emdash 0.11.1 → 0.13.0

package/dist/{adapters-BktHA7EO.d.mts → adapters-9DybjTO6.d.mts}

@@ -118,4 +118,4 @@ interface PostgresConfig {
 declare function postgres(config: PostgresConfig): DatabaseDescriptor;
 //#endregion
 export { SqliteConfig as a, sqlite as c, PostgresConfig as i, DatabaseDialectType as n, libsql as o, LibsqlConfig as r, postgres as s, DatabaseDescriptor as t };
-//# sourceMappingURL=adapters-BktHA7EO.d.mts.map
+//# sourceMappingURL=adapters-9DybjTO6.d.mts.map

package/dist/{adapters-BktHA7EO.d.mts.map → adapters-9DybjTO6.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"adapters-BktHA7EO.d.mts","names":[],"sources":["../src/db/adapters.ts"],"mappings":";;AA0BA;;;;;AAKA;;;;;;;;;;;AAqBA;;;;;AAOA;;;KAjCY,mBAAA;;AAsDZ;;UAjDiB,kBAAA;EAChB,UAAA;EACA,MAAA;EACA,IAAA,EAAM,mBAAA;EA8CuC;;;AAqB9C;;;;;;;;;AAWA;;EA/DC,oBAAA;AAAA;AAAA,UAGgB,YAAA;EA8DhB;;;EA1DA,GAAA;AAAA;AAAA,UAGgB,YAAA;EA6DhB;;;EAzDA,GAAA;EAyD0B;AAa3B;;EAlEC,SAAA;AAAA;;;;;;;;;;;iBAae,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;;;;;;;;;;;iBAqB9B,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;UAW7B,cAAA;EAChB,gBAAA;EACA,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,GAAA;EACA,IAAA;IAAS,GAAA;IAAc,GAAA;EAAA;AAAA;;;;;;;;;;;iBAaR,QAAA,CAAS,MAAA,EAAQ,cAAA,GAAiB,kBAAA"}
+{"version":3,"file":"adapters-9DybjTO6.d.mts","names":[],"sources":["../src/db/adapters.ts"],"mappings":";;AA0BA;;;;;AAKA;;;;;;;;;;;AAqBA;;;;;AAOA;;;KAjCY,mBAAA;;AAsDZ;;UAjDiB,kBAAA;EAChB,UAAA;EACA,MAAA;EACA,IAAA,EAAM,mBAAA;EA8CuC;;;AAqB9C;;;;;;;;;AAWA;;EA/DC,oBAAA;AAAA;AAAA,UAGgB,YAAA;EA8DhB;;;EA1DA,GAAA;AAAA;AAAA,UAGgB,YAAA;EA6DhB;;;EAzDA,GAAA;EAyD0B;AAa3B;;EAlEC,SAAA;AAAA;;;;;;;;;;;iBAae,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;;;;;;;;;;;iBAqB9B,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;UAW7B,cAAA;EAChB,gBAAA;EACA,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,GAAA;EACA,IAAA;IAAS,GAAA;IAAc,GAAA;EAAA;AAAA;;;;;;;;;;;iBAaR,QAAA,CAAS,MAAA,EAAQ,cAAA,GAAiB,kBAAA"}

package/dist/allowed-origins-CDdG-4Gd.mjs

@@ -0,0 +1,116 @@
+import { t as getEnvAllowedOrigins } from "./public-url-CseXl9Fv.mjs";
+
+//#region src/auth/allowed-origins.ts
+/**
+* Resolution and validation of multi-origin passkey verification.
+*
+* `allowedOrigins` lets one EmDash deployment accept passkey assertions from
+* several hostnames sharing the same `rpId` (e.g. apex + preview/staging
+* subdomains under one registrable parent). Origins come from two sources:
+*
+*   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)
+*   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)
+*
+* Sources are merged (union of permissions, deduplicated). Each entry is
+* validated against `siteUrl` to fail loud on dead config the browser would
+* never honor.
+*/
+/**
+* Collect raw allowedOrigins from config and env, source-tagged.
+*
+* Returns raw values — the caller is expected to pass the result through
+* `validateAllowedOrigins()` before use in passkey verification.
+*/
+function getConfiguredAllowedOrigins(config) {
+	const tagged = [];
+	if (config?.allowedOrigins) {
+		for (const origin of config.allowedOrigins) if (origin) tagged.push({
+			origin,
+			source: "config.allowedOrigins"
+		});
+	}
+	for (const origin of getEnvAllowedOrigins()) tagged.push({
+		origin,
+		source: "EMDASH_ALLOWED_ORIGINS"
+	});
+	return tagged;
+}
+/**
+* Validate per-entry shape rules (no `siteUrl` needed):
+*   - parses as `URL`
+*   - protocol is `http:` or `https:`
+*   - hostname has no trailing dot (`example.com.` rejected)
+*   - hostname has no empty labels (`foo..example.com` rejected)
+*
+* Returns the deduplicated, normalized origin form (`URL.origin`) of every
+* input, in input order. Throws on the first violation with a source-tagged
+* error message.
+*/
+function validateOriginShape(tagged) {
+	const normalized = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const { origin, source } of tagged) {
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch (e) {
+			throw configError(source, `invalid URL: "${origin}"`, e);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw configError(source, `origin must be http or https: "${origin}" (got ${parsed.protocol})`);
+		if (parsed.hostname.endsWith(".")) throw configError(source, `hostname has a trailing dot: "${origin}". Remove the trailing dot — assertion origins from the browser do not include it.`);
+		if (parsed.hostname.split(".").includes("")) throw configError(source, `hostname has empty labels: "${origin}"`);
+		if (!seen.has(parsed.origin)) {
+			seen.add(parsed.origin);
+			normalized.push(parsed.origin);
+		}
+	}
+	return normalized;
+}
+/**
+* Validate the effective merged allowedOrigins set against `siteUrl`.
+*
+* Performs `validateOriginShape()` plus the siteUrl-dependent rules:
+*   - Rule A: non-empty origins ⇒ `siteUrl` is set
+*   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)
+*   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)
+*   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain
+*
+* Throws on first violation. Returns the deduplicated normalized origins.
+*
+* Use this at the runtime chokepoint (where config + env are merged into the
+* effective set). At Astro integration init, prefer `validateOriginShape()`
+* for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be
+* supplied at runtime via `EMDASH_SITE_URL`.
+*/
+function validateAllowedOrigins(siteUrl, tagged) {
+	const normalized = validateOriginShape(tagged);
+	if (normalized.length === 0) return normalized;
+	if (!siteUrl) throw new Error(`EmDash config error: allowedOrigins is set (${normalized.length} ${normalized.length === 1 ? "entry" : "entries"}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`);
+	let siteHost;
+	try {
+		siteHost = new URL(siteUrl).hostname;
+	} catch (e) {
+		throw new Error(`EmDash config error: siteUrl is not a valid URL: "${siteUrl}"`, { cause: e });
+	}
+	if (siteHost.endsWith(".")) throw new Error(`EmDash config error: siteUrl "${siteUrl}" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`);
+	if (isIPLiteralHostname(siteHost)) throw new Error(`EmDash config error: siteUrl "${siteUrl}" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`);
+	for (const { origin, source } of tagged) {
+		const h = new URL(origin).hostname;
+		if (h !== siteHost && !h.endsWith("." + siteHost)) throw configError(source, `"${origin}" is not a subdomain of siteUrl "${siteUrl}". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`);
+	}
+	return normalized;
+}
+function configError(source, detail, cause) {
+	const err = /* @__PURE__ */ new Error(`EmDash config error in ${source}: ${detail}`);
+	if (cause !== void 0) err.cause = cause;
+	return err;
+}
+const IPV4_DOTTED_DECIMAL_RE = /^\d+(\.\d+){3}$/;
+function isIPLiteralHostname(h) {
+	if (h.startsWith("[")) return true;
+	return IPV4_DOTTED_DECIMAL_RE.test(h);
+}
+
+//#endregion
+export { validateAllowedOrigins as n, validateOriginShape as r, getConfiguredAllowedOrigins as t };
+//# sourceMappingURL=allowed-origins-CDdG-4Gd.mjs.map

package/dist/allowed-origins-CDdG-4Gd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-origins-CDdG-4Gd.mjs","names":[],"sources":["../src/auth/allowed-origins.ts"],"sourcesContent":["/**\n * Resolution and validation of multi-origin passkey verification.\n *\n * `allowedOrigins` lets one EmDash deployment accept passkey assertions from\n * several hostnames sharing the same `rpId` (e.g. apex + preview/staging\n * subdomains under one registrable parent). Origins come from two sources:\n *\n *   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)\n *   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)\n *\n * Sources are merged (union of permissions, deduplicated). Each entry is\n * validated against `siteUrl` to fail loud on dead config the browser would\n * never honor.\n */\n\nimport { getEnvAllowedOrigins } from \"../api/public-url.js\";\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\nexport type AllowedOriginSource = \"config.allowedOrigins\" | \"EMDASH_ALLOWED_ORIGINS\";\n\nexport interface TaggedOrigin {\n\t/** Raw entry as declared by the operator. */\n\torigin: string;\n\t/** Where the entry came from (used for source-attributed errors). */\n\tsource: AllowedOriginSource;\n}\n\n/**\n * Collect raw allowedOrigins from config and env, source-tagged.\n *\n * Returns raw values — the caller is expected to pass the result through\n * `validateAllowedOrigins()` before use in passkey verification.\n */\nexport function getConfiguredAllowedOrigins(config?: EmDashConfig): TaggedOrigin[] {\n\tconst tagged: TaggedOrigin[] = [];\n\tif (config?.allowedOrigins) {\n\t\tfor (const origin of config.allowedOrigins) {\n\t\t\tif (origin) tagged.push({ origin, source: \"config.allowedOrigins\" });\n\t\t}\n\t}\n\tfor (const origin of getEnvAllowedOrigins()) {\n\t\ttagged.push({ origin, source: \"EMDASH_ALLOWED_ORIGINS\" });\n\t}\n\treturn tagged;\n}\n\n/**\n * Validate per-entry shape rules (no `siteUrl` needed):\n *   - parses as `URL`\n *   - protocol is `http:` or `https:`\n *   - hostname has no trailing dot (`example.com.` rejected)\n *   - hostname has no empty labels (`foo..example.com` rejected)\n *\n * Returns the deduplicated, normalized origin form (`URL.origin`) of every\n * input, in input order. Throws on the first violation with a source-tagged\n * error message.\n */\nexport function validateOriginShape(tagged: TaggedOrigin[]): string[] {\n\tconst normalized: string[] = [];\n\tconst seen = new Set<string>();\n\tfor (const { origin, source } of tagged) {\n\t\tlet parsed: URL;\n\t\ttry {\n\t\t\tparsed = new URL(origin);\n\t\t} catch (e) {\n\t\t\tthrow configError(source, `invalid URL: \"${origin}\"`, e);\n\t\t}\n\t\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`origin must be http or https: \"${origin}\" (got ${parsed.protocol})`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.endsWith(\".\")) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`hostname has a trailing dot: \"${origin}\". Remove the trailing dot — assertion origins from the browser do not include it.`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.split(\".\").includes(\"\")) {\n\t\t\tthrow configError(source, `hostname has empty labels: \"${origin}\"`);\n\t\t}\n\t\tif (!seen.has(parsed.origin)) {\n\t\t\tseen.add(parsed.origin);\n\t\t\tnormalized.push(parsed.origin);\n\t\t}\n\t}\n\treturn normalized;\n}\n\n/**\n * Validate the effective merged allowedOrigins set against `siteUrl`.\n *\n * Performs `validateOriginShape()` plus the siteUrl-dependent rules:\n *   - Rule A: non-empty origins ⇒ `siteUrl` is set\n *   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)\n *   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)\n *   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain\n *\n * Throws on first violation. Returns the deduplicated normalized origins.\n *\n * Use this at the runtime chokepoint (where config + env are merged into the\n * effective set). At Astro integration init, prefer `validateOriginShape()`\n * for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be\n * supplied at runtime via `EMDASH_SITE_URL`.\n */\nexport function validateAllowedOrigins(\n\tsiteUrl: string | undefined,\n\ttagged: TaggedOrigin[],\n): string[] {\n\tconst normalized = validateOriginShape(tagged);\n\tif (normalized.length === 0) return normalized;\n\n\tif (!siteUrl) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: allowedOrigins is set (${normalized.length} ${\n\t\t\t\tnormalized.length === 1 ? \"entry\" : \"entries\"\n\t\t\t}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`,\n\t\t);\n\t}\n\n\tlet siteHost: string;\n\ttry {\n\t\tsiteHost = new URL(siteUrl).hostname;\n\t} catch (e) {\n\t\tthrow new Error(`EmDash config error: siteUrl is not a valid URL: \"${siteUrl}\"`, {\n\t\t\tcause: e,\n\t\t});\n\t}\n\n\tif (siteHost.endsWith(\".\")) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`,\n\t\t);\n\t}\n\tif (isIPLiteralHostname(siteHost)) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`,\n\t\t);\n\t}\n\n\tfor (const { origin, source } of tagged) {\n\t\tconst h = new URL(origin).hostname;\n\t\tif (h !== siteHost && !h.endsWith(\".\" + siteHost)) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`\"${origin}\" is not a subdomain of siteUrl \"${siteUrl}\". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`,\n\t\t\t);\n\t\t}\n\t}\n\n\treturn normalized;\n}\n\nfunction configError(source: AllowedOriginSource, detail: string, cause?: unknown): Error {\n\tconst err = new Error(`EmDash config error in ${source}: ${detail}`);\n\tif (cause !== undefined) (err as Error & { cause?: unknown }).cause = cause;\n\treturn err;\n}\n\nconst IPV4_DOTTED_DECIMAL_RE = /^\\d+(\\.\\d+){3}$/;\n\nfunction isIPLiteralHostname(h: string): boolean {\n\t// IPv6 hostnames are bracketed by URL.hostname, e.g. \"[::1]\"\n\tif (h.startsWith(\"[\")) return true;\n\t// IPv4 dotted-decimal\n\treturn IPV4_DOTTED_DECIMAL_RE.test(h);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,4BAA4B,QAAuC;CAClF,MAAM,SAAyB,EAAE;AACjC,KAAI,QAAQ,gBACX;OAAK,MAAM,UAAU,OAAO,eAC3B,KAAI,OAAQ,QAAO,KAAK;GAAE;GAAQ,QAAQ;GAAyB,CAAC;;AAGtE,MAAK,MAAM,UAAU,sBAAsB,CAC1C,QAAO,KAAK;EAAE;EAAQ,QAAQ;EAA0B,CAAC;AAE1D,QAAO;;;;;;;;;;;;;AAcR,SAAgB,oBAAoB,QAAkC;CACrE,MAAM,aAAuB,EAAE;CAC/B,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,IAAI;AACJ,MAAI;AACH,YAAS,IAAI,IAAI,OAAO;WAChB,GAAG;AACX,SAAM,YAAY,QAAQ,iBAAiB,OAAO,IAAI,EAAE;;AAEzD,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,YACL,QACA,kCAAkC,OAAO,SAAS,OAAO,SAAS,GAClE;AAEF,MAAI,OAAO,SAAS,SAAS,IAAI,CAChC,OAAM,YACL,QACA,iCAAiC,OAAO,oFACxC;AAEF,MAAI,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,CAC1C,OAAM,YAAY,QAAQ,+BAA+B,OAAO,GAAG;AAEpE,MAAI,CAAC,KAAK,IAAI,OAAO,OAAO,EAAE;AAC7B,QAAK,IAAI,OAAO,OAAO;AACvB,cAAW,KAAK,OAAO,OAAO;;;AAGhC,QAAO;;;;;;;;;;;;;;;;;;AAmBR,SAAgB,uBACf,SACA,QACW;CACX,MAAM,aAAa,oBAAoB,OAAO;AAC9C,KAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,KAAI,CAAC,QACJ,OAAM,IAAI,MACT,+CAA+C,WAAW,OAAO,GAChE,WAAW,WAAW,IAAI,UAAU,UACpC,wLACD;CAGF,IAAI;AACJ,KAAI;AACH,aAAW,IAAI,IAAI,QAAQ,CAAC;UACpB,GAAG;AACX,QAAM,IAAI,MAAM,qDAAqD,QAAQ,IAAI,EAChF,OAAO,GACP,CAAC;;AAGH,KAAI,SAAS,SAAS,IAAI,CACzB,OAAM,IAAI,MACT,iCAAiC,QAAQ,yHACzC;AAEF,KAAI,oBAAoB,SAAS,CAChC,OAAM,IAAI,MACT,iCAAiC,QAAQ,oJACzC;AAGF,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC;AAC1B,MAAI,MAAM,YAAY,CAAC,EAAE,SAAS,MAAM,SAAS,CAChD,OAAM,YACL,QACA,IAAI,OAAO,mCAAmC,QAAQ,+EACtD;;AAIH,QAAO;;AAGR,SAAS,YAAY,QAA6B,QAAgB,OAAwB;CACzF,MAAM,sBAAM,IAAI,MAAM,0BAA0B,OAAO,IAAI,SAAS;AACpE,KAAI,UAAU,OAAW,CAAC,IAAoC,QAAQ;AACtE,QAAO;;AAGR,MAAM,yBAAyB;AAE/B,SAAS,oBAAoB,GAAoB;AAEhD,KAAI,EAAE,WAAW,IAAI,CAAE,QAAO;AAE9B,QAAO,uBAAuB,KAAK,EAAE"}

package/dist/api/route-utils.d.mts

@@ -0,0 +1,68 @@
+import { a as parseQuery, c as handleError, i as parseBody, n as ParseResult, o as apiError, r as isParseError, s as apiSuccess, t as OptionsRepository } from "../options-Cq64Wx0O.mjs";
+import { t as Database } from "../types-C1KKK4VP.mjs";
+import { bt as StorageCollection, xt as StorageCollectionConfig } from "../types-B05e2naf.mjs";
+import { Kysely } from "kysely";
+
+//#region src/api/setup-complete.d.ts
+/**
+ * Finalize setup after the first admin user is created.
+ *
+ * Reads the setup_state option (written by the setup wizard's step 1),
+ * persists site_title and site_tagline, then marks setup complete.
+ *
+ * Safe to call multiple times — checks setup_complete first and no-ops
+ * if already done.
+ */
+declare function finalizeSetup(db: Kysely<Database>): Promise<void>;
+//#endregion
+//#region src/api/auth-storage.d.ts
+/**
+ * Get storage collections for an auth provider.
+ *
+ * Returns a record of `StorageCollection` instances, one per declared
+ * collection in the provider's `storage` config. Data is stored in the
+ * shared `_plugin_storage` table under the namespace `auth:<providerId>`.
+ *
+ * @example
+ * ```ts
+ * const storage = getAuthProviderStorage(emdash.db, "atproto", {
+ *   states: { indexes: [] },
+ *   sessions: { indexes: [] },
+ * });
+ * const session = await storage.sessions.get(sessionId);
+ * ```
+ */
+declare function getAuthProviderStorage(db: Kysely<Database>, providerId: string, storageConfig: Record<string, StorageCollectionConfig>): Record<string, StorageCollection>;
+//#endregion
+//#region src/api/public-url.d.ts
+/**
+ * Public URL helpers for reverse-proxy deployments.
+ *
+ * Behind a TLS-terminating proxy the internal request URL
+ * (`http://localhost:4321`) differs from the browser-facing origin
+ * (`https://mysite.example.com`). These pure helpers resolve the
+ * correct public origin from config, falling back to the request URL.
+ *
+ * Workers-safe: no Node.js imports.
+ */
+/** Minimal config shape — avoids importing the full EmDashConfig type tree. */
+interface SiteUrlConfig {
+  siteUrl?: string;
+}
+/** @internal Reset cached env values — test-only. */
+/**
+ * Return the public-facing origin for the site.
+ *
+ * Resolution order:
+ *   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
+ *   2. `EMDASH_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)
+ *   3. `url.origin` (internal request URL — correct when no proxy)
+ *
+ * @param url  The request URL (`new URL(request.url)` or `Astro.url`)
+ * @param config  The EmDash config (from `locals.emdash?.config`)
+ * @returns Origin string, e.g. `"https://mysite.example.com"`
+ */
+declare function getPublicOrigin(url: URL, config?: SiteUrlConfig): string;
+//#endregion
+export { OptionsRepository, type ParseResult, apiError, apiSuccess, finalizeSetup, getAuthProviderStorage, getPublicOrigin, handleError, isParseError, parseBody, parseQuery };
+//# sourceMappingURL=route-utils.d.mts.map

package/dist/api/route-utils.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-utils.d.mts","names":[],"sources":["../../src/api/setup-complete.ts","../../src/api/auth-storage.ts","../../src/api/public-url.ts"],"mappings":";;;;;;;;;;;;;;;iBAsBsB,aAAA,CAAc,EAAA,EAAI,MAAA,CAAO,QAAA,IAAY,OAAA;;;;;;;;;;;;;;;;ACQ3D;;;iBAAgB,sBAAA,CACf,EAAA,EAAI,MAAA,CAAO,QAAA,GACX,UAAA,UACA,aAAA,EAAe,MAAA,SAAe,uBAAA,IAC5B,MAAA,SAAe,iBAAA;;;;;;;;;ADZlB;;;;;UEVU,aAAA;EACT,OAAA;AAAA;;;;;;;;;ADiBD;;;;;iBC2CgB,eAAA,CAAgB,GAAA,EAAK,GAAA,EAAK,MAAA,GAAS,aAAA"}

package/dist/api/route-utils.mjs

@@ -0,0 +1,44 @@
+import "../dialect-helpers-BKCvISIQ.mjs";
+import "../content-D6YG26WG.mjs";
+import "../base64-CqR-7kqF.mjs";
+import "../types-CwXMEPRr.mjs";
+import "../media-Dg7he9uK.mjs";
+import "../user-Dr1bOCqS.mjs";
+import { t as OptionsRepository } from "../options-BL4X94qY.mjs";
+import { n as createStorageAccess } from "../context-qF8d3IPR.mjs";
+import "../seo-DRq9-EPP.mjs";
+import "../request-cache-dzCt8TZB.mjs";
+import "../loader-Cs6-Bqe6.mjs";
+import "../settings-xQKsWnzQ.mjs";
+import "../ssrf-DzFN_qV-.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../error-tSQWIl5U.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../parse-BFTPon-J.mjs";
+import "../ssrf-CTul4uQi.mjs";
+import "../cron-H8eJ46dv.mjs";
+import { n as getPublicOrigin } from "../public-url-CseXl9Fv.mjs";
+import { t as finalizeSetup } from "../setup-complete-C6ZCLhKo.mjs";
+
+//#region src/api/auth-storage.ts
+/**
+* Get storage collections for an auth provider.
+*
+* Returns a record of `StorageCollection` instances, one per declared
+* collection in the provider's `storage` config. Data is stored in the
+* shared `_plugin_storage` table under the namespace `auth:<providerId>`.
+*
+* @example
+* ```ts
+* const storage = getAuthProviderStorage(emdash.db, "atproto", {
+*   states: { indexes: [] },
+*   sessions: { indexes: [] },
+* });
+* const session = await storage.sessions.get(sessionId);
+* ```
+*/
+function getAuthProviderStorage(db, providerId, storageConfig) {
+	return createStorageAccess(db, `auth:${providerId}`, storageConfig);
+}
+
+//#endregion
+export { OptionsRepository, apiError, apiSuccess, finalizeSetup, getAuthProviderStorage, getPublicOrigin, handleError, isParseError, parseBody, parseQuery };
+//# sourceMappingURL=route-utils.mjs.map

package/dist/api/route-utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-utils.mjs","names":[],"sources":["../../src/api/auth-storage.ts"],"sourcesContent":["/**\n * Auth provider storage helper.\n *\n * Gives auth provider routes access to plugin-style storage collections\n * namespaced under `auth:<providerId>`. Reuses the existing `_plugin_storage`\n * table and `PluginStorageRepository` infrastructure.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\nimport { createStorageAccess } from \"../plugins/context.js\";\nimport type { StorageCollection, StorageCollectionConfig } from \"../plugins/types.js\";\n\n/**\n * Get storage collections for an auth provider.\n *\n * Returns a record of `StorageCollection` instances, one per declared\n * collection in the provider's `storage` config. Data is stored in the\n * shared `_plugin_storage` table under the namespace `auth:<providerId>`.\n *\n * @example\n * ```ts\n * const storage = getAuthProviderStorage(emdash.db, \"atproto\", {\n *   states: { indexes: [] },\n *   sessions: { indexes: [] },\n * });\n * const session = await storage.sessions.get(sessionId);\n * ```\n */\nexport function getAuthProviderStorage(\n\tdb: Kysely<Database>,\n\tproviderId: string,\n\tstorageConfig: Record<string, StorageCollectionConfig>,\n): Record<string, StorageCollection> {\n\treturn createStorageAccess(db, `auth:${providerId}`, storageConfig);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,uBACf,IACA,YACA,eACoC;AACpC,QAAO,oBAAoB,IAAI,QAAQ,cAAc,cAAc"}

package/dist/api/schemas/index.d.mts

@@ -0,0 +1,2 @@
+import { $ as siteSettingsSchema, $n as roleLevel, $t as collectionSchema, A as userDetailSchema, An as contentListResponseSchema, At as inviteCreateBody, B as importProbeBody, Bn as contentTrashQuery, Bt as adminCommentListResponseSchema, C as updateWidgetBody, Cn as mediaUpdateBody, Ct as menuTranslationsSchema, D as widgetSchema, Dn as contentCreateBody, Dt as updateMenuItemBody, E as widgetAreaWithWidgetsSchema, En as contentCompareResponseSchema, Et as updateMenuBody, F as atprotoLoginBody, Fn as contentSeoInput, Ft as passkeyRegisterVerifyBody, G as wpRewriteUrlsBody, Gn as apiErrorSchema, Gt as commentSchema, H as wpPluginAnalyzeBody, Hn as trashedContentItemSchema, Ht as commentBulkResponseSchema, I as setupAdminBody, In as contentSeoSchema, It as passkeyRenameBody, J as searchRebuildBody, Jn as deleteResponseSchema, Jt as publicCommentListResponseSchema, K as searchEnableBody, Kn as countResponseSchema, Kt as commentStatusBody, L as setupAdminVerifyBody, Ln as contentTermsBody, Lt as passkeyVerifyBody, M as userSchema, Mn as contentPublishBody, Mt as magicLinkSendBody, N as userUpdateBody, Nn as contentResponseSchema, Nt as passkeyOptionsBody, O as allowedDomainCreateBody, On as contentItemSchema, Ot as authMeActionBody, P as usersListQuery, Pn as contentScheduleBody, Pt as passkeyRegisterOptionsBody, Q as settingsUpdateBody, Qn as offsetPaginationQuery, Qt as collectionResponseSchema, R as setupAtprotoAdminBody, Rn as contentTranslationSchema, Rt as signupCompleteBody, S as reorderWidgetsBody, Sn as mediaResponseSchema, St as menuSchema, T as widgetAreaWithWidgetsAndCountSchema, Tn as mediaUploadUrlResponseSchema, Tt as reorderMenuItemsBody, U as wpPluginExecuteBody, Un as trashedContentListResponseSchema, Ut as commentCountsResponseSchema, V as wpMediaImportBody, Vn as contentUpdateBody, Vt as commentBulkBody, W as wpPrepareBody, Wn as VALID_ROLE_LEVELS, Wt as commentListQuery, X as searchResultSchema, Xn as localeCode, Xt as collectionGetQuery, Y as searchResponseSchema, Yn as httpUrl, Yt as publicCommentSchema, Z as searchSuggestQuery, Zn as localeFilterQuery, Zt as collectionListResponseSchema, _ as redirectSchema, _n as mediaExistingResponseSchema, _t as createMenuBody, a as bylineUpdateBody, an as fieldResponseSchema, at as createTaxonomyDefBody, b as createWidgetAreaBody, bn as mediaListResponseSchema, bt as menuItemTypeEnum, c as createRedirectBody, cn as orphanedTableListResponseSchema, ct as taxonomyDefTranslationsSchema, d as notFoundListResponseSchema, dn as updateCollectionBody, dt as termListResponseSchema, en as collectionWithFieldsResponseSchema, er as slugPattern, et as createSectionBody, f as notFoundPruneBody, fn as updateFieldBody, ft as termResponseSchema, g as redirectListResponseSchema, gn as mediaConfirmResponseSchema, gt as updateTermBody, h as notFoundSummarySchema, hn as mediaConfirmBody, ht as termWithCountSchema, i as bylineSummarySchema, in as fieldReorderBody, it as updateSectionBody, j as userListResponseSchema, jn as contentPreviewUrlBody, jt as inviteRegisterOptionsBody, k as allowedDomainUpdateBody, kn as contentListQuery, kt as inviteCompleteBody, l as notFoundEntrySchema, ln as orphanedTableSchema, lt as taxonomyListResponseSchema, m as notFoundSummaryResponseSchema, mn as formatFileSize, mt as termTranslationsSchema, n as bylineCreditSchema, nn as createFieldBody, nt as sectionSchema, o as bylinesListQuery, on as fieldSchema, ot as createTermBody, p as notFoundSummaryQuery, pn as DEFAULT_MAX_UPLOAD_SIZE, pt as termSchema, q as searchQuery, qn as cursorPaginationQuery, qt as createCommentBody, r as bylineListResponseSchema, rn as fieldListResponseSchema, rt as sectionsListQuery, s as contentBylineInputSchema, sn as orphanRegisterBody, st as taxonomyDefSchema, t as bylineCreateBody, tn as createCollectionBody, tr as successEnvelope, tt as sectionListResponseSchema, u as notFoundListQuery, un as schemaExportQuery, ut as termGetResponseSchema, v as redirectsListQuery, vn as mediaItemSchema, vt as createMenuItemBody, w as widgetAreaSchema, wn as mediaUploadUrlBody, wt as menuWithItemsSchema, x as createWidgetBody, xn as mediaProviderListQuery, xt as menuListItemSchema, y as updateRedirectBody, yn as mediaListQuery, yt as menuItemSchema, z as setupBody, zn as contentTranslationsResponseSchema, zt as signupRequestBody } from "../../bylines-C6eYUWlZ.mjs";
+export { DEFAULT_MAX_UPLOAD_SIZE, VALID_ROLE_LEVELS, adminCommentListResponseSchema, allowedDomainCreateBody, allowedDomainUpdateBody, apiErrorSchema, atprotoLoginBody, authMeActionBody, bylineCreateBody, bylineCreditSchema, bylineListResponseSchema, bylineSummarySchema, bylineUpdateBody, bylinesListQuery, collectionGetQuery, collectionListResponseSchema, collectionResponseSchema, collectionSchema, collectionWithFieldsResponseSchema, commentBulkBody, commentBulkResponseSchema, commentCountsResponseSchema, commentListQuery, commentSchema, commentStatusBody, contentBylineInputSchema, contentCompareResponseSchema, contentCreateBody, contentItemSchema, contentListQuery, contentListResponseSchema, contentPreviewUrlBody, contentPublishBody, contentResponseSchema, contentScheduleBody, contentSeoInput, contentSeoSchema, contentTermsBody, contentTranslationSchema, contentTranslationsResponseSchema, contentTrashQuery, contentUpdateBody, countResponseSchema, createCollectionBody, createCommentBody, createFieldBody, createMenuBody, createMenuItemBody, createRedirectBody, createSectionBody, createTaxonomyDefBody, createTermBody, createWidgetAreaBody, createWidgetBody, cursorPaginationQuery, deleteResponseSchema, fieldListResponseSchema, fieldReorderBody, fieldResponseSchema, fieldSchema, formatFileSize, httpUrl, importProbeBody, inviteCompleteBody, inviteCreateBody, inviteRegisterOptionsBody, localeCode, localeFilterQuery, magicLinkSendBody, mediaConfirmBody, mediaConfirmResponseSchema, mediaExistingResponseSchema, mediaItemSchema, mediaListQuery, mediaListResponseSchema, mediaProviderListQuery, mediaResponseSchema, mediaUpdateBody, mediaUploadUrlBody, mediaUploadUrlResponseSchema, menuItemSchema, menuItemTypeEnum, menuListItemSchema, menuSchema, menuTranslationsSchema, menuWithItemsSchema, notFoundEntrySchema, notFoundListQuery, notFoundListResponseSchema, notFoundPruneBody, notFoundSummaryQuery, notFoundSummaryResponseSchema, notFoundSummarySchema, offsetPaginationQuery, orphanRegisterBody, orphanedTableListResponseSchema, orphanedTableSchema, passkeyOptionsBody, passkeyRegisterOptionsBody, passkeyRegisterVerifyBody, passkeyRenameBody, passkeyVerifyBody, publicCommentListResponseSchema, publicCommentSchema, redirectListResponseSchema, redirectSchema, redirectsListQuery, reorderMenuItemsBody, reorderWidgetsBody, roleLevel, schemaExportQuery, searchEnableBody, searchQuery, searchRebuildBody, searchResponseSchema, searchResultSchema, searchSuggestQuery, sectionListResponseSchema, sectionSchema, sectionsListQuery, settingsUpdateBody, setupAdminBody, setupAdminVerifyBody, setupAtprotoAdminBody, setupBody, signupCompleteBody, signupRequestBody, siteSettingsSchema, slugPattern, successEnvelope, taxonomyDefSchema, taxonomyDefTranslationsSchema, taxonomyListResponseSchema, termGetResponseSchema, termListResponseSchema, termResponseSchema, termSchema, termTranslationsSchema, termWithCountSchema, trashedContentItemSchema, trashedContentListResponseSchema, updateCollectionBody, updateFieldBody, updateMenuBody, updateMenuItemBody, updateRedirectBody, updateSectionBody, updateTermBody, updateWidgetBody, userDetailSchema, userListResponseSchema, userSchema, userUpdateBody, usersListQuery, widgetAreaSchema, widgetAreaWithWidgetsAndCountSchema, widgetAreaWithWidgetsSchema, widgetSchema, wpMediaImportBody, wpPluginAnalyzeBody, wpPluginExecuteBody, wpPrepareBody, wpRewriteUrlsBody };

package/dist/api/schemas/index.mjs

@@ -0,0 +1,4 @@
+import { $ as createMenuBody, $t as contentCreateBody, A as searchRebuildBody, An as localeFilterQuery, At as fieldReorderBody, B as updateSectionBody, Bt as formatFileSize, C as userDetailSchema, Cn as VALID_ROLE_LEVELS, Ct as collectionListResponseSchema, D as usersListQuery, Dn as deleteResponseSchema, Dt as createCollectionBody, E as userUpdateBody, En as cursorPaginationQuery, Et as collectionWithFieldsResponseSchema, F as siteSettingsSchema, Ft as orphanedTableSchema, G as taxonomyListResponseSchema, Gt as mediaListQuery, H as createTermBody, Ht as mediaConfirmResponseSchema, I as createSectionBody, It as schemaExportQuery, J as termResponseSchema, Jt as mediaResponseSchema, K as termGetResponseSchema, Kt as mediaListResponseSchema, L as sectionListResponseSchema, Lt as updateCollectionBody, M as searchResultSchema, Mn as roleLevel, Mt as fieldSchema, N as searchSuggestQuery, Nn as slugPattern, Nt as orphanRegisterBody, O as searchEnableBody, On as httpUrl, Ot as createFieldBody, P as settingsUpdateBody, Pn as successEnvelope, Pt as orphanedTableListResponseSchema, Q as updateTermBody, Qt as contentCompareResponseSchema, R as sectionSchema, Rt as updateFieldBody, S as allowedDomainUpdateBody, Sn as contentBylineInputSchema, St as collectionGetQuery, T as userSchema, Tn as countResponseSchema, Tt as collectionSchema, U as taxonomyDefSchema, Ut as mediaExistingResponseSchema, V as createTaxonomyDefBody, Vt as mediaConfirmBody, W as taxonomyDefTranslationsSchema, Wt as mediaItemSchema, X as termTranslationsSchema, Xt as mediaUploadUrlBody, Y as termSchema, Yt as mediaUpdateBody, Z as termWithCountSchema, Zt as mediaUploadUrlResponseSchema, _ as widgetAreaSchema, _n as bylineCreditSchema, _t as commentSchema, a as notFoundPruneBody, an as contentResponseSchema, at as menuTranslationsSchema, b as widgetSchema, bn as bylineUpdateBody, bt as publicCommentListResponseSchema, c as notFoundSummarySchema, cn as contentSeoSchema, ct as updateMenuBody, d as redirectsListQuery, dn as contentTranslationsResponseSchema, en as contentItemSchema, et as createMenuItemBody, f as updateRedirectBody, fn as contentTrashQuery, ft as adminCommentListResponseSchema, g as updateWidgetBody, gn as bylineCreateBody, gt as commentListQuery, h as reorderWidgetsBody, hn as trashedContentListResponseSchema, ht as commentCountsResponseSchema, i as notFoundListResponseSchema, in as contentPublishBody, it as menuSchema, j as searchResponseSchema, jn as offsetPaginationQuery, jt as fieldResponseSchema, k as searchQuery, kn as localeCode, kt as fieldListResponseSchema, l as redirectListResponseSchema, ln as contentTermsBody, lt as updateMenuItemBody, m as createWidgetBody, mn as trashedContentItemSchema, mt as commentBulkResponseSchema, n as notFoundEntrySchema, nn as contentListResponseSchema, nt as menuItemTypeEnum, o as notFoundSummaryQuery, on as contentScheduleBody, ot as menuWithItemsSchema, p as createWidgetAreaBody, pn as contentUpdateBody, pt as commentBulkBody, q as termListResponseSchema, qt as mediaProviderListQuery, r as notFoundListQuery, rn as contentPreviewUrlBody, rt as menuListItemSchema, s as notFoundSummaryResponseSchema, sn as contentSeoInput, st as reorderMenuItemsBody, t as createRedirectBody, tn as contentListQuery, tt as menuItemSchema, u as redirectSchema, un as contentTranslationSchema, v as widgetAreaWithWidgetsAndCountSchema, vn as bylineListResponseSchema, vt as commentStatusBody, w as userListResponseSchema, wn as apiErrorSchema, wt as collectionResponseSchema, x as allowedDomainCreateBody, xn as bylinesListQuery, xt as publicCommentSchema, y as widgetAreaWithWidgetsSchema, yn as bylineSummarySchema, yt as createCommentBody, z as sectionsListQuery, zt as DEFAULT_MAX_UPLOAD_SIZE } from "../../redirects-Dmj6KRU3.mjs";
+import { C as signupRequestBody, S as signupCompleteBody, _ as passkeyOptionsBody, a as setupBody, b as passkeyRenameBody, c as wpPluginAnalyzeBody, d as wpRewriteUrlsBody, f as authMeActionBody, g as magicLinkSendBody, h as inviteRegisterOptionsBody, i as setupAtprotoAdminBody, l as wpPluginExecuteBody, m as inviteCreateBody, n as setupAdminBody, o as importProbeBody, p as inviteCompleteBody, r as setupAdminVerifyBody, s as wpMediaImportBody, t as atprotoLoginBody, u as wpPrepareBody, v as passkeyRegisterOptionsBody, x as passkeyVerifyBody, y as passkeyRegisterVerifyBody } from "../../setup-BGAJ2uXs.mjs";
+
+export { DEFAULT_MAX_UPLOAD_SIZE, VALID_ROLE_LEVELS, adminCommentListResponseSchema, allowedDomainCreateBody, allowedDomainUpdateBody, apiErrorSchema, atprotoLoginBody, authMeActionBody, bylineCreateBody, bylineCreditSchema, bylineListResponseSchema, bylineSummarySchema, bylineUpdateBody, bylinesListQuery, collectionGetQuery, collectionListResponseSchema, collectionResponseSchema, collectionSchema, collectionWithFieldsResponseSchema, commentBulkBody, commentBulkResponseSchema, commentCountsResponseSchema, commentListQuery, commentSchema, commentStatusBody, contentBylineInputSchema, contentCompareResponseSchema, contentCreateBody, contentItemSchema, contentListQuery, contentListResponseSchema, contentPreviewUrlBody, contentPublishBody, contentResponseSchema, contentScheduleBody, contentSeoInput, contentSeoSchema, contentTermsBody, contentTranslationSchema, contentTranslationsResponseSchema, contentTrashQuery, contentUpdateBody, countResponseSchema, createCollectionBody, createCommentBody, createFieldBody, createMenuBody, createMenuItemBody, createRedirectBody, createSectionBody, createTaxonomyDefBody, createTermBody, createWidgetAreaBody, createWidgetBody, cursorPaginationQuery, deleteResponseSchema, fieldListResponseSchema, fieldReorderBody, fieldResponseSchema, fieldSchema, formatFileSize, httpUrl, importProbeBody, inviteCompleteBody, inviteCreateBody, inviteRegisterOptionsBody, localeCode, localeFilterQuery, magicLinkSendBody, mediaConfirmBody, mediaConfirmResponseSchema, mediaExistingResponseSchema, mediaItemSchema, mediaListQuery, mediaListResponseSchema, mediaProviderListQuery, mediaResponseSchema, mediaUpdateBody, mediaUploadUrlBody, mediaUploadUrlResponseSchema, menuItemSchema, menuItemTypeEnum, menuListItemSchema, menuSchema, menuTranslationsSchema, menuWithItemsSchema, notFoundEntrySchema, notFoundListQuery, notFoundListResponseSchema, notFoundPruneBody, notFoundSummaryQuery, notFoundSummaryResponseSchema, notFoundSummarySchema, offsetPaginationQuery, orphanRegisterBody, orphanedTableListResponseSchema, orphanedTableSchema, passkeyOptionsBody, passkeyRegisterOptionsBody, passkeyRegisterVerifyBody, passkeyRenameBody, passkeyVerifyBody, publicCommentListResponseSchema, publicCommentSchema, redirectListResponseSchema, redirectSchema, redirectsListQuery, reorderMenuItemsBody, reorderWidgetsBody, roleLevel, schemaExportQuery, searchEnableBody, searchQuery, searchRebuildBody, searchResponseSchema, searchResultSchema, searchSuggestQuery, sectionListResponseSchema, sectionSchema, sectionsListQuery, settingsUpdateBody, setupAdminBody, setupAdminVerifyBody, setupAtprotoAdminBody, setupBody, signupCompleteBody, signupRequestBody, siteSettingsSchema, slugPattern, successEnvelope, taxonomyDefSchema, taxonomyDefTranslationsSchema, taxonomyListResponseSchema, termGetResponseSchema, termListResponseSchema, termResponseSchema, termSchema, termTranslationsSchema, termWithCountSchema, trashedContentItemSchema, trashedContentListResponseSchema, updateCollectionBody, updateFieldBody, updateMenuBody, updateMenuItemBody, updateRedirectBody, updateSectionBody, updateTermBody, updateWidgetBody, userDetailSchema, userListResponseSchema, userSchema, userUpdateBody, usersListQuery, widgetAreaSchema, widgetAreaWithWidgetsAndCountSchema, widgetAreaWithWidgetsSchema, widgetSchema, wpMediaImportBody, wpPluginAnalyzeBody, wpPluginExecuteBody, wpPrepareBody, wpRewriteUrlsBody };