emdash 1.3.1 → 1.4.0

package/dist/settings--XlUdUaI.mjs

@@ -0,0 +1,66 @@
+import { f as __exportAll } from "./runner-Bkkfk4O8.mjs";
+import { d as setSiteSettings, i as getSiteSettingWithDb, s as getSiteSettingsWithDb } from "./settings-D932YP2-.mjs";
+
+//#region src/api/handlers/settings.ts
+var settings_exports = /* @__PURE__ */ __exportAll({
+	handleSettingsGet: () => handleSettingsGet,
+	handleSettingsUpdate: () => handleSettingsUpdate
+});
+/**
+* Get all site settings
+*/
+async function handleSettingsGet(db, storage) {
+	try {
+		return {
+			success: true,
+			data: await getSiteSettingsWithDb(db, storage)
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "SETTINGS_READ_ERROR",
+				message: "Failed to get settings"
+			}
+		};
+	}
+}
+/**
+* Update site settings
+*/
+async function handleSettingsUpdate(db, storage, input) {
+	try {
+		const { timezone } = input;
+		if (typeof timezone === "string" && !isValidTimeZone(timezone) && timezone !== await getSiteSettingWithDb("timezone", db)) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: `timezone: "${timezone}" is not an IANA timezone (for example "Europe/Lisbon" or "UTC")`
+			}
+		};
+		await setSiteSettings(input, db);
+		return {
+			success: true,
+			data: await getSiteSettingsWithDb(db, storage)
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "SETTINGS_UPDATE_ERROR",
+				message: "Failed to update settings"
+			}
+		};
+	}
+}
+function isValidTimeZone(timezone) {
+	try {
+		return Boolean(new Intl.DateTimeFormat("en", { timeZone: timezone }).resolvedOptions().timeZone);
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+export { handleSettingsUpdate as n, settings_exports as r, handleSettingsGet as t };
+//# sourceMappingURL=settings--XlUdUaI.mjs.map

package/dist/settings--XlUdUaI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings--XlUdUaI.mjs","names":[],"sources":["../src/api/handlers/settings.ts"],"sourcesContent":["/**\n * Settings handlers\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport {\n\tgetSiteSettingWithDb,\n\tgetSiteSettingsWithDb,\n\tsetSiteSettings,\n} from \"../../settings/index.js\";\nimport type { SiteSettings, SiteSettingsUpdate } from \"../../settings/types.js\";\nimport type { Storage } from \"../../storage/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n/**\n * Get all site settings\n */\nexport async function handleSettingsGet(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n): Promise<ApiResult<Partial<SiteSettings>>> {\n\ttry {\n\t\tconst settings = await getSiteSettingsWithDb(db, storage);\n\t\treturn { success: true, data: settings };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SETTINGS_READ_ERROR\", message: \"Failed to get settings\" },\n\t\t};\n\t}\n}\n\n/**\n * Update site settings\n */\nexport async function handleSettingsUpdate(\n\tdb: Kysely<Database>,\n\tstorage: Storage | null,\n\tinput: SiteSettingsUpdate,\n): Promise<ApiResult<Partial<SiteSettings>>> {\n\ttry {\n\t\tconst { timezone } = input;\n\t\tif (\n\t\t\ttypeof timezone === \"string\" &&\n\t\t\t!isValidTimeZone(timezone) &&\n\t\t\t// A previously stored value is sent back unchanged by the admin's settings\n\t\t\t// form; rejecting it would block saving every other setting.\n\t\t\ttimezone !== (await getSiteSettingWithDb(\"timezone\", db))\n\t\t) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: `timezone: \"${timezone}\" is not an IANA timezone (for example \"Europe/Lisbon\" or \"UTC\")`,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tawait setSiteSettings(input, db);\n\t\tconst updatedSettings = await getSiteSettingsWithDb(db, storage);\n\t\treturn { success: true, data: updatedSettings };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"SETTINGS_UPDATE_ERROR\", message: \"Failed to update settings\" },\n\t\t};\n\t}\n}\n\nfunction isValidTimeZone(timezone: string): boolean {\n\ttry {\n\t\treturn Boolean(\n\t\t\tnew Intl.DateTimeFormat(\"en\", { timeZone: timezone }).resolvedOptions().timeZone,\n\t\t);\n\t} catch {\n\t\treturn false;\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAmBA,eAAsB,kBACrB,IACA,SAC4C;AAC5C,KAAI;AAEH,SAAO;GAAE,SAAS;GAAM,MADP,MAAM,sBAAsB,IAAI,QAAQ;GACjB;SACjC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA0B;GACzE;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,OAC4C;AAC5C,KAAI;EACH,MAAM,EAAE,aAAa;AACrB,MACC,OAAO,aAAa,YACpB,CAAC,gBAAgB,SAAS,IAG1B,aAAc,MAAM,qBAAqB,YAAY,GAAG,CAExD,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,cAAc,SAAS;IAChC;GACD;AAEF,QAAM,gBAAgB,OAAO,GAAG;AAEhC,SAAO;GAAE,SAAS;GAAM,MADA,MAAM,sBAAsB,IAAI,QAAQ;GACjB;SACxC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA6B;GAC9E;;;AAIH,SAAS,gBAAgB,UAA2B;AACnD,KAAI;AACH,SAAO,QACN,IAAI,KAAK,eAAe,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC,iBAAiB,CAAC,SACxE;SACM;AACP,SAAO"}

package/dist/settings-D932YP2-.mjs

@@ -0,0 +1,519 @@
+import { r as isMissingTableError } from "./db-errors-unnO6yiZ.mjs";
+import { t as after } from "./after-32yNRvd2.mjs";
+import { getRequestContext } from "./request-context.mjs";
+import { n as assertStorageKey, t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { i as resolvePluginEncryptionKeys } from "./secrets-Dswzrz3k.mjs";
+import { a as encodeBase64url, r as decodeBase64url } from "./base64-BQBZwXCx.mjs";
+import { n as invalidateSingleFlightCache, r as singleFlightCached, t as createSingleFlightCache } from "./single-flight-cache-D0EaGbN1.mjs";
+import { n as cachedQuery, p as invalidateObjectCache } from "./object-cache-DmKr09La.mjs";
+import { n as peekRequestCache, r as requestCached } from "./request-cache-5z2WzWmh.mjs";
+import { t as withTransaction } from "./transaction-CkoQ5wqQ.mjs";
+import { t as MediaRepository } from "./media-DepNLhPq.mjs";
+import { t as normalizeSiteSettingsVersion } from "./version-DqB7LIO7.mjs";
+import { n as siteSettingsTag } from "./chrome-tags-BIKBMZYO.mjs";
+import { u as getDb } from "./loader-DhnedqY4.mjs";
+import { isRecord } from "./plugin-utils.mjs";
+import { r as bumpRunningExportWriteEpochs } from "./fence-Dagicj14.mjs";
+
+//#region src/plugins/settings.ts
+const ENVELOPE_VERSION = 1;
+const ENVELOPE_MARKER = "plugin-setting";
+const IV_BYTES = 12;
+const KEY_ID_PATTERN = /^[0-9a-f]{8}$/;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder("utf-8", { fatal: true });
+var PluginSettingEncryptionError = class extends Error {
+	name = "PluginSettingEncryptionError";
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+function isEncryptedPluginSetting(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	return Object.keys(value).length === 5 && "$emdash" in value && value.$emdash === ENVELOPE_MARKER && "v" in value && value.v === ENVELOPE_VERSION && "kid" in value && typeof value.kid === "string" && KEY_ID_PATTERN.test(value.kid) && "iv" in value && typeof value.iv === "string" && BASE64URL_PATTERN.test(value.iv) && "ciphertext" in value && typeof value.ciphertext === "string" && BASE64URL_PATTERN.test(value.ciphertext);
+}
+function additionalData(pluginId, key) {
+	return textEncoder.encode(JSON.stringify([
+		"emdash-plugin-setting",
+		ENVELOPE_VERSION,
+		pluginId,
+		key
+	]));
+}
+function exactBuffer(bytes) {
+	return bytes.slice().buffer;
+}
+async function importEncryptionKey(key, usage) {
+	return crypto.subtle.importKey("raw", exactBuffer(key.key), "AES-GCM", false, [usage]);
+}
+async function keysOrDefault(keys) {
+	return keys === void 0 ? resolvePluginEncryptionKeys() : keys;
+}
+async function encryptPluginSetting(pluginId, key, value, keys) {
+	const primary = (await keysOrDefault(keys))?.[0];
+	if (!primary) throw new PluginSettingEncryptionError("PLUGIN_SETTING_ENCRYPTION_KEY_MISSING", "Plugin secret settings require EMDASH_ENCRYPTION_KEY");
+	try {
+		const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+		const cryptoKey = await importEncryptionKey(primary, "encrypt");
+		const ciphertext = await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv: exactBuffer(iv),
+			additionalData: exactBuffer(additionalData(pluginId, key))
+		}, cryptoKey, exactBuffer(textEncoder.encode(value)));
+		return {
+			$emdash: ENVELOPE_MARKER,
+			v: ENVELOPE_VERSION,
+			kid: primary.kid,
+			iv: encodeBase64url(iv),
+			ciphertext: encodeBase64url(new Uint8Array(ciphertext))
+		};
+	} catch (error) {
+		if (error instanceof PluginSettingEncryptionError) throw error;
+		throw new PluginSettingEncryptionError("PLUGIN_SETTING_ENCRYPTION_FAILED", "Plugin secret setting could not be encrypted");
+	}
+}
+async function decryptPluginSetting(pluginId, key, envelope, keys) {
+	const resolved = await keysOrDefault(keys);
+	if (!resolved?.length) throw new PluginSettingEncryptionError("PLUGIN_SETTING_ENCRYPTION_KEY_MISSING", "Plugin secret setting cannot be decrypted because its encryption key is unavailable");
+	const matched = resolved.find((candidate) => candidate.kid === envelope.kid);
+	if (!matched) throw new PluginSettingEncryptionError("PLUGIN_SETTING_ENCRYPTION_KEY_UNKNOWN", "Plugin secret setting was encrypted with an unavailable key");
+	try {
+		const iv = decodeBase64url(envelope.iv);
+		const ciphertext = decodeBase64url(envelope.ciphertext);
+		if (iv.byteLength !== IV_BYTES || ciphertext.byteLength < 16) throw new Error("invalid envelope");
+		const cryptoKey = await importEncryptionKey(matched, "decrypt");
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: exactBuffer(iv),
+			additionalData: exactBuffer(additionalData(pluginId, key))
+		}, cryptoKey, exactBuffer(ciphertext));
+		return textDecoder.decode(plaintext);
+	} catch {
+		throw new PluginSettingEncryptionError("PLUGIN_SETTING_DECRYPTION_FAILED", "Plugin secret setting could not be decrypted");
+	}
+}
+function isSecretField(schema, key) {
+	return schema[key]?.type === "secret";
+}
+async function encodePluginSettingValue(pluginId, key, value, schema, keys, onSecret) {
+	if (!isSecretField(schema, key)) return value;
+	if (typeof value !== "string") throw new PluginSettingEncryptionError("PLUGIN_SETTING_ENCRYPTION_FAILED", "Plugin secret settings must be strings");
+	onSecret?.(key, value);
+	return encryptPluginSetting(pluginId, key, value, keys);
+}
+async function decodePluginSettingValue(pluginId, key, value, schema, keys, onSecret) {
+	if (!isSecretField(schema, key)) {
+		if (isEncryptedPluginSetting(value)) throw new PluginSettingEncryptionError("PLUGIN_SETTING_DECRYPTION_FAILED", "Encrypted plugin setting is not declared as a secret");
+		return value;
+	}
+	if (typeof value === "string") {
+		onSecret?.(key, value);
+		return value;
+	}
+	if (!isEncryptedPluginSetting(value)) throw new PluginSettingEncryptionError("PLUGIN_SETTING_DECRYPTION_FAILED", "Plugin secret setting has an invalid encrypted envelope");
+	const decrypted = await decryptPluginSetting(pluginId, key, value, keys);
+	onSecret?.(key, decrypted);
+	return decrypted;
+}
+function createSettingsAccess(optionsRepo, pluginId, schema = {}, keys, onSecret) {
+	const prefix = `plugin:${pluginId}:settings:`;
+	const optionKey = (key) => {
+		assertStorageKey(key);
+		return `${prefix}${key}`;
+	};
+	return {
+		async get(key) {
+			const value = await optionsRepo.get(optionKey(key));
+			return value === null ? null : decodePluginSettingValue(pluginId, key, value, schema, keys, onSecret);
+		},
+		async getVersioned(key) {
+			const value = await optionsRepo.getVersioned(optionKey(key));
+			if (!value) return null;
+			return {
+				value: await decodePluginSettingValue(pluginId, key, value.value, schema, keys, onSecret),
+				revision: value.revision
+			};
+		},
+		async compareAndSet(key, expectedRevision, value) {
+			return optionsRepo.compareAndSet(optionKey(key), expectedRevision, await encodePluginSettingValue(pluginId, key, value, schema, keys, onSecret));
+		},
+		compareAndDelete(key, expectedRevision) {
+			return optionsRepo.compareAndDelete(optionKey(key), expectedRevision);
+		},
+		async set(key, value) {
+			await optionsRepo.set(optionKey(key), await encodePluginSettingValue(pluginId, key, value, schema, keys, onSecret));
+		},
+		delete(key) {
+			return optionsRepo.delete(optionKey(key));
+		},
+		async list(keyPrefix = "") {
+			assertStorageKey(keyPrefix || "_");
+			const values = await optionsRepo.getByPrefix(`${prefix}${keyPrefix}`);
+			const result = [];
+			for (const [fullKey, value] of values) {
+				const key = fullKey.slice(prefix.length);
+				result.push({
+					key,
+					value: await decodePluginSettingValue(pluginId, key, value, schema, keys, onSecret)
+				});
+			}
+			return result;
+		}
+	};
+}
+
+//#endregion
+//#region src/settings/index.ts
+/** Object-cache namespace for site settings. */
+const SETTINGS_CACHE_NAMESPACE = "settings";
+/** Prefix for site settings in the options table */
+const SETTINGS_PREFIX = "site:";
+/** Settings stored as one object whose fields are updated individually. */
+const NESTED_SETTING_KEYS = new Set(["seo", "social"]);
+function isPluginSettingEnvelopeRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "$emdash" in value && value.$emdash === "plugin-setting";
+}
+async function decodePersistedPluginSetting(pluginId, key, value, encryptionKeys) {
+	if (isEncryptedPluginSetting(value)) return decryptPluginSetting(pluginId, key, value, encryptionKeys);
+	if (isPluginSettingEnvelopeRecord(value)) throw new PluginSettingEncryptionError("PLUGIN_SETTING_DECRYPTION_FAILED", "Plugin secret setting has an invalid encrypted envelope");
+	return value;
+}
+const SITE_SETTINGS_CACHE_TTL_MS = 3e4;
+const SITE_SETTINGS_CACHE_KEY = Symbol.for("emdash:site-settings:swr");
+const g = globalThis;
+const settingsCache = g[SITE_SETTINGS_CACHE_KEY] ?? (() => {
+	const c = {
+		snapshot: null,
+		expiresAt: 0,
+		generation: 0,
+		revalidatingUntil: 0,
+		refresh: createSingleFlightCache()
+	};
+	g[SITE_SETTINGS_CACHE_KEY] = c;
+	return c;
+})();
+/** Capture the resolved snapshot before route-cache headers are finalized. @internal */
+function peekSiteSettingsSnapshot() {
+	return settingsCache.snapshot;
+}
+/** Discard a snapshot found stale by the route-cache freshness check. @internal */
+function invalidateSiteSettingsSnapshot() {
+	settingsCache.generation++;
+	settingsCache.snapshot = null;
+	settingsCache.expiresAt = 0;
+	settingsCache.revalidatingUntil = 0;
+	invalidateSingleFlightCache(settingsCache.refresh);
+}
+/**
+* Bump the isolate-wide site-settings cache version, forcing the next
+* `getSiteSettings()` to re-query the database.
+*
+* Called from every `site:*` write path. Other isolates still serve their
+* own cached copy while a background refresh picks up remote writes.
+*/
+function invalidateSiteSettingsCache() {
+	invalidateSiteSettingsSnapshot();
+	invalidateObjectCache(SETTINGS_CACHE_NAMESPACE);
+}
+/**
+* Type guard for MediaReference values
+*/
+function isMediaReference(value) {
+	return typeof value === "object" && value !== null && "mediaId" in value;
+}
+/**
+* Resolve a media reference to include the full URL plus content metadata.
+*
+* Pulls `mimeType` and intrinsic dimensions from the media row so callers
+* can emit correct head tags (e.g. `<link rel="icon" type="image/svg+xml">`,
+* which Chromium requires when the URL has no `.svg` extension) without
+* a second round-trip to the media table.
+*/
+async function resolveMediaReference(mediaRef, db, _storage) {
+	if (!mediaRef?.mediaId) return mediaRef;
+	try {
+		const media = await new MediaRepository(db).findById(mediaRef.mediaId);
+		if (media) return {
+			...mediaRef,
+			url: `/_emdash/api/media/file/${media.storageKey}`,
+			contentType: media.mimeType,
+			...media.width !== null ? { width: media.width } : {},
+			...media.height !== null ? { height: media.height } : {}
+		};
+	} catch {}
+	return mediaRef;
+}
+/**
+* Get a single site setting by key
+*
+* Returns `undefined` if the setting has not been configured.
+* For media settings (logo, favicon), the URL is resolved automatically.
+*
+* @param key - The setting key (e.g., "title", "logo", "social")
+* @returns The setting value, or undefined if not set
+*
+* @example
+* ```ts
+* import { getSiteSetting } from "emdash";
+*
+* const title = await getSiteSetting("title");
+* const logo = await getSiteSetting("logo");
+* console.log(logo?.url); // Resolved URL
+* ```
+*/
+async function getSiteSetting(key) {
+	const primed = peekRequestCache("siteSettings");
+	if (primed) return (await primed)[key];
+	return requestCached(`siteSetting:${key}`, async () => {
+		return getSiteSettingWithDb(key, await getDb());
+	});
+}
+/**
+* Get a single site setting by key (with explicit db)
+*
+* @internal Use `getSiteSetting()` in templates. This variant is for admin routes
+* that already have a database handle.
+*/
+async function getSiteSettingWithDb(key, db, storage = null) {
+	const value = await new OptionsRepository(db).get(`${SETTINGS_PREFIX}${key}`);
+	if (!value) return;
+	if ((key === "logo" || key === "favicon") && isMediaReference(value)) return await resolveMediaReference(value, db, storage);
+	if (key === "seo" && value && typeof value === "object") {
+		const seo = value;
+		if (seo.defaultOgImage) return {
+			...seo,
+			defaultOgImage: await resolveMediaReference(seo.defaultOgImage, db, storage)
+		};
+	}
+	return value;
+}
+function refreshSiteSettings() {
+	return singleFlightCached(settingsCache.refresh, () => cachedQuery({
+		namespace: SETTINGS_CACHE_NAMESPACE,
+		key: "snapshot-v1",
+		load: async () => loadSiteSettingsSnapshot(await getDb())
+	}), {
+		anchor: (promise) => after(() => promise),
+		ownerTimeoutMs: 3e4
+	});
+}
+function installSiteSettings(snapshot) {
+	settingsCache.snapshot = snapshot;
+	settingsCache.expiresAt = Date.now() + SITE_SETTINGS_CACHE_TTL_MS;
+}
+function revalidateSiteSettings() {
+	const now = Date.now();
+	if (settingsCache.revalidatingUntil > now) return;
+	settingsCache.revalidatingUntil = now + SITE_SETTINGS_CACHE_TTL_MS;
+	const generation = ++settingsCache.generation;
+	invalidateSingleFlightCache(settingsCache.refresh);
+	after(async () => {
+		try {
+			const snapshot = await refreshSiteSettings();
+			if (generation === settingsCache.generation) installSiteSettings(snapshot);
+		} catch (error) {
+			console.error("[emdash:settings] revalidating site settings failed:", error);
+		}
+	});
+}
+async function loadCachedSiteSettings() {
+	for (let attempt = 0; attempt < 3; attempt++) {
+		const snapshot = settingsCache.snapshot;
+		if (snapshot) {
+			if (Date.now() >= settingsCache.expiresAt) revalidateSiteSettings();
+			return snapshot;
+		}
+		const generation = settingsCache.generation;
+		const loaded = await refreshSiteSettings();
+		if (generation === settingsCache.generation) {
+			installSiteSettings(loaded);
+			return loaded;
+		}
+		if (attempt === 2) return loaded;
+	}
+	throw new Error("Site settings refresh exhausted without loading settings");
+}
+/**
+* Get all site settings
+*
+* Returns all configured settings. Unset values are undefined.
+* Media references (logo/favicon) are resolved to include URLs.
+*
+* @example
+* ```ts
+* import { getSiteSettings } from "emdash";
+*
+* const settings = await getSiteSettings();
+* console.log(settings.title); // "My Site"
+* console.log(settings.logo?.url); // "/_emdash/api/media/file/abc123"
+* ```
+*/
+function getSiteSettings() {
+	return requestCached("siteSettings", async () => {
+		return (await requestCached("siteSettingsSnapshot", async () => {
+			const ctx = getRequestContext();
+			const requestSettings = ctx?.siteSettings;
+			if (ctx?.routeCacheFill) return loadSiteSettingsSnapshot(await getDb());
+			let loaded = requestSettings?.snapshot ?? await loadCachedSiteSettings();
+			if (requestSettings?.version !== void 0 && loaded.version !== requestSettings.version) {
+				invalidateSiteSettingsSnapshot();
+				const generation = settingsCache.generation;
+				loaded = await loadSiteSettingsSnapshot(await getDb());
+				if (generation === settingsCache.generation) installSiteSettings(loaded);
+			}
+			return loaded;
+		})).data;
+	}).then(async (data) => {
+		const snapshot = await peekRequestCache("siteSettingsSnapshot");
+		if (snapshot) getRequestContext()?.siteSettings?.onRead(snapshot.version);
+		return data;
+	});
+}
+/**
+* Get all site settings with a Workers edge-cache hint.
+*
+* Use the returned `cacheHint` with `Astro.cache.set()` so pages that render
+* settings can be purged automatically when site settings change.
+*/
+async function getSiteSettingsWithCacheHint() {
+	return {
+		data: await getSiteSettings(),
+		cacheHint: { tags: [siteSettingsTag()] }
+	};
+}
+/**
+* Get all site settings (with explicit db)
+*
+* @internal Use `getSiteSettings()` in templates. This variant is for admin routes
+* that already have a database handle.
+*/
+async function getSiteSettingsWithDb(db, storage = null) {
+	return (await loadSiteSettingsSnapshot(db, storage)).data;
+}
+async function loadSiteSettingsSnapshot(db, storage = null) {
+	const allOptions = await new OptionsRepository(db).getVersionedByPrefix(SETTINGS_PREFIX);
+	const version = normalizeSiteSettingsVersion(JSON.stringify([...allOptions].filter(([key]) => key.startsWith(SETTINGS_PREFIX)).map(([key, value]) => [key, value.revision])));
+	const settings = {};
+	for (const [key, value] of allOptions) {
+		const settingKey = key.replace(SETTINGS_PREFIX, "");
+		settings[settingKey] = value.value;
+	}
+	const typedSettings = settings;
+	if (typedSettings.logo) typedSettings.logo = await resolveMediaReference(typedSettings.logo, db, storage);
+	if (typedSettings.favicon) typedSettings.favicon = await resolveMediaReference(typedSettings.favicon, db, storage);
+	if (typedSettings.seo?.defaultOgImage) typedSettings.seo = {
+		...typedSettings.seo,
+		defaultOgImage: await resolveMediaReference(typedSettings.seo.defaultOgImage, db, storage)
+	};
+	return {
+		data: typedSettings,
+		version
+	};
+}
+/**
+* Set site settings (internal function used by admin API)
+*
+* Merges provided settings with existing ones. Only provided fields are updated,
+* including fields inside `seo` and `social`; `seo.defaultOgImage: null` removes the default image.
+* Media references should include just the mediaId; URLs are resolved on read.
+*
+* @param settings - Partial settings object with values to update
+* @param db - Kysely database instance
+* @returns Promise that resolves when settings are saved
+*
+* @internal
+*
+* @example
+* ```ts
+* // Update multiple settings at once
+* await setSiteSettings({
+*   title: "My Site",
+*   tagline: "Welcome",
+*   logo: { mediaId: "med_123", alt: "Logo" }
+* }, db);
+* ```
+*/
+async function setSiteSettings(settings, db) {
+	const updates = {};
+	const deletions = [];
+	const nestedPatches = [];
+	for (const [key, value] of Object.entries(settings)) {
+		if (value === void 0) continue;
+		if (value === null) deletions.push(`${SETTINGS_PREFIX}${key}`);
+		else if (NESTED_SETTING_KEYS.has(key) && isRecord(value)) nestedPatches.push([key, value]);
+		else updates[`${SETTINGS_PREFIX}${key}`] = value;
+	}
+	if (Object.keys(updates).length === 0 && deletions.length === 0 && nestedPatches.length === 0) return;
+	try {
+		await withTransaction(db, async (trx) => {
+			const transactionOptions = new OptionsRepository(trx);
+			await transactionOptions.setMany(updates);
+			await transactionOptions.deleteMany(deletions);
+			for (const [key, patch] of nestedPatches) {
+				const optionName = `${SETTINGS_PREFIX}${key}`;
+				const next = { ...await transactionOptions.get(optionName) };
+				for (const [field, fieldValue] of Object.entries(patch)) if (fieldValue === null) delete next[field];
+				else if (fieldValue !== void 0) next[field] = fieldValue;
+				if (Object.keys(next).length === 0) await transactionOptions.delete(optionName);
+				else await transactionOptions.set(optionName, next);
+			}
+			try {
+				await bumpRunningExportWriteEpochs(trx);
+			} catch (error) {
+				if (isMissingTableError(error)) return;
+				throw error;
+			}
+		});
+	} finally {
+		invalidateSiteSettingsCache();
+	}
+}
+/**
+* Get a single plugin setting by key.
+*
+* Plugin settings are stored in the options table under
+* `plugin:<pluginId>:settings:<key>`.
+*/
+async function getPluginSetting(pluginId, key) {
+	return getPluginSettingWithDb(pluginId, key, await getDb());
+}
+/**
+* Get a single plugin setting by key (with explicit db).
+*
+* @internal Use `getPluginSetting()` in templates and plugin rendering code.
+*/
+async function getPluginSettingWithDb(pluginId, key, db) {
+	const value = await new OptionsRepository(db).get(`plugin:${pluginId}:settings:${key}`);
+	if (value === null) return void 0;
+	return await decodePersistedPluginSetting(pluginId, key, value);
+}
+/**
+* Get all persisted plugin settings for a plugin.
+*
+* Defaults declared in `admin.settingsSchema` are not materialized
+* automatically; callers should apply their own fallback defaults.
+*/
+async function getPluginSettings(pluginId) {
+	return getPluginSettingsWithDb(pluginId, await getDb());
+}
+/**
+* Get all persisted plugin settings for a plugin (with explicit db).
+*
+* @internal Use `getPluginSettings()` in templates and plugin rendering code.
+*/
+async function getPluginSettingsWithDb(pluginId, db) {
+	const prefix = `plugin:${pluginId}:settings:`;
+	const entries = [...await new OptionsRepository(db).getByPrefix(prefix)].filter(([key]) => key.startsWith(prefix));
+	const encryptionKeys = entries.some(([, value]) => isEncryptedPluginSetting(value)) ? await resolvePluginEncryptionKeys() : void 0;
+	return Object.fromEntries(await Promise.all(entries.map(async ([storedKey, value]) => {
+		const key = storedKey.slice(prefix.length);
+		return [key, await decodePersistedPluginSetting(pluginId, key, value, encryptionKeys)];
+	})));
+}
+
+//#endregion
+export { isEncryptedPluginSetting as _, getSiteSettings as a, invalidateSiteSettingsCache as c, setSiteSettings as d, PluginSettingEncryptionError as f, encryptPluginSetting as g, encodePluginSettingValue as h, getSiteSettingWithDb as i, invalidateSiteSettingsSnapshot as l, decodePluginSettingValue as m, getPluginSettings as n, getSiteSettingsWithCacheHint as o, createSettingsAccess as p, getSiteSetting as r, getSiteSettingsWithDb as s, getPluginSetting as t, peekSiteSettingsSnapshot as u };
+//# sourceMappingURL=settings-D932YP2-.mjs.map