokenData.access_token,\n\t\t\t\ttokenData.refresh_token ?? options.refreshToken,\n\t\t\t\texpiresAt,\n\t\t\t);\n\t\t}\n\n\t\treturn tokenData.access_token;\n\t}\n\n\treturn async (request, next) => {\n\t\t// A request body can only be read once; clone before sending so the\n\t\t// 401 retry has an unconsumed request to rebuild from.\n\t\tconst retryTemplate = request.body ? request.clone() : request;\n\n\t\tconst response = await next(request);\n\n\t\tif (response.status === 401) {\n\t\t\t// Try to refresh\n\t\t\tif (!refreshing) {\n\t\t\t\trefreshing = refresh().finally(() => {\n\t\t\t\t\trefreshing = null;\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst newToken = await refreshing;\n\t\t\tif (newToken) {\n\t\t\t\t// Retry with new token\n\t\t\t\tconst headers = new Headers(retryTemplate.headers);\n\t\t\t\theaders.set(\"Authorization\", `Bearer ${newToken}`);\n\t\t\t\treturn next(new Request(retryTemplate, { headers }));\n\t\t\t}\n\t\t}\n\n\t\treturn response;\n\t};\n}\n"],"mappings":";;;;;;;;AASA,MAAM,4BAA4B;AAelC,SAAS,UAAU,SAAqC;AACvD,QAAO,WAAW,MAAM,QAAQ;;;;;AAMjC,SAAgB,gBAAgB,UAA4B,EAAE,EAE5D;CACD,MAAM,eAAe,QAAQ,gBAAgB,EAAE;CAG/C,IAAI,QAAiD;AACrD,MAAK,IAAI,IAAI,aAAa,SAAS,GAAG,KAAK,GAAG,KAAK;EAClD,MAAM,cAAc,aAAa;EACjC,MAAM,OAAO;AACb,WAAS,QAAQ,YAAY,KAAK,KAAK;;AAGxC,QAAO,EAAE,OAAO,OAAO;;;;;;;;AAaxB,SAAgB,kBAA+B;CAC9C,MAAM,mBAAmB,IAAI,IAAI;EAAC;EAAQ;EAAO;EAAU;EAAQ,CAAC;AAEpE,SAAQ,SAAS,SAAS;AACzB,MAAI,iBAAiB,IAAI,QAAQ,OAAO,EAAE;GACzC,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,WAAQ,IAAI,oBAAoB,IAAI;AACpC,OAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;IAC3B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,YAAQ,IAAI,UAAU,IAAI,OAAO;;AAElC,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAE/C,SAAO,KAAK,QAAQ;;;;;;AAOtB,SAAgB,iBAAiB,OAA4B;AAC5D,SAAQ,SAAS,SAAS;EACzB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAC5C,UAAQ,IAAI,iBAAiB,UAAU,QAAQ;AAC/C,SAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;;;;;;;AAShD,SAAgB,qBAAqB,SAA8B;CAClE,IAAI,gBAA+B;CACnC,IAAI,eAAqC;CAEzC,eAAe,OAAsB;EACpC,MAAM,YAAY,IAAI,IAAI,gCAAgC,QAAQ;EAClE,MAAM,MAAM,MAAM,WAAW,MAAM,WAAW,EAAE,UAAU,UAAU,CAAC;EAGrE,MAAM,YAAY,IAAI,QAAQ,IAAI,aAAa;AAC/C,MAAI,WAAW;GAEd,MAAM,QAAQ,UAAU,MAAM,0BAA0B;AACxD,OAAI,MACH,iBAAgB,MAAM;;AAKxB,MAAI,IAAI,KACP,OAAM,IAAI,MAAM,CAAC,YAAY,GAAG;;AAIlC,QAAO,OAAO,SAAS,SAAS;AAE/B,MAAI,CAAC,eAAe;AACnB,OAAI,CAAC,aACJ,gBAAe,MAAM;AAEtB,SAAM;;AAGP,MAAI,eAAe;GAClB,MAAM,UAAU,IAAI,QAAQ,QAAQ,QAAQ;GAC5C,MAAM,WAAW,QAAQ,IAAI,SAAS;AACtC,WAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,kBAAkB,cAAc;AACjF,UAAO,KAAK,IAAI,QAAQ,SAAS,EAAE,SAAS,CAAC,CAAC;;AAG/C,SAAO,KAAK,QAAQ;;;;;;;AAQtB,SAAgB,mBAAmB,SAKnB;CACf,MAAM,OAAO,QAAQ,SAAS;CAC9B,IAAI,aAA4C;CAEhD,eAAe,UAAkC;EAChD,MAAM,MAAM,MAAM,KACjB,IAAI,QAAQ,QAAQ,eAAe;GAClC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU;IACpB,YAAY;IACZ,eAAe,QAAQ;IACvB,CAAC;GACF,CAAC,CACF;AAED,MAAI,CAAC,IAAI,GAAI,QAAO;EAQpB,MAAM,OAAQ,MAAM,IAAI,MAAM;EAI9B,MAAM,YACL,KAAK,QAAQ,OAAO,KAAK,SAAS,YAAY,kBAAkB,KAAK,OACjE,KAAK,OACL;EAEL,MAAM,YAAY,UAAU,aACzB,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,CAAC,aAAa,GAChE,IAAI,KAAK,KAAK,KAAK,GAAG,KAAS,CAAC,aAAa;AAEhD,MAAI,QAAQ,iBACX,SAAQ,iBACP,UAAU,cACV,UAAU,iBAAiB,QAAQ,cACnC,UACA;AAGF,SAAO,UAAU;;AAGlB,QAAO,OAAO,SAAS,SAAS;EAG/B,MAAM,gBAAgB,QAAQ,OAAO,QAAQ,OAAO,GAAG;EAEvD,MAAM,WAAW,MAAM,KAAK,QAAQ;AAEpC,MAAI,SAAS,WAAW,KAAK;AAE5B,OAAI,CAAC,WACJ,cAAa,SAAS,CAAC,cAAc;AACpC,iBAAa;KACZ;GAGH,MAAM,WAAW,MAAM;AACvB,OAAI,UAAU;IAEb,MAAM,UAAU,IAAI,QAAQ,cAAc,QAAQ;AAClD,YAAQ,IAAI,iBAAiB,UAAU,WAAW;AAClD,WAAO,KAAK,IAAI,QAAQ,eAAe,EAAE,SAAS,CAAC,CAAC;;;AAItD,SAAO"}

package/dist/trusted-proxy-CDRd5Kmw.mjs

@@ -0,0 +1,51 @@
+//#region src/auth/trusted-proxy.ts
+/**
+* RFC 7230 token — valid characters for an HTTP header name. Invalid names
+* passed to `Headers.get()` throw a TypeError at runtime, which would
+* otherwise surface as a 500 from every auth route.
+*/
+const HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
+/**
+* Normalise a list of header names the way both the config path and any
+* caller passing a pre-resolved list should do: trim, lowercase, drop
+* empty, drop anything that isn't a valid RFC 7230 token. Invalid names
+* would crash `Headers.get()` at runtime.
+*/
+function normalizeTrustedHeaders(names) {
+	return names.map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));
+}
+function isValidHeaderName(name) {
+	return HEADER_NAME_PATTERN.test(name);
+}
+/** Cache for the env-derived value. `null` means "not yet parsed". */
+let _envCache = null;
+function getEnvTrustedHeaders() {
+	if (_envCache !== null) return _envCache;
+	let raw;
+	try {
+		const importMetaEnv = import.meta.env;
+		raw = (typeof process !== "undefined" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : void 0) || importMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;
+	} catch {
+		raw = void 0;
+	}
+	if (!raw) {
+		_envCache = [];
+		return _envCache;
+	}
+	_envCache = raw.split(",").map((s) => s.trim().toLowerCase()).filter((s) => s.length > 0 && isValidHeaderName(s));
+	return _envCache;
+}
+/**
+* Return the lowercased list of headers to trust for client-IP resolution.
+*
+* When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it
+* wins. Otherwise fall through to the env var, then to `[]`.
+*/
+function getTrustedProxyHeaders(config) {
+	if (config && config.trustedProxyHeaders !== void 0) return config.trustedProxyHeaders.map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0 && isValidHeaderName(h));
+	return getEnvTrustedHeaders();
+}
+
+//#endregion
+export { normalizeTrustedHeaders as n, getTrustedProxyHeaders as t };
+//# sourceMappingURL=trusted-proxy-CDRd5Kmw.mjs.map

package/dist/trusted-proxy-CDRd5Kmw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-proxy-CDRd5Kmw.mjs","names":[],"sources":["../src/auth/trusted-proxy.ts"],"sourcesContent":["/**\n * Resolve the list of client-IP headers the operator trusts.\n *\n * Resolution order:\n *   1. `config.trustedProxyHeaders` — explicit opt-in via astro.config.mjs.\n *      An empty array is respected (means \"trust nothing, ignore env\").\n *   2. `EMDASH_TRUSTED_PROXY_HEADERS` env var — comma-separated header names.\n *   3. `[]` — default, no trusted headers.\n *\n * Operators must only set this when they control the reverse proxy.\n * Untrusted clients can set any header they like; trusting headers from\n * an open network defeats rate limiting.\n *\n * Header names are returned lowercased because HTTP header lookups are\n * case-insensitive.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\n/**\n * RFC 7230 token — valid characters for an HTTP header name. Invalid names\n * passed to `Headers.get()` throw a TypeError at runtime, which would\n * otherwise surface as a 500 from every auth route.\n */\nconst HEADER_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9a-z]+$/;\n\n/**\n * Normalise a list of header names the way both the config path and any\n * caller passing a pre-resolved list should do: trim, lowercase, drop\n * empty, drop anything that isn't a valid RFC 7230 token. Invalid names\n * would crash `Headers.get()` at runtime.\n */\nexport function normalizeTrustedHeaders(names: readonly string[]): string[] {\n\treturn names\n\t\t.map((h) => h.trim().toLowerCase())\n\t\t.filter((h) => h.length > 0 && HEADER_NAME_PATTERN.test(h));\n}\n\nfunction isValidHeaderName(name: string): boolean {\n\treturn HEADER_NAME_PATTERN.test(name);\n}\n\n/** Cache for the env-derived value. `null` means \"not yet parsed\". */\nlet _envCache: string[] | null = null;\n\n/** Test-only: clear the env cache so a fresh value is read on next call. */\nexport function _resetTrustedProxyHeadersCache(): void {\n\t_envCache = null;\n}\n\nfunction getEnvTrustedHeaders(): string[] {\n\tif (_envCache !== null) return _envCache;\n\tlet raw: string | undefined;\n\ttry {\n\t\t// Prefer process.env so SSR/container deployments can override this\n\t\t// value at runtime (Vite/Astro inline import.meta.env at build time,\n\t\t// which locks the value into the bundle). Fall back to import.meta.env\n\t\t// for bundler-managed environments where process.env isn't populated.\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env shape varies by bundler\n\t\tconst importMetaEnv = (import.meta as unknown as { env?: Record<string, string | undefined> })\n\t\t\t.env;\n\t\traw =\n\t\t\t(typeof process !== \"undefined\" ? process.env?.EMDASH_TRUSTED_PROXY_HEADERS : undefined) ||\n\t\t\timportMetaEnv?.EMDASH_TRUSTED_PROXY_HEADERS;\n\t} catch {\n\t\traw = undefined;\n\t}\n\tif (!raw) {\n\t\t_envCache = [];\n\t\treturn _envCache;\n\t}\n\t_envCache = raw\n\t\t.split(\",\")\n\t\t.map((s) => s.trim().toLowerCase())\n\t\t.filter((s) => s.length > 0 && isValidHeaderName(s));\n\treturn _envCache;\n}\n\n/**\n * Return the lowercased list of headers to trust for client-IP resolution.\n *\n * When `config?.trustedProxyHeaders` is explicitly set (even to `[]`), it\n * wins. Otherwise fall through to the env var, then to `[]`.\n */\nexport function getTrustedProxyHeaders(config: EmDashConfig | null | undefined): string[] {\n\tif (config && config.trustedProxyHeaders !== undefined) {\n\t\treturn config.trustedProxyHeaders\n\t\t\t.map((h) => h.trim().toLowerCase())\n\t\t\t.filter((h) => h.length > 0 && isValidHeaderName(h));\n\t}\n\treturn getEnvTrustedHeaders();\n}\n"],"mappings":";;;;;;AAwBA,MAAM,sBAAsB;;;;;;;AAQ5B,SAAgB,wBAAwB,OAAoC;AAC3E,QAAO,MACL,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,oBAAoB,KAAK,EAAE,CAAC;;AAG7D,SAAS,kBAAkB,MAAuB;AACjD,QAAO,oBAAoB,KAAK,KAAK;;;AAItC,IAAI,YAA6B;AAOjC,SAAS,uBAAiC;AACzC,KAAI,cAAc,KAAM,QAAO;CAC/B,IAAI;AACJ,KAAI;EAMH,MAAM,gBAAiB,OAAO,KAC5B;AACF,SACE,OAAO,YAAY,cAAc,QAAQ,KAAK,+BAA+B,WAC9E,eAAe;SACT;AACP,QAAM;;AAEP,KAAI,CAAC,KAAK;AACT,cAAY,EAAE;AACd,SAAO;;AAER,aAAY,IACV,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AACrD,QAAO;;;;;;;;AASR,SAAgB,uBAAuB,QAAmD;AACzF,KAAI,UAAU,OAAO,wBAAwB,OAC5C,QAAO,OAAO,oBACZ,KAAK,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAClC,QAAQ,MAAM,EAAE,SAAS,KAAK,kBAAkB,EAAE,CAAC;AAEtD,QAAO,sBAAsB"}

package/dist/turnstile-Ct5YuFNY.mjs

@@ -0,0 +1,58 @@
+//#region src/comments/turnstile.ts
+/**
+* Server-side Turnstile verification for public comment submissions.
+*
+* The comment form widget (`CommentForm.astro`) submits a `turnstileToken`;
+* this verifies it against Cloudflare's siteverify API. Enforcement is
+* opt-in: it only runs when the operator configures the Turnstile secret
+* key (`EMDASH_TURNSTILE_SECRET_KEY` or `TURNSTILE_SECRET_KEY`), so
+* existing non-Turnstile sites are unaffected.
+*
+* Mirrors `verifyTurnstile` in `@emdash-cms/plugin-forms` (not imported —
+* core doesn't depend on plugin packages).
+*/
+const SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/**
+* Resolve the configured Turnstile secret key, or `""` when Turnstile
+* enforcement is not configured.
+*
+* Reads `process.env` only: Vite replaces `import.meta.env` at build time,
+* which would bake a build-machine secret into the bundle and hide a secret
+* set on the deployment platform.
+*/
+function getTurnstileSecretKey() {
+	const env = typeof process !== "undefined" && process.env ? process.env : {};
+	return env.EMDASH_TURNSTILE_SECRET_KEY || env.TURNSTILE_SECRET_KEY || "";
+}
+/**
+* Verify a Turnstile response token via siteverify.
+*
+* Fails closed: a missing token, a failed verification, and a siteverify
+* transport error all return `false` — when the operator has configured a
+* secret, an unverifiable submission must not be persisted.
+*/
+async function verifyTurnstileToken(token, secretKey, remoteIp) {
+	if (!token) return false;
+	const body = {
+		secret: secretKey,
+		response: token
+	};
+	if (remoteIp) body.remoteip = remoteIp;
+	try {
+		const data = await (await fetch(SITEVERIFY_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body),
+			signal: AbortSignal.timeout(1e4)
+		})).json();
+		if (!data.success) console.warn("[comments] Turnstile verification failed:", data["error-codes"] ?? []);
+		return data.success === true;
+	} catch (error) {
+		console.error("[comments] Turnstile siteverify request failed:", error instanceof Error ? error.message : error);
+		return false;
+	}
+}
+
+//#endregion
+export { getTurnstileSecretKey, verifyTurnstileToken };
+//# sourceMappingURL=turnstile-Ct5YuFNY.mjs.map

package/dist/turnstile-Ct5YuFNY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile-Ct5YuFNY.mjs","names":[],"sources":["../src/comments/turnstile.ts"],"sourcesContent":["/**\n * Server-side Turnstile verification for public comment submissions.\n *\n * The comment form widget (`CommentForm.astro`) submits a `turnstileToken`;\n * this verifies it against Cloudflare's siteverify API. Enforcement is\n * opt-in: it only runs when the operator configures the Turnstile secret\n * key (`EMDASH_TURNSTILE_SECRET_KEY` or `TURNSTILE_SECRET_KEY`), so\n * existing non-Turnstile sites are unaffected.\n *\n * Mirrors `verifyTurnstile` in `@emdash-cms/plugin-forms` (not imported —\n * core doesn't depend on plugin packages).\n */\n\nconst SITEVERIFY_URL = \"https://challenges.cloudflare.com/turnstile/v0/siteverify\";\n\n/**\n * Resolve the configured Turnstile secret key, or `\"\"` when Turnstile\n * enforcement is not configured.\n *\n * Reads `process.env` only: Vite replaces `import.meta.env` at build time,\n * which would bake a build-machine secret into the bundle and hide a secret\n * set on the deployment platform.\n */\nexport function getTurnstileSecretKey(): string {\n\tconst env = typeof process !== \"undefined\" && process.env ? process.env : {};\n\treturn env.EMDASH_TURNSTILE_SECRET_KEY || env.TURNSTILE_SECRET_KEY || \"\";\n}\n\n/**\n * Verify a Turnstile response token via siteverify.\n *\n * Fails closed: a missing token, a failed verification, and a siteverify\n * transport error all return `false` — when the operator has configured a\n * secret, an unverifiable submission must not be persisted.\n */\nexport async function verifyTurnstileToken(\n\ttoken: string | undefined,\n\tsecretKey: string,\n\tremoteIp?: string | null,\n): Promise<boolean> {\n\tif (!token) return false;\n\n\tconst body: Record<string, string> = { secret: secretKey, response: token };\n\tif (remoteIp) {\n\t\tbody.remoteip = remoteIp;\n\t}\n\n\ttry {\n\t\tconst res = await fetch(SITEVERIFY_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify(body),\n\t\t\t// Fail closed *quickly* if siteverify is slow — without a timeout\n\t\t\t// the comment POST would hang until the runtime kills it\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\t\tconst data: { success?: boolean; \"error-codes\"?: string[] } = await res.json();\n\t\tif (!data.success) {\n\t\t\tconsole.warn(\"[comments] Turnstile verification failed:\", data[\"error-codes\"] ?? []);\n\t\t}\n\t\treturn data.success === true;\n\t} catch (error) {\n\t\tconsole.error(\n\t\t\t\"[comments] Turnstile siteverify request failed:\",\n\t\t\terror instanceof Error ? error.message : error,\n\t\t);\n\t\treturn false;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAM,iBAAiB;;;;;;;;;AAUvB,SAAgB,wBAAgC;CAC/C,MAAM,MAAM,OAAO,YAAY,eAAe,QAAQ,MAAM,QAAQ,MAAM,EAAE;AAC5E,QAAO,IAAI,+BAA+B,IAAI,wBAAwB;;;;;;;;;AAUvE,eAAsB,qBACrB,OACA,WACA,UACmB;AACnB,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,OAA+B;EAAE,QAAQ;EAAW,UAAU;EAAO;AAC3E,KAAI,SACH,MAAK,WAAW;AAGjB,KAAI;EASH,MAAM,OAAwD,OARlD,MAAM,MAAM,gBAAgB;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU,KAAK;GAG1B,QAAQ,YAAY,QAAQ,IAAO;GACnC,CAAC,EACsE,MAAM;AAC9E,MAAI,CAAC,KAAK,QACT,SAAQ,KAAK,6CAA6C,KAAK,kBAAkB,EAAE,CAAC;AAErF,SAAO,KAAK,YAAY;UAChB,OAAO;AACf,UAAQ,MACP,mDACA,iBAAiB,QAAQ,MAAM,UAAU,MACzC;AACD,SAAO"}

package/dist/types-Bgujop4S.d.mts

@@ -0,0 +1,374 @@
+//#region src/schema/block-types.d.ts
+declare const BLOCK_FIELD_TYPES: readonly ["string", "text", "url", "number", "integer", "boolean", "datetime", "select", "multiSelect", "portableText", "image", "file", "repeater"];
+type BlockFieldType = (typeof BLOCK_FIELD_TYPES)[number];
+type BlockTypeSource = "user" | "seed";
+interface BlockFieldOptions {
+  darkVariant?: boolean;
+}
+interface BlockFieldDefinition {
+  slug: string;
+  label: string;
+  type: BlockFieldType;
+  required?: boolean;
+  defaultValue?: unknown;
+  validation?: Omit<FieldValidation, "required">;
+  options?: BlockFieldOptions;
+}
+interface BlockTypeVersion {
+  id: string;
+  blockTypeId: string;
+  version: number;
+  fields: BlockFieldDefinition[];
+  fingerprint: string;
+  active: boolean;
+  unsupportedTypes?: UnsupportedFieldType[];
+  createdAt: string;
+  updatedAt: string;
+}
+interface BlockType {
+  id: string;
+  slug: string;
+  label: string;
+  description?: string;
+  icon?: string;
+  category?: string;
+  currentVersion: number;
+  source: BlockTypeSource;
+  versions: BlockTypeVersion[];
+  createdAt: string;
+  updatedAt: string;
+}
+interface CreateBlockTypeInput {
+  slug: string;
+  label: string;
+  description?: string;
+  icon?: string;
+  category?: string;
+  source?: BlockTypeSource;
+  fields: BlockFieldDefinition[];
+}
+interface UpdateBlockTypeInput {
+  expectedFingerprint: string;
+  label?: string;
+  description?: string | null;
+  icon?: string | null;
+  category?: string | null;
+  fields?: BlockFieldDefinition[];
+  breaking?: boolean;
+}
+interface SeedBlockTypeVersionInput {
+  version: number;
+  fields: BlockFieldDefinition[];
+}
+interface ApplySeedBlockTypeInput {
+  slug: string;
+  label: string;
+  description?: string;
+  icon?: string;
+  category?: string;
+  currentVersion: number;
+  versions: SeedBlockTypeVersionInput[];
+}
+type BlockTypeDifferenceCompatibility = "compatible" | "breaking";
+interface BlockTypeDifference {
+  path: string;
+  change: string;
+  compatibility: BlockTypeDifferenceCompatibility;
+}
+interface BlockTypeCompatibility {
+  compatible: boolean;
+  differences: BlockTypeDifference[];
+}
+//#endregion
+//#region src/schema/types.d.ts
+/**
+ * Supported field types
+ */
+type FieldType = "string" | "text" | "url" | "number" | "integer" | "boolean" | "datetime" | "select" | "multiSelect" | "portableText" | "image" | "file" | "reference" | "json" | "slug" | "repeater" | "blocks";
+/**
+ * SQLite column types that map from field types
+ */
+type ColumnType = "TEXT" | "REAL" | "INTEGER" | "JSON";
+/**
+ * Map field types to their SQLite column types
+ */
+declare const FIELD_TYPE_TO_COLUMN: Record<FieldType, ColumnType>;
+/**
+ * Features a collection can support
+ */
+type CollectionSupport = "drafts" | "revisions" | "preview" | "scheduling" | "search" | "seo";
+/**
+ * Sources for how a collection was created
+ */
+type CollectionSource = `template:${string}` | `import:${string}` | "manual" | "discovered" | "seed";
+/**
+ * Validation rules for a field
+ */
+/** Sub-field definition for repeater fields */
+interface RepeaterSubField {
+  slug: string;
+  type: "string" | "text" | "url" | "number" | "integer" | "boolean" | "datetime" | "select" | "image";
+  label: string;
+  required?: boolean;
+  options?: string[];
+}
+interface FieldValidation {
+  required?: boolean;
+  min?: number;
+  max?: number;
+  minLength?: number;
+  maxLength?: number;
+  pattern?: string;
+  options?: string[];
+  subFields?: RepeaterSubField[];
+  minItems?: number;
+  maxItems?: number;
+  allowedMimeTypes?: string[];
+  /** Reference fields: the relation's slug. */
+  relation?: string;
+  /**
+   * Reference fields: which end of the relation this collection sits on.
+   * `parent` picks children and controls their order; `child` picks parents
+   * and is unordered, since `sort_order` is scoped to a parent.
+   */
+  relationSide?: "parent" | "child";
+  /** Reference fields: the collection on the *other* end (derived from the
+   * relation and the side, denormalized here). */
+  targetCollection?: string;
+  /** Reference fields: allow selecting more than one entry (UI constraint). */
+  multiple?: boolean;
+  allowedTypes?: string[];
+  retiredTypes?: string[];
+}
+/**
+ * Widget options for field rendering
+ */
+interface FieldWidgetOptions {
+  rows?: number;
+  showPreview?: boolean;
+  darkVariant?: boolean;
+  collection?: string;
+  allowMultiple?: boolean;
+  [key: string]: unknown;
+}
+interface UnsupportedFieldType {
+  type: string;
+  path: string;
+}
+/** Collection-level admin presentation options. */
+interface CollectionAdminConfig {
+  /** Custom field slugs to show in the content list. */
+  listColumns?: string[];
+  /** Show a "new entry" quick action on the dashboard. Defaults to true. */
+  quickCreate?: boolean;
+}
+/**
+ * A collection definition
+ */
+interface Collection {
+  id: string;
+  slug: string;
+  label: string;
+  labelSingular?: string;
+  description?: string;
+  icon?: string;
+  admin?: CollectionAdminConfig;
+  supports: CollectionSupport[];
+  source?: CollectionSource;
+  /** Whether this collection has SEO metadata fields enabled */
+  hasSeo: boolean;
+  /** Field slug powering the admin list Title column. Defaults to the standard title display. */
+  titleField?: string;
+  /** Field slug powering the admin list Date column. Must be a `datetime` field. Defaults to last-updated. */
+  dateField?: string;
+  /** URL pattern with {slug} placeholder (e.g. "/{slug}", "/blog/{slug}") */
+  urlPattern?: string;
+  /** Whether published entries require a public slug. Defaults to true. */
+  routable?: boolean;
+  /**
+   * Omit this collection's auto-generated sidebar entry and dashboard quick
+   * action. The collection stays fully functional everywhere else (API, MCP,
+   * hooks, direct `/content/:collection` URLs), so a plugin that owns the
+   * collection can point editors at its own admin UI.
+   */
+  hidden: boolean;
+  /**
+   * Explicit position in the admin sidebar. Collections with a `sortOrder`
+   * come first, in ascending order; the rest keep the alphabetical-by-slug
+   * order and follow. `undefined` means "no explicit position".
+   */
+  sortOrder?: number;
+  /**
+   * Admin sidebar folder. Collections sharing a group render under one
+   * collapsible entry labelled with the group; `undefined` keeps the
+   * collection inline.
+   */
+  group?: string;
+  /** Whether comments are enabled for this collection */
+  commentsEnabled: boolean;
+  /** Moderation strategy: "all" | "first_time" | "none" */
+  commentsModeration: "all" | "first_time" | "none";
+  /** Auto-close comments after N days. 0 = never close. */
+  commentsClosedAfterDays: number;
+  /** Auto-approve comments from authenticated CMS users */
+  commentsAutoApproveUsers: boolean;
+  /** Whether opening an entry takes an edit lock. Defaults to true. */
+  editLocking: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
+/**
+ * A field definition
+ */
+interface Field {
+  id: string;
+  collectionId: string;
+  slug: string;
+  label: string;
+  type: FieldType;
+  /** Raw stored type metadata that this runtime cannot safely interpret. */
+  unsupportedType?: UnsupportedFieldType;
+  blockTypes?: BlockType[];
+  blockTypeFingerprint?: string;
+  columnType: ColumnType;
+  required: boolean;
+  unique: boolean;
+  defaultValue?: unknown;
+  validation?: FieldValidation;
+  widget?: string;
+  options?: FieldWidgetOptions;
+  sortOrder: number;
+  searchable: boolean;
+  /** Whether this field has a physical index for structured list queries. */
+  indexed: boolean;
+  /** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */
+  translatable: boolean;
+  createdAt: string;
+}
+/**
+ * Input for creating a collection
+ */
+interface CreateCollectionInput {
+  slug: string;
+  label: string;
+  labelSingular?: string;
+  description?: string;
+  icon?: string;
+  admin?: CollectionAdminConfig;
+  supports?: CollectionSupport[];
+  source?: CollectionSource;
+  urlPattern?: string;
+  routable?: boolean;
+  hasSeo?: boolean;
+  /** Omit the auto-generated sidebar entry and dashboard quick action (defaults to false) */
+  hidden?: boolean;
+  /** Explicit admin sidebar position (omit for the alphabetical fallback) */
+  sortOrder?: number | null;
+  /** Admin sidebar folder shared with other collections of the same group */
+  group?: string | null;
+  commentsEnabled?: boolean;
+  /** Take an edit lock when an entry is opened (defaults to true) */
+  editLocking?: boolean;
+}
+/**
+ * Input for updating a collection
+ */
+interface UpdateCollectionInput {
+  label?: string;
+  labelSingular?: string;
+  description?: string;
+  icon?: string;
+  admin?: CollectionAdminConfig;
+  supports?: CollectionSupport[];
+  urlPattern?: string | null;
+  routable?: boolean;
+  hasSeo?: boolean;
+  /** Omit the auto-generated sidebar entry and dashboard quick action */
+  hidden?: boolean;
+  /** Explicit admin sidebar position; `null` clears it back to alphabetical */
+  sortOrder?: number | null;
+  /** Admin sidebar folder; `null` moves the collection back inline */
+  group?: string | null;
+  commentsEnabled?: boolean;
+  commentsModeration?: "all" | "first_time" | "none";
+  commentsClosedAfterDays?: number;
+  commentsAutoApproveUsers?: boolean;
+  /** Take an edit lock when an entry is opened */
+  editLocking?: boolean;
+  /** Field slug for the Title column; `null`/`""` clears back to the default. */
+  titleField?: string | null;
+  /** Datetime field slug for the Date column; `null`/`""` clears back to the default. */
+  dateField?: string | null;
+}
+/**
+ * Input for creating a field
+ */
+interface CreateFieldInput {
+  slug: string;
+  label: string;
+  type: FieldType;
+  required?: boolean;
+  unique?: boolean;
+  defaultValue?: unknown;
+  validation?: FieldValidation | null;
+  widget?: string;
+  options?: FieldWidgetOptions;
+  sortOrder?: number;
+  /** Whether this field should be indexed for search */
+  searchable?: boolean;
+  /** Create a physical index for structured sorting. */
+  indexed?: boolean;
+  /** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */
+  translatable?: boolean;
+}
+/**
+ * Input for updating a field
+ */
+interface UpdateFieldInput {
+  label?: string;
+  /**
+   * Change the field's type. Only storage-compatible text aliases (`string`,
+   * `text`, and `slug`) can be changed in place. Other changes require an
+   * explicit content migration. Omit to keep the current type.
+   */
+  type?: FieldType;
+  required?: boolean;
+  unique?: boolean;
+  defaultValue?: unknown;
+  validation?: FieldValidation | null;
+  widget?: string;
+  options?: FieldWidgetOptions;
+  sortOrder?: number;
+  /** Whether this field should be indexed for search */
+  searchable?: boolean;
+  /** Create or remove the physical index used by structured sorting. */
+  indexed?: boolean;
+  /** Whether this field is translatable (default true). Non-translatable fields are synced across locales. */
+  translatable?: boolean;
+}
+/**
+ * A collection with its fields
+ */
+interface CollectionWithFields extends Collection {
+  fields: Field[];
+}
+/**
+ * Reserved field slugs that cannot be used.
+ *
+ * Includes names reserved for runtime hydration (`terms`, `bylines`, `byline`)
+ * so user-defined fields never shadow the auto-hydrated values on entry.data.
+ */
+declare const RESERVED_FIELD_SLUGS: string[];
+/**
+ * Reserved collection slugs that cannot be used
+ */
+declare const RESERVED_COLLECTION_SLUGS: string[];
+/**
+ * Runtime value type for a byline custom field. The narrow union mirrors
+ * what the five v1 field types can produce: `string`/`text`/`url`/`select`
+ * → string, `boolean` → boolean, plus `null` for cleared values.
+ */
+type CustomFieldValue = string | boolean | null;
+//#endregion
+export { SeedBlockTypeVersionInput as A, BlockFieldType as C, BlockTypeSource as D, BlockTypeDifference as E, BlockTypeVersion as O, BlockFieldOptions as S, BlockTypeCompatibility as T, UnsupportedFieldType as _, CollectionWithFields as a, ApplySeedBlockTypeInput as b, CreateFieldInput as c, Field as d, FieldType as f, RESERVED_FIELD_SLUGS as g, RESERVED_COLLECTION_SLUGS as h, CollectionSupport as i, UpdateBlockTypeInput as j, CreateBlockTypeInput as k, CustomFieldValue as l, FieldWidgetOptions as m, CollectionAdminConfig as n, ColumnType as o, FieldValidation as p, CollectionSource as r, CreateCollectionInput as s, Collection as t, FIELD_TYPE_TO_COLUMN as u, UpdateCollectionInput as v, BlockType as w, BlockFieldDefinition as x, UpdateFieldInput as y };
+//# sourceMappingURL=types-Bgujop4S.d.mts.map

package/dist/types-Bgujop4S.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-Bgujop4S.d.mts","names":[],"sources":["../src/schema/block-types.ts","../src/schema/types.ts"],"mappings":";cAEa,iBAAA;AAAA,KAgBD,cAAA,WAAyB,iBAAA;AAAA,KACzB,eAAA;AAAA,UAEK,iBAAA;EAChB,WAAA;AAAA;AAAA,UAGgB,oBAAA;EAChB,IAAA;EACA,KAAA;EACA,IAAA,EAAM,cAAA;EACN,QAAA;EACA,YAAA;EACA,UAAA,GAAa,IAAA,CAAK,eAAA;EAClB,OAAA,GAAU,iBAAA;AAAA;AAAA,UAGM,gBAAA;EAChB,EAAA;EACA,WAAA;EACA,OAAA;EACA,MAAA,EAAQ,oBAAA;EACR,WAAA;EACA,MAAA;EACA,gBAAA,GAAmB,oBAAA;EACnB,SAAA;EACA,SAAA;AAAA;AAAA,UAGgB,SAAA;EAChB,EAAA;EACA,IAAA;EACA,KAAA;EACA,WAAA;EACA,IAAA;EACA,QAAA;EACA,cAAA;EACA,MAAA,EAAQ,eAAA;EACR,QAAA,EAAU,gBAAA;EACV,SAAA;EACA,SAAA;AAAA;AAAA,UAGgB,oBAAA;EAChB,IAAA;EACA,KAAA;EACA,WAAA;EACA,IAAA;EACA,QAAA;EACA,MAAA,GAAS,eAAA;EACT,MAAA,EAAQ,oBAAA;AAAA;AAAA,UAGQ,oBAAA;EAChB,mBAAA;EACA,KAAA;EACA,WAAA;EACA,IAAA;EACA,QAAA;EACA,MAAA,GAAS,oBAAA;EACT,QAAA;AAAA;AAAA,UAGgB,yBAAA;EAChB,OAAA;EACA,MAAA,EAAQ,oBAAA;AAAA;AAAA,UAGQ,uBAAA;EAChB,IAAA;EACA,KAAA;EACA,WAAA;EACA,IAAA;EACA,QAAA;EACA,cAAA;EACA,QAAA,EAAU,yBAAA;AAAA;AAAA,KAGC,gCAAA;AAAA,UAEK,mBAAA;EAChB,IAAA;EACA,MAAA;EACA,aAAA,EAAe,gCAAA;AAAA;AAAA,UAGC,sBAAA;EAChB,UAAA;EACA,WAAA,EAAa,mBAAA;AAAA;;;;;;KC9FF,SAAA;;;;KA8DA,UAAA;;;;cAKC,oBAAA,EAAsB,MAAA,CAAO,SAAA,EAAW,UAAA;;;;KAmEzC,iBAAA;ADnGZ;;;AAAA,KC8GY,gBAAA;;;;;UAWK,gBAAA;EAChB,IAAA;EACA,IAAA;EAUA,KAAA;EACA,QAAA;EACA,OAAA;AAAA;AAAA,UAgBgB,eAAA;EAChB,QAAA;EACA,GAAA;EACA,GAAA;EACA,SAAA;EACA,SAAA;EACA,OAAA;EACA,OAAA;EACA,SAAA,GAAY,gBAAA;EACZ,QAAA;EACA,QAAA;EACA,gBAAA;ED9IS;ECgJT,QAAA;ED/IQ;;;AAGT;;ECkJC,YAAA;ED5I6B;;EC+I7B,gBAAA;EDlJA;ECoJA,QAAA;EACA,YAAA;EACA,YAAA;AAAA;;;;UAMgB,kBAAA;EAChB,IAAA;EACA,WAAA;EACA,WAAA;EACA,UAAA;EACA,aAAA;EAAA,CACC,GAAA;AAAA;AAAA,UAGe,oBAAA;EAChB,IAAA;EACA,IAAA;AAAA;;UAYgB,qBAAA;EDhKhB;ECkKA,WAAA;EDlKmC;ECoKnC,WAAA;AAAA;;;;UAMgB,UAAA;EAChB,EAAA;EACA,IAAA;EACA,KAAA;EACA,aAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA,EAAU,iBAAA;EACV,MAAA,GAAS,gBAAA;ED3KsC;EC6K/C,MAAA;ED1KsC;EC4KtC,UAAA;ED1KgC;EC4KhC,SAAA;ED5KA;EC8KA,UAAA;ED9KgC;ECgLhC,QAAA;;;;AA9QD;;;EAqRC,MAAA;EArRoB;AA8DrB;;;;EA6NC,SAAA;EAxNY;;;;;EA8NZ,KAAA;EA9NwC;EAgOxC,eAAA;EAhOkC;EAkOlC,kBAAA;EAlOoD;EAoOpD,uBAAA;EApO8D;EAsO9D,wBAAA;EAnK4B;EAqK5B,WAAA;EACA,SAAA;EACA,SAAA;AAAA;;;;UAMgB,KAAA;EAChB,EAAA;EACA,YAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,SAAA;EA1JN;EA4JA,eAAA,GAAkB,oBAAA;EAClB,UAAA,GAAa,SAAA;EACb,oBAAA;EACA,UAAA,EAAY,UAAA;EACZ,QAAA;EACA,MAAA;EACA,YAAA;EACA,UAAA,GAAa,eAAA;EACb,MAAA;EACA,OAAA,GAAU,kBAAA;EACV,SAAA;EACA,UAAA;EAvIA;EAyIA,OAAA;EAvIA;EAyIA,YAAA;EACA,SAAA;AAAA;;;;UAMgB,qBAAA;EAChB,IAAA;EACA,KAAA;EACA,aAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA,GAAW,iBAAA;EACX,MAAA,GAAS,gBAAA;EACT,UAAA;EACA,QAAA;EACA,MAAA;EAhIA;EAkIA,MAAA;EAhIA;EAkIA,SAAA;EAhIA;EAkIA,KAAA;EACA,eAAA;EAlIY;EAoIZ,WAAA;AAAA;;;;UAMgB,qBAAA;EAChB,KAAA;EACA,aAAA;EACA,WAAA;EACA,IAAA;EACA,KAAA,GAAQ,qBAAA;EACR,QAAA,GAAW,iBAAA;EACX,UAAA;EACA,QAAA;EACA,MAAA;EA/GS;EAiHT,MAAA;EAjHyB;EAmHzB,SAAA;EA1HA;EA4HA,KAAA;EACA,eAAA;EACA,kBAAA;EACA,uBAAA;EACA,wBAAA;EA3HQ;EA6HR,WAAA;EA5HU;EA8HV,UAAA;EA7HS;EA+HT,SAAA;AAAA;;;;UAMgB,gBAAA;EAChB,IAAA;EACA,KAAA;EACA,IAAA,EAAM,SAAA;EACN,QAAA;EACA,MAAA;EACA,YAAA;EACA,UAAA,GAAa,eAAA;EACb,MAAA;EACA,OAAA,GAAU,kBAAA;EACV,SAAA;EAtGS;EAwGT,UAAA;EAlGqB;EAoGrB,OAAA;EA/FM;EAiGN,YAAA;AAAA;;;;UAMgB,gBAAA;EAChB,KAAA;EA5GA;;;;;EAkHA,IAAA,GAAO,SAAA;EACP,QAAA;EACA,MAAA;EACA,YAAA;EACA,UAAA,GAAa,eAAA;EACb,MAAA;EACA,OAAA,GAAU,kBAAA;EACV,SAAA;EA/GA;EAiHA,UAAA;EA/GA;EAiHA,OAAA;EAhHa;EAkHb,YAAA;AAAA;;;;UAMgB,oBAAA,SAA6B,UAAA;EAC7C,MAAA,EAAQ,KAAA;AAAA;;;AA1GT;;;;cAmHa,oBAAA;;;;cAuBA,yBAAA;;;;;;KA6GD,gBAAA"}

package/dist/types-BirHUEXt.mjs

@@ -0,0 +1,18 @@
+//#region src/search/types.ts
+/**
+* Search Types
+*
+* Type definitions for the EmDash search system.
+*/
+/**
+* Search configuration for a collection
+*/
+const SEARCH_TOKENIZERS = [
+	"porter unicode61",
+	"unicode61",
+	"trigram"
+];
+
+//#endregion
+export { SEARCH_TOKENIZERS as t };
+//# sourceMappingURL=types-BirHUEXt.mjs.map

package/dist/types-BirHUEXt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-BirHUEXt.mjs","names":[],"sources":["../src/search/types.ts"],"sourcesContent":["/**\n * Search Types\n *\n * Type definitions for the EmDash search system.\n */\n\n/**\n * Search configuration for a collection\n */\nexport const SEARCH_TOKENIZERS = [\"porter unicode61\", \"unicode61\", \"trigram\"] as const;\n\nexport type SearchTokenizer = (typeof SEARCH_TOKENIZERS)[number];\n\nexport interface SearchConfig {\n\t/** Whether search is enabled for this collection */\n\tenabled: boolean;\n\t/** Field weights for ranking (higher = more important) */\n\tweights?: Record<string, number>;\n\t/** Field slug used as the result title, from the collection's titleField. */\n\ttitleField?: string;\n\t/** FTS5 tokenizer configuration (defaults to English Porter stemming) */\n\ttokenize?: SearchTokenizer;\n}\n\n/**\n * Options for search queries\n */\nexport interface SearchOptions {\n\t/** Collections to search (defaults to all searchable collections) */\n\tcollections?: string[];\n\t/** Filter by content status (defaults to 'published') */\n\tstatus?: string;\n\t/** Filter by locale (omit to search all locales) */\n\tlocale?: string;\n\t/** Maximum results to return (defaults to 20) */\n\tlimit?: number;\n\t/** Pagination cursor */\n\tcursor?: string;\n\t/**\n\t * Which indexed fields to match against (defaults to 'all').\n\t * With 'title', only the collection's title field is matched; collections\n\t * whose title field is not indexed for search return no results.\n\t */\n\tscope?: \"all\" | \"title\";\n}\n\n/**\n * Options for collection-specific search\n */\nexport interface CollectionSearchOptions {\n\t/** Filter by content status (defaults to 'published') */\n\tstatus?: string;\n\t/** Filter by locale (omit to search all locales) */\n\tlocale?: string;\n\t/** Maximum results to return (defaults to 20) */\n\tlimit?: number;\n\t/** Pagination cursor */\n\tcursor?: string;\n\t/** Which indexed fields to match against (defaults to 'all'). */\n\tscope?: \"all\" | \"title\";\n}\n\n/**\n * A single search result\n */\nexport interface SearchResult {\n\t/** Collection the result belongs to */\n\tcollection: string;\n\t/** Entry ID */\n\tid: string;\n\t/** Entry slug */\n\tslug: string | null;\n\t/** Content locale */\n\tlocale: string;\n\t/** Entry title (if available) */\n\ttitle?: string;\n\t/**\n\t * Highlighted snippet showing match context.\n\t *\n\t * Sanitized server-side to be safe for `set:html` / `innerHTML`:\n\t * all HTML metacharacters in the source text are escaped, and\n\t * matched terms are wrapped in literal `<mark>...</mark>` tags\n\t * (the only HTML the snippet is allowed to contain).\n\t */\n\tsnippet?: string;\n\t/** Relevance score (higher = more relevant) */\n\tscore: number;\n}\n\n/**\n * Response from a search query\n */\nexport interface SearchResponse {\n\t/** Search results */\n\titems: SearchResult[];\n\t/** Cursor for next page of results */\n\tnextCursor?: string;\n}\n\n/**\n * Options for suggestion/autocomplete queries\n */\nexport interface SuggestOptions {\n\t/** Collections to search (defaults to all searchable collections) */\n\tcollections?: string[];\n\t/** Filter by locale (omit to search all locales) */\n\tlocale?: string;\n\t/** Maximum suggestions to return (defaults to 5) */\n\tlimit?: number;\n}\n\n/**\n * A single suggestion result\n */\nexport interface Suggestion {\n\t/** Collection the suggestion belongs to */\n\tcollection: string;\n\t/** Entry ID */\n\tid: string;\n\t/** Entry slug, when available */\n\tslug?: string | null;\n\t/** Entry title */\n\ttitle: string;\n}\n\n/**\n * Search index statistics\n */\nexport interface SearchStats {\n\tcollections: Record<\n\t\tstring,\n\t\t{\n\t\t\t/** Number of indexed entries */\n\t\t\tindexed: number;\n\t\t\t/** When the index was last rebuilt */\n\t\t\tlastRebuilt?: string;\n\t\t}\n\t>;\n}\n"],"mappings":";;;;;;;;;AASA,MAAa,oBAAoB;CAAC;CAAoB;CAAa;CAAU"}