emdash 1.3.1 → 1.4.0

package/dist/hash-BJaeek87.mjs

@@ -0,0 +1,37 @@
+//#region src/utils/hash.ts
+const MAX_CONTENT_HASH_BYTES = 8 * 1024 * 1024;
+function formatContentHash(hash) {
+	return `sha1:${Array.from(hash, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+/**
+* SHA-256 hash of a string, truncated to 16 hex chars (64 bits).
+* For cache invalidation / ETags — not for security.
+*/
+async function hashString(content) {
+	const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(content));
+	return Array.from(new Uint8Array(buf).slice(0, 8), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Compute content hash using Web Crypto API
+*
+* Uses SHA-1 which is the fastest option in SubtleCrypto.
+* SHA-1 is cryptographically weak but fine for content deduplication
+* where we only need to detect identical files, not resist attacks.
+*
+* Returns hex string prefixed with "sha1:" for future-proofing
+*/
+async function computeContentHash(content) {
+	let buf;
+	if (content instanceof ArrayBuffer) buf = content;
+	else if (content.buffer instanceof ArrayBuffer && content.byteOffset === 0 && content.byteLength === content.buffer.byteLength) buf = content.buffer;
+	else {
+		buf = new ArrayBuffer(content.byteLength);
+		new Uint8Array(buf).set(content);
+	}
+	const hashBuffer = await crypto.subtle.digest("SHA-1", buf);
+	return formatContentHash(new Uint8Array(hashBuffer));
+}
+
+//#endregion
+export { computeContentHash as n, hashString as r, MAX_CONTENT_HASH_BYTES as t };
+//# sourceMappingURL=hash-BJaeek87.mjs.map

package/dist/hash-BJaeek87.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-BJaeek87.mjs","names":[],"sources":["../src/utils/hash.ts"],"sourcesContent":["export const MAX_CONTENT_HASH_BYTES = 8 * 1024 * 1024;\n\nfunction formatContentHash(hash: Uint8Array): string {\n\tconst hashHex = Array.from(hash, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\treturn `sha1:${hashHex}`;\n}\n\n/**\n * SHA-256 hash of a string, truncated to 16 hex chars (64 bits).\n * For cache invalidation / ETags — not for security.\n */\nexport async function hashString(content: string): Promise<string> {\n\tconst buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(content));\n\treturn Array.from(new Uint8Array(buf).slice(0, 8), (b) => b.toString(16).padStart(2, \"0\")).join(\n\t\t\"\",\n\t);\n}\n\n/**\n * Compute content hash using Web Crypto API\n *\n * Uses SHA-1 which is the fastest option in SubtleCrypto.\n * SHA-1 is cryptographically weak but fine for content deduplication\n * where we only need to detect identical files, not resist attacks.\n *\n * Returns hex string prefixed with \"sha1:\" for future-proofing\n */\nexport async function computeContentHash(content: Uint8Array | ArrayBuffer): Promise<string> {\n\t// SubtleCrypto.digest() requires BufferSource (ArrayBuffer | ArrayBufferView<ArrayBuffer>).\n\t// Uint8Array.buffer is ArrayBufferLike which may include SharedArrayBuffer in the type system,\n\t// so we ensure we have a plain ArrayBuffer.\n\tlet buf: ArrayBuffer;\n\tif (content instanceof ArrayBuffer) {\n\t\tbuf = content;\n\t} else if (\n\t\tcontent.buffer instanceof ArrayBuffer &&\n\t\tcontent.byteOffset === 0 &&\n\t\tcontent.byteLength === content.buffer.byteLength\n\t) {\n\t\tbuf = content.buffer;\n\t} else {\n\t\tbuf = new ArrayBuffer(content.byteLength);\n\t\tnew Uint8Array(buf).set(content);\n\t}\n\tconst hashBuffer = await crypto.subtle.digest(\"SHA-1\", buf);\n\treturn formatContentHash(new Uint8Array(hashBuffer));\n}\n"],"mappings":";AAAA,MAAa,yBAAyB,IAAI,OAAO;AAEjD,SAAS,kBAAkB,MAA0B;AAEpD,QAAO,QADS,MAAM,KAAK,OAAO,SAAS,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;;;;;AAQxF,eAAsB,WAAW,SAAkC;CAClE,MAAM,MAAM,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC,OAAO,QAAQ,CAAC;AACpF,QAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAC1F,GACA;;;;;;;;;;;AAYF,eAAsB,mBAAmB,SAAoD;CAI5F,IAAI;AACJ,KAAI,mBAAmB,YACtB,OAAM;UAEN,QAAQ,kBAAkB,eAC1B,QAAQ,eAAe,KACvB,QAAQ,eAAe,QAAQ,OAAO,WAEtC,OAAM,QAAQ;MACR;AACN,QAAM,IAAI,YAAY,QAAQ,WAAW;AACzC,MAAI,WAAW,IAAI,CAAC,IAAI,QAAQ;;CAEjC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,SAAS,IAAI;AAC3D,QAAO,kBAAkB,IAAI,WAAW,WAAW,CAAC"}

package/dist/hreflang-8dUOJAPJ.d.mts

@@ -0,0 +1,50 @@
+import { t as Database } from "./types-DKwRUA-x.mjs";
+import { Kysely } from "kysely";
+
+//#region src/seo/hreflang.d.ts
+/** A single alternate link, ready to render as `<link rel="alternate">`. */
+interface HreflangAlternate {
+  /** Locale code, or `"x-default"` for the default variant */
+  hreflang: string;
+  /** Absolute URL of the variant */
+  href: string;
+}
+interface HreflangOptions {
+  /**
+   * Absolute site origin (e.g. `https://example.com`) used to build
+   * the alternate URLs. Falls back to the site settings URL; when
+   * neither is available the result is empty, since hreflang
+   * requires fully-qualified URLs.
+   */
+  siteUrl?: string;
+  /** Astro's route trailing-slash policy. */
+  trailingSlash?: "always" | "never" | "ignore";
+}
+/**
+ * Resolve hreflang alternates for a content entry.
+ *
+ * @example
+ * ```astro
+ * ---
+ * import { getHreflangAlternates } from "emdash";
+ *
+ * const alternates = await getHreflangAlternates("posts", entry.data.id, {
+ *   siteUrl: Astro.url.origin,
+ * });
+ * ---
+ * <head>
+ *   {alternates.map((a) => <link rel="alternate" hreflang={a.hreflang} href={a.href} />)}
+ * </head>
+ * ```
+ */
+declare function getHreflangAlternates(collection: string, entryId: string, options?: HreflangOptions): Promise<HreflangAlternate[]>;
+/**
+ * Resolve hreflang alternates with an explicit db handle.
+ *
+ * @internal Use `getHreflangAlternates()` in templates. This variant is
+ * for routes/components that already have a database handle.
+ */
+declare function getHreflangAlternatesWithDb(db: Kysely<Database>, collection: string, entryId: string, options?: HreflangOptions): Promise<HreflangAlternate[]>;
+//#endregion
+export { getHreflangAlternatesWithDb as i, HreflangOptions as n, getHreflangAlternates as r, HreflangAlternate as t };
+//# sourceMappingURL=hreflang-8dUOJAPJ.d.mts.map

package/dist/hreflang-8dUOJAPJ.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hreflang-8dUOJAPJ.d.mts","names":[],"sources":["../src/seo/hreflang.ts"],"mappings":";;;;;UA4DiB,iBAAA;EAwCN;EAtCV,QAAA;EAsC2B;EApC3B,IAAA;AAAA;AAAA,UAGgB,eAAA;EAkDL;;;;;;EA3CX,OAAA;EA2CI;EAzCJ,aAAA;AAAA;;;;;;;;;;;;;;;;;;iBAoBqB,qBAAA,CACrB,UAAA,UACA,OAAA,UACA,OAAA,GAAS,eAAA,GACP,OAAA,CAAQ,iBAAA;;;;;;;iBAgBW,2BAAA,CACrB,EAAA,EAAI,MAAA,CAAO,QAAA,GACX,UAAA,UACA,OAAA,UACA,OAAA,GAAS,eAAA,GACP,OAAA,CAAQ,iBAAA"}

package/dist/hreflang-BW5A4FLK.mjs

@@ -0,0 +1,105 @@
+import { r as getI18nConfig, s as isI18nEnabled } from "./config-Cs_AwWXI.mjs";
+import { t as ContentRepository } from "./content-BKHUVsE5.mjs";
+import { r as requestCached } from "./request-cache-5z2WzWmh.mjs";
+import { a as resolveLocalizedContentRoutePath } from "./resolve-DdNXBJSr.mjs";
+import { n as getCollectionInfoWithDb } from "./query-LmPY2y0C.mjs";
+import { s as getSiteSettingsWithDb } from "./settings-D932YP2-.mjs";
+
+//#region src/seo/hreflang.ts
+const TRAILING_SLASH_RE = /\/$/;
+const ABSOLUTE_URL_RE = /^https?:\/\//i;
+/**
+* IDs of variants flagged `noindex` in the SEO panel. Entries without
+* an `_emdash_seo` row are indexable by default (same as the sitemap).
+* The id list is bounded by the number of configured locales, so no
+* chunking is needed.
+*/
+async function findNoindexIds(db, collection, ids) {
+	if (ids.length === 0) return /* @__PURE__ */ new Set();
+	const rows = await db.selectFrom("_emdash_seo").select("content_id").where("collection", "=", collection).where("content_id", "in", ids).where("seo_no_index", "=", 1).execute();
+	return new Set(rows.map((r) => r.content_id));
+}
+/**
+* Resolve hreflang alternates for a content entry.
+*
+* @example
+* ```astro
+* ---
+* import { getHreflangAlternates } from "emdash";
+*
+* const alternates = await getHreflangAlternates("posts", entry.data.id, {
+*   siteUrl: Astro.url.origin,
+* });
+* ---
+* <head>
+*   {alternates.map((a) => <link rel="alternate" hreflang={a.hreflang} href={a.href} />)}
+* </head>
+* ```
+*/
+async function getHreflangAlternates(collection, entryId, options = {}) {
+	if (!isI18nEnabled()) return [];
+	return requestCached(`hreflang:${collection}:${entryId}:${options.siteUrl ?? ""}:${options.trailingSlash ?? "ignore"}`, async () => {
+		const { getDb } = await import("./loader-DhnedqY4.mjs").then((n) => n.f);
+		return getHreflangAlternatesWithDb(await getDb(), collection, entryId, options);
+	});
+}
+/**
+* Resolve hreflang alternates with an explicit db handle.
+*
+* @internal Use `getHreflangAlternates()` in templates. This variant is
+* for routes/components that already have a database handle.
+*/
+async function getHreflangAlternatesWithDb(db, collection, entryId, options = {}) {
+	if (!isI18nEnabled()) return [];
+	let siteUrl = options.siteUrl;
+	if (!siteUrl) siteUrl = (await getSiteSettingsWithDb(db)).url;
+	if (!siteUrl || !ABSOLUTE_URL_RE.test(siteUrl)) return [];
+	siteUrl = siteUrl.replace(TRAILING_SLASH_RE, "");
+	const repo = new ContentRepository(db);
+	const item = await repo.findByIdOrSlug(collection, entryId);
+	if (!item) return [];
+	const group = item.translationGroup || item.id;
+	let variants = await repo.findTranslations(collection, group);
+	if (variants.length === 0) variants = [item];
+	let published = variants.filter((v) => v.status === "published");
+	if (published.length === 0) return [];
+	const noindexIds = await findNoindexIds(db, collection, published.map((v) => v.id));
+	if (noindexIds.has(item.id)) return [];
+	published = published.filter((v) => !noindexIds.has(v.id));
+	const urlPattern = (await getCollectionInfoWithDb(db, collection))?.urlPattern ?? null;
+	const resolved = [];
+	for (const variant of published) {
+		const locale = variant.locale || "en";
+		const path = await resolveLocalizedContentRoutePath({
+			pattern: urlPattern,
+			collection,
+			slug: variant.slug || variant.id,
+			id: variant.id,
+			date: variant.publishedAt,
+			locale,
+			trailingSlash: options.trailingSlash
+		});
+		if (path === null) continue;
+		resolved.push({
+			locale,
+			href: `${siteUrl}${path}`
+		});
+	}
+	if (resolved.length === 0) return [];
+	resolved.sort((a, b) => a.locale.localeCompare(b.locale));
+	const alternates = resolved.map((r) => ({
+		hreflang: r.locale,
+		href: r.href
+	}));
+	const defaultLocale = getI18nConfig()?.defaultLocale;
+	const xDefault = resolved.find((r) => r.locale === defaultLocale) ?? resolved[0];
+	if (xDefault) alternates.push({
+		hreflang: "x-default",
+		href: xDefault.href
+	});
+	return alternates;
+}
+
+//#endregion
+export { getHreflangAlternatesWithDb as n, getHreflangAlternates as t };
+//# sourceMappingURL=hreflang-BW5A4FLK.mjs.map

package/dist/hreflang-BW5A4FLK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"hreflang-BW5A4FLK.mjs","names":[],"sources":["../src/seo/hreflang.ts"],"sourcesContent":["/**\n * hreflang alternate resolution for translated content (#1690).\n *\n * Mirrors the sitemap route's semantics so the render path and the\n * sitemap always agree:\n *\n * - Alternates are emitted per published locale variant of a\n *   translation group, including a self-referencing entry (Google\n *   recommends the page annotate itself).\n * - `x-default` points at the default-locale variant, falling back to\n *   the first routable variant when the default locale has no\n *   translation.\n * - Variants whose locale isn't in the configured `i18n.locales` list\n *   are dropped: linking to a route the site can't serve is worse than\n *   no link at all.\n * - Variants flagged `noindex` in the SEO panel are excluded — the\n *   sitemap doesn't list them, and pointing search engines at a page\n *   that asks not to be indexed is a contradictory signal. When the\n *   entry itself is noindex the result is empty: a page opting out of\n *   indexing shouldn't announce an hreflang set at all.\n * - When i18n is disabled (or no absolute site URL can be resolved,\n *   which hreflang requires) the result is empty and no queries run.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { ContentRepository } from \"../database/repositories/content.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getI18nConfig, isI18nEnabled } from \"../i18n/config.js\";\nimport { resolveLocalizedContentRoutePath } from \"../i18n/resolve.js\";\nimport { requestCached } from \"../request-cache.js\";\nimport { getCollectionInfoWithDb } from \"../schema/query.js\";\nimport { getSiteSettingsWithDb } from \"../settings/index.js\";\n\nconst TRAILING_SLASH_RE = /\\/$/;\nconst ABSOLUTE_URL_RE = /^https?:\\/\\//i;\n\n/**\n * IDs of variants flagged `noindex` in the SEO panel. Entries without\n * an `_emdash_seo` row are indexable by default (same as the sitemap).\n * The id list is bounded by the number of configured locales, so no\n * chunking is needed.\n */\nasync function findNoindexIds(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tids: string[],\n): Promise<Set<string>> {\n\tif (ids.length === 0) return new Set();\n\tconst rows = await db\n\t\t.selectFrom(\"_emdash_seo\")\n\t\t.select(\"content_id\")\n\t\t.where(\"collection\", \"=\", collection)\n\t\t.where(\"content_id\", \"in\", ids)\n\t\t.where(\"seo_no_index\", \"=\", 1)\n\t\t.execute();\n\treturn new Set(rows.map((r) => r.content_id));\n}\n\n/** A single alternate link, ready to render as `<link rel=\"alternate\">`. */\nexport interface HreflangAlternate {\n\t/** Locale code, or `\"x-default\"` for the default variant */\n\threflang: string;\n\t/** Absolute URL of the variant */\n\thref: string;\n}\n\nexport interface HreflangOptions {\n\t/**\n\t * Absolute site origin (e.g. `https://example.com`) used to build\n\t * the alternate URLs. Falls back to the site settings URL; when\n\t * neither is available the result is empty, since hreflang\n\t * requires fully-qualified URLs.\n\t */\n\tsiteUrl?: string;\n\t/** Astro's route trailing-slash policy. */\n\ttrailingSlash?: \"always\" | \"never\" | \"ignore\";\n}\n\n/**\n * Resolve hreflang alternates for a content entry.\n *\n * @example\n * ```astro\n * ---\n * import { getHreflangAlternates } from \"emdash\";\n *\n * const alternates = await getHreflangAlternates(\"posts\", entry.data.id, {\n *   siteUrl: Astro.url.origin,\n * });\n * ---\n * <head>\n *   {alternates.map((a) => <link rel=\"alternate\" hreflang={a.hreflang} href={a.href} />)}\n * </head>\n * ```\n */\nexport async function getHreflangAlternates(\n\tcollection: string,\n\tentryId: string,\n\toptions: HreflangOptions = {},\n): Promise<HreflangAlternate[]> {\n\tif (!isI18nEnabled()) return [];\n\tconst key = `hreflang:${collection}:${entryId}:${options.siteUrl ?? \"\"}:${options.trailingSlash ?? \"ignore\"}`;\n\treturn requestCached(key, async () => {\n\t\tconst { getDb } = await import(\"../loader.js\");\n\t\tconst db = await getDb();\n\t\treturn getHreflangAlternatesWithDb(db, collection, entryId, options);\n\t});\n}\n\n/**\n * Resolve hreflang alternates with an explicit db handle.\n *\n * @internal Use `getHreflangAlternates()` in templates. This variant is\n * for routes/components that already have a database handle.\n */\nexport async function getHreflangAlternatesWithDb(\n\tdb: Kysely<Database>,\n\tcollection: string,\n\tentryId: string,\n\toptions: HreflangOptions = {},\n): Promise<HreflangAlternate[]> {\n\tif (!isI18nEnabled()) return [];\n\n\tlet siteUrl = options.siteUrl;\n\tif (!siteUrl) {\n\t\tconst settings = await getSiteSettingsWithDb(db);\n\t\tsiteUrl = settings.url;\n\t}\n\t// hreflang requires fully-qualified URLs; a relative site URL would\n\t// produce invalid output (and EmDashHead's isSafeHref would drop it).\n\tif (!siteUrl || !ABSOLUTE_URL_RE.test(siteUrl)) return [];\n\tsiteUrl = siteUrl.replace(TRAILING_SLASH_RE, \"\");\n\n\tconst repo = new ContentRepository(db);\n\tconst item = await repo.findByIdOrSlug(collection, entryId);\n\tif (!item) return [];\n\n\t// Legacy rows imported before i18n may have no translation_group;\n\t// treat them as a single-variant group.\n\tconst group = item.translationGroup || item.id;\n\tlet variants = await repo.findTranslations(collection, group);\n\tif (variants.length === 0) variants = [item];\n\n\tlet published = variants.filter((v) => v.status === \"published\");\n\tif (published.length === 0) return [];\n\n\t// Exclude noindex variants, matching the sitemap's `_emdash_seo`\n\t// filter so head and sitemap agree on which variants are\n\t// discoverable. When the requested entry itself is noindex, emit\n\t// nothing: a page opting out of indexing shouldn't announce an\n\t// hreflang set.\n\tconst noindexIds = await findNoindexIds(\n\t\tdb,\n\t\tcollection,\n\t\tpublished.map((v) => v.id),\n\t);\n\tif (noindexIds.has(item.id)) return [];\n\tpublished = published.filter((v) => !noindexIds.has(v.id));\n\n\tconst info = await getCollectionInfoWithDb(db, collection);\n\tconst urlPattern = info?.urlPattern ?? null;\n\n\tconst resolved: Array<{ locale: string; href: string }> = [];\n\tfor (const variant of published) {\n\t\tconst locale = variant.locale || \"en\";\n\t\tconst path = await resolveLocalizedContentRoutePath({\n\t\t\tpattern: urlPattern,\n\t\t\tcollection,\n\t\t\tslug: variant.slug || variant.id,\n\t\t\tid: variant.id,\n\t\t\tdate: variant.publishedAt,\n\t\t\tlocale,\n\t\t\ttrailingSlash: options.trailingSlash,\n\t\t});\n\t\tif (path === null) continue;\n\t\tresolved.push({ locale, href: `${siteUrl}${path}` });\n\t}\n\tif (resolved.length === 0) return [];\n\n\tresolved.sort((a, b) => a.locale.localeCompare(b.locale));\n\tconst alternates: HreflangAlternate[] = resolved.map((r) => ({\n\t\threflang: r.locale,\n\t\thref: r.href,\n\t}));\n\n\t// x-default: default-locale variant, else the first routable one.\n\t// Same fallback the sitemap route uses.\n\tconst defaultLocale = getI18nConfig()?.defaultLocale;\n\tconst xDefault = resolved.find((r) => r.locale === defaultLocale) ?? resolved[0];\n\tif (xDefault) {\n\t\talternates.push({ hreflang: \"x-default\", href: xDefault.href });\n\t}\n\n\treturn alternates;\n}\n"],"mappings":";;;;;;;;AAkCA,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;;;;;;;AAQxB,eAAe,eACd,IACA,YACA,KACuB;AACvB,KAAI,IAAI,WAAW,EAAG,wBAAO,IAAI,KAAK;CACtC,MAAM,OAAO,MAAM,GACjB,WAAW,cAAc,CACzB,OAAO,aAAa,CACpB,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,cAAc,MAAM,IAAI,CAC9B,MAAM,gBAAgB,KAAK,EAAE,CAC7B,SAAS;AACX,QAAO,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,WAAW,CAAC;;;;;;;;;;;;;;;;;;;AAwC9C,eAAsB,sBACrB,YACA,SACA,UAA2B,EAAE,EACE;AAC/B,KAAI,CAAC,eAAe,CAAE,QAAO,EAAE;AAE/B,QAAO,cADK,YAAY,WAAW,GAAG,QAAQ,GAAG,QAAQ,WAAW,GAAG,GAAG,QAAQ,iBAAiB,YACzE,YAAY;EACrC,MAAM,EAAE,UAAU,MAAM,OAAO;AAE/B,SAAO,4BADI,MAAM,OAAO,EACe,YAAY,SAAS,QAAQ;GACnE;;;;;;;;AASH,eAAsB,4BACrB,IACA,YACA,SACA,UAA2B,EAAE,EACE;AAC/B,KAAI,CAAC,eAAe,CAAE,QAAO,EAAE;CAE/B,IAAI,UAAU,QAAQ;AACtB,KAAI,CAAC,QAEJ,YADiB,MAAM,sBAAsB,GAAG,EAC7B;AAIpB,KAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,QAAQ,CAAE,QAAO,EAAE;AACzD,WAAU,QAAQ,QAAQ,mBAAmB,GAAG;CAEhD,MAAM,OAAO,IAAI,kBAAkB,GAAG;CACtC,MAAM,OAAO,MAAM,KAAK,eAAe,YAAY,QAAQ;AAC3D,KAAI,CAAC,KAAM,QAAO,EAAE;CAIpB,MAAM,QAAQ,KAAK,oBAAoB,KAAK;CAC5C,IAAI,WAAW,MAAM,KAAK,iBAAiB,YAAY,MAAM;AAC7D,KAAI,SAAS,WAAW,EAAG,YAAW,CAAC,KAAK;CAE5C,IAAI,YAAY,SAAS,QAAQ,MAAM,EAAE,WAAW,YAAY;AAChE,KAAI,UAAU,WAAW,EAAG,QAAO,EAAE;CAOrC,MAAM,aAAa,MAAM,eACxB,IACA,YACA,UAAU,KAAK,MAAM,EAAE,GAAG,CAC1B;AACD,KAAI,WAAW,IAAI,KAAK,GAAG,CAAE,QAAO,EAAE;AACtC,aAAY,UAAU,QAAQ,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG,CAAC;CAG1D,MAAM,cADO,MAAM,wBAAwB,IAAI,WAAW,GACjC,cAAc;CAEvC,MAAM,WAAoD,EAAE;AAC5D,MAAK,MAAM,WAAW,WAAW;EAChC,MAAM,SAAS,QAAQ,UAAU;EACjC,MAAM,OAAO,MAAM,iCAAiC;GACnD,SAAS;GACT;GACA,MAAM,QAAQ,QAAQ,QAAQ;GAC9B,IAAI,QAAQ;GACZ,MAAM,QAAQ;GACd;GACA,eAAe,QAAQ;GACvB,CAAC;AACF,MAAI,SAAS,KAAM;AACnB,WAAS,KAAK;GAAE;GAAQ,MAAM,GAAG,UAAU;GAAQ,CAAC;;AAErD,KAAI,SAAS,WAAW,EAAG,QAAO,EAAE;AAEpC,UAAS,MAAM,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,OAAO,CAAC;CACzD,MAAM,aAAkC,SAAS,KAAK,OAAO;EAC5D,UAAU,EAAE;EACZ,MAAM,EAAE;EACR,EAAE;CAIH,MAAM,gBAAgB,eAAe,EAAE;CACvC,MAAM,WAAW,SAAS,MAAM,MAAM,EAAE,WAAW,cAAc,IAAI,SAAS;AAC9E,KAAI,SACH,YAAW,KAAK;EAAE,UAAU;EAAa,MAAM,SAAS;EAAM,CAAC;AAGhE,QAAO"}

package/dist/http-route-dispatch-rXKvTNm9.mjs

@@ -0,0 +1,342 @@
+import { n as generateFieldSchema } from "./zod-generator--nlM0930.mjs";
+import { n as apiSuccess, t as apiError } from "./error-BCMgPxdn.mjs";
+import { i as pluginRouteResponseToWire, n as parseDeclaredPluginRouteInput, r as pluginRouteResponseFromWire, t as PluginRouteRequestError } from "./route-wire-Ca_HWCZ5.mjs";
+import { a as requireOwnerPerm, o as requirePerm } from "./authorize-NJgp8kLI.mjs";
+import { n as requireScope } from "./scopes-DNaY7Ey0.mjs";
+import { Permissions } from "@emdash-cms/auth";
+import { getLocaleDir, resolveLocale } from "@emdash-cms/admin/locales";
+import { isEditorDraftPatchEffect, validateContentEditorPanelInteraction, validateEditorDraftPatchEffect } from "@emdash-cms/blocks/server";
+
+//#region src/plugins/editor-draft.ts
+const EDITOR_DRAFT_LIMITS = {
+	maxFields: 32,
+	maxSnapshotBytes: 192 * 1024,
+	maxFieldBytes: 64 * 1024
+};
+const ENCODER = new TextEncoder();
+const INVOCATION_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isBrowserDraftRequest(value) {
+	return isRecord$1(value) && typeof value.collection === "string" && typeof value.entryId === "string" && (value.locale === null || typeof value.locale === "string") && typeof value.baseRevision === "string" && typeof value.generation === "number" && typeof value.invocationId === "string" && isRecord$1(value.fields);
+}
+function jsonBytes(value) {
+	try {
+		return ENCODER.encode(JSON.stringify(value)).byteLength;
+	} catch {
+		return null;
+	}
+}
+function selectedFields(collection, selector) {
+	const selected = new Set(selector?.fields ?? []);
+	if (selector?.translatable) {
+		for (const field of collection.fields) if (field.translatable) selected.add(field.slug);
+	}
+	return selected;
+}
+function sanitizeField(field) {
+	return {
+		slug: field.slug,
+		label: field.label,
+		type: field.type,
+		required: field.required,
+		translatable: field.translatable,
+		...field.validation ? { validation: { ...field.validation } } : {}
+	};
+}
+function fail(code, message) {
+	return {
+		code,
+		message
+	};
+}
+function validateEditorDraftRequest(input) {
+	if (!isBrowserDraftRequest(input.request)) return fail("EDITOR_DRAFT_INVALID", "Invalid editor draft snapshot");
+	const request = input.request;
+	if (request.collection !== input.collection.slug || request.entryId !== input.entry.id || request.locale !== input.entry.locale) return fail("EDITOR_DRAFT_STALE", "Editor draft identity is stale");
+	if (request.baseRevision !== input.entry.revision) return fail("EDITOR_DRAFT_STALE", "Editor draft base revision is stale");
+	if (!Number.isSafeInteger(request.generation) || request.generation < 0 || typeof request.invocationId !== "string" || !INVOCATION_PATTERN.test(request.invocationId)) return fail("EDITOR_DRAFT_INVALID", "Invalid editor draft invocation identity");
+	const size = jsonBytes(request);
+	if (size === null) return fail("EDITOR_DRAFT_INVALID", "Editor draft snapshot must be JSON serializable");
+	if (size > EDITOR_DRAFT_LIMITS.maxSnapshotBytes) return fail("EDITOR_DRAFT_TOO_LARGE", "Editor draft snapshot exceeds the size limit");
+	const readFields = selectedFields(input.collection, input.readSelector);
+	const patchFields = selectedFields(input.collection, input.patchSelector);
+	if (readFields.size > EDITOR_DRAFT_LIMITS.maxFields || patchFields.size > EDITOR_DRAFT_LIMITS.maxFields) return fail("EDITOR_DRAFT_TOO_LARGE", "Editor draft selector exceeds the field limit");
+	const supplied = Object.keys(request.fields);
+	if (supplied.length > EDITOR_DRAFT_LIMITS.maxFields) return fail("EDITOR_DRAFT_TOO_LARGE", "Editor draft snapshot exceeds the field limit");
+	if (supplied.length > 0 && !input.canRead) return fail("EDITOR_DRAFT_CAPABILITY_REQUIRED", "Plugin cannot read unsaved editor content");
+	const bySlug = new Map(input.collection.fields.map((field) => [field.slug, field]));
+	const patchFieldDefinitions = Array.from(patchFields, (slug) => bySlug.get(slug)).filter((field) => Boolean(field && !field.unsupportedType)).map(sanitizeField);
+	const fields = {};
+	const fieldDefinitions = [];
+	for (const slug of supplied) {
+		if (!readFields.has(slug)) return fail("EDITOR_DRAFT_FIELD_FORBIDDEN", `Editor draft field '${slug}' is not allowed`);
+		const field = bySlug.get(slug);
+		if (!field || field.unsupportedType) return fail("EDITOR_DRAFT_UNSUPPORTED_FIELD_TYPE", `Editor draft field '${slug}' has an unsupported type`);
+		const fieldSize = jsonBytes(request.fields[slug]);
+		if (fieldSize === null) return fail("EDITOR_DRAFT_INVALID", `Editor draft field '${slug}' is invalid`);
+		if (fieldSize > EDITOR_DRAFT_LIMITS.maxFieldBytes) return fail("EDITOR_DRAFT_TOO_LARGE", `Editor draft field '${slug}' exceeds the size limit`);
+		if (!generateFieldSchema(field).safeParse(request.fields[slug]).success) return fail("EDITOR_DRAFT_INVALID", `Editor draft field '${slug}' is invalid`);
+		fields[slug] = request.fields[slug];
+		fieldDefinitions.push(sanitizeField(field));
+	}
+	if (input.readSelector && !input.canRead) return fail("EDITOR_DRAFT_CAPABILITY_REQUIRED", "Plugin cannot read unsaved editor content");
+	if (input.patchSelector && !input.canPatch) return fail("EDITOR_DRAFT_CAPABILITY_REQUIRED", "Plugin cannot propose unsaved editor changes");
+	return {
+		snapshot: {
+			collection: input.collection.slug,
+			entryId: input.entry.id,
+			locale: input.entry.locale,
+			baseRevision: input.entry.revision,
+			invocationId: request.invocationId,
+			fields,
+			fieldDefinitions
+		},
+		receipt: {
+			entryId: input.entry.id,
+			locale: input.entry.locale,
+			baseRevision: input.entry.revision,
+			generation: request.generation,
+			invocationId: request.invocationId,
+			fieldDefinitions: patchFieldDefinitions
+		},
+		readFields,
+		patchFields
+	};
+}
+function validateEditorDraftPatch(input) {
+	if (!validateEditorDraftPatchEffect(input.patch).valid || !isEditorDraftPatchEffect(input.patch)) return fail("EDITOR_DRAFT_INVALID", "Plugin returned an invalid editor draft patch");
+	const patch = input.patch;
+	const bySlug = new Map(input.collection.fields.map((field) => [field.slug, field]));
+	for (const operation of patch.operations) {
+		if (!input.allowedFields.has(operation.field)) return fail("EDITOR_DRAFT_FIELD_FORBIDDEN", `Editor draft field '${operation.field}' is not allowed`);
+		const field = bySlug.get(operation.field);
+		if (!field || field.unsupportedType) return fail("EDITOR_DRAFT_UNSUPPORTED_FIELD_TYPE", `Editor draft field '${operation.field}' has an unsupported type`);
+		const value = operation.op === "clear" ? null : operation.value;
+		if (!generateFieldSchema(field).safeParse(value).success) return fail("EDITOR_DRAFT_INVALID", `Editor draft field '${operation.field}' is invalid`);
+		const fieldSize = jsonBytes(value);
+		if (fieldSize === null || fieldSize > EDITOR_DRAFT_LIMITS.maxFieldBytes) return fail("EDITOR_DRAFT_TOO_LARGE", `Editor draft field '${operation.field}' exceeds the size limit`);
+	}
+	return patch;
+}
+
+//#endregion
+//#region src/plugins/http-route-dispatch.ts
+function editorDraftErrorResponse(error) {
+	const status = error.code === "EDITOR_DRAFT_STALE" ? 409 : error.code === "EDITOR_DRAFT_FIELD_FORBIDDEN" || error.code === "EDITOR_DRAFT_CAPABILITY_REQUIRED" ? 403 : error.code === "EDITOR_DRAFT_TOO_LARGE" ? 413 : error.code === "EDITOR_DRAFT_UNSUPPORTED_FIELD_TYPE" ? 422 : 400;
+	return apiError(error.code, error.message, status);
+}
+function toRoleLevel$1(value) {
+	if (value === 10 || value === 20 || value === 30 || value === 40 || value === 50) return value;
+	return null;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPermission(value) {
+	return Object.hasOwn(Permissions, value);
+}
+function authorizePrivatePluginRouteRequest(routeMeta, request, user, tokenScopes) {
+	const permission = routeMeta.permission ?? "plugins:manage";
+	if (!isPermission(permission)) return apiError("INVALID_PLUGIN_ROUTE", "Plugin route declares an invalid permission", 500);
+	let permissionUser;
+	if (user) {
+		const role = toRoleLevel$1(user.role);
+		if (role === null) return apiError("INVALID_USER", "Authenticated user has an invalid role", 500);
+		permissionUser = {
+			id: user.id,
+			role
+		};
+	} else permissionUser = user;
+	const denied = requirePerm(permissionUser, permission);
+	if (denied) return denied;
+	const scopeError = requireScope({ tokenScopes }, "admin");
+	if (scopeError) return scopeError;
+	if (!tokenScopes && request.headers.get("X-EmDash-Request") !== "1") return apiError("CSRF_REJECTED", "Missing required header", 403);
+	return null;
+}
+/** Dispatch a request through the production plugin-route policy boundary. */
+async function dispatchPluginApiRequest({ runtime, pluginId, path, request, user, tokenScopes, invalidateContentCache, editorDispatch }) {
+	const method = request.method.toUpperCase();
+	const routeMeta = runtime.getPluginRouteMeta(pluginId, path);
+	if (!routeMeta) return apiError("NOT_FOUND", "Plugin route not found", 404);
+	if (!routeMeta.public) {
+		const denied = authorizePrivatePluginRouteRequest(routeMeta, request, user, tokenScopes);
+		if (denied) return denied;
+	}
+	if (routeMeta.methods && !routeMeta.methods.some((allowed) => allowed === method)) {
+		const response = apiError("METHOD_NOT_ALLOWED", "Method not allowed", 405);
+		response.headers.set("Allow", routeMeta.methods.join(", "));
+		return response;
+	}
+	const caller = routeMeta.public ? void 0 : user ?? void 0;
+	const result = await runtime.handlePluginApiRoute(pluginId, method, path, request, caller, invalidateContentCache, editorDispatch);
+	if (!result.success) {
+		const code = result.error?.code ?? "PLUGIN_ERROR";
+		const message = code === "INTERNAL_ERROR" ? "Plugin route error" : result.error?.message ?? "Plugin route error";
+		const status = result.status ?? (code === "NOT_FOUND" ? 404 : 400);
+		const details = code !== "INTERNAL_ERROR" && result.error && "details" in result.error ? result.error.details : void 0;
+		return apiError(code, message, status, isRecord(details) ? details : void 0);
+	}
+	let response;
+	if (routeMeta.response === "raw") try {
+		response = pluginRouteResponseFromWire(await pluginRouteResponseToWire(result.data, routeMeta.public ? { publicRequestUrl: request.url } : { allowExternalLocation: true }), method);
+	} catch (error) {
+		console.error(`[plugin:${pluginId}] Invalid raw route response:`, error);
+		return apiError("INVALID_PLUGIN_RESPONSE", "Plugin returned an invalid response", 500);
+	}
+	else response = apiSuccess(result.data);
+	if (response.ok && routeMeta.public && routeMeta.cacheControl && (method === "GET" || method === "HEAD")) response.headers.set("Cache-Control", routeMeta.cacheControl);
+	else response.headers.set("Cache-Control", "private, no-store");
+	return response;
+}
+const EDITOR_EXTENSION_REQUEST_MAX_BYTES = 256 * 1024;
+/** Dispatch a saved-entry extension through ownership, route, and isolate policy. */
+async function dispatchPluginEditorExtensionApiRequest({ runtime, pluginId, kind, extensionId, collection, entryId, request, user, tokenScopes, invalidateContentCache }) {
+	const definition = runtime.getPluginEditorExtension(pluginId, kind, extensionId, collection);
+	if (!definition) return apiError("NOT_FOUND", "Plugin editor extension not found", 404);
+	const routeMeta = runtime.getPluginRouteMeta(pluginId, definition.extension.route);
+	if (!routeMeta || routeMeta.public) return apiError("INVALID_PLUGIN_EDITOR_EXTENSION", "Plugin editor extension must reference a private route", 500);
+	const denied = authorizePrivatePluginRouteRequest(routeMeta, request, user, tokenScopes);
+	if (denied) return denied;
+	const requestedLocale = new URL(request.url).searchParams.get("locale") || void 0;
+	const contentResult = await runtime.handleContentGet(collection, entryId, requestedLocale);
+	if (!contentResult.success) return contentResult.error?.code === "NOT_FOUND" ? apiError("NOT_FOUND", "Content item not found", 404) : apiError("CONTENT_GET_ERROR", "Failed to load content item", 500);
+	const contentData = contentResult.data;
+	const item = typeof contentData === "object" && contentData !== null && "item" in contentData ? contentData.item : null;
+	if (typeof item !== "object" || item === null) return apiError("CONTENT_GET_ERROR", "Failed to load content item", 500);
+	const authorId = "authorId" in item && typeof item.authorId === "string" ? item.authorId : "";
+	let ownershipUser = user == null ? user : void 0;
+	if (user) {
+		const ownerRole = toRoleLevel$1(user.role);
+		if (ownerRole === null) return apiError("INVALID_USER", "Authenticated user has an invalid role", 500);
+		ownershipUser = {
+			id: user.id,
+			role: ownerRole
+		};
+	}
+	const ownershipDenied = requireOwnerPerm(ownershipUser, authorId, "content:edit_own", "content:edit_any");
+	if (ownershipDenied) return ownershipDenied;
+	const canonicalId = "id" in item && typeof item.id === "string" ? item.id : null;
+	const canonicalLocale = "locale" in item && typeof item.locale === "string" ? item.locale : null;
+	const version = "version" in item && typeof item.version === "number" ? item.version : null;
+	const baseRevision = typeof contentData === "object" && contentData !== null && "_rev" in contentData && typeof contentData._rev === "string" ? contentData._rev : null;
+	if (!canonicalId || version === null) return apiError("CONTENT_GET_ERROR", "Content item has invalid identity", 500);
+	let input;
+	let editorBody;
+	try {
+		editorBody = await parseDeclaredPluginRouteInput(request, {
+			body: "json",
+			maxBytes: EDITOR_EXTENSION_REQUEST_MAX_BYTES
+		});
+	} catch (error) {
+		if (error instanceof PluginRouteRequestError) return apiError(error.status === 413 ? "EDITOR_DRAFT_TOO_LARGE" : "INVALID_REQUEST", error.status === 413 ? "Editor interaction exceeds the size limit" : "Invalid editor interaction", error.status);
+		return apiError("INVALID_REQUEST", "Editor interaction could not be read", 400);
+	}
+	if (kind === "panel") {
+		if (!isRecord(editorBody)) return apiError("INVALID_REQUEST", "Editor panel interaction must be an object", 400);
+		input = editorBody;
+		if (!validateContentEditorPanelInteraction(input).valid) return apiError("INVALID_PLUGIN_UI_CONTEXT", "Invalid editor panel interaction", 400);
+	} else {
+		if (!isRecord(editorBody)) return apiError("INVALID_REQUEST", "Invalid editor action interaction", 400);
+		input = {
+			type: "editor_action",
+			...Object.hasOwn(editorBody, "draft") ? { draft: editorBody.draft } : {}
+		};
+	}
+	let validatedDraft = null;
+	if (input.draft !== void 0) {
+		if (!baseRevision) return apiError("EDITOR_DRAFT_INVALID", "Content item has no draft revision identity", 409);
+		const collectionSchema = await runtime.getPluginEditorDraftSchema(collection);
+		if (!collectionSchema) return apiError("NOT_FOUND", "Collection not found", 404);
+		const draft = validateEditorDraftRequest({
+			request: input.draft,
+			collection: collectionSchema,
+			entry: {
+				id: canonicalId,
+				locale: canonicalLocale,
+				revision: baseRevision
+			},
+			readSelector: definition.extension.draft?.read,
+			patchSelector: definition.extension.draft?.patch,
+			canRead: definition.capabilities.includes("admin.editor-draft:read"),
+			canPatch: definition.capabilities.includes("admin.editor-draft:patch")
+		});
+		if ("code" in draft) {
+			console.warn(`[plugin:${pluginId}] Editor draft ${kind}/${extensionId} rejected: ${draft.code}`);
+			return editorDraftErrorResponse(draft);
+		}
+		validatedDraft = draft;
+		input = {
+			...input,
+			draft: draft.snapshot
+		};
+	}
+	const headers = new Headers(request.headers);
+	headers.delete("content-length");
+	headers.delete("content-encoding");
+	headers.set("Content-Type", "application/json");
+	const pluginRequest = new Request(request.url, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(input)
+	});
+	const locale = resolveLocale(request);
+	const response = await dispatchPluginApiRequest({
+		runtime,
+		pluginId,
+		path: definition.extension.route,
+		request: pluginRequest,
+		user,
+		tokenScopes,
+		invalidateContentCache,
+		editorDispatch: {
+			kind,
+			policy: definition.policy,
+			ui: {
+				surface: kind === "panel" ? "content-editor-panel" : "content-editor-action",
+				locale,
+				direction: getLocaleDir(locale),
+				contentLocale: canonicalLocale ?? void 0,
+				extensionId,
+				entry: {
+					collection,
+					id: canonicalId,
+					locale: canonicalLocale,
+					version
+				}
+			}
+		}
+	});
+	if (!response.ok) return response;
+	const envelope = await response.clone().json();
+	if (!isRecord(envelope) || !isRecord(envelope.data)) return apiError("INVALID_PLUGIN_RESPONSE", "Plugin returned an invalid response", 502);
+	const data = envelope.data;
+	if (data.patch === void 0 && !validatedDraft) return response;
+	if (data.patch !== void 0 && !validatedDraft) return apiError("EDITOR_DRAFT_INVALID", "Plugin returned an editor draft patch without a draft invocation", 400);
+	if (data.patch !== void 0) {
+		const collectionSchema = await runtime.getPluginEditorDraftSchema(collection);
+		if (!collectionSchema) return apiError("NOT_FOUND", "Collection not found", 404);
+		const patch = validateEditorDraftPatch({
+			patch: data.patch,
+			collection: collectionSchema,
+			allowedFields: validatedDraft?.patchFields ?? /* @__PURE__ */ new Set()
+		});
+		if ("code" in patch) {
+			console.warn(`[plugin:${pluginId}] Editor draft ${kind}/${extensionId} rejected: ${patch.code}`);
+			return editorDraftErrorResponse(patch);
+		}
+		data.patch = patch;
+	}
+	const finalResponse = apiSuccess({
+		...data,
+		editorInvocation: validatedDraft?.receipt
+	});
+	finalResponse.headers.set("Cache-Control", "private, no-store");
+	return finalResponse;
+}
+
+//#endregion
+export { validateEditorDraftRequest as i, dispatchPluginEditorExtensionApiRequest as n, validateEditorDraftPatch as r, dispatchPluginApiRequest as t };
+//# sourceMappingURL=http-route-dispatch-rXKvTNm9.mjs.map