emdash 0.0.0-a → 0.0.1

package/src/astro/routes/api/content/[collection]/[id]/restore.ts

@@ -0,0 +1,54 @@
+/**
+ * Restore content from trash endpoint - injected by EmDash integration
+ *
+ * POST /_emdash/api/content/{collection}/{id}/restore - Restore from trash
+ */
+
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm } from "#api/authorize.js";
+import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, locals, cache }) => {
+	const { emdash, user } = locals;
+	const collection = params.collection!;
+	const id = params.id!;
+
+	if (!emdash?.handleContentRestore || !emdash?.handleContentGetIncludingTrashed) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Fetch item including trashed items to check ownership
+	const existing = await emdash.handleContentGetIncludingTrashed(collection, id);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+	const existingData =
+		existing.data && typeof existing.data === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown data; narrowed by typeof check above
+				(existing.data as Record<string, unknown>)
+			: undefined;
+	// Handler returns { item, _rev } — extract the item for ownership check
+	const existingItem =
+		existingData?.item && typeof existingData.item === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed by typeof check above
+				(existingData.item as Record<string, unknown>)
+			: existingData;
+	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
+	const denied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	if (denied) return denied;
+
+	const result = await emdash.handleContentRestore(collection, id);
+
+	if (!result.success) return unwrapResult(result);
+
+	if (cache.enabled) await cache.invalidate({ tags: [collection, id] });
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/content/[collection]/[id]/revisions.ts

@@ -0,0 +1,31 @@
+/**
+ * Revisions API endpoint - injected by EmDash integration
+ *
+ * GET /_emdash/api/content/{collection}/{id}/revisions - List revisions
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, url, locals }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+	const collection = params.collection!;
+	const id = params.id!;
+
+	if (!emdash?.handleRevisionList) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const limit = url.searchParams.get("limit");
+	const result = await emdash.handleRevisionList(collection, id, {
+		limit: limit ? parseInt(limit, 10) : undefined,
+	});
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/content/[collection]/[id]/schedule.ts

@@ -0,0 +1,105 @@
+/**
+ * Schedule content for future publishing - injected by EmDash integration
+ *
+ * POST /_emdash/api/content/{collection}/{id}/schedule - Schedule for publishing
+ * DELETE /_emdash/api/content/{collection}/{id}/schedule - Unschedule (clear scheduled time)
+ */
+
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm } from "#api/authorize.js";
+import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { parseBody, isParseError } from "#api/parse.js";
+import { contentScheduleBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+/**
+ * Extract author ID from a content item response (shared by POST and DELETE).
+ */
+function extractOwnership(data: unknown): { authorId: string; resolvedId: string | undefined } {
+	const obj =
+		data && typeof data === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown; narrowed by typeof
+				(data as Record<string, unknown>)
+			: undefined;
+	const item =
+		obj?.item && typeof obj.item === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed by typeof
+				(obj.item as Record<string, unknown>)
+			: obj;
+	return {
+		authorId: typeof item?.authorId === "string" ? item.authorId : "",
+		resolvedId: typeof item?.id === "string" ? item.id : undefined,
+	};
+}
+
+export const POST: APIRoute = async ({ params, request, locals, cache }) => {
+	const { emdash, user } = locals;
+	const collection = params.collection!;
+	const id = params.id!;
+	const body = await parseBody(request, contentScheduleBody);
+	if (isParseError(body)) return body;
+
+	if (!emdash?.handleContentSchedule || !emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Fetch item to check ownership
+	const existing = await emdash.handleContentGet(collection, id);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+
+	const { authorId, resolvedId } = extractOwnership(existing.data);
+	const denied = requireOwnerPerm(user, authorId, "content:publish_own", "content:publish_any");
+	if (denied) return denied;
+
+	const result = await emdash.handleContentSchedule(
+		collection,
+		resolvedId ?? id,
+		body.scheduledAt,
+	);
+
+	if (!result.success) return unwrapResult(result);
+
+	if (cache.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+
+	return unwrapResult(result);
+};
+
+export const DELETE: APIRoute = async ({ params, locals, cache }) => {
+	const { emdash, user } = locals;
+	const collection = params.collection!;
+	const id = params.id!;
+
+	if (!emdash?.handleContentUnschedule || !emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Fetch item to check ownership
+	const existing = await emdash.handleContentGet(collection, id);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+
+	const { authorId, resolvedId } = extractOwnership(existing.data);
+	const denied = requireOwnerPerm(user, authorId, "content:publish_own", "content:publish_any");
+	if (denied) return denied;
+
+	const result = await emdash.handleContentUnschedule(collection, resolvedId ?? id);
+
+	if (!result.success) return unwrapResult(result);
+
+	if (cache.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/content/[collection]/[id]/terms/[taxonomy].ts

@@ -0,0 +1,140 @@
+/**
+ * Content-taxonomy association endpoint
+ *
+ * GET /_emdash/api/content/:collection/:id/terms/:taxonomy - Get terms for an entry
+ * POST /_emdash/api/content/:collection/:id/terms/:taxonomy - Set terms for an entry
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError, requireDb } from "#api/error.js";
+import { parseBody, isParseError } from "#api/parse.js";
+import { contentTermsBody } from "#api/schemas.js";
+import { TaxonomyRepository } from "#db/repositories/taxonomy.js";
+
+export const prerender = false;
+
+/**
+ * Get terms assigned to an entry
+ */
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const { collection, id, taxonomy } = params;
+
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+
+	if (!collection || !id || !taxonomy) {
+		return apiError("VALIDATION_ERROR", "Collection, id, and taxonomy required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	try {
+		const repo = new TaxonomyRepository(emdash!.db);
+		const terms = await repo.getTermsForEntry(collection, id, taxonomy);
+
+		return apiSuccess({
+			terms: terms.map((t) => ({
+				id: t.id,
+				name: t.name,
+				slug: t.slug,
+				label: t.label,
+				parentId: t.parentId,
+			})),
+		});
+	} catch (error) {
+		return handleError(error, "Failed to get entry terms", "TERMS_GET_ERROR");
+	}
+};
+
+/**
+ * Set terms for an entry (replaces existing)
+ */
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { collection, id, taxonomy } = params;
+
+	if (!collection || !id || !taxonomy) {
+		return apiError("VALIDATION_ERROR", "Collection, id, and taxonomy required", 400);
+	}
+
+	const denied = requirePerm(user, "content:edit_own");
+	if (denied) return denied;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	if (!emdash!.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Verify the content exists before modifying its terms
+	const existing = await emdash!.handleContentGet(collection, id);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "NOT_FOUND",
+			existing.error?.message ?? "Content not found",
+			existing.error?.code === "NOT_FOUND" ? 404 : 500,
+		);
+	}
+
+	// Check ownership for edit permission
+	const existingData =
+		existing.data && typeof existing.data === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown data; narrowed by typeof check above
+				(existing.data as Record<string, unknown>)
+			: undefined;
+	// Handler returns { item, _rev } — extract the item for ownership check
+	const existingItem =
+		existingData?.item && typeof existingData.item === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed by typeof check above
+				(existingData.item as Record<string, unknown>)
+			: existingData;
+	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
+	const editDenied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	if (editDenied) return editDenied;
+
+	try {
+		const body = await parseBody(request, contentTermsBody);
+		if (isParseError(body)) return body;
+		const { termIds } = body;
+
+		const repo = new TaxonomyRepository(emdash!.db);
+
+		// Verify all term IDs exist and belong to the correct taxonomy
+		for (const termId of termIds) {
+			const term = await repo.findById(termId);
+			if (!term) {
+				return apiError("NOT_FOUND", `Term ID '${termId}' not found`, 404);
+			}
+			if (term.name !== taxonomy) {
+				return apiError(
+					"VALIDATION_ERROR",
+					`Term ID '${termId}' does not belong to taxonomy '${taxonomy}'`,
+					400,
+				);
+			}
+		}
+
+		// Set the terms (replaces existing)
+		await repo.setTermsForEntry(collection, id, taxonomy, termIds);
+
+		// Get the updated terms
+		const terms = await repo.getTermsForEntry(collection, id, taxonomy);
+
+		return apiSuccess({
+			terms: terms.map((t) => ({
+				id: t.id,
+				name: t.name,
+				slug: t.slug,
+				label: t.label,
+				parentId: t.parentId,
+			})),
+		});
+	} catch (error) {
+		return handleError(error, "Failed to set entry terms", "TERMS_SET_ERROR");
+	}
+};

package/src/astro/routes/api/content/[collection]/[id]/translations.ts

@@ -0,0 +1,30 @@
+/**
+ * Content translations endpoint
+ *
+ * GET /_emdash/api/content/{collection}/{id}/translations
+ *
+ * Returns all locale variants linked to the same translation group.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+	const collection = params.collection!;
+	const id = params.id!;
+
+	if (!emdash?.handleContentTranslations) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const result = await emdash.handleContentTranslations(collection, id);
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/content/[collection]/[id]/unpublish.ts

@@ -0,0 +1,56 @@
+/**
+ * Unpublish content - removes from public view, preserves draft
+ *
+ * POST /_emdash/api/content/{collection}/{id}/unpublish
+ */
+
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm } from "#api/authorize.js";
+import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, locals, cache }) => {
+	const { emdash, user } = locals;
+	const collection = params.collection!;
+	const id = params.id!;
+
+	if (!emdash?.handleContentUnpublish || !emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Fetch item to check ownership
+	const existing = await emdash.handleContentGet(collection, id);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+
+	const existingData =
+		existing.data && typeof existing.data === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown data; narrowed by typeof check above
+				(existing.data as Record<string, unknown>)
+			: undefined;
+	const existingItem =
+		existingData?.item && typeof existingData.item === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed by typeof check above
+				(existingData.item as Record<string, unknown>)
+			: existingData;
+	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
+	const denied = requireOwnerPerm(user, authorId, "content:publish_own", "content:publish_any");
+	if (denied) return denied;
+
+	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
+
+	const result = await emdash.handleContentUnpublish(collection, resolvedId);
+
+	if (!result.success) return unwrapResult(result);
+
+	if (cache.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -0,0 +1,137 @@
+/**
+ * Single content item endpoints - injected by EmDash integration
+ *
+ * GET    /_emdash/api/content/{collection}/{id} - Get content
+ * PUT    /_emdash/api/content/{collection}/{id} - Update content
+ * DELETE /_emdash/api/content/{collection}/{id} - Delete content
+ */
+
+import { hasPermission, type Permission } from "@emdash-cms/auth";
+import type { APIRoute } from "astro";
+
+import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
+import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { parseBody, isParseError } from "#api/parse.js";
+import { contentUpdateBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, url, locals }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+	const collection = params.collection!;
+	const id = params.id!;
+	const locale = url.searchParams.get("locale") || undefined;
+
+	if (!emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const result = await emdash.handleContentGet(collection, id, locale);
+
+	return unwrapResult(result);
+};
+
+export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
+	const { emdash, user } = locals;
+	const collection = params.collection!;
+	const id = params.id!;
+	const body = await parseBody(request, contentUpdateBody);
+	if (isParseError(body)) return body;
+
+	if (!emdash?.handleContentUpdate || !emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Fetch item to check ownership
+	const existing = await emdash.handleContentGet(collection, id);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+
+	const existingData =
+		existing.data && typeof existing.data === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown data; narrowed by typeof check above
+				(existing.data as Record<string, unknown>)
+			: undefined;
+	// Handler returns { item, _rev } — extract the item for ownership and ID resolution
+	const existingItem =
+		existingData?.item && typeof existingData.item === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed by typeof check above
+				(existingData.item as Record<string, unknown>)
+			: existingData;
+	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
+	const editDenied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	if (editDenied) return editDenied;
+
+	// Use the resolved ID (handles slug → ID resolution)
+	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
+
+	// Only allow authorId changes if user has content:edit_any permission (editor+)
+	const canChangeAuthor =
+		body.authorId !== undefined && user && hasPermission(user, "content:edit_any" as Permission);
+	const updateBody = canChangeAuthor ? body : { ...body, authorId: undefined };
+
+	// Pass _rev through for optimistic concurrency validation
+	const result = await emdash.handleContentUpdate(collection, resolvedId, {
+		...updateBody,
+		_rev: body._rev,
+	});
+
+	if (!result.success) return unwrapResult(result);
+
+	if (cache.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+
+	return unwrapResult(result);
+};
+
+export const DELETE: APIRoute = async ({ params, locals, cache }) => {
+	const { emdash, user } = locals;
+	const collection = params.collection!;
+	const id = params.id!;
+
+	if (!emdash?.handleContentDelete || !emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Fetch item to check ownership
+	const existing = await emdash.handleContentGet(collection, id);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+
+	const deleteData =
+		existing.data && typeof existing.data === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown data; narrowed by typeof check above
+				(existing.data as Record<string, unknown>)
+			: undefined;
+	// Handler returns { item, _rev } — extract the item for ownership and ID resolution
+	const deleteItem =
+		deleteData?.item && typeof deleteData.item === "object"
+			? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed by typeof check above
+				(deleteData.item as Record<string, unknown>)
+			: deleteData;
+	const authorId = typeof deleteItem?.authorId === "string" ? deleteItem.authorId : "";
+	const deleteDenied = requireOwnerPerm(user, authorId, "content:delete_own", "content:delete_any");
+	if (deleteDenied) return deleteDenied;
+
+	// Use the resolved ID (handles slug → ID resolution)
+	const resolvedId = typeof deleteItem?.id === "string" ? deleteItem.id : id;
+
+	const result = await emdash.handleContentDelete(collection, resolvedId);
+
+	if (!result.success) return unwrapResult(result);
+
+	if (cache.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/content/[collection]/index.ts

@@ -0,0 +1,59 @@
+/**
+ * Content list and create endpoints - injected by EmDash integration
+ *
+ * GET  /_emdash/api/content/{collection} - List content
+ * POST /_emdash/api/content/{collection} - Create content
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+import { parseBody, parseQuery, isParseError } from "#api/parse.js";
+import { contentListQuery, contentCreateBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, url, locals }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+	const collection = params.collection!;
+	const query = parseQuery(url, contentListQuery);
+	if (isParseError(query)) return query;
+
+	if (!emdash?.handleContentList) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const result = await emdash.handleContentList(collection, query);
+
+	return unwrapResult(result);
+};
+
+export const POST: APIRoute = async ({ params, request, locals, cache }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:create");
+	if (denied) return denied;
+	const collection = params.collection!;
+	const body = await parseBody(request, contentCreateBody);
+	if (isParseError(body)) return body;
+
+	if (!emdash?.handleContentCreate) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Auto-set authorId to current user when creating content
+	const result = await emdash.handleContentCreate(collection, {
+		...body,
+		authorId: user?.id,
+		locale: body.locale,
+		translationOf: body.translationOf,
+	});
+
+	if (!result.success) return unwrapResult(result);
+
+	if (cache.enabled) await cache.invalidate({ tags: [collection] });
+
+	return unwrapResult(result, 201);
+};

package/src/astro/routes/api/content/[collection]/trash.ts

@@ -0,0 +1,33 @@
+/**
+ * Trash endpoints for content collection - injected by EmDash integration
+ *
+ * GET /_emdash/api/content/{collection}/trash - List trashed items
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+import { parseQuery, isParseError } from "#api/parse.js";
+import { contentTrashQuery } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, url, locals }) => {
+	const { emdash, user } = locals;
+	const collection = params.collection!;
+
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+
+	if (!emdash?.handleContentListTrashed) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const query = parseQuery(url, contentTrashQuery);
+	if (isParseError(query)) return query;
+
+	const result = await emdash.handleContentListTrashed(collection, query);
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/dashboard.ts

@@ -0,0 +1,32 @@
+/**
+ * Dashboard stats endpoint
+ *
+ * GET /_emdash/api/dashboard - Collection counts, media/user counts, recent items
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleDashboardStats } from "#api/handlers/dashboard.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		const result = await handleDashboardStats(emdash.db);
+
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to load dashboard", "DASHBOARD_ERROR");
+	}
+};