dineway 0.1.9 → 0.1.12

package/dist/astro/routes/api/media/_id_/confirm.d.mts

@@ -0,0 +1,10 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/[id]/confirm.d.ts
+declare const prerender = false;
+/**
+ * Confirm upload completion
+ */
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/media/_id_/confirm.mjs

@@ -0,0 +1,59 @@
+import "../../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BMUPwxgx.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-C9106ehs.mjs";
+import { Lt as mediaConfirmBody } from "../../../../../redirects-lrlmYXVE.mjs";
+import "../../../../../import-CNcKWTbp.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { n as requirePerm, t as requireOwnerPerm } from "../../../../../authorize-BAdbMCwC.mjs";
+import { MediaRepository } from "dineway";
+
+//#region src/astro/routes/api/media/[id]/confirm.ts
+const prerender = false;
+/**
+* Add URL to media item (relative URL for portability)
+*/
+function addUrlToMedia(item) {
+	return {
+		...item,
+		url: `/_dineway/api/media/file/${item.storageKey}`
+	};
+}
+/**
+* Confirm upload completion
+*/
+const POST = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { id } = params;
+	const denied = requirePerm(user, "media:upload");
+	if (denied) return denied;
+	if (!id) return apiError("INVALID_REQUEST", "Media ID is required", 400);
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const body = await parseOptionalBody(request, mediaConfirmBody, {});
+		if (isParseError(body)) return body;
+		const repo = new MediaRepository(dineway.db);
+		const existing = await repo.findById(id);
+		if (!existing) return apiError("NOT_FOUND", `Media item not found: ${id}`, 404);
+		if (existing.status !== "pending") return apiError("INVALID_STATE", `Media item is not pending: ${existing.status}`, 400);
+		const ownerDenied = requireOwnerPerm(user, existing.authorId ?? "", "media:edit_own", "media:edit_any");
+		if (ownerDenied) return ownerDenied;
+		if (dineway.storage) {
+			if (!await dineway.storage.exists(existing.storageKey)) {
+				await repo.markFailed(id);
+				return apiError("FILE_NOT_FOUND", "File was not uploaded to storage", 400);
+			}
+		}
+		const item = await repo.confirmUpload(id, {
+			size: body.size,
+			width: body.width,
+			height: body.height
+		});
+		if (!item) return apiError("CONFIRM_FAILED", "Failed to confirm upload", 500);
+		return apiSuccess({ item: addUrlToMedia(item) });
+	} catch (error) {
+		return handleError(error, "Failed to confirm upload", "CONFIRM_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/media/_id_.d.mts

@@ -0,0 +1,22 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/[id].d.ts
+declare const prerender = false;
+/**
+ * Get media item
+ */
+declare const GET: APIRoute;
+/**
+ * Update media metadata
+ *
+ * Authors can edit their own media; editors+ can edit any.
+ */
+declare const PUT: APIRoute;
+/**
+ * Delete media item
+ *
+ * Authors can delete their own media; editors+ can delete any.
+ */
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, GET, PUT, prerender };

package/dist/astro/routes/api/media/_id_.mjs

@@ -0,0 +1,81 @@
+import "../../../../context-types-C-LwdAxx.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C9106ehs.mjs";
+import { Gt as mediaUpdateBody } from "../../../../redirects-lrlmYXVE.mjs";
+import "../../../../import-CNcKWTbp.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as requirePerm, t as requireOwnerPerm } from "../../../../authorize-BAdbMCwC.mjs";
+
+//#region src/astro/routes/api/media/[id].ts
+const prerender = false;
+/**
+* Get media item
+*/
+const GET = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const { id } = params;
+	const readDenied = requirePerm(user, "media:read");
+	if (readDenied) return readDenied;
+	if (!id) return apiError("INVALID_REQUEST", "Media ID required", 400);
+	if (!dineway?.handleMediaGet) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	return unwrapResult(await dineway.handleMediaGet(id));
+};
+/**
+* Update media metadata
+*
+* Authors can edit their own media; editors+ can edit any.
+*/
+const PUT = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { id } = params;
+	const editDenied = requirePerm(user, "media:edit_own");
+	if (editDenied) return editDenied;
+	if (!id) return apiError("INVALID_REQUEST", "Media ID required", 400);
+	if (!dineway?.handleMediaGet || !dineway?.handleMediaUpdate) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const getResult = await dineway.handleMediaGet(id);
+		if (!getResult.success || !getResult.data?.item) return apiError("NOT_FOUND", "Media item not found", 404);
+		const media = getResult.data.item;
+		const ownerDenied = requireOwnerPerm(user, media.authorId, "media:edit_own", "media:edit_any");
+		if (ownerDenied) return ownerDenied;
+		const body = await parseBody(request, mediaUpdateBody);
+		if (isParseError(body)) return body;
+		return unwrapResult(await dineway.handleMediaUpdate(id, {
+			alt: body.alt,
+			caption: body.caption,
+			width: body.width,
+			height: body.height
+		}));
+	} catch (error) {
+		return handleError(error, "Failed to update media", "MEDIA_UPDATE_ERROR");
+	}
+};
+/**
+* Delete media item
+*
+* Authors can delete their own media; editors+ can delete any.
+*/
+const DELETE = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const { id } = params;
+	const deleteDenied = requirePerm(user, "media:delete_own");
+	if (deleteDenied) return deleteDenied;
+	if (!id) return apiError("INVALID_REQUEST", "Media ID required", 400);
+	if (!dineway?.handleMediaGet || !dineway?.handleMediaDelete) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const getResult = await dineway.handleMediaGet(id);
+		if (!getResult.success || !getResult.data?.item) return apiError("NOT_FOUND", "Media item not found", 404);
+		const media = getResult.data.item;
+		const ownerDenied = requireOwnerPerm(user, media.authorId, "media:delete_own", "media:delete_any");
+		if (ownerDenied) return ownerDenied;
+		if (dineway.storage) try {
+			await dineway.storage.delete(media.storageKey);
+		} catch {}
+		return unwrapResult(await dineway.handleMediaDelete(id));
+	} catch (error) {
+		return handleError(error, "Failed to delete media", "MEDIA_DELETE_ERROR");
+	}
+};
+
+//#endregion
+export { DELETE, GET, PUT, prerender };

package/dist/astro/routes/api/media/file/_...key_.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/file/[...key].d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/media/file/_...key_.mjs

@@ -0,0 +1,49 @@
+import { r as handleError, t as apiError } from "../../../../../error-BMUPwxgx.mjs";
+
+//#region src/astro/routes/api/media/file/[...key].ts
+const prerender = false;
+/**
+* Content types that are safe to display inline (simple raster/vector images, video, audio).
+* Everything else gets Content-Disposition: attachment to prevent script execution.
+*/
+const SAFE_INLINE_TYPES = new Set([
+	"image/jpeg",
+	"image/png",
+	"image/gif",
+	"image/webp",
+	"image/avif",
+	"image/x-icon",
+	"video/mp4",
+	"video/webm",
+	"audio/mpeg",
+	"audio/wav",
+	"audio/ogg"
+]);
+const GET = async ({ params, locals }) => {
+	const { key } = params;
+	const { dineway } = locals;
+	if (!key) return apiError("NOT_FOUND", "File not found", 404);
+	if (!dineway?.storage) return apiError("NOT_CONFIGURED", "Storage not configured", 500);
+	try {
+		const result = await dineway.storage.download(key);
+		const headers = {
+			"Content-Type": result.contentType,
+			"Cache-Control": "public, max-age=31536000, immutable",
+			"X-Content-Type-Options": "nosniff",
+			"Content-Security-Policy": "sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'"
+		};
+		if (result.size) headers["Content-Length"] = String(result.size);
+		if (SAFE_INLINE_TYPES.has(result.contentType)) headers["Content-Disposition"] = "inline";
+		else headers["Content-Disposition"] = "attachment";
+		return new Response(result.body, {
+			status: 200,
+			headers
+		});
+	} catch (error) {
+		if (error instanceof Error && (error.message.includes("not found") || error.message.includes("NOT_FOUND"))) return apiError("NOT_FOUND", "File not found", 404);
+		return handleError(error, "Failed to serve file", "FILE_SERVE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/media/providers/_providerId_/_itemId_.d.mts

@@ -0,0 +1,14 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/providers/[providerId]/[itemId].d.ts
+declare const prerender = false;
+/**
+ * Get a single media item from a provider
+ */
+declare const GET: APIRoute;
+/**
+ * Delete a media item from a provider
+ */
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, GET, prerender };

package/dist/astro/routes/api/media/providers/_providerId_/_itemId_.mjs

@@ -0,0 +1,49 @@
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BMUPwxgx.mjs";
+import { n as requirePerm } from "../../../../../../authorize-BAdbMCwC.mjs";
+
+//#region src/astro/routes/api/media/providers/[providerId]/[itemId].ts
+const prerender = false;
+/**
+* Get a single media item from a provider
+*/
+const GET = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const denied = requirePerm(user, "media:read");
+	if (denied) return denied;
+	const { providerId, itemId } = params;
+	if (!providerId || !itemId) return apiError("INVALID_REQUEST", "Provider ID and Item ID required", 400);
+	if (!dineway?.getMediaProvider) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const provider = dineway.getMediaProvider(providerId);
+	if (!provider) return apiError("NOT_FOUND", `Provider "${providerId}" not found`, 404);
+	if (!provider.get) return apiError("NOT_SUPPORTED", `Provider "${providerId}" does not support getting individual items`, 400);
+	try {
+		const item = await provider.get(itemId);
+		if (!item) return apiError("NOT_FOUND", "Item not found", 404);
+		return apiSuccess({ item });
+	} catch (error) {
+		return handleError(error, "Failed to get item from provider", "PROVIDER_GET_ERROR");
+	}
+};
+/**
+* Delete a media item from a provider
+*/
+const DELETE = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const denied = requirePerm(user, "media:delete_any");
+	if (denied) return denied;
+	const { providerId, itemId } = params;
+	if (!providerId || !itemId) return apiError("INVALID_REQUEST", "Provider ID and Item ID required", 400);
+	if (!dineway?.getMediaProvider) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const provider = dineway.getMediaProvider(providerId);
+	if (!provider) return apiError("NOT_FOUND", `Provider "${providerId}" not found`, 404);
+	if (!provider.delete) return apiError("NOT_SUPPORTED", `Provider "${providerId}" does not support deletion`, 400);
+	try {
+		await provider.delete(itemId);
+		return apiSuccess({ deleted: true });
+	} catch (error) {
+		return handleError(error, "Failed to delete item from provider", "PROVIDER_DELETE_ERROR");
+	}
+};
+
+//#endregion
+export { DELETE, GET, prerender };

package/dist/astro/routes/api/media/providers/_providerId_/index.d.mts

@@ -0,0 +1,14 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/providers/[providerId]/index.d.ts
+declare const prerender = false;
+/**
+ * List media from a specific provider
+ */
+declare const GET: APIRoute;
+/**
+ * Upload media to a specific provider
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/media/providers/_providerId_/index.mjs

@@ -0,0 +1,72 @@
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BMUPwxgx.mjs";
+import { n as requirePerm } from "../../../../../../authorize-BAdbMCwC.mjs";
+
+//#region src/astro/routes/api/media/providers/[providerId]/index.ts
+const prerender = false;
+/**
+* List media from a specific provider
+*/
+const GET = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { providerId } = params;
+	const readDenied = requirePerm(user, "media:read");
+	if (readDenied) return readDenied;
+	if (!providerId) return apiError("INVALID_REQUEST", "Provider ID required", 400);
+	if (!dineway?.getMediaProvider) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const provider = dineway.getMediaProvider(providerId);
+	if (!provider) return apiError("NOT_FOUND", `Provider "${providerId}" not found`, 404);
+	const url = new URL(request.url);
+	const cursor = url.searchParams.get("cursor") || void 0;
+	const rawLimit = url.searchParams.get("limit");
+	const limit = rawLimit ? Math.max(1, Math.min(parseInt(rawLimit, 10) || 50, 100)) : void 0;
+	const query = url.searchParams.get("query") || void 0;
+	const mimeType = url.searchParams.get("mimeType") || void 0;
+	try {
+		const result = await provider.list({
+			cursor,
+			limit,
+			query,
+			mimeType
+		});
+		return apiSuccess({
+			items: result.items,
+			nextCursor: result.nextCursor
+		});
+	} catch (error) {
+		return handleError(error, "Failed to list media from provider", "PROVIDER_LIST_ERROR");
+	}
+};
+/**
+* Upload media to a specific provider
+*/
+const POST = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { providerId } = params;
+	const uploadDenied = requirePerm(user, "media:upload");
+	if (uploadDenied) return uploadDenied;
+	if (!providerId) return apiError("INVALID_REQUEST", "Provider ID required", 400);
+	if (!dineway?.getMediaProvider) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const provider = dineway.getMediaProvider(providerId);
+	if (!provider) return apiError("NOT_FOUND", `Provider "${providerId}" not found`, 404);
+	if (!provider.upload) return apiError("NOT_SUPPORTED", `Provider "${providerId}" does not support uploads`, 400);
+	try {
+		const formData = await request.formData();
+		const fileEntry = formData.get("file");
+		const file = fileEntry instanceof File ? fileEntry : null;
+		const altEntry = formData.get("alt");
+		const alt = typeof altEntry === "string" ? altEntry : null;
+		if (!file) return apiError("NO_FILE", "No file provided", 400);
+		const maxSize = dineway.config?.maxUploadSize ?? 50 * 1024 * 1024;
+		if (file.size > maxSize) return apiError("FILE_TOO_LARGE", `File exceeds maximum size of ${Math.round(maxSize / 1024 / 1024)}MB`, 413);
+		return apiSuccess({ item: await provider.upload({
+			file,
+			filename: file.name,
+			alt: alt || void 0
+		}) }, 201);
+	} catch (error) {
+		return handleError(error, "Failed to upload to provider", "PROVIDER_UPLOAD_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/media/providers/index.d.mts

@@ -0,0 +1,10 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/providers/index.d.ts
+declare const prerender = false;
+/**
+ * List all configured media providers
+ */
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/media/providers/index.mjs

@@ -0,0 +1,18 @@
+import { n as apiSuccess, t as apiError } from "../../../../../error-BMUPwxgx.mjs";
+import { n as requirePerm } from "../../../../../authorize-BAdbMCwC.mjs";
+
+//#region src/astro/routes/api/media/providers/index.ts
+const prerender = false;
+/**
+* List all configured media providers
+*/
+const GET = async ({ locals }) => {
+	const { dineway, user } = locals;
+	const denied = requirePerm(user, "media:read");
+	if (denied) return denied;
+	if (!dineway?.getMediaProviderList) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	return apiSuccess({ items: dineway.getMediaProviderList() });
+};
+
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/media/upload-url.d.mts

@@ -0,0 +1,10 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/upload-url.d.ts
+declare const prerender = false;
+/**
+ * Get a signed upload URL for direct-to-storage upload
+ */
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/media/upload-url.mjs

@@ -0,0 +1,82 @@
+import "../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C9106ehs.mjs";
+import { Ft as DEFAULT_MAX_UPLOAD_SIZE, Kt as mediaUploadUrlBody } from "../../../../redirects-lrlmYXVE.mjs";
+import "../../../../import-CNcKWTbp.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as requirePerm } from "../../../../authorize-BAdbMCwC.mjs";
+import { ulid } from "ulidx";
+import * as path from "node:path";
+import { MediaRepository } from "dineway";
+
+//#region src/astro/routes/api/media/upload-url.ts
+/**
+* Media upload URL endpoint
+*
+* POST /_dineway/api/media/upload-url
+*
+* Returns a signed URL for direct upload to storage.
+* Creates a pending media record that must be confirmed after upload.
+*/
+const prerender = false;
+/**
+* Get a signed upload URL for direct-to-storage upload
+*/
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	const denied = requirePerm(user, "media:upload");
+	if (denied) return denied;
+	if (!dineway?.storage) return apiError("NO_STORAGE", "Storage not configured. Signed URL uploads require S3-compatible storage.", 501);
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const maxUploadSize = dineway.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;
+		if (!Number.isFinite(maxUploadSize) || maxUploadSize <= 0) return apiError("CONFIGURATION_ERROR", "Invalid maxUploadSize configuration. Expected a positive finite number.", 500);
+		const body = await parseBody(request, mediaUploadUrlBody(maxUploadSize));
+		if (isParseError(body)) return body;
+		if (![
+			"image/",
+			"video/",
+			"audio/",
+			"application/pdf"
+		].some((type) => body.contentType.startsWith(type))) return apiError("INVALID_TYPE", "File type not allowed", 400);
+		const repo = new MediaRepository(dineway.db);
+		if (body.contentHash) {
+			const existing = await repo.findByContentHash(body.contentHash);
+			if (existing) return apiSuccess({
+				existing: true,
+				mediaId: existing.id,
+				storageKey: existing.storageKey,
+				url: `/_dineway/api/media/file/${existing.storageKey}`
+			});
+		}
+		const storageKey = `${ulid()}${path.extname(body.filename) || ""}`;
+		const mediaItem = await repo.createPending({
+			filename: body.filename,
+			mimeType: body.contentType,
+			size: body.size,
+			storageKey,
+			contentHash: body.contentHash,
+			authorId: user?.id
+		});
+		const signedUrl = await dineway.storage.getSignedUploadUrl({
+			key: storageKey,
+			contentType: body.contentType,
+			size: body.size,
+			expiresIn: 3600
+		});
+		return apiSuccess({
+			uploadUrl: signedUrl.url,
+			method: signedUrl.method,
+			headers: signedUrl.headers,
+			mediaId: mediaItem.id,
+			storageKey,
+			expiresAt: signedUrl.expiresAt
+		});
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "NOT_SUPPORTED") return apiError("NOT_SUPPORTED", "Storage does not support signed upload URLs. Use direct upload.", 501);
+		return handleError(error, "Failed to generate upload URL", "UPLOAD_URL_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/media.d.mts

@@ -0,0 +1,16 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media.d.ts
+declare const prerender = false;
+/**
+ * List media items
+ */
+declare const GET: APIRoute;
+/**
+ * Upload media file
+ *
+ * Uses the configured storage adapter to store the file.
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/media.mjs

@@ -0,0 +1,137 @@
+import "../../../base64-Cz-aU0X1.mjs";
+import "../../../types-Bs6lTBBW.mjs";
+import { t as MediaRepository } from "../../../media-_7Fxdu45.mjs";
+import { t as generatePlaceholder } from "../../../placeholder-C2P5fKa4.mjs";
+import "../../../context-types-C-LwdAxx.mjs";
+import { t as computeContentHash } from "../../../hash-CDX7M0ze.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../error-BMUPwxgx.mjs";
+import { i as parseQuery, t as isParseError } from "../../../parse-C9106ehs.mjs";
+import { Ft as DEFAULT_MAX_UPLOAD_SIZE, It as formatFileSize, Vt as mediaListQuery } from "../../../redirects-lrlmYXVE.mjs";
+import "../../../import-CNcKWTbp.mjs";
+import "../../../api/schemas/index.mjs";
+import { n as requirePerm } from "../../../authorize-BAdbMCwC.mjs";
+import { ulid } from "ulidx";
+import * as path from "node:path";
+
+//#region src/astro/routes/api/media.ts
+/**
+* Media list and upload endpoint
+*
+* GET /_dineway/api/media - List all media
+* POST /_dineway/api/media - Upload new media (via configured storage adapter)
+*/
+const prerender = false;
+/**
+* Add URL to media items
+* Uses relative URLs to ensure portability across deployments
+*/
+function addUrlToMedia(item) {
+	return {
+		...item,
+		url: `/_dineway/api/media/file/${item.storageKey}`
+	};
+}
+/**
+* List media items
+*/
+const GET = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	const denied = requirePerm(user, "media:read");
+	if (denied) return denied;
+	if (!dineway?.handleMediaList) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const query = parseQuery(new URL(request.url), mediaListQuery);
+	if (isParseError(query)) return query;
+	const result = await dineway.handleMediaList({
+		cursor: query.cursor,
+		limit: query.limit,
+		mimeType: query.mimeType
+	});
+	if (!result.success) return unwrapResult(result);
+	return apiSuccess({
+		items: result.data.items.map((item) => addUrlToMedia(item)),
+		nextCursor: result.data.nextCursor
+	});
+};
+/**
+* Upload media file
+*
+* Uses the configured storage adapter to store the file.
+*/
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	const denied = requirePerm(user, "media:upload");
+	if (denied) return denied;
+	if (!dineway?.handleMediaCreate) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	if (!dineway?.storage) return apiError("NO_STORAGE", "Storage not configured", 500);
+	try {
+		const maxUploadSize = dineway.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;
+		if (!Number.isFinite(maxUploadSize) || maxUploadSize <= 0) return apiError("CONFIGURATION_ERROR", "Invalid maxUploadSize configuration", 500);
+		const contentLength = request.headers.get("Content-Length");
+		if (contentLength && parseInt(contentLength, 10) > maxUploadSize) return apiError("PAYLOAD_TOO_LARGE", "Upload too large", 413);
+		const formData = await request.formData();
+		const fileEntry = formData.get("file");
+		const file = fileEntry instanceof File ? fileEntry : null;
+		if (!file) return apiError("NO_FILE", "No file provided", 400);
+		if (![
+			"image/",
+			"video/",
+			"audio/",
+			"application/pdf"
+		].some((type) => file.type.startsWith(type))) return apiError("INVALID_TYPE", "File type not allowed", 400);
+		if (file.size > maxUploadSize) return apiError("PAYLOAD_TOO_LARGE", `File exceeds maximum size of ${formatFileSize(maxUploadSize)}`, 413);
+		const buffer = new Uint8Array(await file.arrayBuffer());
+		const contentHash = await computeContentHash(buffer);
+		const existing = await new MediaRepository(dineway.db).findByContentHash(contentHash);
+		if (existing) return apiSuccess({
+			item: addUrlToMedia(existing),
+			deduplicated: true
+		});
+		const storageKey = `${ulid()}${path.extname(file.name) || ""}`;
+		await dineway.storage.upload({
+			key: storageKey,
+			body: buffer,
+			contentType: file.type
+		});
+		const widthEntry = formData.get("width");
+		const widthStr = typeof widthEntry === "string" ? widthEntry : null;
+		const heightEntry = formData.get("height");
+		const heightStr = typeof heightEntry === "string" ? heightEntry : null;
+		const width = widthStr ? parseInt(widthStr, 10) : void 0;
+		const height = heightStr ? parseInt(heightStr, 10) : void 0;
+		const thumbnailEntry = formData.get("thumbnail");
+		const thumbnail = thumbnailEntry instanceof File ? thumbnailEntry : null;
+		let placeholder = null;
+		if (file.type.startsWith("image/")) if (thumbnail) placeholder = await generatePlaceholder(new Uint8Array(await thumbnail.arrayBuffer()), thumbnail.type);
+		else {
+			const clientDims = width && height ? {
+				width,
+				height
+			} : void 0;
+			placeholder = await generatePlaceholder(buffer, file.type, clientDims);
+		}
+		const result = await dineway.handleMediaCreate({
+			filename: file.name,
+			mimeType: file.type,
+			size: file.size,
+			width,
+			height,
+			storageKey,
+			contentHash,
+			blurhash: placeholder?.blurhash,
+			dominantColor: placeholder?.dominantColor,
+			authorId: user?.id
+		});
+		if (!result.success) {
+			try {
+				await dineway.storage.delete(storageKey);
+			} catch {}
+			return unwrapResult(result);
+		}
+		return apiSuccess({ item: addUrlToMedia(result.data.item) }, 201);
+	} catch (error) {
+		return handleError(error, "Upload failed", "UPLOAD_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };