emdash 1.3.0 → 1.4.0

package/dist/{settings-CWb84sDm.mjs → settings-D932YP2-.mjs}

@@ -1,17 +1,19 @@
-import { n as isMissingTableError } from "./db-errors-CBD5yMro.mjs";
-import { t as after } from "./after-PcEvMY_6.mjs";
+import { r as isMissingTableError } from "./db-errors-unnO6yiZ.mjs";
+import { t as after } from "./after-32yNRvd2.mjs";
+import { getRequestContext } from "./request-context.mjs";
 import { n as assertStorageKey, t as OptionsRepository } from "./options-DhrI7eMv.mjs";
-import { i as resolvePluginEncryptionKeys } from "./secrets-Cc_O3Kp-.mjs";
+import { i as resolvePluginEncryptionKeys } from "./secrets-Dswzrz3k.mjs";
 import { a as encodeBase64url, r as decodeBase64url } from "./base64-BQBZwXCx.mjs";
 import { n as invalidateSingleFlightCache, r as singleFlightCached, t as createSingleFlightCache } from "./single-flight-cache-D0EaGbN1.mjs";
-import { f as invalidateObjectCache, n as cachedQuery } from "./object-cache-Bo6DGaC9.mjs";
-import { n as peekRequestCache, r as requestCached } from "./request-cache-C4CIo5ad.mjs";
-import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
-import { t as MediaRepository } from "./media-Bws9f18T.mjs";
+import { n as cachedQuery, p as invalidateObjectCache } from "./object-cache-DmKr09La.mjs";
+import { n as peekRequestCache, r as requestCached } from "./request-cache-5z2WzWmh.mjs";
+import { t as withTransaction } from "./transaction-CkoQ5wqQ.mjs";
+import { t as MediaRepository } from "./media-DepNLhPq.mjs";
+import { t as normalizeSiteSettingsVersion } from "./version-DqB7LIO7.mjs";
 import { n as siteSettingsTag } from "./chrome-tags-BIKBMZYO.mjs";
-import { c as getDb } from "./loader-CswroUbe.mjs";
+import { u as getDb } from "./loader-DhnedqY4.mjs";
 import { isRecord } from "./plugin-utils.mjs";
-import { r as bumpRunningExportWriteEpochs } from "./fence-C3MUitUN.mjs";
+import { r as bumpRunningExportWriteEpochs } from "./fence-Dagicj14.mjs";
 
 //#region src/plugins/settings.ts
 const ENVELOPE_VERSION = 1;
@@ -179,38 +181,41 @@ async function decodePersistedPluginSetting(pluginId, key, value, encryptionKeys
 	if (isPluginSettingEnvelopeRecord(value)) throw new PluginSettingEncryptionError("PLUGIN_SETTING_DECRYPTION_FAILED", "Plugin secret setting has an invalid encrypted envelope");
 	return value;
 }
-/**
-* Worker-isolate cache for the resolved `site:*` settings.
-*
-* Site settings (title, logo, SEO defaults) change rarely but are read on
-* every public request. Caching across the isolate's lifetime drops the
-* `options WHERE name LIKE 'site:%'` prefix scan from once-per-request to
-* once-per-isolate. Cross-isolate staleness is bounded by isolate lifetime
-* (workerd typically recycles within minutes); acceptable for chrome.
-*
-* Backed by single-flight-cache.ts: concurrent cold reads coalesce onto one
-* query via a reclaimable single-flight lock and the resolved *value* is
-* cached — never a shared in-flight promise, so a cancelled request can't
-* poison the isolate (see that file's header). Stored on globalThis with a
-* Symbol.for key so Vite SSR chunk duplication doesn't produce two
-* independent caches (same pattern as request-context.ts).
-*/
-const SITE_SETTINGS_CACHE_KEY = Symbol.for("emdash:site-settings");
+const SITE_SETTINGS_CACHE_TTL_MS = 3e4;
+const SITE_SETTINGS_CACHE_KEY = Symbol.for("emdash:site-settings:swr");
 const g = globalThis;
 const settingsCache = g[SITE_SETTINGS_CACHE_KEY] ?? (() => {
-	const c = createSingleFlightCache();
+	const c = {
+		snapshot: null,
+		expiresAt: 0,
+		generation: 0,
+		revalidatingUntil: 0,
+		refresh: createSingleFlightCache()
+	};
 	g[SITE_SETTINGS_CACHE_KEY] = c;
 	return c;
 })();
+/** Capture the resolved snapshot before route-cache headers are finalized. @internal */
+function peekSiteSettingsSnapshot() {
+	return settingsCache.snapshot;
+}
+/** Discard a snapshot found stale by the route-cache freshness check. @internal */
+function invalidateSiteSettingsSnapshot() {
+	settingsCache.generation++;
+	settingsCache.snapshot = null;
+	settingsCache.expiresAt = 0;
+	settingsCache.revalidatingUntil = 0;
+	invalidateSingleFlightCache(settingsCache.refresh);
+}
 /**
 * Bump the isolate-wide site-settings cache version, forcing the next
 * `getSiteSettings()` to re-query the database.
 *
 * Called from every `site:*` write path. Other isolates still serve their
-* own cached copy until they expire — staleness bounded by isolate lifetime.
+* own cached copy while a background refresh picks up remote writes.
 */
 function invalidateSiteSettingsCache() {
-	invalidateSingleFlightCache(settingsCache);
+	invalidateSiteSettingsSnapshot();
 	invalidateObjectCache(SETTINGS_CACHE_NAMESPACE);
 }
 /**
@@ -285,6 +290,52 @@ async function getSiteSettingWithDb(key, db, storage = null) {
 	}
 	return value;
 }
+function refreshSiteSettings() {
+	return singleFlightCached(settingsCache.refresh, () => cachedQuery({
+		namespace: SETTINGS_CACHE_NAMESPACE,
+		key: "snapshot-v1",
+		load: async () => loadSiteSettingsSnapshot(await getDb())
+	}), {
+		anchor: (promise) => after(() => promise),
+		ownerTimeoutMs: 3e4
+	});
+}
+function installSiteSettings(snapshot) {
+	settingsCache.snapshot = snapshot;
+	settingsCache.expiresAt = Date.now() + SITE_SETTINGS_CACHE_TTL_MS;
+}
+function revalidateSiteSettings() {
+	const now = Date.now();
+	if (settingsCache.revalidatingUntil > now) return;
+	settingsCache.revalidatingUntil = now + SITE_SETTINGS_CACHE_TTL_MS;
+	const generation = ++settingsCache.generation;
+	invalidateSingleFlightCache(settingsCache.refresh);
+	after(async () => {
+		try {
+			const snapshot = await refreshSiteSettings();
+			if (generation === settingsCache.generation) installSiteSettings(snapshot);
+		} catch (error) {
+			console.error("[emdash:settings] revalidating site settings failed:", error);
+		}
+	});
+}
+async function loadCachedSiteSettings() {
+	for (let attempt = 0; attempt < 3; attempt++) {
+		const snapshot = settingsCache.snapshot;
+		if (snapshot) {
+			if (Date.now() >= settingsCache.expiresAt) revalidateSiteSettings();
+			return snapshot;
+		}
+		const generation = settingsCache.generation;
+		const loaded = await refreshSiteSettings();
+		if (generation === settingsCache.generation) {
+			installSiteSettings(loaded);
+			return loaded;
+		}
+		if (attempt === 2) return loaded;
+	}
+	throw new Error("Site settings refresh exhausted without loading settings");
+}
 /**
 * Get all site settings
 *
@@ -301,16 +352,25 @@ async function getSiteSettingWithDb(key, db, storage = null) {
 * ```
 */
 function getSiteSettings() {
-	return requestCached("siteSettings", () => singleFlightCached(settingsCache, () => cachedQuery({
-		namespace: SETTINGS_CACHE_NAMESPACE,
-		key: "all",
-		load: async () => {
-			return getSiteSettingsWithDb(await getDb());
-		}
-	}), {
-		anchor: (promise) => after(() => promise),
-		ownerTimeoutMs: 3e4
-	}));
+	return requestCached("siteSettings", async () => {
+		return (await requestCached("siteSettingsSnapshot", async () => {
+			const ctx = getRequestContext();
+			const requestSettings = ctx?.siteSettings;
+			if (ctx?.routeCacheFill) return loadSiteSettingsSnapshot(await getDb());
+			let loaded = requestSettings?.snapshot ?? await loadCachedSiteSettings();
+			if (requestSettings?.version !== void 0 && loaded.version !== requestSettings.version) {
+				invalidateSiteSettingsSnapshot();
+				const generation = settingsCache.generation;
+				loaded = await loadSiteSettingsSnapshot(await getDb());
+				if (generation === settingsCache.generation) installSiteSettings(loaded);
+			}
+			return loaded;
+		})).data;
+	}).then(async (data) => {
+		const snapshot = await peekRequestCache("siteSettingsSnapshot");
+		if (snapshot) getRequestContext()?.siteSettings?.onRead(snapshot.version);
+		return data;
+	});
 }
 /**
 * Get all site settings with a Workers edge-cache hint.
@@ -331,11 +391,15 @@ async function getSiteSettingsWithCacheHint() {
 * that already have a database handle.
 */
 async function getSiteSettingsWithDb(db, storage = null) {
-	const allOptions = await new OptionsRepository(db).getByPrefix(SETTINGS_PREFIX);
+	return (await loadSiteSettingsSnapshot(db, storage)).data;
+}
+async function loadSiteSettingsSnapshot(db, storage = null) {
+	const allOptions = await new OptionsRepository(db).getVersionedByPrefix(SETTINGS_PREFIX);
+	const version = normalizeSiteSettingsVersion(JSON.stringify([...allOptions].filter(([key]) => key.startsWith(SETTINGS_PREFIX)).map(([key, value]) => [key, value.revision])));
 	const settings = {};
 	for (const [key, value] of allOptions) {
 		const settingKey = key.replace(SETTINGS_PREFIX, "");
-		settings[settingKey] = value;
+		settings[settingKey] = value.value;
 	}
 	const typedSettings = settings;
 	if (typedSettings.logo) typedSettings.logo = await resolveMediaReference(typedSettings.logo, db, storage);
@@ -344,7 +408,10 @@ async function getSiteSettingsWithDb(db, storage = null) {
 		...typedSettings.seo,
 		defaultOgImage: await resolveMediaReference(typedSettings.seo.defaultOgImage, db, storage)
 	};
-	return typedSettings;
+	return {
+		data: typedSettings,
+		version
+	};
 }
 /**
 * Set site settings (internal function used by admin API)
@@ -448,5 +515,5 @@ async function getPluginSettingsWithDb(pluginId, db) {
 }
 
 //#endregion
-export { getSiteSettings as a, invalidateSiteSettingsCache as c, createSettingsAccess as d, decodePluginSettingValue as f, isEncryptedPluginSetting as h, getSiteSettingWithDb as i, setSiteSettings as l, encryptPluginSetting as m, getPluginSettings as n, getSiteSettingsWithCacheHint as o, encodePluginSettingValue as p, getSiteSetting as r, getSiteSettingsWithDb as s, getPluginSetting as t, PluginSettingEncryptionError as u };
-//# sourceMappingURL=settings-CWb84sDm.mjs.map
+export { isEncryptedPluginSetting as _, getSiteSettings as a, invalidateSiteSettingsCache as c, setSiteSettings as d, PluginSettingEncryptionError as f, encryptPluginSetting as g, encodePluginSettingValue as h, getSiteSettingWithDb as i, invalidateSiteSettingsSnapshot as l, decodePluginSettingValue as m, getPluginSettings as n, getSiteSettingsWithCacheHint as o, createSettingsAccess as p, getSiteSetting as r, getSiteSettingsWithDb as s, getPluginSetting as t, peekSiteSettingsSnapshot as u };
+//# sourceMappingURL=settings-D932YP2-.mjs.map

package/dist/settings-D932YP2-.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-D932YP2-.mjs","names":[],"sources":["../src/plugins/settings.ts","../src/settings/index.ts"],"sourcesContent":["import { resolvePluginEncryptionKeys, type ParsedEncryptionKey } from \"../config/secrets.js\";\nimport type { OptionsRepository } from \"../database/repositories/options.js\";\nimport { decodeBase64url, encodeBase64url } from \"../utils/base64.js\";\nimport { assertStorageKey } from \"./conditional-storage.js\";\nexport { createPluginSecretRedactor } from \"./secret-redactor.js\";\nexport type { PluginSecretRedactor } from \"./secret-redactor.js\";\nimport type {\n\tConditionalDeleteResult,\n\tConditionalWriteResult,\n\tSettingField,\n\tSettingsAccess,\n\tVersionedValue,\n} from \"./types.js\";\n\nconst ENVELOPE_VERSION = 1;\nconst ENVELOPE_MARKER = \"plugin-setting\";\nconst IV_BYTES = 12;\nconst KEY_ID_PATTERN = /^[0-9a-f]{8}$/;\nconst BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;\nconst textEncoder = new TextEncoder();\nconst textDecoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport interface EncryptedPluginSetting {\n\t$emdash: \"plugin-setting\";\n\tv: 1;\n\tkid: string;\n\tiv: string;\n\tciphertext: string;\n}\n\nexport class PluginSettingEncryptionError extends Error {\n\toverride readonly name = \"PluginSettingEncryptionError\";\n\treadonly code:\n\t\t| \"PLUGIN_SETTING_ENCRYPTION_KEY_MISSING\"\n\t\t| \"PLUGIN_SETTING_ENCRYPTION_KEY_UNKNOWN\"\n\t\t| \"PLUGIN_SETTING_ENCRYPTION_FAILED\"\n\t\t| \"PLUGIN_SETTING_DECRYPTION_FAILED\";\n\n\tconstructor(code: PluginSettingEncryptionError[\"code\"], message: string) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t}\n}\n\nexport function isEncryptedPluginSetting(value: unknown): value is EncryptedPluginSetting {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n\treturn (\n\t\tObject.keys(value).length === 5 &&\n\t\t\"$emdash\" in value &&\n\t\tvalue.$emdash === ENVELOPE_MARKER &&\n\t\t\"v\" in value &&\n\t\tvalue.v === ENVELOPE_VERSION &&\n\t\t\"kid\" in value &&\n\t\ttypeof value.kid === \"string\" &&\n\t\tKEY_ID_PATTERN.test(value.kid) &&\n\t\t\"iv\" in value &&\n\t\ttypeof value.iv === \"string\" &&\n\t\tBASE64URL_PATTERN.test(value.iv) &&\n\t\t\"ciphertext\" in value &&\n\t\ttypeof value.ciphertext === \"string\" &&\n\t\tBASE64URL_PATTERN.test(value.ciphertext)\n\t);\n}\n\nfunction additionalData(pluginId: string, key: string): Uint8Array {\n\treturn textEncoder.encode(\n\t\tJSON.stringify([\"emdash-plugin-setting\", ENVELOPE_VERSION, pluginId, key]),\n\t);\n}\n\nfunction exactBuffer(bytes: Uint8Array): ArrayBuffer {\n\treturn bytes.slice().buffer;\n}\n\nasync function importEncryptionKey(key: ParsedEncryptionKey, usage: KeyUsage): Promise<CryptoKey> {\n\treturn crypto.subtle.importKey(\"raw\", exactBuffer(key.key), \"AES-GCM\", false, [usage]);\n}\n\nasync function keysOrDefault(\n\tkeys: ParsedEncryptionKey[] | null | undefined,\n): Promise<ParsedEncryptionKey[] | null> {\n\treturn keys === undefined ? resolvePluginEncryptionKeys() : keys;\n}\n\nexport async function encryptPluginSetting(\n\tpluginId: string,\n\tkey: string,\n\tvalue: string,\n\tkeys?: ParsedEncryptionKey[] | null,\n): Promise<EncryptedPluginSetting> {\n\tconst resolved = await keysOrDefault(keys);\n\tconst primary = resolved?.[0];\n\tif (!primary) {\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_ENCRYPTION_KEY_MISSING\",\n\t\t\t\"Plugin secret settings require EMDASH_ENCRYPTION_KEY\",\n\t\t);\n\t}\n\n\ttry {\n\t\tconst iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));\n\t\tconst cryptoKey = await importEncryptionKey(primary, \"encrypt\");\n\t\tconst ciphertext = await crypto.subtle.encrypt(\n\t\t\t{\n\t\t\t\tname: \"AES-GCM\",\n\t\t\t\tiv: exactBuffer(iv),\n\t\t\t\tadditionalData: exactBuffer(additionalData(pluginId, key)),\n\t\t\t},\n\t\t\tcryptoKey,\n\t\t\texactBuffer(textEncoder.encode(value)),\n\t\t);\n\t\treturn {\n\t\t\t$emdash: ENVELOPE_MARKER,\n\t\t\tv: ENVELOPE_VERSION,\n\t\t\tkid: primary.kid,\n\t\t\tiv: encodeBase64url(iv),\n\t\t\tciphertext: encodeBase64url(new Uint8Array(ciphertext)),\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof PluginSettingEncryptionError) throw error;\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_ENCRYPTION_FAILED\",\n\t\t\t\"Plugin secret setting could not be encrypted\",\n\t\t);\n\t}\n}\n\nexport async function decryptPluginSetting(\n\tpluginId: string,\n\tkey: string,\n\tenvelope: EncryptedPluginSetting,\n\tkeys?: ParsedEncryptionKey[] | null,\n): Promise<string> {\n\tconst resolved = await keysOrDefault(keys);\n\tif (!resolved?.length) {\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_ENCRYPTION_KEY_MISSING\",\n\t\t\t\"Plugin secret setting cannot be decrypted because its encryption key is unavailable\",\n\t\t);\n\t}\n\tconst matched = resolved.find((candidate) => candidate.kid === envelope.kid);\n\tif (!matched) {\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_ENCRYPTION_KEY_UNKNOWN\",\n\t\t\t\"Plugin secret setting was encrypted with an unavailable key\",\n\t\t);\n\t}\n\n\ttry {\n\t\tconst iv = decodeBase64url(envelope.iv);\n\t\tconst ciphertext = decodeBase64url(envelope.ciphertext);\n\t\tif (iv.byteLength !== IV_BYTES || ciphertext.byteLength < 16)\n\t\t\tthrow new Error(\"invalid envelope\");\n\t\tconst cryptoKey = await importEncryptionKey(matched, \"decrypt\");\n\t\tconst plaintext = await crypto.subtle.decrypt(\n\t\t\t{\n\t\t\t\tname: \"AES-GCM\",\n\t\t\t\tiv: exactBuffer(iv),\n\t\t\t\tadditionalData: exactBuffer(additionalData(pluginId, key)),\n\t\t\t},\n\t\t\tcryptoKey,\n\t\t\texactBuffer(ciphertext),\n\t\t);\n\t\treturn textDecoder.decode(plaintext);\n\t} catch {\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_DECRYPTION_FAILED\",\n\t\t\t\"Plugin secret setting could not be decrypted\",\n\t\t);\n\t}\n}\n\nfunction isSecretField(schema: Record<string, SettingField>, key: string): boolean {\n\treturn schema[key]?.type === \"secret\";\n}\n\nexport async function encodePluginSettingValue(\n\tpluginId: string,\n\tkey: string,\n\tvalue: unknown,\n\tschema: Record<string, SettingField>,\n\tkeys?: ParsedEncryptionKey[] | null,\n\tonSecret?: (key: string, value: string) => void,\n): Promise<unknown> {\n\tif (!isSecretField(schema, key)) return value;\n\tif (typeof value !== \"string\") {\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_ENCRYPTION_FAILED\",\n\t\t\t\"Plugin secret settings must be strings\",\n\t\t);\n\t}\n\tonSecret?.(key, value);\n\treturn encryptPluginSetting(pluginId, key, value, keys);\n}\n\nexport async function decodePluginSettingValue<T = unknown>(\n\tpluginId: string,\n\tkey: string,\n\tvalue: unknown,\n\tschema: Record<string, SettingField>,\n\tkeys?: ParsedEncryptionKey[] | null,\n\tonSecret?: (key: string, value: string) => void,\n): Promise<T> {\n\tif (!isSecretField(schema, key)) {\n\t\tif (isEncryptedPluginSetting(value)) {\n\t\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\t\"PLUGIN_SETTING_DECRYPTION_FAILED\",\n\t\t\t\t\"Encrypted plugin setting is not declared as a secret\",\n\t\t\t);\n\t\t}\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- caller supplies the expected non-secret setting type\n\t\treturn value as T;\n\t}\n\tif (typeof value === \"string\") {\n\t\tonSecret?.(key, value);\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- secret schema guarantees a string and caller supplies its compatible type\n\t\treturn value as T;\n\t}\n\tif (!isEncryptedPluginSetting(value)) {\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_DECRYPTION_FAILED\",\n\t\t\t\"Plugin secret setting has an invalid encrypted envelope\",\n\t\t);\n\t}\n\tconst decrypted = await decryptPluginSetting(pluginId, key, value, keys);\n\tonSecret?.(key, decrypted);\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- secret schema guarantees a string and caller supplies its compatible type\n\treturn decrypted as T;\n}\n\nexport function createSettingsAccess(\n\toptionsRepo: OptionsRepository,\n\tpluginId: string,\n\tschema: Record<string, SettingField> = {},\n\tkeys?: ParsedEncryptionKey[] | null,\n\tonSecret?: (key: string, value: string) => void,\n): SettingsAccess {\n\tconst prefix = `plugin:${pluginId}:settings:`;\n\tconst optionKey = (key: string) => {\n\t\tassertStorageKey(key);\n\t\treturn `${prefix}${key}`;\n\t};\n\n\treturn {\n\t\tasync get<T>(key: string): Promise<T | null> {\n\t\t\tconst value = await optionsRepo.get(optionKey(key));\n\t\t\treturn value === null\n\t\t\t\t? null\n\t\t\t\t: decodePluginSettingValue<T>(pluginId, key, value, schema, keys, onSecret);\n\t\t},\n\t\tasync getVersioned<T>(key: string): Promise<VersionedValue<T> | null> {\n\t\t\tconst value = await optionsRepo.getVersioned(optionKey(key));\n\t\t\tif (!value) return null;\n\t\t\treturn {\n\t\t\t\tvalue: await decodePluginSettingValue<T>(\n\t\t\t\t\tpluginId,\n\t\t\t\t\tkey,\n\t\t\t\t\tvalue.value,\n\t\t\t\t\tschema,\n\t\t\t\t\tkeys,\n\t\t\t\t\tonSecret,\n\t\t\t\t),\n\t\t\t\trevision: value.revision,\n\t\t\t};\n\t\t},\n\t\tasync compareAndSet(\n\t\t\tkey: string,\n\t\t\texpectedRevision: string | null,\n\t\t\tvalue: unknown,\n\t\t): Promise<ConditionalWriteResult> {\n\t\t\treturn optionsRepo.compareAndSet(\n\t\t\t\toptionKey(key),\n\t\t\t\texpectedRevision,\n\t\t\t\tawait encodePluginSettingValue(pluginId, key, value, schema, keys, onSecret),\n\t\t\t);\n\t\t},\n\t\tcompareAndDelete(key: string, expectedRevision: string): Promise<ConditionalDeleteResult> {\n\t\t\treturn optionsRepo.compareAndDelete(optionKey(key), expectedRevision);\n\t\t},\n\t\tasync set(key: string, value: unknown): Promise<void> {\n\t\t\tawait optionsRepo.set(\n\t\t\t\toptionKey(key),\n\t\t\t\tawait encodePluginSettingValue(pluginId, key, value, schema, keys, onSecret),\n\t\t\t);\n\t\t},\n\t\tdelete(key: string): Promise<boolean> {\n\t\t\treturn optionsRepo.delete(optionKey(key));\n\t\t},\n\t\tasync list(keyPrefix = \"\"): Promise<Array<{ key: string; value: unknown }>> {\n\t\t\tassertStorageKey(keyPrefix || \"_\");\n\t\t\tconst values = await optionsRepo.getByPrefix(`${prefix}${keyPrefix}`);\n\t\t\tconst result: Array<{ key: string; value: unknown }> = [];\n\t\t\tfor (const [fullKey, value] of values) {\n\t\t\t\tconst key = fullKey.slice(prefix.length);\n\t\t\t\tresult.push({\n\t\t\t\t\tkey,\n\t\t\t\t\tvalue: await decodePluginSettingValue(pluginId, key, value, schema, keys, onSecret),\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn result;\n\t\t},\n\t};\n}\n","/**\n * Site Settings API\n *\n * Functions for getting and setting global site configuration.\n * Settings are stored in the options table with 'site:' prefix.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { after } from \"../after.js\";\nimport { siteSettingsTag } from \"../cache/chrome-tags.js\";\nimport { resolvePluginEncryptionKeys } from \"../config/secrets.js\";\nimport { MediaRepository } from \"../database/repositories/media.js\";\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport { withTransaction } from \"../database/transaction.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getDb } from \"../loader.js\";\nimport { cachedQuery, invalidateObjectCache } from \"../object-cache/index.js\";\nimport { isRecord } from \"../plugin-utils.js\";\nimport {\n\tPluginSettingEncryptionError,\n\tdecryptPluginSetting,\n\tisEncryptedPluginSetting,\n} from \"../plugins/settings.js\";\nimport type { CacheHint } from \"../query.js\";\nimport { peekRequestCache, requestCached } from \"../request-cache.js\";\nimport { getRequestContext } from \"../request-context.js\";\nimport { bumpRunningExportWriteEpochs } from \"../transfer/fence.js\";\nimport { isMissingTableError } from \"../utils/db-errors.js\";\n\n/** Object-cache namespace for site settings. */\nconst SETTINGS_CACHE_NAMESPACE = \"settings\";\nimport type { Storage } from \"../storage/types.js\";\nimport {\n\tcreateSingleFlightCache,\n\ttype SingleFlightCache,\n\tinvalidateSingleFlightCache,\n\tsingleFlightCached,\n} from \"../utils/single-flight-cache.js\";\nimport type {\n\tMediaReference,\n\tSeoSettings,\n\tSiteSettings,\n\tSiteSettingsUpdate,\n\tSiteSettingKey,\n} from \"./types.js\";\nimport { normalizeSiteSettingsVersion } from \"./version.js\";\n\n/** Prefix for site settings in the options table */\nconst SETTINGS_PREFIX = \"site:\";\n\n/** Settings stored as one object whose fields are updated individually. */\nconst NESTED_SETTING_KEYS = new Set([\"seo\", \"social\"]);\n\nfunction isPluginSettingEnvelopeRecord(value: unknown): value is Record<string, unknown> {\n\treturn (\n\t\ttypeof value === \"object\" &&\n\t\tvalue !== null &&\n\t\t!Array.isArray(value) &&\n\t\t\"$emdash\" in value &&\n\t\tvalue.$emdash === \"plugin-setting\"\n\t);\n}\n\nasync function decodePersistedPluginSetting(\n\tpluginId: string,\n\tkey: string,\n\tvalue: unknown,\n\tencryptionKeys?: Awaited<ReturnType<typeof resolvePluginEncryptionKeys>>,\n): Promise<unknown> {\n\tif (isEncryptedPluginSetting(value)) {\n\t\treturn decryptPluginSetting(pluginId, key, value, encryptionKeys);\n\t}\n\tif (isPluginSettingEnvelopeRecord(value)) {\n\t\tthrow new PluginSettingEncryptionError(\n\t\t\t\"PLUGIN_SETTING_DECRYPTION_FAILED\",\n\t\t\t\"Plugin secret setting has an invalid encrypted envelope\",\n\t\t);\n\t}\n\treturn value;\n}\n\n/**\n * Worker-isolate cache for the resolved `site:*` settings.\n *\n * Site settings (title, logo, SEO defaults) change rarely but are read on\n * every public request. Revalidate warm snapshots after 30 seconds in the\n * background, retaining the last good value if the reload fails.\n *\n * Backed by single-flight-cache.ts: concurrent cold reads coalesce onto one\n * query via a reclaimable single-flight lock and the resolved *value* is\n * cached — never a shared in-flight promise, so a cancelled request can't\n * poison the isolate (see that file's header). Stored on globalThis with a\n * Symbol.for key so Vite SSR chunk duplication doesn't produce two\n * independent caches (same pattern as request-context.ts).\n */\ninterface CachedSiteSettings {\n\tdata: Partial<SiteSettings>;\n\tversion: string;\n}\n\ninterface SiteSettingsCache {\n\tsnapshot: CachedSiteSettings | null;\n\texpiresAt: number;\n\tgeneration: number;\n\trevalidatingUntil: number;\n\trefresh: SingleFlightCache<CachedSiteSettings>;\n}\n\nconst SITE_SETTINGS_CACHE_TTL_MS = 30_000;\nconst SITE_SETTINGS_CACHE_KEY = Symbol.for(\"emdash:site-settings:swr\");\nconst g = globalThis as Record<symbol, unknown>;\nconst settingsCache: SiteSettingsCache =\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)\n\t(g[SITE_SETTINGS_CACHE_KEY] as SiteSettingsCache | undefined) ??\n\t(() => {\n\t\tconst c: SiteSettingsCache = {\n\t\t\tsnapshot: null,\n\t\t\texpiresAt: 0,\n\t\t\tgeneration: 0,\n\t\t\trevalidatingUntil: 0,\n\t\t\trefresh: createSingleFlightCache<CachedSiteSettings>(),\n\t\t};\n\t\tg[SITE_SETTINGS_CACHE_KEY] = c;\n\t\treturn c;\n\t})();\n\n/** Capture the resolved snapshot before route-cache headers are finalized. @internal */\nexport function peekSiteSettingsSnapshot(): CachedSiteSettings | null {\n\treturn settingsCache.snapshot;\n}\n\n/** Discard a snapshot found stale by the route-cache freshness check. @internal */\nexport function invalidateSiteSettingsSnapshot(): void {\n\tsettingsCache.generation++;\n\tsettingsCache.snapshot = null;\n\tsettingsCache.expiresAt = 0;\n\tsettingsCache.revalidatingUntil = 0;\n\tinvalidateSingleFlightCache(settingsCache.refresh);\n}\n\n/**\n * Bump the isolate-wide site-settings cache version, forcing the next\n * `getSiteSettings()` to re-query the database.\n *\n * Called from every `site:*` write path. Other isolates still serve their\n * own cached copy while a background refresh picks up remote writes.\n */\nexport function invalidateSiteSettingsCache(): void {\n\tinvalidateSiteSettingsSnapshot();\n\t// Cross-isolate invalidation for the optional distributed object cache.\n\tinvalidateObjectCache(SETTINGS_CACHE_NAMESPACE);\n}\n\n/**\n * Type guard for MediaReference values\n */\nfunction isMediaReference(value: unknown): value is MediaReference {\n\treturn typeof value === \"object\" && value !== null && \"mediaId\" in value;\n}\n\n/**\n * Resolve a media reference to include the full URL plus content metadata.\n *\n * Pulls `mimeType` and intrinsic dimensions from the media row so callers\n * can emit correct head tags (e.g. `<link rel=\"icon\" type=\"image/svg+xml\">`,\n * which Chromium requires when the URL has no `.svg` extension) without\n * a second round-trip to the media table.\n */\nasync function resolveMediaReference(\n\tmediaRef: MediaReference | undefined,\n\tdb: Kysely<Database>,\n\t_storage: Storage | null,\n): Promise<MediaReference | undefined> {\n\tif (!mediaRef?.mediaId) {\n\t\treturn mediaRef;\n\t}\n\n\ttry {\n\t\tconst mediaRepo = new MediaRepository(db);\n\t\tconst media = await mediaRepo.findById(mediaRef.mediaId);\n\n\t\tif (media) {\n\t\t\t// Construct URL using the same pattern as API handlers\n\t\t\treturn {\n\t\t\t\t...mediaRef,\n\t\t\t\turl: `/_emdash/api/media/file/${media.storageKey}`,\n\t\t\t\tcontentType: media.mimeType,\n\t\t\t\t...(media.width !== null ? { width: media.width } : {}),\n\t\t\t\t...(media.height !== null ? { height: media.height } : {}),\n\t\t\t};\n\t\t}\n\t} catch {\n\t\t// If media not found or error, return the reference as-is\n\t}\n\n\treturn mediaRef;\n}\n\n/**\n * Get a single site setting by key\n *\n * Returns `undefined` if the setting has not been configured.\n * For media settings (logo, favicon), the URL is resolved automatically.\n *\n * @param key - The setting key (e.g., \"title\", \"logo\", \"social\")\n * @returns The setting value, or undefined if not set\n *\n * @example\n * ```ts\n * import { getSiteSetting } from \"emdash\";\n *\n * const title = await getSiteSetting(\"title\");\n * const logo = await getSiteSetting(\"logo\");\n * console.log(logo?.url); // Resolved URL\n * ```\n */\nexport async function getSiteSetting<K extends SiteSettingKey>(\n\tkey: K,\n): Promise<SiteSettings[K] | undefined> {\n\t// If `getSiteSettings()` has already been called in this request,\n\t// read from that (request-cached) batch rather than firing a second\n\t// options-table query. Common layout: a Base template pulls the\n\t// whole settings object up-front, then `EmDashHead` or a plugin\n\t// asks for one key — no reason the singular call should round-trip\n\t// again.\n\tconst primed = peekRequestCache<Partial<SiteSettings>>(\"siteSettings\");\n\tif (primed) {\n\t\tconst settings = await primed;\n\t\treturn settings[key];\n\t}\n\n\t// Otherwise cache per-key. Templates that pull several settings\n\t// independently still share the in-flight query for each one.\n\treturn requestCached(`siteSetting:${key}`, async () => {\n\t\tconst db = await getDb();\n\t\treturn getSiteSettingWithDb(key, db);\n\t});\n}\n\n/**\n * Get a single site setting by key (with explicit db)\n *\n * @internal Use `getSiteSetting()` in templates. This variant is for admin routes\n * that already have a database handle.\n */\nexport async function getSiteSettingWithDb<K extends SiteSettingKey>(\n\tkey: K,\n\tdb: Kysely<Database>,\n\tstorage: Storage | null = null,\n): Promise<SiteSettings[K] | undefined> {\n\tconst options = new OptionsRepository(db);\n\tconst value = await options.get<SiteSettings[K]>(`${SETTINGS_PREFIX}${key}`);\n\n\tif (!value) {\n\t\treturn undefined;\n\t}\n\n\t// Resolve media references if needed.\n\t// TS cannot narrow generic K from key equality checks — this is a known limitation.\n\t// We use the non-generic getSiteSettingsWithDb for media resolution instead.\n\tif ((key === \"logo\" || key === \"favicon\") && isMediaReference(value)) {\n\t\tconst resolved = await resolveMediaReference(value, db, storage);\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- TS can't narrow generic K from key equality; resolved type is correct\n\t\treturn resolved as SiteSettings[K] | undefined;\n\t}\n\n\tif (key === \"seo\" && value && typeof value === \"object\") {\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- TS can't narrow generic K from key equality\n\t\tconst seo = value as SeoSettings;\n\t\tif (seo.defaultOgImage) {\n\t\t\tconst resolved = {\n\t\t\t\t...seo,\n\t\t\t\tdefaultOgImage: await resolveMediaReference(seo.defaultOgImage, db, storage),\n\t\t\t};\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- TS can't narrow generic K from key equality\n\t\t\treturn resolved as SiteSettings[K] | undefined;\n\t\t}\n\t}\n\n\treturn value;\n}\n\nfunction refreshSiteSettings(): Promise<CachedSiteSettings> {\n\treturn singleFlightCached(\n\t\tsettingsCache.refresh,\n\t\t() =>\n\t\t\tcachedQuery({\n\t\t\t\tnamespace: SETTINGS_CACHE_NAMESPACE,\n\t\t\t\tkey: \"snapshot-v1\",\n\t\t\t\tload: async () => loadSiteSettingsSnapshot(await getDb()),\n\t\t\t}),\n\t\t{ anchor: (promise) => after(() => promise), ownerTimeoutMs: 30_000 },\n\t);\n}\n\nfunction installSiteSettings(snapshot: CachedSiteSettings): void {\n\tsettingsCache.snapshot = snapshot;\n\tsettingsCache.expiresAt = Date.now() + SITE_SETTINGS_CACHE_TTL_MS;\n}\n\nfunction revalidateSiteSettings(): void {\n\tconst now = Date.now();\n\tif (settingsCache.revalidatingUntil > now) return;\n\tsettingsCache.revalidatingUntil = now + SITE_SETTINGS_CACHE_TTL_MS;\n\tconst generation = ++settingsCache.generation;\n\tinvalidateSingleFlightCache(settingsCache.refresh);\n\tafter(async () => {\n\t\ttry {\n\t\t\tconst snapshot = await refreshSiteSettings();\n\t\t\tif (generation === settingsCache.generation) installSiteSettings(snapshot);\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[emdash:settings] revalidating site settings failed:\", error);\n\t\t}\n\t});\n}\n\nasync function loadCachedSiteSettings(): Promise<CachedSiteSettings> {\n\tfor (let attempt = 0; attempt < 3; attempt++) {\n\t\tconst snapshot = settingsCache.snapshot;\n\t\tif (snapshot) {\n\t\t\tif (Date.now() >= settingsCache.expiresAt) revalidateSiteSettings();\n\t\t\treturn snapshot;\n\t\t}\n\t\tconst generation = settingsCache.generation;\n\t\tconst loaded = await refreshSiteSettings();\n\t\tif (generation === settingsCache.generation) {\n\t\t\tinstallSiteSettings(loaded);\n\t\t\treturn loaded;\n\t\t}\n\t\tif (attempt === 2) return loaded;\n\t}\n\tthrow new Error(\"Site settings refresh exhausted without loading settings\");\n}\n\n/**\n * Get all site settings\n *\n * Returns all configured settings. Unset values are undefined.\n * Media references (logo/favicon) are resolved to include URLs.\n *\n * @example\n * ```ts\n * import { getSiteSettings } from \"emdash\";\n *\n * const settings = await getSiteSettings();\n * console.log(settings.title); // \"My Site\"\n * console.log(settings.logo?.url); // \"/_emdash/api/media/file/abc123\"\n * ```\n */\nexport function getSiteSettings(): Promise<Partial<SiteSettings>> {\n\treturn requestCached(\"siteSettings\", async () => {\n\t\tconst snapshot = await requestCached(\"siteSettingsSnapshot\", async () => {\n\t\t\tconst ctx = getRequestContext();\n\t\t\tconst requestSettings = ctx?.siteSettings;\n\t\t\tif (ctx?.routeCacheFill) return loadSiteSettingsSnapshot(await getDb());\n\t\t\tlet loaded = requestSettings?.snapshot ?? (await loadCachedSiteSettings());\n\t\t\t// A cold streamed component may join a load started before verification.\n\t\t\t// Reload an older result instead of streaming that snapshot into a fill.\n\t\t\tif (requestSettings?.version !== undefined && loaded.version !== requestSettings.version) {\n\t\t\t\tinvalidateSiteSettingsSnapshot();\n\t\t\t\tconst generation = settingsCache.generation;\n\t\t\t\tloaded = await loadSiteSettingsSnapshot(await getDb());\n\t\t\t\tif (generation === settingsCache.generation) installSiteSettings(loaded);\n\t\t\t}\n\t\t\treturn loaded;\n\t\t});\n\t\treturn snapshot.data;\n\t}).then(async (data) => {\n\t\tconst snapshot = await peekRequestCache<CachedSiteSettings>(\"siteSettingsSnapshot\");\n\t\tif (snapshot) getRequestContext()?.siteSettings?.onRead(snapshot.version);\n\t\treturn data;\n\t});\n}\n\n/**\n * Get all site settings with a Workers edge-cache hint.\n *\n * Use the returned `cacheHint` with `Astro.cache.set()` so pages that render\n * settings can be purged automatically when site settings change.\n */\nexport async function getSiteSettingsWithCacheHint(): Promise<{\n\tdata: Partial<SiteSettings>;\n\tcacheHint: CacheHint;\n}> {\n\tconst data = await getSiteSettings();\n\treturn { data, cacheHint: { tags: [siteSettingsTag()] } };\n}\n\n/**\n * Get all site settings (with explicit db)\n *\n * @internal Use `getSiteSettings()` in templates. This variant is for admin routes\n * that already have a database handle.\n */\nexport async function getSiteSettingsWithDb(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null = null,\n): Promise<Partial<SiteSettings>> {\n\treturn (await loadSiteSettingsSnapshot(db, storage)).data;\n}\n\nasync function loadSiteSettingsSnapshot(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null = null,\n): Promise<CachedSiteSettings> {\n\tconst options = new OptionsRepository(db);\n\tconst allOptions = await options.getVersionedByPrefix(SETTINGS_PREFIX);\n\tconst version = normalizeSiteSettingsVersion(\n\t\tJSON.stringify(\n\t\t\t[...allOptions]\n\t\t\t\t.filter(([key]) => key.startsWith(SETTINGS_PREFIX))\n\t\t\t\t.map(([key, value]) => [key, value.revision]),\n\t\t),\n\t);\n\tconst settings: Record<string, unknown> = {};\n\n\tfor (const [key, value] of allOptions) {\n\t\tconst settingKey = key.replace(SETTINGS_PREFIX, \"\");\n\t\tsettings[settingKey] = value.value;\n\t}\n\n\tconst typedSettings = settings as Partial<SiteSettings>;\n\n\t// Resolve media references\n\tif (typedSettings.logo) {\n\t\ttypedSettings.logo = await resolveMediaReference(typedSettings.logo, db, storage);\n\t}\n\tif (typedSettings.favicon) {\n\t\ttypedSettings.favicon = await resolveMediaReference(typedSettings.favicon, db, storage);\n\t}\n\tif (typedSettings.seo?.defaultOgImage) {\n\t\ttypedSettings.seo = {\n\t\t\t...typedSettings.seo,\n\t\t\tdefaultOgImage: await resolveMediaReference(typedSettings.seo.defaultOgImage, db, storage),\n\t\t};\n\t}\n\n\treturn { data: typedSettings, version };\n}\n\n/**\n * Set site settings (internal function used by admin API)\n *\n * Merges provided settings with existing ones. Only provided fields are updated,\n * including fields inside `seo` and `social`; `seo.defaultOgImage: null` removes the default image.\n * Media references should include just the mediaId; URLs are resolved on read.\n *\n * @param settings - Partial settings object with values to update\n * @param db - Kysely database instance\n * @returns Promise that resolves when settings are saved\n *\n * @internal\n *\n * @example\n * ```ts\n * // Update multiple settings at once\n * await setSiteSettings({\n *   title: \"My Site\",\n *   tagline: \"Welcome\",\n *   logo: { mediaId: \"med_123\", alt: \"Logo\" }\n * }, db);\n * ```\n */\nexport async function setSiteSettings(\n\tsettings: SiteSettingsUpdate,\n\tdb: Kysely<Database>,\n): Promise<void> {\n\tconst updates: Record<string, unknown> = {};\n\tconst deletions: string[] = [];\n\tconst nestedPatches: [key: string, patch: Record<string, unknown>][] = [];\n\n\tfor (const [key, value] of Object.entries(settings)) {\n\t\tif (value === undefined) continue;\n\t\tif (value === null) deletions.push(`${SETTINGS_PREFIX}${key}`);\n\t\telse if (NESTED_SETTING_KEYS.has(key) && isRecord(value)) nestedPatches.push([key, value]);\n\t\telse updates[`${SETTINGS_PREFIX}${key}`] = value;\n\t}\n\n\tif (Object.keys(updates).length === 0 && deletions.length === 0 && nestedPatches.length === 0) {\n\t\treturn;\n\t}\n\n\ttry {\n\t\tawait withTransaction(db, async (trx) => {\n\t\t\tconst transactionOptions = new OptionsRepository(trx);\n\t\t\tawait transactionOptions.setMany(updates);\n\t\t\tawait transactionOptions.deleteMany(deletions);\n\n\t\t\tfor (const [key, patch] of nestedPatches) {\n\t\t\t\tconst optionName = `${SETTINGS_PREFIX}${key}`;\n\t\t\t\tconst next = { ...(await transactionOptions.get<Record<string, unknown>>(optionName)) };\n\t\t\t\tfor (const [field, fieldValue] of Object.entries(patch)) {\n\t\t\t\t\tif (fieldValue === null) delete next[field];\n\t\t\t\t\telse if (fieldValue !== undefined) next[field] = fieldValue;\n\t\t\t\t}\n\t\t\t\tif (Object.keys(next).length === 0) await transactionOptions.delete(optionName);\n\t\t\t\telse await transactionOptions.set(optionName, next);\n\t\t\t}\n\n\t\t\t// A running export detects writes to tables without updated_at via\n\t\t\t// the operation's write_epoch. Record that bump in the same\n\t\t\t// transaction so the settings update is not accepted unless the\n\t\t\t// export fence can see it. When the transfer system has not been\n\t\t\t// installed yet (pre-migration, or a minimal seed fixture), there\n\t\t\t// is no running export to notify, so the absence of its table is\n\t\t\t// not a reason to reject the settings update.\n\t\t\ttry {\n\t\t\t\tawait bumpRunningExportWriteEpochs(trx);\n\t\t\t} catch (error) {\n\t\t\t\tif (isMissingTableError(error)) return;\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t});\n\t} finally {\n\t\tinvalidateSiteSettingsCache();\n\t}\n}\n\n/**\n * Get a single plugin setting by key.\n *\n * Plugin settings are stored in the options table under\n * `plugin:<pluginId>:settings:<key>`.\n */\nexport async function getPluginSetting<T = unknown>(\n\tpluginId: string,\n\tkey: string,\n): Promise<T | undefined> {\n\tconst db = await getDb();\n\treturn getPluginSettingWithDb<T>(pluginId, key, db);\n}\n\n/**\n * Get a single plugin setting by key (with explicit db).\n *\n * @internal Use `getPluginSetting()` in templates and plugin rendering code.\n */\nexport async function getPluginSettingWithDb<T = unknown>(\n\tpluginId: string,\n\tkey: string,\n\tdb: Kysely<Database>,\n): Promise<T | undefined> {\n\tconst options = new OptionsRepository(db);\n\tconst value = await options.get(`plugin:${pluginId}:settings:${key}`);\n\tif (value === null) return undefined;\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- caller supplies the expected plugin setting type\n\treturn (await decodePersistedPluginSetting(pluginId, key, value)) as T;\n}\n\n/**\n * Get all persisted plugin settings for a plugin.\n *\n * Defaults declared in `admin.settingsSchema` are not materialized\n * automatically; callers should apply their own fallback defaults.\n */\nexport async function getPluginSettings(pluginId: string): Promise<Record<string, unknown>> {\n\tconst db = await getDb();\n\treturn getPluginSettingsWithDb(pluginId, db);\n}\n\n/**\n * Get all persisted plugin settings for a plugin (with explicit db).\n *\n * @internal Use `getPluginSettings()` in templates and plugin rendering code.\n */\nexport async function getPluginSettingsWithDb(\n\tpluginId: string,\n\tdb: Kysely<Database>,\n): Promise<Record<string, unknown>> {\n\tconst prefix = `plugin:${pluginId}:settings:`;\n\tconst options = new OptionsRepository(db);\n\tconst allOptions = await options.getByPrefix(prefix);\n\n\tconst entries = [...allOptions].filter(([key]) => key.startsWith(prefix));\n\tconst encryptionKeys = entries.some(([, value]) => isEncryptedPluginSetting(value))\n\t\t? await resolvePluginEncryptionKeys()\n\t\t: undefined;\n\treturn Object.fromEntries(\n\t\tawait Promise.all(\n\t\t\tentries.map(async ([storedKey, value]) => {\n\t\t\t\tconst key = storedKey.slice(prefix.length);\n\t\t\t\treturn [\n\t\t\t\t\tkey,\n\t\t\t\t\tawait decodePersistedPluginSetting(pluginId, key, value, encryptionKeys),\n\t\t\t\t] as const;\n\t\t\t}),\n\t\t),\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAcA,MAAM,mBAAmB;AACzB,MAAM,kBAAkB;AACxB,MAAM,WAAW;AACjB,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,cAAc,IAAI,aAAa;AACrC,MAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC;AAU7D,IAAa,+BAAb,cAAkD,MAAM;CACvD,AAAkB,OAAO;CACzB,AAAS;CAMT,YAAY,MAA4C,SAAiB;AACxE,QAAM,QAAQ;AACd,OAAK,OAAO;;;AAId,SAAgB,yBAAyB,OAAiD;AACzF,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CAAE,QAAO;AAChF,QACC,OAAO,KAAK,MAAM,CAAC,WAAW,KAC9B,aAAa,SACb,MAAM,YAAY,mBAClB,OAAO,SACP,MAAM,MAAM,oBACZ,SAAS,SACT,OAAO,MAAM,QAAQ,YACrB,eAAe,KAAK,MAAM,IAAI,IAC9B,QAAQ,SACR,OAAO,MAAM,OAAO,YACpB,kBAAkB,KAAK,MAAM,GAAG,IAChC,gBAAgB,SAChB,OAAO,MAAM,eAAe,YAC5B,kBAAkB,KAAK,MAAM,WAAW;;AAI1C,SAAS,eAAe,UAAkB,KAAyB;AAClE,QAAO,YAAY,OAClB,KAAK,UAAU;EAAC;EAAyB;EAAkB;EAAU;EAAI,CAAC,CAC1E;;AAGF,SAAS,YAAY,OAAgC;AACpD,QAAO,MAAM,OAAO,CAAC;;AAGtB,eAAe,oBAAoB,KAA0B,OAAqC;AACjG,QAAO,OAAO,OAAO,UAAU,OAAO,YAAY,IAAI,IAAI,EAAE,WAAW,OAAO,CAAC,MAAM,CAAC;;AAGvF,eAAe,cACd,MACwC;AACxC,QAAO,SAAS,SAAY,6BAA6B,GAAG;;AAG7D,eAAsB,qBACrB,UACA,KACA,OACA,MACkC;CAElC,MAAM,WADW,MAAM,cAAc,KAAK,IACf;AAC3B,KAAI,CAAC,QACJ,OAAM,IAAI,6BACT,yCACA,uDACA;AAGF,KAAI;EACH,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,SAAS,CAAC;EAC3D,MAAM,YAAY,MAAM,oBAAoB,SAAS,UAAU;EAC/D,MAAM,aAAa,MAAM,OAAO,OAAO,QACtC;GACC,MAAM;GACN,IAAI,YAAY,GAAG;GACnB,gBAAgB,YAAY,eAAe,UAAU,IAAI,CAAC;GAC1D,EACD,WACA,YAAY,YAAY,OAAO,MAAM,CAAC,CACtC;AACD,SAAO;GACN,SAAS;GACT,GAAG;GACH,KAAK,QAAQ;GACb,IAAI,gBAAgB,GAAG;GACvB,YAAY,gBAAgB,IAAI,WAAW,WAAW,CAAC;GACvD;UACO,OAAO;AACf,MAAI,iBAAiB,6BAA8B,OAAM;AACzD,QAAM,IAAI,6BACT,oCACA,+CACA;;;AAIH,eAAsB,qBACrB,UACA,KACA,UACA,MACkB;CAClB,MAAM,WAAW,MAAM,cAAc,KAAK;AAC1C,KAAI,CAAC,UAAU,OACd,OAAM,IAAI,6BACT,yCACA,sFACA;CAEF,MAAM,UAAU,SAAS,MAAM,cAAc,UAAU,QAAQ,SAAS,IAAI;AAC5E,KAAI,CAAC,QACJ,OAAM,IAAI,6BACT,yCACA,8DACA;AAGF,KAAI;EACH,MAAM,KAAK,gBAAgB,SAAS,GAAG;EACvC,MAAM,aAAa,gBAAgB,SAAS,WAAW;AACvD,MAAI,GAAG,eAAe,YAAY,WAAW,aAAa,GACzD,OAAM,IAAI,MAAM,mBAAmB;EACpC,MAAM,YAAY,MAAM,oBAAoB,SAAS,UAAU;EAC/D,MAAM,YAAY,MAAM,OAAO,OAAO,QACrC;GACC,MAAM;GACN,IAAI,YAAY,GAAG;GACnB,gBAAgB,YAAY,eAAe,UAAU,IAAI,CAAC;GAC1D,EACD,WACA,YAAY,WAAW,CACvB;AACD,SAAO,YAAY,OAAO,UAAU;SAC7B;AACP,QAAM,IAAI,6BACT,oCACA,+CACA;;;AAIH,SAAS,cAAc,QAAsC,KAAsB;AAClF,QAAO,OAAO,MAAM,SAAS;;AAG9B,eAAsB,yBACrB,UACA,KACA,OACA,QACA,MACA,UACmB;AACnB,KAAI,CAAC,cAAc,QAAQ,IAAI,CAAE,QAAO;AACxC,KAAI,OAAO,UAAU,SACpB,OAAM,IAAI,6BACT,oCACA,yCACA;AAEF,YAAW,KAAK,MAAM;AACtB,QAAO,qBAAqB,UAAU,KAAK,OAAO,KAAK;;AAGxD,eAAsB,yBACrB,UACA,KACA,OACA,QACA,MACA,UACa;AACb,KAAI,CAAC,cAAc,QAAQ,IAAI,EAAE;AAChC,MAAI,yBAAyB,MAAM,CAClC,OAAM,IAAI,6BACT,oCACA,uDACA;AAGF,SAAO;;AAER,KAAI,OAAO,UAAU,UAAU;AAC9B,aAAW,KAAK,MAAM;AAEtB,SAAO;;AAER,KAAI,CAAC,yBAAyB,MAAM,CACnC,OAAM,IAAI,6BACT,oCACA,0DACA;CAEF,MAAM,YAAY,MAAM,qBAAqB,UAAU,KAAK,OAAO,KAAK;AACxE,YAAW,KAAK,UAAU;AAE1B,QAAO;;AAGR,SAAgB,qBACf,aACA,UACA,SAAuC,EAAE,EACzC,MACA,UACiB;CACjB,MAAM,SAAS,UAAU,SAAS;CAClC,MAAM,aAAa,QAAgB;AAClC,mBAAiB,IAAI;AACrB,SAAO,GAAG,SAAS;;AAGpB,QAAO;EACN,MAAM,IAAO,KAAgC;GAC5C,MAAM,QAAQ,MAAM,YAAY,IAAI,UAAU,IAAI,CAAC;AACnD,UAAO,UAAU,OACd,OACA,yBAA4B,UAAU,KAAK,OAAO,QAAQ,MAAM,SAAS;;EAE7E,MAAM,aAAgB,KAAgD;GACrE,MAAM,QAAQ,MAAM,YAAY,aAAa,UAAU,IAAI,CAAC;AAC5D,OAAI,CAAC,MAAO,QAAO;AACnB,UAAO;IACN,OAAO,MAAM,yBACZ,UACA,KACA,MAAM,OACN,QACA,MACA,SACA;IACD,UAAU,MAAM;IAChB;;EAEF,MAAM,cACL,KACA,kBACA,OACkC;AAClC,UAAO,YAAY,cAClB,UAAU,IAAI,EACd,kBACA,MAAM,yBAAyB,UAAU,KAAK,OAAO,QAAQ,MAAM,SAAS,CAC5E;;EAEF,iBAAiB,KAAa,kBAA4D;AACzF,UAAO,YAAY,iBAAiB,UAAU,IAAI,EAAE,iBAAiB;;EAEtE,MAAM,IAAI,KAAa,OAA+B;AACrD,SAAM,YAAY,IACjB,UAAU,IAAI,EACd,MAAM,yBAAyB,UAAU,KAAK,OAAO,QAAQ,MAAM,SAAS,CAC5E;;EAEF,OAAO,KAA+B;AACrC,UAAO,YAAY,OAAO,UAAU,IAAI,CAAC;;EAE1C,MAAM,KAAK,YAAY,IAAqD;AAC3E,oBAAiB,aAAa,IAAI;GAClC,MAAM,SAAS,MAAM,YAAY,YAAY,GAAG,SAAS,YAAY;GACrE,MAAM,SAAiD,EAAE;AACzD,QAAK,MAAM,CAAC,SAAS,UAAU,QAAQ;IACtC,MAAM,MAAM,QAAQ,MAAM,OAAO,OAAO;AACxC,WAAO,KAAK;KACX;KACA,OAAO,MAAM,yBAAyB,UAAU,KAAK,OAAO,QAAQ,MAAM,SAAS;KACnF,CAAC;;AAEH,UAAO;;EAER;;;;;;AC9QF,MAAM,2BAA2B;;AAkBjC,MAAM,kBAAkB;;AAGxB,MAAM,sBAAsB,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC;AAEtD,SAAS,8BAA8B,OAAkD;AACxF,QACC,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAQ,MAAM,IACrB,aAAa,SACb,MAAM,YAAY;;AAIpB,eAAe,6BACd,UACA,KACA,OACA,gBACmB;AACnB,KAAI,yBAAyB,MAAM,CAClC,QAAO,qBAAqB,UAAU,KAAK,OAAO,eAAe;AAElE,KAAI,8BAA8B,MAAM,CACvC,OAAM,IAAI,6BACT,oCACA,0DACA;AAEF,QAAO;;AA8BR,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,OAAO,IAAI,2BAA2B;AACtE,MAAM,IAAI;AACV,MAAM,gBAEJ,EAAE,mCACI;CACN,MAAM,IAAuB;EAC5B,UAAU;EACV,WAAW;EACX,YAAY;EACZ,mBAAmB;EACnB,SAAS,yBAA6C;EACtD;AACD,GAAE,2BAA2B;AAC7B,QAAO;IACJ;;AAGL,SAAgB,2BAAsD;AACrE,QAAO,cAAc;;;AAItB,SAAgB,iCAAuC;AACtD,eAAc;AACd,eAAc,WAAW;AACzB,eAAc,YAAY;AAC1B,eAAc,oBAAoB;AAClC,6BAA4B,cAAc,QAAQ;;;;;;;;;AAUnD,SAAgB,8BAAoC;AACnD,iCAAgC;AAEhC,uBAAsB,yBAAyB;;;;;AAMhD,SAAS,iBAAiB,OAAyC;AAClE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa;;;;;;;;;;AAWpE,eAAe,sBACd,UACA,IACA,UACsC;AACtC,KAAI,CAAC,UAAU,QACd,QAAO;AAGR,KAAI;EAEH,MAAM,QAAQ,MADI,IAAI,gBAAgB,GAAG,CACX,SAAS,SAAS,QAAQ;AAExD,MAAI,MAEH,QAAO;GACN,GAAG;GACH,KAAK,2BAA2B,MAAM;GACtC,aAAa,MAAM;GACnB,GAAI,MAAM,UAAU,OAAO,EAAE,OAAO,MAAM,OAAO,GAAG,EAAE;GACtD,GAAI,MAAM,WAAW,OAAO,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;GACzD;SAEK;AAIR,QAAO;;;;;;;;;;;;;;;;;;;;AAqBR,eAAsB,eACrB,KACuC;CAOvC,MAAM,SAAS,iBAAwC,eAAe;AACtE,KAAI,OAEH,SADiB,MAAM,QACP;AAKjB,QAAO,cAAc,eAAe,OAAO,YAAY;AAEtD,SAAO,qBAAqB,KADjB,MAAM,OAAO,CACY;GACnC;;;;;;;;AASH,eAAsB,qBACrB,KACA,IACA,UAA0B,MACa;CAEvC,MAAM,QAAQ,MADE,IAAI,kBAAkB,GAAG,CACb,IAAqB,GAAG,kBAAkB,MAAM;AAE5E,KAAI,CAAC,MACJ;AAMD,MAAK,QAAQ,UAAU,QAAQ,cAAc,iBAAiB,MAAM,CAGnE,QAFiB,MAAM,sBAAsB,OAAO,IAAI,QAAQ;AAKjE,KAAI,QAAQ,SAAS,SAAS,OAAO,UAAU,UAAU;EAExD,MAAM,MAAM;AACZ,MAAI,IAAI,eAMP,QALiB;GAChB,GAAG;GACH,gBAAgB,MAAM,sBAAsB,IAAI,gBAAgB,IAAI,QAAQ;GAC5E;;AAMH,QAAO;;AAGR,SAAS,sBAAmD;AAC3D,QAAO,mBACN,cAAc,eAEb,YAAY;EACX,WAAW;EACX,KAAK;EACL,MAAM,YAAY,yBAAyB,MAAM,OAAO,CAAC;EACzD,CAAC,EACH;EAAE,SAAS,YAAY,YAAY,QAAQ;EAAE,gBAAgB;EAAQ,CACrE;;AAGF,SAAS,oBAAoB,UAAoC;AAChE,eAAc,WAAW;AACzB,eAAc,YAAY,KAAK,KAAK,GAAG;;AAGxC,SAAS,yBAA+B;CACvC,MAAM,MAAM,KAAK,KAAK;AACtB,KAAI,cAAc,oBAAoB,IAAK;AAC3C,eAAc,oBAAoB,MAAM;CACxC,MAAM,aAAa,EAAE,cAAc;AACnC,6BAA4B,cAAc,QAAQ;AAClD,OAAM,YAAY;AACjB,MAAI;GACH,MAAM,WAAW,MAAM,qBAAqB;AAC5C,OAAI,eAAe,cAAc,WAAY,qBAAoB,SAAS;WAClE,OAAO;AACf,WAAQ,MAAM,wDAAwD,MAAM;;GAE5E;;AAGH,eAAe,yBAAsD;AACpE,MAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW;EAC7C,MAAM,WAAW,cAAc;AAC/B,MAAI,UAAU;AACb,OAAI,KAAK,KAAK,IAAI,cAAc,UAAW,yBAAwB;AACnE,UAAO;;EAER,MAAM,aAAa,cAAc;EACjC,MAAM,SAAS,MAAM,qBAAqB;AAC1C,MAAI,eAAe,cAAc,YAAY;AAC5C,uBAAoB,OAAO;AAC3B,UAAO;;AAER,MAAI,YAAY,EAAG,QAAO;;AAE3B,OAAM,IAAI,MAAM,2DAA2D;;;;;;;;;;;;;;;;;AAkB5E,SAAgB,kBAAkD;AACjE,QAAO,cAAc,gBAAgB,YAAY;AAgBhD,UAfiB,MAAM,cAAc,wBAAwB,YAAY;GACxE,MAAM,MAAM,mBAAmB;GAC/B,MAAM,kBAAkB,KAAK;AAC7B,OAAI,KAAK,eAAgB,QAAO,yBAAyB,MAAM,OAAO,CAAC;GACvE,IAAI,SAAS,iBAAiB,YAAa,MAAM,wBAAwB;AAGzE,OAAI,iBAAiB,YAAY,UAAa,OAAO,YAAY,gBAAgB,SAAS;AACzF,oCAAgC;IAChC,MAAM,aAAa,cAAc;AACjC,aAAS,MAAM,yBAAyB,MAAM,OAAO,CAAC;AACtD,QAAI,eAAe,cAAc,WAAY,qBAAoB,OAAO;;AAEzE,UAAO;IACN,EACc;GACf,CAAC,KAAK,OAAO,SAAS;EACvB,MAAM,WAAW,MAAM,iBAAqC,uBAAuB;AACnF,MAAI,SAAU,oBAAmB,EAAE,cAAc,OAAO,SAAS,QAAQ;AACzE,SAAO;GACN;;;;;;;;AASH,eAAsB,+BAGnB;AAEF,QAAO;EAAE,MADI,MAAM,iBAAiB;EACrB,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE;EAAE;;;;;;;;AAS1D,eAAsB,sBACrB,IACA,UAA0B,MACO;AACjC,SAAQ,MAAM,yBAAyB,IAAI,QAAQ,EAAE;;AAGtD,eAAe,yBACd,IACA,UAA0B,MACI;CAE9B,MAAM,aAAa,MADH,IAAI,kBAAkB,GAAG,CACR,qBAAqB,gBAAgB;CACtE,MAAM,UAAU,6BACf,KAAK,UACJ,CAAC,GAAG,WAAW,CACb,QAAQ,CAAC,SAAS,IAAI,WAAW,gBAAgB,CAAC,CAClD,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,MAAM,SAAS,CAAC,CAC9C,CACD;CACD,MAAM,WAAoC,EAAE;AAE5C,MAAK,MAAM,CAAC,KAAK,UAAU,YAAY;EACtC,MAAM,aAAa,IAAI,QAAQ,iBAAiB,GAAG;AACnD,WAAS,cAAc,MAAM;;CAG9B,MAAM,gBAAgB;AAGtB,KAAI,cAAc,KACjB,eAAc,OAAO,MAAM,sBAAsB,cAAc,MAAM,IAAI,QAAQ;AAElF,KAAI,cAAc,QACjB,eAAc,UAAU,MAAM,sBAAsB,cAAc,SAAS,IAAI,QAAQ;AAExF,KAAI,cAAc,KAAK,eACtB,eAAc,MAAM;EACnB,GAAG,cAAc;EACjB,gBAAgB,MAAM,sBAAsB,cAAc,IAAI,gBAAgB,IAAI,QAAQ;EAC1F;AAGF,QAAO;EAAE,MAAM;EAAe;EAAS;;;;;;;;;;;;;;;;;;;;;;;;;AA0BxC,eAAsB,gBACrB,UACA,IACgB;CAChB,MAAM,UAAmC,EAAE;CAC3C,MAAM,YAAsB,EAAE;CAC9B,MAAM,gBAAiE,EAAE;AAEzE,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,EAAE;AACpD,MAAI,UAAU,OAAW;AACzB,MAAI,UAAU,KAAM,WAAU,KAAK,GAAG,kBAAkB,MAAM;WACrD,oBAAoB,IAAI,IAAI,IAAI,SAAS,MAAM,CAAE,eAAc,KAAK,CAAC,KAAK,MAAM,CAAC;MACrF,SAAQ,GAAG,kBAAkB,SAAS;;AAG5C,KAAI,OAAO,KAAK,QAAQ,CAAC,WAAW,KAAK,UAAU,WAAW,KAAK,cAAc,WAAW,EAC3F;AAGD,KAAI;AACH,QAAM,gBAAgB,IAAI,OAAO,QAAQ;GACxC,MAAM,qBAAqB,IAAI,kBAAkB,IAAI;AACrD,SAAM,mBAAmB,QAAQ,QAAQ;AACzC,SAAM,mBAAmB,WAAW,UAAU;AAE9C,QAAK,MAAM,CAAC,KAAK,UAAU,eAAe;IACzC,MAAM,aAAa,GAAG,kBAAkB;IACxC,MAAM,OAAO,EAAE,GAAI,MAAM,mBAAmB,IAA6B,WAAW,EAAG;AACvF,SAAK,MAAM,CAAC,OAAO,eAAe,OAAO,QAAQ,MAAM,CACtD,KAAI,eAAe,KAAM,QAAO,KAAK;aAC5B,eAAe,OAAW,MAAK,SAAS;AAElD,QAAI,OAAO,KAAK,KAAK,CAAC,WAAW,EAAG,OAAM,mBAAmB,OAAO,WAAW;QAC1E,OAAM,mBAAmB,IAAI,YAAY,KAAK;;AAUpD,OAAI;AACH,UAAM,6BAA6B,IAAI;YAC/B,OAAO;AACf,QAAI,oBAAoB,MAAM,CAAE;AAChC,UAAM;;IAEN;WACO;AACT,+BAA6B;;;;;;;;;AAU/B,eAAsB,iBACrB,UACA,KACyB;AAEzB,QAAO,uBAA0B,UAAU,KADhC,MAAM,OAAO,CAC2B;;;;;;;AAQpD,eAAsB,uBACrB,UACA,KACA,IACyB;CAEzB,MAAM,QAAQ,MADE,IAAI,kBAAkB,GAAG,CACb,IAAI,UAAU,SAAS,YAAY,MAAM;AACrE,KAAI,UAAU,KAAM,QAAO;AAE3B,QAAQ,MAAM,6BAA6B,UAAU,KAAK,MAAM;;;;;;;;AASjE,eAAsB,kBAAkB,UAAoD;AAE3F,QAAO,wBAAwB,UADpB,MAAM,OAAO,CACoB;;;;;;;AAQ7C,eAAsB,wBACrB,UACA,IACmC;CACnC,MAAM,SAAS,UAAU,SAAS;CAIlC,MAAM,UAAU,CAAC,GAFE,MADH,IAAI,kBAAkB,GAAG,CACR,YAAY,OAAO,CAErB,CAAC,QAAQ,CAAC,SAAS,IAAI,WAAW,OAAO,CAAC;CACzE,MAAM,iBAAiB,QAAQ,MAAM,GAAG,WAAW,yBAAyB,MAAM,CAAC,GAChF,MAAM,6BAA6B,GACnC;AACH,QAAO,OAAO,YACb,MAAM,QAAQ,IACb,QAAQ,IAAI,OAAO,CAAC,WAAW,WAAW;EACzC,MAAM,MAAM,UAAU,MAAM,OAAO,OAAO;AAC1C,SAAO,CACN,KACA,MAAM,6BAA6B,UAAU,KAAK,OAAO,eAAe,CACxE;GACA,CACF,CACD"}

package/dist/{setup-complete-BuNxAUiN.mjs → setup-complete-qsJYWutC.mjs}

@@ -1,4 +1,4 @@
-import { u as isPostgres } from "./dialect-helpers-7_IqPdh9.mjs";
+import { u as isPostgres } from "./dialect-helpers-B1XN2HGB.mjs";
 import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
@@ -62,4 +62,4 @@ async function finalizeSetup(db) {
 
 //#endregion
 export { finalizeSetup as n, createFirstAdmin as t };
-//# sourceMappingURL=setup-complete-BuNxAUiN.mjs.map
+//# sourceMappingURL=setup-complete-qsJYWutC.mjs.map

package/dist/{setup-complete-BuNxAUiN.mjs.map → setup-complete-qsJYWutC.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-complete-BuNxAUiN.mjs","names":[],"sources":["../src/api/setup-complete.ts"],"sourcesContent":["/**\n * Shared setup completion logic.\n *\n * Called by OAuth callbacks and the passkey verify step when the first user\n * is created during setup. Persists site title/tagline from setup state\n * and marks setup as complete.\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { sql, type Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { isPostgres } from \"../database/dialect-helpers.js\";\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\n\nexport const FIRST_ADMIN_LOCK_KEY = 1_168_624_764;\n\nexport interface FirstAdmin {\n\tid: string;\n\temail: string;\n\tname: string | null;\n\trole: typeof Role.ADMIN;\n}\n\n/**\n * Create the first admin only while the users table is empty.\n *\n * Returns null when a user already exists, including one created by a\n * concurrent call after the caller's own zero-users check. On Postgres the\n * insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see\n * another transaction's uncommitted row under READ COMMITTED.\n */\nexport async function createFirstAdmin(\n\tdb: Kysely<Database>,\n\tinput: { email: string; name: string | null },\n): Promise<FirstAdmin | null> {\n\tconst admin: FirstAdmin = {\n\t\tid: ulid(),\n\t\temail: input.email.toLowerCase(),\n\t\tname: input.name,\n\t\trole: Role.ADMIN,\n\t};\n\tconst now = new Date().toISOString();\n\tconst insert = async (executor: Kysely<Database>) =>\n\t\tsql<{ id: string }>`\n\t\t\tINSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)\n\t\t\tSELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}\n\t\t\tWHERE NOT EXISTS (SELECT 1 FROM users)\n\t\t\tRETURNING id\n\t\t`.execute(executor);\n\n\tconst result = isPostgres(db)\n\t\t? await db.transaction().execute(async (trx) => {\n\t\t\t\tawait sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);\n\t\t\t\treturn insert(trx);\n\t\t\t})\n\t\t: await insert(db);\n\treturn result.rows.length > 0 ? admin : null;\n}\n\n/**\n * Finalize setup after the first admin user is created.\n *\n * Reads the setup_state option (written by the setup wizard's step 1),\n * persists site_title and site_tagline, then marks setup complete.\n *\n * Safe to call multiple times — checks setup_complete first and no-ops\n * if already done.\n */\nexport async function finalizeSetup(db: Kysely<Database>): Promise<void> {\n\tconst options = new OptionsRepository(db);\n\n\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\tif (setupComplete === true || setupComplete === \"true\") return;\n\n\t// Persist site title/tagline from setup state (stored in step 1)\n\tconst setupState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\tif (setupState?.title && typeof setupState.title === \"string\") {\n\t\tawait options.set(\"emdash:site_title\", setupState.title);\n\t}\n\tif (setupState?.tagline && typeof setupState.tagline === \"string\") {\n\t\tawait options.set(\"emdash:site_tagline\", setupState.tagline);\n\t}\n\n\tawait options.set(\"emdash:setup_complete\", true);\n\tawait options.delete(\"emdash:setup_state\");\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAa,uBAAuB;;;;;;;;;AAiBpC,eAAsB,iBACrB,IACA,OAC6B;CAC7B,MAAM,QAAoB;EACzB,IAAI,MAAM;EACV,OAAO,MAAM,MAAM,aAAa;EAChC,MAAM,MAAM;EACZ,MAAM,KAAK;EACX;CACD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CACpC,MAAM,SAAS,OAAO,aACrB,GAAmB;;YAET,MAAM,GAAG,IAAI,MAAM,MAAM,IAAI,MAAM,KAAK,SAAS,MAAM,KAAK,mBAAmB,IAAI,IAAI,IAAI;;;IAGnG,QAAQ,SAAS;AAQpB,SANe,WAAW,GAAG,GAC1B,MAAM,GAAG,aAAa,CAAC,QAAQ,OAAO,QAAQ;AAC9C,QAAM,GAAG,gCAAgC,qBAAqB,GAAG,QAAQ,IAAI;AAC7E,SAAO,OAAO,IAAI;GACjB,GACD,MAAM,OAAO,GAAG,EACL,KAAK,SAAS,IAAI,QAAQ;;;;;;;;;;;AAYzC,eAAsB,cAAc,IAAqC;CACxE,MAAM,UAAU,IAAI,kBAAkB,GAAG;CAEzC,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAChE,KAAI,kBAAkB,QAAQ,kBAAkB,OAAQ;CAGxD,MAAM,aAAa,MAAM,QAAQ,IAA6B,qBAAqB;AACnF,KAAI,YAAY,SAAS,OAAO,WAAW,UAAU,SACpD,OAAM,QAAQ,IAAI,qBAAqB,WAAW,MAAM;AAEzD,KAAI,YAAY,WAAW,OAAO,WAAW,YAAY,SACxD,OAAM,QAAQ,IAAI,uBAAuB,WAAW,QAAQ;AAG7D,OAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,OAAM,QAAQ,OAAO,qBAAqB"}
+{"version":3,"file":"setup-complete-qsJYWutC.mjs","names":[],"sources":["../src/api/setup-complete.ts"],"sourcesContent":["/**\n * Shared setup completion logic.\n *\n * Called by OAuth callbacks and the passkey verify step when the first user\n * is created during setup. Persists site title/tagline from setup state\n * and marks setup as complete.\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { sql, type Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { isPostgres } from \"../database/dialect-helpers.js\";\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\n\nexport const FIRST_ADMIN_LOCK_KEY = 1_168_624_764;\n\nexport interface FirstAdmin {\n\tid: string;\n\temail: string;\n\tname: string | null;\n\trole: typeof Role.ADMIN;\n}\n\n/**\n * Create the first admin only while the users table is empty.\n *\n * Returns null when a user already exists, including one created by a\n * concurrent call after the caller's own zero-users check. On Postgres the\n * insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see\n * another transaction's uncommitted row under READ COMMITTED.\n */\nexport async function createFirstAdmin(\n\tdb: Kysely<Database>,\n\tinput: { email: string; name: string | null },\n): Promise<FirstAdmin | null> {\n\tconst admin: FirstAdmin = {\n\t\tid: ulid(),\n\t\temail: input.email.toLowerCase(),\n\t\tname: input.name,\n\t\trole: Role.ADMIN,\n\t};\n\tconst now = new Date().toISOString();\n\tconst insert = async (executor: Kysely<Database>) =>\n\t\tsql<{ id: string }>`\n\t\t\tINSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)\n\t\t\tSELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}\n\t\t\tWHERE NOT EXISTS (SELECT 1 FROM users)\n\t\t\tRETURNING id\n\t\t`.execute(executor);\n\n\tconst result = isPostgres(db)\n\t\t? await db.transaction().execute(async (trx) => {\n\t\t\t\tawait sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);\n\t\t\t\treturn insert(trx);\n\t\t\t})\n\t\t: await insert(db);\n\treturn result.rows.length > 0 ? admin : null;\n}\n\n/**\n * Finalize setup after the first admin user is created.\n *\n * Reads the setup_state option (written by the setup wizard's step 1),\n * persists site_title and site_tagline, then marks setup complete.\n *\n * Safe to call multiple times — checks setup_complete first and no-ops\n * if already done.\n */\nexport async function finalizeSetup(db: Kysely<Database>): Promise<void> {\n\tconst options = new OptionsRepository(db);\n\n\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\tif (setupComplete === true || setupComplete === \"true\") return;\n\n\t// Persist site title/tagline from setup state (stored in step 1)\n\tconst setupState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\tif (setupState?.title && typeof setupState.title === \"string\") {\n\t\tawait options.set(\"emdash:site_title\", setupState.title);\n\t}\n\tif (setupState?.tagline && typeof setupState.tagline === \"string\") {\n\t\tawait options.set(\"emdash:site_tagline\", setupState.tagline);\n\t}\n\n\tawait options.set(\"emdash:setup_complete\", true);\n\tawait options.delete(\"emdash:setup_state\");\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAa,uBAAuB;;;;;;;;;AAiBpC,eAAsB,iBACrB,IACA,OAC6B;CAC7B,MAAM,QAAoB;EACzB,IAAI,MAAM;EACV,OAAO,MAAM,MAAM,aAAa;EAChC,MAAM,MAAM;EACZ,MAAM,KAAK;EACX;CACD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CACpC,MAAM,SAAS,OAAO,aACrB,GAAmB;;YAET,MAAM,GAAG,IAAI,MAAM,MAAM,IAAI,MAAM,KAAK,SAAS,MAAM,KAAK,mBAAmB,IAAI,IAAI,IAAI;;;IAGnG,QAAQ,SAAS;AAQpB,SANe,WAAW,GAAG,GAC1B,MAAM,GAAG,aAAa,CAAC,QAAQ,OAAO,QAAQ;AAC9C,QAAM,GAAG,gCAAgC,qBAAqB,GAAG,QAAQ,IAAI;AAC7E,SAAO,OAAO,IAAI;GACjB,GACD,MAAM,OAAO,GAAG,EACL,KAAK,SAAS,IAAI,QAAQ;;;;;;;;;;;AAYzC,eAAsB,cAAc,IAAqC;CACxE,MAAM,UAAU,IAAI,kBAAkB,GAAG;CAEzC,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAChE,KAAI,kBAAkB,QAAQ,kBAAkB,OAAQ;CAGxD,MAAM,aAAa,MAAM,QAAQ,IAA6B,qBAAqB;AACnF,KAAI,YAAY,SAAS,OAAO,WAAW,UAAU,SACpD,OAAM,QAAQ,IAAI,qBAAqB,WAAW,MAAM;AAEzD,KAAI,YAAY,WAAW,OAAO,WAAW,YAAY,SACxD,OAAM,QAAQ,IAAI,uBAAuB,WAAW,QAAQ;AAG7D,OAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,OAAM,QAAQ,OAAO,qBAAqB"}

package/dist/{setup-nonce-BnEAX0iy.mjs → setup-nonce-CBFgUFXw.mjs}

@@ -22,4 +22,4 @@ const SETUP_NONCE_MAX_AGE_SECONDS = 3600;
 
 //#endregion
 export { SETUP_NONCE_MAX_AGE_SECONDS as n, SETUP_NONCE_COOKIE as t };
-//# sourceMappingURL=setup-nonce-BnEAX0iy.mjs.map
+//# sourceMappingURL=setup-nonce-CBFgUFXw.mjs.map

package/dist/{setup-nonce-BnEAX0iy.mjs.map → setup-nonce-CBFgUFXw.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-nonce-BnEAX0iy.mjs","names":[],"sources":["../src/auth/setup-nonce.ts"],"sourcesContent":["/**\n * Session binding for the first-setup admin-creation flow.\n *\n * Shared constants for the nonce cookie that ties /_emdash/api/setup/admin\n * and /_emdash/api/setup/admin/verify to the same browser. Without this\n * binding, any unauthenticated caller could POST /setup/admin during the\n * setup window and substitute their own email into the stored setup state\n * before the legitimate admin completes passkey verification.\n *\n * Implementation lives in the two route handlers; this module is just\n * the name / lifetime so both ends agree.\n */\n\n/** Cookie name carrying the setup-admin session nonce. */\nexport const SETUP_NONCE_COOKIE = \"emdash_setup_nonce\";\n\n/**\n * Cookie max-age in seconds. One hour is plenty of time to complete\n * a passkey registration; if the user lingers longer the admin step\n * can simply be retried.\n */\nexport const SETUP_NONCE_MAX_AGE_SECONDS = 60 * 60;\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,qBAAqB;;;;;;AAOlC,MAAa,8BAA8B"}
+{"version":3,"file":"setup-nonce-CBFgUFXw.mjs","names":[],"sources":["../src/auth/setup-nonce.ts"],"sourcesContent":["/**\n * Session binding for the first-setup admin-creation flow.\n *\n * Shared constants for the nonce cookie that ties /_emdash/api/setup/admin\n * and /_emdash/api/setup/admin/verify to the same browser. Without this\n * binding, any unauthenticated caller could POST /setup/admin during the\n * setup window and substitute their own email into the stored setup state\n * before the legitimate admin completes passkey verification.\n *\n * Implementation lives in the two route handlers; this module is just\n * the name / lifetime so both ends agree.\n */\n\n/** Cookie name carrying the setup-admin session nonce. */\nexport const SETUP_NONCE_COOKIE = \"emdash_setup_nonce\";\n\n/**\n * Cookie max-age in seconds. One hour is plenty of time to complete\n * a passkey registration; if the user lingers longer the admin step\n * can simply be retried.\n */\nexport const SETUP_NONCE_MAX_AGE_SECONDS = 60 * 60;\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,qBAAqB;;;;;;AAOlC,MAAa,8BAA8B"}

package/dist/{site-domain-Bq5j5bVg.mjs → site-domain-oRGS_JfA.mjs}

@@ -1,6 +1,6 @@
 import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
 import { a as encodeBase64url } from "./base64-BQBZwXCx.mjs";
-import { l as setSiteSettings } from "./settings-CWb84sDm.mjs";
+import { d as setSiteSettings } from "./settings-D932YP2-.mjs";
 import { r as resolveAndValidateExternalUrl } from "./ssrf-BcYjyM4M.mjs";
 
 //#region src/api/handlers/site-domain.ts
@@ -128,4 +128,4 @@ async function handleDomainProof(db) {
 
 //#endregion
 export { handleSiteDomainChange as n, handleDomainProof as t };
-//# sourceMappingURL=site-domain-Bq5j5bVg.mjs.map
+//# sourceMappingURL=site-domain-oRGS_JfA.mjs.map

package/dist/{site-domain-Bq5j5bVg.mjs.map → site-domain-oRGS_JfA.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"site-domain-Bq5j5bVg.mjs","names":[],"sources":["../src/api/handlers/site-domain.ts"],"sourcesContent":["/**\n * Site domain handlers\n *\n * Changing the site's domain stores the new origin as the Site URL, which\n * links in emails and plugins, sitemaps, and absolute URLs in search and\n * social metadata use. Before it is stored, EmDash fetches a one-time token\n * from the new domain to prove the domain serves this site.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../../database/repositories/options.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { resolveAndValidateExternalUrl } from \"../../security/ssrf.js\";\nimport { setSiteSettings } from \"../../settings/index.js\";\nimport { encodeBase64url } from \"../../utils/base64.js\";\nimport type { ApiResult } from \"../types.js\";\n\nexport const DOMAIN_PROOF_PATH = \"/_emdash/api/site/domain-proof\";\n\nconst PROOF_OPTION = \"emdash:domain_proof\";\nconst PROOF_TTL_MS = 60_000;\nconst CHECK_TIMEOUT_MS = 10_000;\nconst IPV4_RE = /^\\d{1,3}(\\.\\d{1,3}){3}$/;\n\ninterface DomainProof {\n\ttoken: string;\n\texpiresAt: number;\n}\n\n/**\n * Parse a bare hostname or an `https://` origin into an origin. Paths,\n * ports, credentials, IP addresses, and single-label hosts are rejected.\n */\nexport function parseSiteDomain(input: string): string | undefined {\n\tconst trimmed = input.trim();\n\tconst candidate = trimmed.includes(\"://\") ? trimmed : `https://${trimmed}`;\n\tif (!URL.canParse(candidate)) return undefined;\n\tconst url = new URL(candidate);\n\tif (url.protocol !== \"https:\") return undefined;\n\tif (url.username || url.password || url.port || url.search || url.hash) return undefined;\n\tif (url.pathname !== \"/\") return undefined;\n\tconst host = url.hostname;\n\tif (!host.includes(\".\") || host.endsWith(\".\") || host.startsWith(\"[\") || IPV4_RE.test(host)) {\n\t\treturn undefined;\n\t}\n\treturn url.origin;\n}\n\n/** Why a domain check failed, sent as `error.details` with the addresses its message names. */\ntype DomainCheckFailure =\n\t| { reason: \"NO_PUBLIC_ADDRESS\"; host: string }\n\t| { reason: \"UNREACHABLE\"; origin: string }\n\t| { reason: \"REDIRECT\"; origin: string; target?: string }\n\t| { reason: \"NOT_SERVING\"; origin: string };\n\nfunction checkFailed(message: string, details: DomainCheckFailure): ApiResult<never> {\n\treturn { success: false, error: { code: \"DOMAIN_CHECK_FAILED\", message, details } };\n}\n\n/**\n * Verify that `input` serves this site and store it as the Site URL.\n */\nexport async function handleSiteDomainChange(\n\tdb: Kysely<Database>,\n\tinput: string,\n): Promise<ApiResult<{ url: string }>> {\n\tconst origin = parseSiteDomain(input);\n\tif (!origin) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\tmessage: \"Enter a domain such as example.com, without a path or port\",\n\t\t\t},\n\t\t};\n\t}\n\n\tconst options = new OptionsRepository(db);\n\tconst token = encodeBase64url(crypto.getRandomValues(new Uint8Array(24)));\n\tconst proof: DomainProof = { token, expiresAt: Date.now() + PROOF_TTL_MS };\n\tconst revision = await options.setVersioned(PROOF_OPTION, proof);\n\n\ttry {\n\t\tconst proofUrl = `${origin}${DOMAIN_PROOF_PATH}`;\n\t\ttry {\n\t\t\tawait resolveAndValidateExternalUrl(proofUrl);\n\t\t} catch {\n\t\t\tconst host = new URL(origin).hostname;\n\t\t\treturn checkFailed(`${host} does not resolve to a public address`, {\n\t\t\t\treason: \"NO_PUBLIC_ADDRESS\",\n\t\t\t\thost,\n\t\t\t});\n\t\t}\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(proofUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\theaders: { Accept: \"application/json\", \"X-EmDash-Request\": \"1\" },\n\t\t\t\tsignal: AbortSignal.timeout(CHECK_TIMEOUT_MS),\n\t\t\t});\n\t\t} catch {\n\t\t\treturn checkFailed(`Could not reach ${origin}`, { reason: \"UNREACHABLE\", origin });\n\t\t}\n\n\t\tif (response.status >= 300 && response.status < 400) {\n\t\t\tconst location = response.headers.get(\"Location\");\n\t\t\tconst target =\n\t\t\t\tlocation && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;\n\t\t\treturn target\n\t\t\t\t? checkFailed(`${origin} redirects to ${target.origin}. Enter that address instead.`, {\n\t\t\t\t\t\treason: \"REDIRECT\",\n\t\t\t\t\t\torigin,\n\t\t\t\t\t\ttarget: target.origin,\n\t\t\t\t\t})\n\t\t\t\t: checkFailed(`${origin} redirects elsewhere`, { reason: \"REDIRECT\", origin });\n\t\t}\n\n\t\tconst body: unknown = response.ok ? await response.json().catch(() => null) : null;\n\t\tconst received =\n\t\t\tbody &&\n\t\t\ttypeof body === \"object\" &&\n\t\t\t\"data\" in body &&\n\t\t\tbody.data &&\n\t\t\ttypeof body.data === \"object\"\n\t\t\t\t? (body.data as { token?: unknown }).token\n\t\t\t\t: undefined;\n\t\tif (received !== token) {\n\t\t\treturn checkFailed(`${origin} does not serve this site yet`, {\n\t\t\t\treason: \"NOT_SERVING\",\n\t\t\t\torigin,\n\t\t\t});\n\t\t}\n\n\t\tawait setSiteSettings({ url: origin }, db);\n\t\treturn { success: true, data: { url: origin } };\n\t} finally {\n\t\tawait db\n\t\t\t.deleteFrom(\"options\")\n\t\t\t.where(\"name\", \"=\", PROOF_OPTION)\n\t\t\t.where(\"revision\", \"=\", revision)\n\t\t\t.execute();\n\t}\n}\n\n/**\n * Return the pending domain proof token, if a check is in progress.\n */\nexport async function handleDomainProof(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<{ token: string }>> {\n\tconst proof = await new OptionsRepository(db).get<DomainProof>(PROOF_OPTION);\n\tif (!proof || typeof proof.token !== \"string\" || proof.expiresAt < Date.now()) {\n\t\treturn { success: false, error: { code: \"NOT_FOUND\", message: \"No domain check in progress\" } };\n\t}\n\treturn { success: true, data: { token: proof.token } };\n}\n"],"mappings":";;;;;;AAkBA,MAAa,oBAAoB;AAEjC,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,mBAAmB;AACzB,MAAM,UAAU;;;;;AAWhB,SAAgB,gBAAgB,OAAmC;CAClE,MAAM,UAAU,MAAM,MAAM;CAC5B,MAAM,YAAY,QAAQ,SAAS,MAAM,GAAG,UAAU,WAAW;AACjE,KAAI,CAAC,IAAI,SAAS,UAAU,CAAE,QAAO;CACrC,MAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,KAAI,IAAI,aAAa,SAAU,QAAO;AACtC,KAAI,IAAI,YAAY,IAAI,YAAY,IAAI,QAAQ,IAAI,UAAU,IAAI,KAAM,QAAO;AAC/E,KAAI,IAAI,aAAa,IAAK,QAAO;CACjC,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,QAAQ,KAAK,KAAK,CAC1F;AAED,QAAO,IAAI;;AAUZ,SAAS,YAAY,SAAiB,SAA+C;AACpF,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAuB;GAAS;GAAS;EAAE;;;;;AAMpF,eAAsB,uBACrB,IACA,OACsC;CACtC,MAAM,SAAS,gBAAgB,MAAM;AACrC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;CAGF,MAAM,UAAU,IAAI,kBAAkB,GAAG;CACzC,MAAM,QAAQ,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC,CAAC;CACzE,MAAM,QAAqB;EAAE;EAAO,WAAW,KAAK,KAAK,GAAG;EAAc;CAC1E,MAAM,WAAW,MAAM,QAAQ,aAAa,cAAc,MAAM;AAEhE,KAAI;EACH,MAAM,WAAW,GAAG,SAAS;AAC7B,MAAI;AACH,SAAM,8BAA8B,SAAS;UACtC;GACP,MAAM,OAAO,IAAI,IAAI,OAAO,CAAC;AAC7B,UAAO,YAAY,GAAG,KAAK,wCAAwC;IAClE,QAAQ;IACR;IACA,CAAC;;EAGH,IAAI;AACJ,MAAI;AACH,cAAW,MAAM,MAAM,UAAU;IAChC,QAAQ;IACR,UAAU;IACV,SAAS;KAAE,QAAQ;KAAoB,oBAAoB;KAAK;IAChE,QAAQ,YAAY,QAAQ,iBAAiB;IAC7C,CAAC;UACK;AACP,UAAO,YAAY,mBAAmB,UAAU;IAAE,QAAQ;IAAe;IAAQ,CAAC;;AAGnF,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;GACpD,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;GACjD,MAAM,SACL,YAAY,IAAI,SAAS,UAAU,SAAS,GAAG,IAAI,IAAI,UAAU,SAAS,GAAG;AAC9E,UAAO,SACJ,YAAY,GAAG,OAAO,gBAAgB,OAAO,OAAO,gCAAgC;IACpF,QAAQ;IACR;IACA,QAAQ,OAAO;IACf,CAAC,GACD,YAAY,GAAG,OAAO,uBAAuB;IAAE,QAAQ;IAAY;IAAQ,CAAC;;EAGhF,MAAM,OAAgB,SAAS,KAAK,MAAM,SAAS,MAAM,CAAC,YAAY,KAAK,GAAG;AAS9E,OAPC,QACA,OAAO,SAAS,YAChB,UAAU,QACV,KAAK,QACL,OAAO,KAAK,SAAS,WACjB,KAAK,KAA6B,QACnC,YACa,MAChB,QAAO,YAAY,GAAG,OAAO,gCAAgC;GAC5D,QAAQ;GACR;GACA,CAAC;AAGH,QAAM,gBAAgB,EAAE,KAAK,QAAQ,EAAE,GAAG;AAC1C,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,KAAK,QAAQ;GAAE;WACtC;AACT,QAAM,GACJ,WAAW,UAAU,CACrB,MAAM,QAAQ,KAAK,aAAa,CAChC,MAAM,YAAY,KAAK,SAAS,CAChC,SAAS;;;;;;AAOb,eAAsB,kBACrB,IACwC;CACxC,MAAM,QAAQ,MAAM,IAAI,kBAAkB,GAAG,CAAC,IAAiB,aAAa;AAC5E,KAAI,CAAC,SAAS,OAAO,MAAM,UAAU,YAAY,MAAM,YAAY,KAAK,KAAK,CAC5E,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAa,SAAS;GAA+B;EAAE;AAEhG,QAAO;EAAE,SAAS;EAAM,MAAM,EAAE,OAAO,MAAM,OAAO;EAAE"}
+{"version":3,"file":"site-domain-oRGS_JfA.mjs","names":[],"sources":["../src/api/handlers/site-domain.ts"],"sourcesContent":["/**\n * Site domain handlers\n *\n * Changing the site's domain stores the new origin as the Site URL, which\n * links in emails and plugins, sitemaps, and absolute URLs in search and\n * social metadata use. Before it is stored, EmDash fetches a one-time token\n * from the new domain to prove the domain serves this site.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../../database/repositories/options.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { resolveAndValidateExternalUrl } from \"../../security/ssrf.js\";\nimport { setSiteSettings } from \"../../settings/index.js\";\nimport { encodeBase64url } from \"../../utils/base64.js\";\nimport type { ApiResult } from \"../types.js\";\n\nexport const DOMAIN_PROOF_PATH = \"/_emdash/api/site/domain-proof\";\n\nconst PROOF_OPTION = \"emdash:domain_proof\";\nconst PROOF_TTL_MS = 60_000;\nconst CHECK_TIMEOUT_MS = 10_000;\nconst IPV4_RE = /^\\d{1,3}(\\.\\d{1,3}){3}$/;\n\ninterface DomainProof {\n\ttoken: string;\n\texpiresAt: number;\n}\n\n/**\n * Parse a bare hostname or an `https://` origin into an origin. Paths,\n * ports, credentials, IP addresses, and single-label hosts are rejected.\n */\nexport function parseSiteDomain(input: string): string | undefined {\n\tconst trimmed = input.trim();\n\tconst candidate = trimmed.includes(\"://\") ? trimmed : `https://${trimmed}`;\n\tif (!URL.canParse(candidate)) return undefined;\n\tconst url = new URL(candidate);\n\tif (url.protocol !== \"https:\") return undefined;\n\tif (url.username || url.password || url.port || url.search || url.hash) return undefined;\n\tif (url.pathname !== \"/\") return undefined;\n\tconst host = url.hostname;\n\tif (!host.includes(\".\") || host.endsWith(\".\") || host.startsWith(\"[\") || IPV4_RE.test(host)) {\n\t\treturn undefined;\n\t}\n\treturn url.origin;\n}\n\n/** Why a domain check failed, sent as `error.details` with the addresses its message names. */\ntype DomainCheckFailure =\n\t| { reason: \"NO_PUBLIC_ADDRESS\"; host: string }\n\t| { reason: \"UNREACHABLE\"; origin: string }\n\t| { reason: \"REDIRECT\"; origin: string; target?: string }\n\t| { reason: \"NOT_SERVING\"; origin: string };\n\nfunction checkFailed(message: string, details: DomainCheckFailure): ApiResult<never> {\n\treturn { success: false, error: { code: \"DOMAIN_CHECK_FAILED\", message, details } };\n}\n\n/**\n * Verify that `input` serves this site and store it as the Site URL.\n */\nexport async function handleSiteDomainChange(\n\tdb: Kysely<Database>,\n\tinput: string,\n): Promise<ApiResult<{ url: string }>> {\n\tconst origin = parseSiteDomain(input);\n\tif (!origin) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\tmessage: \"Enter a domain such as example.com, without a path or port\",\n\t\t\t},\n\t\t};\n\t}\n\n\tconst options = new OptionsRepository(db);\n\tconst token = encodeBase64url(crypto.getRandomValues(new Uint8Array(24)));\n\tconst proof: DomainProof = { token, expiresAt: Date.now() + PROOF_TTL_MS };\n\tconst revision = await options.setVersioned(PROOF_OPTION, proof);\n\n\ttry {\n\t\tconst proofUrl = `${origin}${DOMAIN_PROOF_PATH}`;\n\t\ttry {\n\t\t\tawait resolveAndValidateExternalUrl(proofUrl);\n\t\t} catch {\n\t\t\tconst host = new URL(origin).hostname;\n\t\t\treturn checkFailed(`${host} does not resolve to a public address`, {\n\t\t\t\treason: \"NO_PUBLIC_ADDRESS\",\n\t\t\t\thost,\n\t\t\t});\n\t\t}\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(proofUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\theaders: { Accept: \"application/json\", \"X-EmDash-Request\": \"1\" },\n\t\t\t\tsignal: AbortSignal.timeout(CHECK_TIMEOUT_MS),\n\t\t\t});\n\t\t} catch {\n\t\t\treturn checkFailed(`Could not reach ${origin}`, { reason: \"UNREACHABLE\", origin });\n\t\t}\n\n\t\tif (response.status >= 300 && response.status < 400) {\n\t\t\tconst location = response.headers.get(\"Location\");\n\t\t\tconst target =\n\t\t\t\tlocation && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;\n\t\t\treturn target\n\t\t\t\t? checkFailed(`${origin} redirects to ${target.origin}. Enter that address instead.`, {\n\t\t\t\t\t\treason: \"REDIRECT\",\n\t\t\t\t\t\torigin,\n\t\t\t\t\t\ttarget: target.origin,\n\t\t\t\t\t})\n\t\t\t\t: checkFailed(`${origin} redirects elsewhere`, { reason: \"REDIRECT\", origin });\n\t\t}\n\n\t\tconst body: unknown = response.ok ? await response.json().catch(() => null) : null;\n\t\tconst received =\n\t\t\tbody &&\n\t\t\ttypeof body === \"object\" &&\n\t\t\t\"data\" in body &&\n\t\t\tbody.data &&\n\t\t\ttypeof body.data === \"object\"\n\t\t\t\t? (body.data as { token?: unknown }).token\n\t\t\t\t: undefined;\n\t\tif (received !== token) {\n\t\t\treturn checkFailed(`${origin} does not serve this site yet`, {\n\t\t\t\treason: \"NOT_SERVING\",\n\t\t\t\torigin,\n\t\t\t});\n\t\t}\n\n\t\tawait setSiteSettings({ url: origin }, db);\n\t\treturn { success: true, data: { url: origin } };\n\t} finally {\n\t\tawait db\n\t\t\t.deleteFrom(\"options\")\n\t\t\t.where(\"name\", \"=\", PROOF_OPTION)\n\t\t\t.where(\"revision\", \"=\", revision)\n\t\t\t.execute();\n\t}\n}\n\n/**\n * Return the pending domain proof token, if a check is in progress.\n */\nexport async function handleDomainProof(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<{ token: string }>> {\n\tconst proof = await new OptionsRepository(db).get<DomainProof>(PROOF_OPTION);\n\tif (!proof || typeof proof.token !== \"string\" || proof.expiresAt < Date.now()) {\n\t\treturn { success: false, error: { code: \"NOT_FOUND\", message: \"No domain check in progress\" } };\n\t}\n\treturn { success: true, data: { token: proof.token } };\n}\n"],"mappings":";;;;;;AAkBA,MAAa,oBAAoB;AAEjC,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,mBAAmB;AACzB,MAAM,UAAU;;;;;AAWhB,SAAgB,gBAAgB,OAAmC;CAClE,MAAM,UAAU,MAAM,MAAM;CAC5B,MAAM,YAAY,QAAQ,SAAS,MAAM,GAAG,UAAU,WAAW;AACjE,KAAI,CAAC,IAAI,SAAS,UAAU,CAAE,QAAO;CACrC,MAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,KAAI,IAAI,aAAa,SAAU,QAAO;AACtC,KAAI,IAAI,YAAY,IAAI,YAAY,IAAI,QAAQ,IAAI,UAAU,IAAI,KAAM,QAAO;AAC/E,KAAI,IAAI,aAAa,IAAK,QAAO;CACjC,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,QAAQ,KAAK,KAAK,CAC1F;AAED,QAAO,IAAI;;AAUZ,SAAS,YAAY,SAAiB,SAA+C;AACpF,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAuB;GAAS;GAAS;EAAE;;;;;AAMpF,eAAsB,uBACrB,IACA,OACsC;CACtC,MAAM,SAAS,gBAAgB,MAAM;AACrC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;CAGF,MAAM,UAAU,IAAI,kBAAkB,GAAG;CACzC,MAAM,QAAQ,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC,CAAC;CACzE,MAAM,QAAqB;EAAE;EAAO,WAAW,KAAK,KAAK,GAAG;EAAc;CAC1E,MAAM,WAAW,MAAM,QAAQ,aAAa,cAAc,MAAM;AAEhE,KAAI;EACH,MAAM,WAAW,GAAG,SAAS;AAC7B,MAAI;AACH,SAAM,8BAA8B,SAAS;UACtC;GACP,MAAM,OAAO,IAAI,IAAI,OAAO,CAAC;AAC7B,UAAO,YAAY,GAAG,KAAK,wCAAwC;IAClE,QAAQ;IACR;IACA,CAAC;;EAGH,IAAI;AACJ,MAAI;AACH,cAAW,MAAM,MAAM,UAAU;IAChC,QAAQ;IACR,UAAU;IACV,SAAS;KAAE,QAAQ;KAAoB,oBAAoB;KAAK;IAChE,QAAQ,YAAY,QAAQ,iBAAiB;IAC7C,CAAC;UACK;AACP,UAAO,YAAY,mBAAmB,UAAU;IAAE,QAAQ;IAAe;IAAQ,CAAC;;AAGnF,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;GACpD,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;GACjD,MAAM,SACL,YAAY,IAAI,SAAS,UAAU,SAAS,GAAG,IAAI,IAAI,UAAU,SAAS,GAAG;AAC9E,UAAO,SACJ,YAAY,GAAG,OAAO,gBAAgB,OAAO,OAAO,gCAAgC;IACpF,QAAQ;IACR;IACA,QAAQ,OAAO;IACf,CAAC,GACD,YAAY,GAAG,OAAO,uBAAuB;IAAE,QAAQ;IAAY;IAAQ,CAAC;;EAGhF,MAAM,OAAgB,SAAS,KAAK,MAAM,SAAS,MAAM,CAAC,YAAY,KAAK,GAAG;AAS9E,OAPC,QACA,OAAO,SAAS,YAChB,UAAU,QACV,KAAK,QACL,OAAO,KAAK,SAAS,WACjB,KAAK,KAA6B,QACnC,YACa,MAChB,QAAO,YAAY,GAAG,OAAO,gCAAgC;GAC5D,QAAQ;GACR;GACA,CAAC;AAGH,QAAM,gBAAgB,EAAE,KAAK,QAAQ,EAAE,GAAG;AAC1C,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,KAAK,QAAQ;GAAE;WACtC;AACT,QAAM,GACJ,WAAW,UAAU,CACrB,MAAM,QAAQ,KAAK,aAAa,CAChC,MAAM,YAAY,KAAK,SAAS,CAChC,SAAS;;;;;;AAOb,eAAsB,kBACrB,IACwC;CACxC,MAAM,QAAQ,MAAM,IAAI,kBAAkB,GAAG,CAAC,IAAiB,aAAa;AAC5E,KAAI,CAAC,SAAS,OAAO,MAAM,UAAU,YAAY,MAAM,YAAY,KAAK,KAAK,CAC5E,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAa,SAAS;GAA+B;EAAE;AAEhG,QAAO;EAAE,SAAS;EAAM,MAAM,EAAE,OAAO,MAAM,OAAO;EAAE"}

package/dist/{sitemap-name-BTg2NJJv.mjs → sitemap-name-B8QP8wud.mjs}

@@ -23,4 +23,4 @@ function parseCollectionSitemapName(name) {
 
 //#endregion
 export { parseCollectionSitemapName as t };
-//# sourceMappingURL=sitemap-name-BTg2NJJv.mjs.map
+//# sourceMappingURL=sitemap-name-B8QP8wud.mjs.map

package/dist/{sitemap-name-BTg2NJJv.mjs.map → sitemap-name-B8QP8wud.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"sitemap-name-BTg2NJJv.mjs","names":[],"sources":["../src/seo/sitemap-name.ts"],"sourcesContent":["/**\n * The `{name}` in a per-collection sitemap path, `/sitemap-{name}.xml`.\n */\n\nimport { isValidSchemaSlug } from \"../schema/slug.js\";\n\n/** `{collection}` for page 1, `{collection}-{n}` for page n from 2 up. */\nconst SITEMAP_NAME_RE = /^([a-z][a-z0-9_]*)(?:-([2-9]|[1-9]\\d{1,5}))?$/;\n\n/**\n * The collection and page a sitemap name refers to, or null when the name\n * can't belong to any collection (its collection part must be a valid\n * collection slug).\n */\nexport function parseCollectionSitemapName(\n\tname: string,\n): { collection: string; page: number } | null {\n\tconst match = SITEMAP_NAME_RE.exec(name);\n\tconst collection = match?.[1];\n\tif (!match || !isValidSchemaSlug(collection)) return null;\n\treturn { collection, page: match[2] ? Number(match[2]) : 1 };\n}\n"],"mappings":";;;;;;;AAOA,MAAM,kBAAkB;;;;;;AAOxB,SAAgB,2BACf,MAC8C;CAC9C,MAAM,QAAQ,gBAAgB,KAAK,KAAK;CACxC,MAAM,aAAa,QAAQ;AAC3B,KAAI,CAAC,SAAS,CAAC,kBAAkB,WAAW,CAAE,QAAO;AACrD,QAAO;EAAE;EAAY,MAAM,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG;EAAG"}
+{"version":3,"file":"sitemap-name-B8QP8wud.mjs","names":[],"sources":["../src/seo/sitemap-name.ts"],"sourcesContent":["/**\n * The `{name}` in a per-collection sitemap path, `/sitemap-{name}.xml`.\n */\n\nimport { isValidSchemaSlug } from \"../schema/slug.js\";\n\n/** `{collection}` for page 1, `{collection}-{n}` for page n from 2 up. */\nconst SITEMAP_NAME_RE = /^([a-z][a-z0-9_]*)(?:-([2-9]|[1-9]\\d{1,5}))?$/;\n\n/**\n * The collection and page a sitemap name refers to, or null when the name\n * can't belong to any collection (its collection part must be a valid\n * collection slug).\n */\nexport function parseCollectionSitemapName(\n\tname: string,\n): { collection: string; page: number } | null {\n\tconst match = SITEMAP_NAME_RE.exec(name);\n\tconst collection = match?.[1];\n\tif (!match || !isValidSchemaSlug(collection)) return null;\n\treturn { collection, page: match[2] ? Number(match[2]) : 1 };\n}\n"],"mappings":";;;;;;;AAOA,MAAM,kBAAkB;;;;;;AAOxB,SAAgB,2BACf,MAC8C;CAC9C,MAAM,QAAQ,gBAAgB,KAAK,KAAK;CACxC,MAAM,aAAa,QAAQ;AAC3B,KAAI,CAAC,SAAS,CAAC,kBAAkB,WAAW,CAAE,QAAO;AACrD,QAAO;EAAE;EAAY,MAAM,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG;EAAG"}

package/dist/{slugify-bu2-jKia.mjs → slugify-BDEG9pLk.mjs}

@@ -19,4 +19,4 @@ function decodeSlug(raw) {
 
 //#endregion
 export { slugify as n, decodeSlug as t };
-//# sourceMappingURL=slugify-bu2-jKia.mjs.map
+//# sourceMappingURL=slugify-BDEG9pLk.mjs.map

package/dist/{slugify-bu2-jKia.mjs.map → slugify-BDEG9pLk.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"slugify-bu2-jKia.mjs","names":[],"sources":["../src/utils/slugify.ts"],"sourcesContent":["export { slugify } from \"@emdash-cms/admin/slugify\";\n\n/**\n * Decode a URI-encoded slug parameter.\n *\n * Browsers percent-encode non-ASCII characters in URLs, so a slug like\n * \"మేష-రాసి\" arrives as \"%e0%b0%ae%e0%b1%87%e0%b0%b7-%e0%b0%b0%e0%b0%be%e0%b0%b8%e0%b0%bf\".\n * Call this on `Astro.params.slug` before using it in database lookups.\n */\nexport function decodeSlug(raw: string | undefined): string | undefined {\n\tif (!raw) return undefined;\n\ttry {\n\t\treturn decodeURIComponent(raw);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"],"mappings":";;;;;;;;;;AASA,SAAgB,WAAW,KAA6C;AACvE,KAAI,CAAC,IAAK,QAAO;AACjB,KAAI;AACH,SAAO,mBAAmB,IAAI;SACvB;AACP"}
+{"version":3,"file":"slugify-BDEG9pLk.mjs","names":[],"sources":["../src/utils/slugify.ts"],"sourcesContent":["export { slugify } from \"@emdash-cms/admin/slugify\";\n\n/**\n * Decode a URI-encoded slug parameter.\n *\n * Browsers percent-encode non-ASCII characters in URLs, so a slug like\n * \"మేష-రాసి\" arrives as \"%e0%b0%ae%e0%b1%87%e0%b0%b7-%e0%b0%b0%e0%b0%be%e0%b0%b8%e0%b0%bf\".\n * Call this on `Astro.params.slug` before using it in database lookups.\n */\nexport function decodeSlug(raw: string | undefined): string | undefined {\n\tif (!raw) return undefined;\n\ttry {\n\t\treturn decodeURIComponent(raw);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"],"mappings":";;;;;;;;;;AASA,SAAgB,WAAW,KAA6C;AACvE,KAAI,CAAC,IAAK,QAAO;AACjB,KAAI;AACH,SAAO,mBAAmB,IAAI;SACvB;AACP"}

package/dist/{snapshot-DYsG4uOq.mjs → snapshot-BjaXDZQ5.mjs}

@@ -1,4 +1,4 @@
-import { m as listTablesLike, p as listTableColumns } from "./dialect-helpers-7_IqPdh9.mjs";
+import { m as listTablesLike, p as listTableColumns } from "./dialect-helpers-B1XN2HGB.mjs";
 import { sql } from "kysely";
 
 //#region src/api/handlers/snapshot.ts
@@ -411,4 +411,4 @@ async function generateSnapshot(db, options) {
 
 //#endregion
 export { parsePreviewSignatureHeader as n, verifyPreviewSignature as r, generateSnapshot as t };
-//# sourceMappingURL=snapshot-DYsG4uOq.mjs.map
+//# sourceMappingURL=snapshot-BjaXDZQ5.mjs.map