emdash 1.3.0 → 1.3.1

package/dist/url-Dn3IStq8.mjs

@@ -1,104 +0,0 @@
-//#region src/utils/url.ts
-/**
-* URL scheme validation utilities
-*
-* Prevents XSS via dangerous URL schemes (javascript:, data:, vbscript:, etc.)
-* by allowlisting known-safe schemes before rendering into href attributes.
-*/
-/**
-* Matches URLs that are safe to render in href attributes.
-*
-* Allowed:
-* - http:// and https://
-* - mailto: and tel:
-* - Relative paths (starting with /)
-* - Fragment links (starting with #)
-* - Protocol-relative URLs are NOT allowed (starting with //) as they can
-*   redirect to attacker-controlled hosts.
-*/
-const SAFE_ABSOLUTE_URL_RE = /^(https?:|mailto:|tel:)/i;
-const SITE_RELATIVE_HREF_RE = /^(\/(?![/\\])|#)/;
-const URL_SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
-const URL_BASE = new URL("https://emdash.invalid/");
-function containsHrefControl(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0);
-		if (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return true;
-	}
-	return false;
-}
-function resolvesOnSite(value) {
-	try {
-		return new URL(value, URL_BASE).origin === URL_BASE.origin;
-	} catch {
-		return false;
-	}
-}
-/**
-* Returns the URL unchanged if it uses a safe scheme, otherwise returns "#".
-*
-* Use this at the render layer as the primary defense against XSS via
-* dangerous URL schemes like `javascript:`, `data:`, or `vbscript:`.
-*
-* @example
-* ```ts
-* sanitizeHref("https://example.com")        // "https://example.com"
-* sanitizeHref("/about")                      // "/about"
-* sanitizeHref("#section")                    // "#section"
-* sanitizeHref("mailto:a@b.com")              // "mailto:a@b.com"
-* sanitizeHref("javascript:alert(1)")         // "#"
-* sanitizeHref("data:text/html,<script>")     // "#"
-* sanitizeHref("")                            // "#"
-* ```
-*/
-function sanitizeHref(url) {
-	if (!url) return "#";
-	return isSafeHref(url) ? url : "#";
-}
-/**
-* Returns true if the URL uses a safe scheme for rendering in href attributes.
-*/
-function isSafeHref(url) {
-	if (containsHrefControl(url)) return false;
-	if (SAFE_ABSOLUTE_URL_RE.test(url)) return URL.canParse(url);
-	return SITE_RELATIVE_HREF_RE.test(url) && resolvesOnSite(url);
-}
-const ALLOWED_URL_SCHEMES = new Set([
-	"http",
-	"https",
-	"mailto",
-	"tel"
-]);
-/**
-* Returns true if the value names a URL scheme other than http, https,
-* mailto, or tel, as a browser would resolve it in an href.
-*/
-function hasUnsafeUrlScheme(value) {
-	const stripped = value.replace(/[\t\n\r]/g, "").trimStart();
-	const scheme = URL_SCHEME_RE.exec(stripped)?.[1];
-	return scheme !== void 0 && !ALLOWED_URL_SCHEMES.has(scheme.toLowerCase());
-}
-/**
-* Returns true when a repository write may keep the value. Repository callers
-* preserve legacy scheme-less values, but reject anything a browser resolves
-* off-site or to a script-capable scheme.
-*/
-function isSafeUrlFieldWriteValue(value) {
-	if (containsHrefControl(value) || hasUnsafeUrlScheme(value)) return false;
-	const candidate = value.trimStart();
-	const scheme = URL_SCHEME_RE.exec(candidate)?.[1];
-	if (scheme !== void 0) return ALLOWED_URL_SCHEMES.has(scheme.toLowerCase());
-	return resolvesOnSite(candidate);
-}
-/**
-* Returns true if the value may be stored in a `url` content field: a safe
-* href per {@link isSafeHref} that is either site-relative or a parseable
-* absolute URL.
-*/
-function isSafeUrlFieldValue(value) {
-	return isSafeHref(value);
-}
-
-//#endregion
-export { sanitizeHref as i, isSafeUrlFieldValue as n, isSafeUrlFieldWriteValue as r, isSafeHref as t };
-//# sourceMappingURL=url-Dn3IStq8.mjs.map

package/dist/url-Dn3IStq8.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-Dn3IStq8.mjs","names":[],"sources":["../src/utils/url.ts"],"sourcesContent":["/**\n * URL scheme validation utilities\n *\n * Prevents XSS via dangerous URL schemes (javascript:, data:, vbscript:, etc.)\n * by allowlisting known-safe schemes before rendering into href attributes.\n */\n\n/**\n * Matches URLs that are safe to render in href attributes.\n *\n * Allowed:\n * - http:// and https://\n * - mailto: and tel:\n * - Relative paths (starting with /)\n * - Fragment links (starting with #)\n * - Protocol-relative URLs are NOT allowed (starting with //) as they can\n *   redirect to attacker-controlled hosts.\n */\nconst SAFE_ABSOLUTE_URL_RE = /^(https?:|mailto:|tel:)/i;\nconst SITE_RELATIVE_HREF_RE = /^(\\/(?![/\\\\])|#)/;\nconst URL_SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;\nconst URL_BASE = new URL(\"https://emdash.invalid/\");\n\nfunction containsHrefControl(value: string): boolean {\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)) return true;\n\t}\n\treturn false;\n}\n\nfunction resolvesOnSite(value: string): boolean {\n\ttry {\n\t\treturn new URL(value, URL_BASE).origin === URL_BASE.origin;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Returns the URL unchanged if it uses a safe scheme, otherwise returns \"#\".\n *\n * Use this at the render layer as the primary defense against XSS via\n * dangerous URL schemes like `javascript:`, `data:`, or `vbscript:`.\n *\n * @example\n * ```ts\n * sanitizeHref(\"https://example.com\")        // \"https://example.com\"\n * sanitizeHref(\"/about\")                      // \"/about\"\n * sanitizeHref(\"#section\")                    // \"#section\"\n * sanitizeHref(\"mailto:a@b.com\")              // \"mailto:a@b.com\"\n * sanitizeHref(\"javascript:alert(1)\")         // \"#\"\n * sanitizeHref(\"data:text/html,<script>\")     // \"#\"\n * sanitizeHref(\"\")                            // \"#\"\n * ```\n */\nexport function sanitizeHref(url: string | undefined | null): string {\n\tif (!url) return \"#\";\n\treturn isSafeHref(url) ? url : \"#\";\n}\n\n/**\n * Returns true if the URL uses a safe scheme for rendering in href attributes.\n */\nexport function isSafeHref(url: string): boolean {\n\tif (containsHrefControl(url)) return false;\n\tif (SAFE_ABSOLUTE_URL_RE.test(url)) return URL.canParse(url);\n\treturn SITE_RELATIVE_HREF_RE.test(url) && resolvesOnSite(url);\n}\n\nconst ALLOWED_URL_SCHEMES = new Set([\"http\", \"https\", \"mailto\", \"tel\"]);\n\n/**\n * Returns true if the value names a URL scheme other than http, https,\n * mailto, or tel, as a browser would resolve it in an href.\n */\nexport function hasUnsafeUrlScheme(value: string): boolean {\n\tconst stripped = value.replace(/[\\t\\n\\r]/g, \"\").trimStart();\n\tconst scheme = URL_SCHEME_RE.exec(stripped)?.[1];\n\treturn scheme !== undefined && !ALLOWED_URL_SCHEMES.has(scheme.toLowerCase());\n}\n\n/**\n * Returns true when a repository write may keep the value. Repository callers\n * preserve legacy scheme-less values, but reject anything a browser resolves\n * off-site or to a script-capable scheme.\n */\nexport function isSafeUrlFieldWriteValue(value: string): boolean {\n\tif (containsHrefControl(value) || hasUnsafeUrlScheme(value)) return false;\n\tconst candidate = value.trimStart();\n\tconst scheme = URL_SCHEME_RE.exec(candidate)?.[1];\n\tif (scheme !== undefined) return ALLOWED_URL_SCHEMES.has(scheme.toLowerCase());\n\treturn resolvesOnSite(candidate);\n}\n\n/**\n * Returns true if the value may be stored in a `url` content field: a safe\n * href per {@link isSafeHref} that is either site-relative or a parseable\n * absolute URL.\n */\nexport function isSafeUrlFieldValue(value: string): boolean {\n\treturn isSafeHref(value);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;AAC9B,MAAM,gBAAgB;AACtB,MAAM,WAAW,IAAI,IAAI,0BAA0B;AAEnD,SAAS,oBAAoB,OAAwB;AACpD,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,YAAY,UAAU,YAAY,EAAE;AAC1C,MAAI,cAAc,WAAc,aAAa,MAAQ,cAAc,KAAO,QAAO;;AAElF,QAAO;;AAGR,SAAS,eAAe,OAAwB;AAC/C,KAAI;AACH,SAAO,IAAI,IAAI,OAAO,SAAS,CAAC,WAAW,SAAS;SAC7C;AACP,SAAO;;;;;;;;;;;;;;;;;;;;AAqBT,SAAgB,aAAa,KAAwC;AACpE,KAAI,CAAC,IAAK,QAAO;AACjB,QAAO,WAAW,IAAI,GAAG,MAAM;;;;;AAMhC,SAAgB,WAAW,KAAsB;AAChD,KAAI,oBAAoB,IAAI,CAAE,QAAO;AACrC,KAAI,qBAAqB,KAAK,IAAI,CAAE,QAAO,IAAI,SAAS,IAAI;AAC5D,QAAO,sBAAsB,KAAK,IAAI,IAAI,eAAe,IAAI;;AAG9D,MAAM,sBAAsB,IAAI,IAAI;CAAC;CAAQ;CAAS;CAAU;CAAM,CAAC;;;;;AAMvE,SAAgB,mBAAmB,OAAwB;CAC1D,MAAM,WAAW,MAAM,QAAQ,aAAa,GAAG,CAAC,WAAW;CAC3D,MAAM,SAAS,cAAc,KAAK,SAAS,GAAG;AAC9C,QAAO,WAAW,UAAa,CAAC,oBAAoB,IAAI,OAAO,aAAa,CAAC;;;;;;;AAQ9E,SAAgB,yBAAyB,OAAwB;AAChE,KAAI,oBAAoB,MAAM,IAAI,mBAAmB,MAAM,CAAE,QAAO;CACpE,MAAM,YAAY,MAAM,WAAW;CACnC,MAAM,SAAS,cAAc,KAAK,UAAU,GAAG;AAC/C,KAAI,WAAW,OAAW,QAAO,oBAAoB,IAAI,OAAO,aAAa,CAAC;AAC9E,QAAO,eAAe,UAAU;;;;;;;AAQjC,SAAgB,oBAAoB,OAAwB;AAC3D,QAAO,WAAW,MAAM"}

package/dist/url-pattern-QATUE_rv.mjs

@@ -1,41 +0,0 @@
-//#region src/schema/url-pattern.ts
-const URL_PARAM_PATTERN = /\{(\w+)\}/g;
-const REGEX_SPECIAL_CHARACTERS = /[.*+?^${}()|[\]\\]/g;
-const INVALID_LITERAL_PATTERN = /[{}]/;
-function escapeRegex(literal) {
-	return literal.replace(REGEX_SPECIAL_CHARACTERS, "\\$&");
-}
-/**
-* Compile a collection URL pattern to an anchored regex.
-*
-* Each placeholder must sit in its own path segment. Two `[^/]+` groups in one
-* segment can split the segment many ways, so a crafted request path makes the
-* regex backtrack polynomially (exponentially in the placeholder count).
-*/
-function compileUrlPattern(pattern) {
-	const paramNames = [];
-	let regexSource = "";
-	let previousIndex = 0;
-	for (const match of pattern.matchAll(URL_PARAM_PATTERN)) {
-		const matchIndex = match.index;
-		const literal = pattern.slice(previousIndex, matchIndex);
-		if (INVALID_LITERAL_PATTERN.test(literal)) throw new Error("Invalid URL pattern placeholder");
-		if (paramNames.length > 0 && !literal.includes("/")) throw new Error("URL patterns allow only one placeholder per path segment");
-		regexSource += escapeRegex(literal);
-		const name = match[1];
-		paramNames.push(name);
-		regexSource += "([^/]+)";
-		previousIndex = matchIndex + match[0].length;
-	}
-	const trailingLiteral = pattern.slice(previousIndex);
-	if (INVALID_LITERAL_PATTERN.test(trailingLiteral)) throw new Error("Invalid URL pattern placeholder");
-	regexSource += escapeRegex(trailingLiteral);
-	return {
-		regex: new RegExp(`^${regexSource}$`),
-		paramNames
-	};
-}
-
-//#endregion
-export { compileUrlPattern as t };
-//# sourceMappingURL=url-pattern-QATUE_rv.mjs.map

package/dist/url-pattern-QATUE_rv.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-pattern-QATUE_rv.mjs","names":[],"sources":["../src/schema/url-pattern.ts"],"sourcesContent":["const URL_PARAM_PATTERN = /\\{(\\w+)\\}/g;\nconst REGEX_SPECIAL_CHARACTERS = /[.*+?^${}()|[\\]\\\\]/g;\nconst INVALID_LITERAL_PATTERN = /[{}]/;\n\nfunction escapeRegex(literal: string): string {\n\treturn literal.replace(REGEX_SPECIAL_CHARACTERS, \"\\\\$&\");\n}\n\n/**\n * Compile a collection URL pattern to an anchored regex.\n *\n * Each placeholder must sit in its own path segment. Two `[^/]+` groups in one\n * segment can split the segment many ways, so a crafted request path makes the\n * regex backtrack polynomially (exponentially in the placeholder count).\n */\nexport function compileUrlPattern(pattern: string): { regex: RegExp; paramNames: string[] } {\n\tconst paramNames: string[] = [];\n\tlet regexSource = \"\";\n\tlet previousIndex = 0;\n\n\tfor (const match of pattern.matchAll(URL_PARAM_PATTERN)) {\n\t\tconst matchIndex = match.index;\n\t\tconst literal = pattern.slice(previousIndex, matchIndex);\n\t\tif (INVALID_LITERAL_PATTERN.test(literal)) throw new Error(\"Invalid URL pattern placeholder\");\n\t\tif (paramNames.length > 0 && !literal.includes(\"/\")) {\n\t\t\tthrow new Error(\"URL patterns allow only one placeholder per path segment\");\n\t\t}\n\t\tregexSource += escapeRegex(literal);\n\n\t\tconst name = match[1];\n\t\tparamNames.push(name);\n\t\tregexSource += \"([^/]+)\";\n\t\tpreviousIndex = matchIndex + match[0].length;\n\t}\n\n\tconst trailingLiteral = pattern.slice(previousIndex);\n\tif (INVALID_LITERAL_PATTERN.test(trailingLiteral)) {\n\t\tthrow new Error(\"Invalid URL pattern placeholder\");\n\t}\n\tregexSource += escapeRegex(trailingLiteral);\n\n\treturn { regex: new RegExp(`^${regexSource}$`), paramNames };\n}\n"],"mappings":";AAAA,MAAM,oBAAoB;AAC1B,MAAM,2BAA2B;AACjC,MAAM,0BAA0B;AAEhC,SAAS,YAAY,SAAyB;AAC7C,QAAO,QAAQ,QAAQ,0BAA0B,OAAO;;;;;;;;;AAUzD,SAAgB,kBAAkB,SAA0D;CAC3F,MAAM,aAAuB,EAAE;CAC/B,IAAI,cAAc;CAClB,IAAI,gBAAgB;AAEpB,MAAK,MAAM,SAAS,QAAQ,SAAS,kBAAkB,EAAE;EACxD,MAAM,aAAa,MAAM;EACzB,MAAM,UAAU,QAAQ,MAAM,eAAe,WAAW;AACxD,MAAI,wBAAwB,KAAK,QAAQ,CAAE,OAAM,IAAI,MAAM,kCAAkC;AAC7F,MAAI,WAAW,SAAS,KAAK,CAAC,QAAQ,SAAS,IAAI,CAClD,OAAM,IAAI,MAAM,2DAA2D;AAE5E,iBAAe,YAAY,QAAQ;EAEnC,MAAM,OAAO,MAAM;AACnB,aAAW,KAAK,KAAK;AACrB,iBAAe;AACf,kBAAgB,aAAa,MAAM,GAAG;;CAGvC,MAAM,kBAAkB,QAAQ,MAAM,cAAc;AACpD,KAAI,wBAAwB,KAAK,gBAAgB,CAChD,OAAM,IAAI,MAAM,kCAAkC;AAEnD,gBAAe,YAAY,gBAAgB;AAE3C,QAAO;EAAE,OAAO,IAAI,OAAO,IAAI,YAAY,GAAG;EAAE;EAAY"}

package/dist/user-BlCTKVAm.mjs

@@ -1,171 +0,0 @@
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-xC4UD5-S.mjs";
-import { c as decodeCursor, l as encodeCursor } from "./types-D2NEXtgB.mjs";
-import { ulid } from "ulidx";
-
-//#region src/database/repositories/user.ts
-/**
-* User repository for CRUD operations
-*/
-var UserRepository = class UserRepository {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Create a new user
-	*/
-	async create(input) {
-		const id = ulid();
-		const row = {
-			id,
-			email: input.email.toLowerCase(),
-			name: input.name ?? null,
-			role: UserRepository.resolveRole(input.role ?? 10),
-			avatar_url: input.avatarUrl ?? null,
-			email_verified: 0,
-			data: input.data ? JSON.stringify(input.data) : null
-		};
-		await this.db.insertInto("users").values(row).execute();
-		const user = await this.findById(id);
-		if (!user) throw new Error("Failed to create user");
-		return user;
-	}
-	/**
-	* Find user by ID
-	*/
-	async findById(id) {
-		const row = await this.db.selectFrom("users").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? this.rowToUser(row) : null;
-	}
-	/**
-	* Batch-resolve users by ID. Returns only the users that exist; missing
-	* IDs are silently dropped. Chunked at `SQL_BATCH_SIZE` to stay within
-	* D1's bind-parameter limit.
-	*/
-	async findByIds(ids) {
-		const unique = [...new Set(ids)].filter((id) => id.length > 0);
-		if (unique.length === 0) return [];
-		const out = [];
-		for (const batch of chunks(unique, SQL_BATCH_SIZE)) {
-			const rows = await this.db.selectFrom("users").selectAll().where("id", "in", batch).execute();
-			for (const row of rows) out.push(this.rowToUser(row));
-		}
-		return out;
-	}
-	/**
-	* Find user by email (case-insensitive)
-	*/
-	async findByEmail(email) {
-		const row = await this.db.selectFrom("users").selectAll().where("email", "=", email.toLowerCase()).executeTakeFirst();
-		return row ? this.rowToUser(row) : null;
-	}
-	/**
-	* List all users with cursor-based pagination
-	*/
-	async findMany(options = {}) {
-		const limit = Math.min(Math.max(1, options.limit || 50), 100);
-		let query = this.db.selectFrom("users").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
-		if (options.role !== void 0) query = query.where("role", "=", UserRepository.resolveRole(options.role));
-		if (options.cursor) {
-			const decoded = decodeCursor(options.cursor);
-			query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
-		}
-		const rows = await query.execute();
-		const items = rows.slice(0, limit).map((row) => this.rowToUser(row));
-		const result = { items };
-		if (rows.length > limit && items.length > 0) {
-			const last = items.at(-1);
-			result.nextCursor = encodeCursor(last.createdAt, last.id);
-		}
-		return result;
-	}
-	/**
-	* Update a user
-	*/
-	async update(id, input) {
-		if (!await this.findById(id)) return null;
-		const updates = {};
-		if (input.name !== void 0) updates.name = input.name;
-		if (input.role !== void 0) updates.role = UserRepository.resolveRole(input.role);
-		if (input.avatarUrl !== void 0) updates.avatar_url = input.avatarUrl;
-		if (input.data !== void 0) updates.data = JSON.stringify(input.data);
-		if (Object.keys(updates).length > 0) await this.db.updateTable("users").set(updates).where("id", "=", id).execute();
-		return this.findById(id);
-	}
-	/**
-	* Delete a user
-	*/
-	async delete(id) {
-		return ((await this.db.deleteFrom("users").where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0) > 0;
-	}
-	/**
-	* Count users
-	*/
-	async count(role) {
-		let query = this.db.selectFrom("users").select((eb) => eb.fn.count("id").as("count"));
-		if (role !== void 0) query = query.where("role", "=", UserRepository.resolveRole(role));
-		const result = await query.executeTakeFirst();
-		return Number(result?.count || 0);
-	}
-	/**
-	* Check if email exists
-	*/
-	async emailExists(email) {
-		return !!await this.db.selectFrom("users").select("id").where("email", "=", email.toLowerCase()).executeTakeFirst();
-	}
-	/**
-	* Convert database row to User object
-	*/
-	rowToUser(row) {
-		return {
-			id: row.id,
-			email: row.email,
-			name: row.name,
-			role: UserRepository.toRole(row.role),
-			avatarUrl: row.avatar_url,
-			emailVerified: row.email_verified === 1,
-			data: row.data ? JSON.parse(row.data) : null,
-			createdAt: row.created_at
-		};
-	}
-	/** Map of role name strings to numeric levels */
-	static ROLE_NAME_TO_LEVEL = {
-		subscriber: 10,
-		contributor: 20,
-		author: 30,
-		editor: 40,
-		admin: 50
-	};
-	/** Valid numeric role levels */
-	static VALID_LEVELS = new Set([
-		10,
-		20,
-		30,
-		40,
-		50
-	]);
-	/**
-	* Resolve a role name or number to a valid numeric UserRole.
-	* Accepts both string names ("admin") and numeric levels (50).
-	*/
-	static resolveRole(role) {
-		if (typeof role === "string") {
-			const level = UserRepository.ROLE_NAME_TO_LEVEL[role];
-			if (level === void 0) throw new Error(`Invalid role name: ${role}`);
-			return level;
-		}
-		if (!UserRepository.VALID_LEVELS.has(role)) throw new Error(`Invalid role level: ${role}`);
-		return role;
-	}
-	/**
-	* Convert a raw DB integer to a typed UserRole.
-	* Falls back to subscriber (10) for unknown values.
-	*/
-	static toRole(level) {
-		if (UserRepository.VALID_LEVELS.has(level)) return level;
-		return 10;
-	}
-};
-
-//#endregion
-export { UserRepository as t };
-//# sourceMappingURL=user-BlCTKVAm.mjs.map

package/dist/user-BlCTKVAm.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-BlCTKVAm.mjs","names":[],"sources":["../src/database/repositories/user.ts"],"sourcesContent":["import type { Kysely, Selectable, Updateable } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { chunks, SQL_BATCH_SIZE } from \"../../utils/chunks.js\";\nimport type { Database, UserTable } from \"../types.js\";\nimport { encodeCursor, decodeCursor, type FindManyResult } from \"./types.js\";\n\ntype UserRow = Selectable<UserTable>;\n\n/**\n * Valid role levels matching the database schema.\n * 10=subscriber, 20=contributor, 30=author, 40=editor, 50=admin\n */\nexport type UserRole = 10 | 20 | 30 | 40 | 50;\n\n/** String role names for convenience APIs */\nexport type UserRoleName = \"subscriber\" | \"contributor\" | \"author\" | \"editor\" | \"admin\";\n\nexport interface User {\n\tid: string;\n\temail: string;\n\tname: string | null;\n\trole: UserRole;\n\tavatarUrl: string | null;\n\temailVerified: boolean;\n\tdata: Record<string, unknown> | null;\n\tcreatedAt: string;\n}\n\nexport interface CreateUserInput {\n\temail: string;\n\tname?: string;\n\trole?: UserRole | UserRoleName;\n\tavatarUrl?: string;\n\tdata?: Record<string, unknown>;\n}\n\nexport interface UpdateUserInput {\n\tname?: string;\n\trole?: UserRole | UserRoleName;\n\tavatarUrl?: string | null;\n\tdata?: Record<string, unknown>;\n}\n\n/**\n * User repository for CRUD operations\n */\nexport class UserRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\t/**\n\t * Create a new user\n\t */\n\tasync create(input: CreateUserInput): Promise<User> {\n\t\tconst id = ulid();\n\n\t\tconst row: Omit<UserTable, \"created_at\" | \"updated_at\" | \"disabled\"> = {\n\t\t\tid,\n\t\t\temail: input.email.toLowerCase(),\n\t\t\tname: input.name ?? null,\n\t\t\trole: UserRepository.resolveRole(input.role ?? 10),\n\t\t\tavatar_url: input.avatarUrl ?? null,\n\t\t\temail_verified: 0,\n\t\t\tdata: input.data ? JSON.stringify(input.data) : null,\n\t\t};\n\n\t\tawait this.db.insertInto(\"users\").values(row).execute();\n\n\t\tconst user = await this.findById(id);\n\t\tif (!user) {\n\t\t\tthrow new Error(\"Failed to create user\");\n\t\t}\n\t\treturn user;\n\t}\n\n\t/**\n\t * Find user by ID\n\t */\n\tasync findById(id: string): Promise<User | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\n\t\treturn row ? this.rowToUser(row) : null;\n\t}\n\n\t/**\n\t * Batch-resolve users by ID. Returns only the users that exist; missing\n\t * IDs are silently dropped. Chunked at `SQL_BATCH_SIZE` to stay within\n\t * D1's bind-parameter limit.\n\t */\n\tasync findByIds(ids: string[]): Promise<User[]> {\n\t\tconst unique = [...new Set(ids)].filter((id) => id.length > 0);\n\t\tif (unique.length === 0) return [];\n\n\t\tconst out: User[] = [];\n\t\tfor (const batch of chunks(unique, SQL_BATCH_SIZE)) {\n\t\t\tconst rows = await this.db.selectFrom(\"users\").selectAll().where(\"id\", \"in\", batch).execute();\n\t\t\tfor (const row of rows) out.push(this.rowToUser(row));\n\t\t}\n\t\treturn out;\n\t}\n\n\t/**\n\t * Find user by email (case-insensitive)\n\t */\n\tasync findByEmail(email: string): Promise<User | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", email.toLowerCase())\n\t\t\t.executeTakeFirst();\n\n\t\treturn row ? this.rowToUser(row) : null;\n\t}\n\n\t/**\n\t * List all users with cursor-based pagination\n\t */\n\tasync findMany(\n\t\toptions: {\n\t\t\trole?: UserRole | UserRoleName;\n\t\t\tlimit?: number;\n\t\t\tcursor?: string;\n\t\t} = {},\n\t): Promise<FindManyResult<User>> {\n\t\tconst limit = Math.min(Math.max(1, options.limit || 50), 100);\n\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.orderBy(\"id\", \"desc\")\n\t\t\t.limit(limit + 1);\n\n\t\tif (options.role !== undefined) {\n\t\t\tquery = query.where(\"role\", \"=\", UserRepository.resolveRole(options.role));\n\t\t}\n\n\t\tif (options.cursor) {\n\t\t\tconst decoded = decodeCursor(options.cursor);\n\t\t\tquery = query.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"created_at\", \"<\", decoded.orderValue),\n\t\t\t\t\teb.and([eb(\"created_at\", \"=\", decoded.orderValue), eb(\"id\", \"<\", decoded.id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\tconst items = rows.slice(0, limit).map((row) => this.rowToUser(row));\n\t\tconst result: FindManyResult<User> = { items };\n\n\t\tif (rows.length > limit && items.length > 0) {\n\t\t\tconst last = items.at(-1)!;\n\t\t\tresult.nextCursor = encodeCursor(last.createdAt, last.id);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Update a user\n\t */\n\tasync update(id: string, input: UpdateUserInput): Promise<User | null> {\n\t\tconst existing = await this.findById(id);\n\t\tif (!existing) return null;\n\n\t\tconst updates: Updateable<UserTable> = {};\n\t\tif (input.name !== undefined) updates.name = input.name;\n\t\tif (input.role !== undefined) updates.role = UserRepository.resolveRole(input.role);\n\t\tif (input.avatarUrl !== undefined) updates.avatar_url = input.avatarUrl;\n\t\tif (input.data !== undefined) updates.data = JSON.stringify(input.data);\n\n\t\tif (Object.keys(updates).length > 0) {\n\t\t\tawait this.db.updateTable(\"users\").set(updates).where(\"id\", \"=\", id).execute();\n\t\t}\n\n\t\treturn this.findById(id);\n\t}\n\n\t/**\n\t * Delete a user\n\t */\n\tasync delete(id: string): Promise<boolean> {\n\t\tconst result = await this.db.deleteFrom(\"users\").where(\"id\", \"=\", id).executeTakeFirst();\n\n\t\treturn (result.numDeletedRows ?? 0) > 0;\n\t}\n\n\t/**\n\t * Count users\n\t */\n\tasync count(role?: UserRole | UserRoleName): Promise<number> {\n\t\tlet query = this.db.selectFrom(\"users\").select((eb) => eb.fn.count(\"id\").as(\"count\"));\n\n\t\tif (role !== undefined) {\n\t\t\tquery = query.where(\"role\", \"=\", UserRepository.resolveRole(role));\n\t\t}\n\n\t\tconst result = await query.executeTakeFirst();\n\t\treturn Number(result?.count || 0);\n\t}\n\n\t/**\n\t * Check if email exists\n\t */\n\tasync emailExists(email: string): Promise<boolean> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"email\", \"=\", email.toLowerCase())\n\t\t\t.executeTakeFirst();\n\n\t\treturn !!row;\n\t}\n\n\t/**\n\t * Convert database row to User object\n\t */\n\tprivate rowToUser(row: UserRow): User {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\temail: row.email,\n\t\t\tname: row.name,\n\t\t\trole: UserRepository.toRole(row.role),\n\t\t\tavatarUrl: row.avatar_url,\n\t\t\temailVerified: row.email_verified === 1,\n\t\t\tdata: row.data ? JSON.parse(row.data) : null,\n\t\t\tcreatedAt: row.created_at,\n\t\t};\n\t}\n\n\t/** Map of role name strings to numeric levels */\n\tprivate static readonly ROLE_NAME_TO_LEVEL: Record<UserRoleName, UserRole> = {\n\t\tsubscriber: 10,\n\t\tcontributor: 20,\n\t\tauthor: 30,\n\t\teditor: 40,\n\t\tadmin: 50,\n\t};\n\n\t/** Valid numeric role levels */\n\tprivate static readonly VALID_LEVELS = new Set<number>([10, 20, 30, 40, 50]);\n\n\t/**\n\t * Resolve a role name or number to a valid numeric UserRole.\n\t * Accepts both string names (\"admin\") and numeric levels (50).\n\t */\n\tstatic resolveRole(role: UserRole | UserRoleName): UserRole {\n\t\tif (typeof role === \"string\") {\n\t\t\tconst level = UserRepository.ROLE_NAME_TO_LEVEL[role];\n\t\t\tif (level === undefined) {\n\t\t\t\tthrow new Error(`Invalid role name: ${role}`);\n\t\t\t}\n\t\t\treturn level;\n\t\t}\n\t\tif (!UserRepository.VALID_LEVELS.has(role)) {\n\t\t\tthrow new Error(`Invalid role level: ${role}`);\n\t\t}\n\t\treturn role;\n\t}\n\n\t/**\n\t * Convert a raw DB integer to a typed UserRole.\n\t * Falls back to subscriber (10) for unknown values.\n\t */\n\tprivate static toRole(level: number): UserRole {\n\t\tif (UserRepository.VALID_LEVELS.has(level)) return level as UserRole;\n\t\treturn 10;\n\t}\n}\n"],"mappings":";;;;;;;;AA+CA,IAAa,iBAAb,MAAa,eAAe;CAC3B,YAAY,AAAQ,IAAsB;EAAtB;;;;;CAKpB,MAAM,OAAO,OAAuC;EACnD,MAAM,KAAK,MAAM;EAEjB,MAAM,MAAiE;GACtE;GACA,OAAO,MAAM,MAAM,aAAa;GAChC,MAAM,MAAM,QAAQ;GACpB,MAAM,eAAe,YAAY,MAAM,QAAQ,GAAG;GAClD,YAAY,MAAM,aAAa;GAC/B,gBAAgB;GAChB,MAAM,MAAM,OAAO,KAAK,UAAU,MAAM,KAAK,GAAG;GAChD;AAED,QAAM,KAAK,GAAG,WAAW,QAAQ,CAAC,OAAO,IAAI,CAAC,SAAS;EAEvD,MAAM,OAAO,MAAM,KAAK,SAAS,GAAG;AACpC,MAAI,CAAC,KACJ,OAAM,IAAI,MAAM,wBAAwB;AAEzC,SAAO;;;;;CAMR,MAAM,SAAS,IAAkC;EAChD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AAEpB,SAAO,MAAM,KAAK,UAAU,IAAI,GAAG;;;;;;;CAQpC,MAAM,UAAU,KAAgC;EAC/C,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,OAAO,GAAG,SAAS,EAAE;AAC9D,MAAI,OAAO,WAAW,EAAG,QAAO,EAAE;EAElC,MAAM,MAAc,EAAE;AACtB,OAAK,MAAM,SAAS,OAAO,QAAQ,eAAe,EAAE;GACnD,MAAM,OAAO,MAAM,KAAK,GAAG,WAAW,QAAQ,CAAC,WAAW,CAAC,MAAM,MAAM,MAAM,MAAM,CAAC,SAAS;AAC7F,QAAK,MAAM,OAAO,KAAM,KAAI,KAAK,KAAK,UAAU,IAAI,CAAC;;AAEtD,SAAO;;;;;CAMR,MAAM,YAAY,OAAqC;EACtD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,MAAM,aAAa,CAAC,CACxC,kBAAkB;AAEpB,SAAO,MAAM,KAAK,UAAU,IAAI,GAAG;;;;;CAMpC,MAAM,SACL,UAII,EAAE,EAC0B;EAChC,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,GAAG,QAAQ,SAAS,GAAG,EAAE,IAAI;EAE7D,IAAI,QAAQ,KAAK,GACf,WAAW,QAAQ,CACnB,WAAW,CACX,QAAQ,cAAc,OAAO,CAC7B,QAAQ,MAAM,OAAO,CACrB,MAAM,QAAQ,EAAE;AAElB,MAAI,QAAQ,SAAS,OACpB,SAAQ,MAAM,MAAM,QAAQ,KAAK,eAAe,YAAY,QAAQ,KAAK,CAAC;AAG3E,MAAI,QAAQ,QAAQ;GACnB,MAAM,UAAU,aAAa,QAAQ,OAAO;AAC5C,WAAQ,MAAM,OAAO,OACpB,GAAG,GAAG,CACL,GAAG,cAAc,KAAK,QAAQ,WAAW,EACzC,GAAG,IAAI,CAAC,GAAG,cAAc,KAAK,QAAQ,WAAW,EAAE,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,CAC9E,CAAC,CACF;;EAGF,MAAM,OAAO,MAAM,MAAM,SAAS;EAClC,MAAM,QAAQ,KAAK,MAAM,GAAG,MAAM,CAAC,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC;EACpE,MAAM,SAA+B,EAAE,OAAO;AAE9C,MAAI,KAAK,SAAS,SAAS,MAAM,SAAS,GAAG;GAC5C,MAAM,OAAO,MAAM,GAAG,GAAG;AACzB,UAAO,aAAa,aAAa,KAAK,WAAW,KAAK,GAAG;;AAG1D,SAAO;;;;;CAMR,MAAM,OAAO,IAAY,OAA8C;AAEtE,MAAI,CADa,MAAM,KAAK,SAAS,GAAG,CACzB,QAAO;EAEtB,MAAM,UAAiC,EAAE;AACzC,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,MAAM;AACnD,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,eAAe,YAAY,MAAM,KAAK;AACnF,MAAI,MAAM,cAAc,OAAW,SAAQ,aAAa,MAAM;AAC9D,MAAI,MAAM,SAAS,OAAW,SAAQ,OAAO,KAAK,UAAU,MAAM,KAAK;AAEvE,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,EACjC,OAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,SAAS;AAG/E,SAAO,KAAK,SAAS,GAAG;;;;;CAMzB,MAAM,OAAO,IAA8B;AAG1C,WAFe,MAAM,KAAK,GAAG,WAAW,QAAQ,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,kBAAkB,EAEzE,kBAAkB,KAAK;;;;;CAMvC,MAAM,MAAM,MAAiD;EAC5D,IAAI,QAAQ,KAAK,GAAG,WAAW,QAAQ,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC;AAErF,MAAI,SAAS,OACZ,SAAQ,MAAM,MAAM,QAAQ,KAAK,eAAe,YAAY,KAAK,CAAC;EAGnE,MAAM,SAAS,MAAM,MAAM,kBAAkB;AAC7C,SAAO,OAAO,QAAQ,SAAS,EAAE;;;;;CAMlC,MAAM,YAAY,OAAiC;AAOlD,SAAO,CAAC,CANI,MAAM,KAAK,GACrB,WAAW,QAAQ,CACnB,OAAO,KAAK,CACZ,MAAM,SAAS,KAAK,MAAM,aAAa,CAAC,CACxC,kBAAkB;;;;;CAQrB,AAAQ,UAAU,KAAoB;AACrC,SAAO;GACN,IAAI,IAAI;GACR,OAAO,IAAI;GACX,MAAM,IAAI;GACV,MAAM,eAAe,OAAO,IAAI,KAAK;GACrC,WAAW,IAAI;GACf,eAAe,IAAI,mBAAmB;GACtC,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG;GACxC,WAAW,IAAI;GACf;;;CAIF,OAAwB,qBAAqD;EAC5E,YAAY;EACZ,aAAa;EACb,QAAQ;EACR,QAAQ;EACR,OAAO;EACP;;CAGD,OAAwB,eAAe,IAAI,IAAY;EAAC;EAAI;EAAI;EAAI;EAAI;EAAG,CAAC;;;;;CAM5E,OAAO,YAAY,MAAyC;AAC3D,MAAI,OAAO,SAAS,UAAU;GAC7B,MAAM,QAAQ,eAAe,mBAAmB;AAChD,OAAI,UAAU,OACb,OAAM,IAAI,MAAM,sBAAsB,OAAO;AAE9C,UAAO;;AAER,MAAI,CAAC,eAAe,aAAa,IAAI,KAAK,CACzC,OAAM,IAAI,MAAM,uBAAuB,OAAO;AAE/C,SAAO;;;;;;CAOR,OAAe,OAAO,OAAyB;AAC9C,MAAI,eAAe,aAAa,IAAI,MAAM,CAAE,QAAO;AACnD,SAAO"}