emdash 0.11.1 → 0.13.0

package/dist/astro/routes/api/auth/invite/accept.mjs

@@ -0,0 +1,34 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { InviteError, roleFromLevel, validateInvite } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/auth/invite/accept.ts
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const token = url.searchParams.get("token");
+	if (!token) return apiError("MISSING_PARAM", "Token is required", 400);
+	try {
+		const invite = await validateInvite(createKyselyAdapter(emdash.db), token);
+		return apiSuccess({
+			success: true,
+			email: invite.email,
+			role: invite.role,
+			roleName: roleFromLevel(invite.role)
+		});
+	} catch (error) {
+		if (error instanceof InviteError) return apiError(error.code.toUpperCase(), error.message, {
+			invalid_token: 404,
+			token_expired: 410,
+			user_exists: 409
+		}[error.code] ?? 400);
+		return handleError(error, "Failed to validate invite", "INVITE_VALIDATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=accept.mjs.map

package/dist/astro/routes/api/auth/invite/accept.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/accept.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/invite/accept\n *\n * Validate an invite token and return invite data for the UI.\n * This is called when the invitee clicks the email link.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { validateInvite, InviteError, roleFromLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst token = url.searchParams.get(\"token\");\n\n\tif (!token) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Token is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst invite = await validateInvite(adapter, token);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\temail: invite.email,\n\t\t\trole: invite.role,\n\t\t\troleName: roleFromLevel(invite.role),\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tinvalid_token: 404,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_exists: 409,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to validate invite\", \"INVITE_VALIDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;AASA,MAAa,YAAY;AAOzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,KAAI,CAAC,MACJ,QAAO,SAAS,iBAAiB,qBAAqB,IAAI;AAG3D,KAAI;EAEH,MAAM,SAAS,MAAM,eADL,oBAAoB,OAAO,GAAG,EACD,MAAM;AAEnD,SAAO,WAAW;GACjB,SAAS;GACT,OAAO,OAAO;GACd,MAAM,OAAO;GACb,UAAU,cAAc,OAAO,KAAK;GACpC,CAAC;UACM,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,eAAe;GACf,eAAe;GACf,aAAa;GACb,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}

package/dist/astro/routes/api/auth/invite/complete.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/invite/complete.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=complete.d.mts.map

package/dist/astro/routes/api/auth/invite/complete.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/complete.ts"],"mappings":";;;cASa,SAAA;AAAA,cAeA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/invite/complete.mjs

@@ -0,0 +1,56 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { t as OptionsRepository } from "../../../../../options-BL4X94qY.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BFTPon-J.mjs";
+import "../../../../../redirects-Dmj6KRU3.mjs";
+import { p as inviteCompleteBody } from "../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-CseXl9Fv.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CDdG-4Gd.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-CJ0OOHOr.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-Cg86_ISa.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { InviteError, completeInvite } from "@emdash-cms/auth";
+import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";
+
+//#region src/astro/routes/api/auth/invite/complete.ts
+const prerender = false;
+const POST = async ({ request, locals, session }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		const body = await parseBody(request, inviteCompleteBody);
+		if (isParseError(body)) return body;
+		const adapter = createKyselyAdapter(emdash.db);
+		const url = new URL(request.url);
+		const siteName = await new OptionsRepository(emdash.db).get("emdash:site_title") ?? void 0;
+		const siteUrl = getPublicOrigin(url, emdash?.config);
+		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, validateAllowedOrigins(siteUrl, getConfiguredAllowedOrigins(emdash?.config)));
+		const challengeStore = createChallengeStore(emdash.db);
+		const verified = await verifyRegistrationResponse(passkeyConfig, body.credential, challengeStore);
+		const user = await completeInvite(adapter, body.token, { name: body.name });
+		await registerPasskey(adapter, user.id, verified, "Initial passkey");
+		if (session) session.set("user", { id: user.id });
+		return apiSuccess({
+			success: true,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role
+			}
+		});
+	} catch (error) {
+		if (error instanceof InviteError) return apiError(error.code.toUpperCase(), error.message, {
+			invalid_token: 404,
+			token_expired: 410,
+			user_exists: 409
+		}[error.code] ?? 400);
+		return handleError(error, "Failed to complete invite", "INVITE_COMPLETE_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=complete.mjs.map

package/dist/astro/routes/api/auth/invite/complete.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/complete.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite/complete\n *\n * Complete the invite by registering a passkey for the new user.\n * This creates the user account and establishes a session.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { completeInvite, InviteError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { inviteCompleteBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteCompleteBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the passkey registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Complete the invite - creates the user\n\t\tconst user = await completeInvite(adapter, body.token, {\n\t\t\tname: body.name,\n\t\t});\n\n\t\t// Register the passkey for the new user\n\t\tawait registerPasskey(adapter, user.id, verified, \"Initial passkey\");\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tinvalid_token: 404,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_exists: 409,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to complete invite\", \"INVITE_COMPLETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAEhC,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,MAAM,OAAO,MAAM,eAAe,SAAS,KAAK,OAAO,EACtD,MAAM,KAAK,MACX,CAAC;AAGF,QAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,kBAAkB;AAGpE,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAGrC,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,eAAe;GACf,eAAe;GACf,aAAa;GACb,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}

package/dist/astro/routes/api/auth/invite/index.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/invite/index.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/auth/invite/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/index.ts"],"mappings":";;;cAaa,SAAA;AAAA,cAWA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/invite/index.mjs

@@ -0,0 +1,53 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { t as OptionsRepository } from "../../../../../options-BL4X94qY.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BFTPon-J.mjs";
+import "../../../../../redirects-Dmj6KRU3.mjs";
+import { m as inviteCreateBody } from "../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-D-M4Fd8O.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { InviteError, Role, createInvite } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/auth/invite/index.ts
+const prerender = false;
+const POST = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	try {
+		const body = await parseBody(request, inviteCreateBody);
+		if (isParseError(body)) return body;
+		const role = body.role ?? Role.AUTHOR;
+		const siteName = await new OptionsRepository(emdash.db).get("emdash:site_title") || "EmDash";
+		const baseUrl = await getSiteBaseUrl(emdash.db, request);
+		const emailSend = emdash.email?.isAvailable() ? (message) => emdash.email.send(message, "system") : void 0;
+		const result = await createInvite({
+			baseUrl,
+			siteName,
+			email: emailSend
+		}, adapter, body.email, role, user.id);
+		if (emailSend) return apiSuccess({
+			success: true,
+			message: `Invite sent to ${body.email}`
+		});
+		return apiSuccess({
+			success: true,
+			message: "Invite created. No email provider configured — share the link manually.",
+			inviteUrl: result.url
+		}, 200);
+	} catch (error) {
+		if (error instanceof InviteError) return apiError(error.code.toUpperCase(), error.message, {
+			user_exists: 409,
+			invalid_token: 400,
+			token_expired: 400
+		}[error.code] ?? 400);
+		return handleError(error, "Failed to create invite", "INVITE_CREATE_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/auth/invite/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite\n *\n * Create an invite for a new user. Admin only.\n *\n * When an email provider is configured (via the plugin email pipeline),\n * the invite email is sent automatically.\n * When no provider is configured, returns the invite URL for the admin\n * to share manually (copy-link fallback).\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createInvite, InviteError, Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { inviteCreateBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Default to AUTHOR role if not specified (Zod validates the level)\n\t\tconst role = body.role ?? Role.AUTHOR;\n\n\t\t// Get site config for invite email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use stored site URL to prevent Host header spoofing in invite emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request);\n\n\t\t// Build email sender from the plugin pipeline (if available)\n\t\tconst emailSend = emdash.email?.isAvailable()\n\t\t\t? (message: { to: string; subject: string; text: string; html?: string }) =>\n\t\t\t\t\temdash.email!.send(message, \"system\")\n\t\t\t: undefined;\n\n\t\tconst result = await createInvite(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: emailSend,\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email,\n\t\t\trole,\n\t\t\tuser.id,\n\t\t);\n\n\t\tif (emailSend) {\n\t\t\t// Email was sent\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: `Invite sent to ${body.email}`,\n\t\t\t});\n\t\t}\n\n\t\t// No email provider — return the invite URL for manual sharing\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"Invite created. No email provider configured — share the link manually.\",\n\t\t\t\tinviteUrl: result.url,\n\t\t\t},\n\t\t\t200,\n\t\t);\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tuser_exists: 409,\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 400,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to create invite\", \"INVITE_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,YAAY;AAWzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,KAAK,QAAQ,KAAK;EAI/B,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EAGrE,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,QAAQ;EAGxD,MAAM,YAAY,OAAO,OAAO,aAAa,IACzC,YACD,OAAO,MAAO,KAAK,SAAS,SAAS,GACrC;EAEH,MAAM,SAAS,MAAM,aACpB;GACC;GACA;GACA,OAAO;GACP,EACD,SACA,KAAK,OACL,MACA,KAAK,GACL;AAED,MAAI,UAEH,QAAO,WAAW;GACjB,SAAS;GACT,SAAS,kBAAkB,KAAK;GAChC,CAAC;AAIH,SAAO,WACN;GACC,SAAS;GACT,SAAS;GACT,WAAW,OAAO;GAClB,EACD,IACA;UACO,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,aAAa;GACb,eAAe;GACf,eAAe;GACf,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,2BAA2B,sBAAsB"}

package/dist/astro/routes/api/auth/invite/register-options.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/invite/register-options.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=register-options.d.mts.map

package/dist/astro/routes/api/auth/invite/register-options.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-options.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/register-options.ts"],"mappings":";;;cAUa,SAAA;AAAA,cAeA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/invite/register-options.mjs

@@ -0,0 +1,46 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { t as OptionsRepository } from "../../../../../options-BL4X94qY.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BFTPon-J.mjs";
+import "../../../../../redirects-Dmj6KRU3.mjs";
+import { h as inviteRegisterOptionsBody } from "../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-CseXl9Fv.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-CJ0OOHOr.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-Cg86_ISa.mjs";
+import { ulid } from "ulidx";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { InviteError, validateInvite } from "@emdash-cms/auth";
+import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";
+
+//#region src/astro/routes/api/auth/invite/register-options.ts
+const prerender = false;
+const POST = async ({ request, locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		const body = await parseBody(request, inviteRegisterOptionsBody);
+		if (isParseError(body)) return body;
+		const invite = await validateInvite(createKyselyAdapter(emdash.db), body.token);
+		const url = new URL(request.url);
+		const passkeyConfig = getPasskeyConfig(url, await new OptionsRepository(emdash.db).get("emdash:site_title") ?? void 0, getPublicOrigin(url, emdash?.config));
+		const challengeStore = createChallengeStore(emdash.db);
+		return apiSuccess({ options: await generateRegistrationOptions(passkeyConfig, {
+			id: ulid(),
+			email: invite.email,
+			name: body.name || null
+		}, [], challengeStore) });
+	} catch (error) {
+		if (error instanceof InviteError) return apiError(error.code.toUpperCase(), error.message, {
+			invalid_token: 404,
+			token_expired: 410,
+			user_exists: 409
+		}[error.code] ?? 400);
+		return handleError(error, "Failed to generate registration options", "INVITE_REGISTER_OPTIONS_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=register-options.mjs.map

package/dist/astro/routes/api/auth/invite/register-options.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/register-options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite/register-options\n *\n * Generate WebAuthn registration options for an invited user.\n * Validates the invite token and creates a temporary user identity\n * for the passkey registration flow.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { validateInvite, InviteError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { inviteRegisterOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteRegisterOptionsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Validate the invite token to get the email\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst invite = await validateInvite(adapter, body.token);\n\n\t\t// Get passkey config\n\t\t// Resolve siteUrl from config / EMDASH_SITE_URL so the RP ID matches the\n\t\t// browser-facing origin when running behind a TLS-terminating reverse proxy\n\t\t// (e.g. Traefik, nginx). Without this, getPasskeyConfig falls back to\n\t\t// url.hostname — the internal hostname like \"localhost\" — and the browser\n\t\t// rejects the WebAuthn registration. See issue #994.\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options with a temporary user identity\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst tempUser = {\n\t\t\tid: ulid(),\n\t\t\temail: invite.email,\n\t\t\tname: body.name || null,\n\t\t};\n\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\ttempUser,\n\t\t\t[],\n\t\t\tchallengeStore,\n\t\t);\n\n\t\treturn apiSuccess({ options: registrationOptions });\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tinvalid_token: 404,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_exists: 409,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to generate registration options\",\n\t\t\t\"INVITE_REGISTER_OPTIONS_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,0BAA0B;AAChE,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,SAAS,MAAM,eADL,oBAAoB,OAAO,GAAG,EACD,KAAK,MAAM;EAQxD,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAIhC,MAAM,gBAAgB,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;AActD,SAAO,WAAW,EAAE,SAPQ,MAAM,4BACjC,eAPgB;GAChB,IAAI,MAAM;GACV,OAAO,OAAO;GACd,MAAM,KAAK,QAAQ;GACnB,EAKA,EAAE,EACF,eACA,EAEiD,CAAC;UAC3C,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,eAAe;GACf,eAAe;GACf,aAAa;GACb,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YACN,OACA,2CACA,gCACA"}

package/dist/astro/routes/api/auth/logout.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/logout.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=logout.d.mts.map

package/dist/astro/routes/api/auth/logout.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/auth/logout.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAKA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/logout.mjs

@@ -0,0 +1,27 @@
+import "../../../../base64-CqR-7kqF.mjs";
+import "../../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, r as handleError } from "../../../../error-tSQWIl5U.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-DGRsLO2I.mjs";
+
+//#region src/astro/routes/api/auth/logout.ts
+const prerender = false;
+const POST = async ({ session, url }) => {
+	try {
+		if (session) session.destroy();
+		const redirect = url.searchParams.get("redirect");
+		if (isSafeRedirect(redirect)) return new Response(null, {
+			status: 302,
+			headers: { Location: redirect }
+		});
+		return apiSuccess({
+			success: true,
+			message: "Logged out successfully"
+		});
+	} catch (error) {
+		return handleError(error, "Logout failed", "LOGOUT_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=logout.mjs.map

package/dist/astro/routes/api/auth/logout.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/logout.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/logout\n *\n * Destroys the current session and logs the user out.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiSuccess, handleError } from \"#api/error.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\n\nexport const POST: APIRoute = async ({ session, url }) => {\n\ttry {\n\t\t// Destroy session\n\t\tif (session) {\n\t\t\tsession.destroy();\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (isSafeRedirect(redirect)) {\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 302,\n\t\t\t\theaders: { Location: redirect },\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Logged out successfully\",\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Logout failed\", \"LOGOUT_ERROR\");\n\t}\n};\n\n// No GET handler — logout must be POST-only to prevent CSRF via link/img tags\n"],"mappings":";;;;;;AAQA,MAAa,YAAY;AAKzB,MAAa,OAAiB,OAAO,EAAE,SAAS,UAAU;AACzD,KAAI;AAEH,MAAI,QACH,SAAQ,SAAS;EAIlB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,eAAe,SAAS,CAC3B,QAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS,EAAE,UAAU,UAAU;GAC/B,CAAC;AAGH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}

package/dist/astro/routes/api/auth/magic-link/send.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/magic-link/send.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=send.d.mts.map

package/dist/astro/routes/api/auth/magic-link/send.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"mappings":";;;cAWa,SAAA;AAAA,cAaA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/magic-link/send.mjs

@@ -0,0 +1,50 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { t as OptionsRepository } from "../../../../../options-BL4X94qY.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BFTPon-J.mjs";
+import "../../../../../redirects-Dmj6KRU3.mjs";
+import { g as magicLinkSendBody } from "../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CJhQIk65.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-D-M4Fd8O.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-t5CVjCO6.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { sendMagicLink } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/auth/magic-link/send.ts
+const prerender = false;
+const POST = async ({ request, locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		const body = await parseBody(request, magicLinkSendBody);
+		if (isParseError(body)) return body;
+		const ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));
+		if (!(await checkRateLimit(emdash.db, ip, "magic-link/send", 3, 300)).allowed) return apiSuccess({
+			success: true,
+			message: "If an account exists for this email, a magic link has been sent."
+		});
+		if (!emdash.email?.isAvailable()) return apiError("EMAIL_NOT_CONFIGURED", "Email is not configured. Magic link authentication requires an email provider.", 503);
+		const options = new OptionsRepository(emdash.db);
+		await sendMagicLink({
+			baseUrl: await getSiteBaseUrl(emdash.db, request),
+			siteName: await options.get("emdash:site_title") ?? "EmDash",
+			email: (message) => emdash.email.send(message, "system")
+		}, createKyselyAdapter(emdash.db), body.email.toLowerCase());
+		return apiSuccess({
+			success: true,
+			message: "If an account exists for this email, a magic link has been sent."
+		});
+	} catch (error) {
+		console.error("Magic link send error:", error);
+		return apiSuccess({
+			success: true,
+			message: "If an account exists for this email, a magic link has been sent."
+		});
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=send.mjs.map

package/dist/astro/routes/api/auth/magic-link/send.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using stored site URL (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? \"EmDash\";\n\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAYhD,QAAM,cAR0B;GAC/B,SAJe,MAAM,eAAe,OAAO,IAAI,QAAQ;GAKvD,UAJiB,MAAM,QAAQ,IAAY,oBAAoB,IAAK;GAKpE,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}

package/dist/astro/routes/api/auth/magic-link/verify.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/magic-link/verify.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=verify.d.mts.map

package/dist/astro/routes/api/auth/magic-link/verify.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"mappings":";;;cASa,SAAA;AAAA,cAQA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/auth/magic-link/verify.mjs

@@ -0,0 +1,35 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { t as isSafeRedirect } from "../../../../../redirect-DGRsLO2I.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { MagicLinkError, verifyMagicLink } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/auth/magic-link/verify.ts
+const prerender = false;
+const GET = async ({ url, locals, session, redirect }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const token = url.searchParams.get("token");
+	if (!token) return redirect("/_emdash/admin/login?error=missing_token");
+	try {
+		const adapter = createKyselyAdapter(emdash.db);
+		const user = await verifyMagicLink(adapter, token);
+		adapter.deleteExpiredTokens().catch(() => {});
+		if (session) session.set("user", { id: user.id });
+		const rawRedirect = url.searchParams.get("redirect");
+		return redirect(isSafeRedirect(rawRedirect) ? rawRedirect : "/_emdash/admin");
+	} catch (error) {
+		console.error("Magic link verify error:", error);
+		if (error instanceof MagicLinkError) switch (error.code) {
+			case "invalid_token": return redirect("/_emdash/admin/login?error=invalid_link");
+			case "token_expired": return redirect("/_emdash/admin/login?error=link_expired");
+			case "user_not_found": return redirect("/_emdash/admin/login?error=user_not_found");
+		}
+		return redirect("/_emdash/admin/login?error=verification_failed");
+	}
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=verify.mjs.map

package/dist/astro/routes/api/auth/magic-link/verify.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/magic-link/verify\n *\n * Verify a magic link token and create a session.\n * Tokens are single-use and expire after 15 minutes.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { verifyMagicLink, MagicLinkError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError } from \"#api/error.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\n\nexport const GET: APIRoute = async ({ url, locals, session, redirect }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Get token from query params\n\tconst token = url.searchParams.get(\"token\");\n\n\tif (!token) {\n\t\t// Redirect to login with error\n\t\treturn redirect(\"/_emdash/admin/login?error=missing_token\");\n\t}\n\n\ttry {\n\t\t// Verify the magic link token\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await verifyMagicLink(adapter, token);\n\n\t\t// Fire-and-forget cleanup of expired tokens -- prevents accumulation\n\t\tvoid adapter.deleteExpiredTokens().catch(() => {});\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Check for a stored redirect URL (from original request)\n\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\tconst rawRedirect = url.searchParams.get(\"redirect\");\n\t\tconst redirectUrl = isSafeRedirect(rawRedirect) ? rawRedirect : \"/_emdash/admin\";\n\n\t\t// Redirect to admin dashboard or original URL\n\t\treturn redirect(redirectUrl);\n\t} catch (error) {\n\t\tconsole.error(\"Magic link verify error:\", error);\n\n\t\t// Handle specific errors\n\t\tif (error instanceof MagicLinkError) {\n\t\t\tswitch (error.code) {\n\t\t\t\tcase \"invalid_token\":\n\t\t\t\t\treturn redirect(\"/_emdash/admin/login?error=invalid_link\");\n\t\t\t\tcase \"token_expired\":\n\t\t\t\t\treturn redirect(\"/_emdash/admin/login?error=link_expired\");\n\t\t\t\tcase \"user_not_found\":\n\t\t\t\t\treturn redirect(\"/_emdash/admin/login?error=user_not_found\");\n\t\t\t}\n\t\t}\n\n\t\t// Generic error\n\t\treturn redirect(\"/_emdash/admin/login?error=verification_failed\");\n\t}\n};\n"],"mappings":";;;;;;;;AASA,MAAa,YAAY;AAQzB,MAAa,MAAgB,OAAO,EAAE,KAAK,QAAQ,SAAS,eAAe;CAC1E,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,KAAI,CAAC,MAEJ,QAAO,SAAS,2CAA2C;AAG5D,KAAI;EAEH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,OAAO,MAAM,gBAAgB,SAAS,MAAM;AAGlD,EAAK,QAAQ,qBAAqB,CAAC,YAAY,GAAG;AAGlD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAKrC,MAAM,cAAc,IAAI,aAAa,IAAI,WAAW;AAIpD,SAAO,SAHa,eAAe,YAAY,GAAG,cAAc,iBAGpC;UACpB,OAAO;AACf,UAAQ,MAAM,4BAA4B,MAAM;AAGhD,MAAI,iBAAiB,eACpB,SAAQ,MAAM,MAAd;GACC,KAAK,gBACJ,QAAO,SAAS,0CAA0C;GAC3D,KAAK,gBACJ,QAAO,SAAS,0CAA0C;GAC3D,KAAK,iBACJ,QAAO,SAAS,4CAA4C;;AAK/D,SAAO,SAAS,iDAAiD"}

package/dist/astro/routes/api/auth/me.d.mts

@@ -0,0 +1,14 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/me.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+/**
+ * POST /_emdash/api/auth/me
+ *
+ * Mark that the user has seen the welcome modal.
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=me.d.mts.map

package/dist/astro/routes/api/auth/me.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/auth/me.ts"],"mappings":";;;cASa,SAAA;AAAA,cAMA,GAAA,EAAK,QAAA;;;;;AA4BlB;cAAa,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/me.mjs

@@ -0,0 +1,43 @@
+import "../../../../base64-CqR-7kqF.mjs";
+import "../../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../error-tSQWIl5U.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-BFTPon-J.mjs";
+import "../../../../redirects-Dmj6KRU3.mjs";
+import { f as authMeActionBody } from "../../../../setup-BGAJ2uXs.mjs";
+import "../../../../api/schemas/index.mjs";
+
+//#region src/astro/routes/api/auth/me.ts
+const prerender = false;
+const GET = async ({ locals, session }) => {
+	const { user } = locals;
+	if (!user) return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	const isFirstLogin = !await session?.get("hasSeenWelcome");
+	return apiSuccess({
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		role: user.role,
+		avatarUrl: user.avatarUrl,
+		isFirstLogin
+	});
+};
+/**
+* POST /_emdash/api/auth/me
+*
+* Mark that the user has seen the welcome modal.
+*/
+const POST = async ({ request, locals, session }) => {
+	const { user } = locals;
+	if (!user) return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	const body = await parseBody(request, authMeActionBody);
+	if (isParseError(body)) return body;
+	if (body.action === "dismissWelcome") {
+		session?.set("hasSeenWelcome", true);
+		return apiSuccess({ success: true });
+	}
+	return apiError("UNKNOWN_ACTION", "Unknown action", 400);
+};
+
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=me.mjs.map

package/dist/astro/routes/api/auth/me.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/me.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/me\n *\n * Returns the current authenticated user's info.\n * Used by the admin UI to display user info in the header.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { authMeActionBody } from \"#api/schemas.js\";\n\nexport const GET: APIRoute = async ({ locals, session }) => {\n\tconst { user } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\t// Check if this is the user's first login (for welcome modal)\n\t// We track this in the session to show the modal only once\n\tconst hasSeenWelcome = await session?.get(\"hasSeenWelcome\");\n\tconst isFirstLogin = !hasSeenWelcome;\n\n\t// Return safe user info (no sensitive data)\n\treturn apiSuccess({\n\t\tid: user.id,\n\t\temail: user.email,\n\t\tname: user.name,\n\t\trole: user.role,\n\t\tavatarUrl: user.avatarUrl,\n\t\tisFirstLogin,\n\t});\n};\n\n/**\n * POST /_emdash/api/auth/me\n *\n * Mark that the user has seen the welcome modal.\n */\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { user } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tconst body = await parseBody(request, authMeActionBody);\n\tif (isParseError(body)) return body;\n\n\tif (body.action === \"dismissWelcome\") {\n\t\tsession?.set(\"hasSeenWelcome\", true);\n\t\treturn apiSuccess({ success: true });\n\t}\n\n\treturn apiError(\"UNKNOWN_ACTION\", \"Unknown action\", 400);\n};\n"],"mappings":";;;;;;;;;AASA,MAAa,YAAY;AAMzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,cAAc;CAC3D,MAAM,EAAE,SAAS;AAEjB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;CAM/D,MAAM,eAAe,CADE,MAAM,SAAS,IAAI,iBAAiB;AAI3D,QAAO,WAAW;EACjB,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB;EACA,CAAC;;;;;;;AAQH,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,SAAS;AAEjB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;CAG/D,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,KAAI,aAAa,KAAK,CAAE,QAAO;AAE/B,KAAI,KAAK,WAAW,kBAAkB;AACrC,WAAS,IAAI,kBAAkB,KAAK;AACpC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;;AAGrC,QAAO,SAAS,kBAAkB,kBAAkB,IAAI"}

package/dist/astro/routes/api/auth/mode.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/mode.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=mode.d.mts.map

package/dist/astro/routes/api/auth/mode.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/auth/mode.ts"],"mappings":";;;cAea,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/auth/mode.mjs

@@ -0,0 +1,29 @@
+import { t as getAuthMode } from "../../../../mode-DPRPvJYm.mjs";
+
+//#region src/astro/routes/api/auth/mode.ts
+const prerender = false;
+const GET = async ({ locals }) => {
+	const { emdash } = locals;
+	const authMode = getAuthMode(emdash?.config);
+	let signupEnabled = false;
+	if (emdash?.db && authMode.type === "passkey") try {
+		const { sql } = await import("kysely");
+		const result = await sql`
+				SELECT COUNT(*) as cnt FROM allowed_domains WHERE enabled = 1
+			`.execute(emdash.db);
+		signupEnabled = Number(result.rows[0]?.cnt ?? 0) > 0;
+	} catch {}
+	const providers = (emdash?.config?.authProviders ?? []).map((p) => ({
+		id: p.id,
+		label: p.label
+	}));
+	return Response.json({ data: {
+		authMode: authMode.type === "external" ? authMode.providerType : "passkey",
+		signupEnabled,
+		providers
+	} }, { headers: { "Cache-Control": "private, no-store" } });
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=mode.mjs.map

package/dist/astro/routes/api/auth/mode.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/mode.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/mode\n *\n * Public endpoint that returns the active authentication mode.\n * Used by the login page to determine which login UI to render.\n *\n * Unlike the full manifest endpoint, this is intentionally public\n * and returns only the auth mode — no collection schemas, plugin\n * info, or other internal details.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { getAuthMode } from \"#auth/mode.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash } = locals;\n\n\tconst authMode = getAuthMode(emdash?.config);\n\n\t// Only check signup for passkey auth (external providers handle their own)\n\tlet signupEnabled = false;\n\tif (emdash?.db && authMode.type === \"passkey\") {\n\t\ttry {\n\t\t\tconst { sql } = await import(\"kysely\");\n\t\t\tconst result = await sql<{ cnt: unknown }>`\n\t\t\t\tSELECT COUNT(*) as cnt FROM allowed_domains WHERE enabled = 1\n\t\t\t`.execute(emdash.db);\n\t\t\tsignupEnabled = Number(result.rows[0]?.cnt ?? 0) > 0;\n\t\t} catch {\n\t\t\t// Table may not exist yet\n\t\t}\n\t}\n\n\t// Collect pluggable auth providers (from authProviders config)\n\tconst providers = (emdash?.config?.authProviders ?? []).map((p) => ({\n\t\tid: p.id,\n\t\tlabel: p.label,\n\t}));\n\n\treturn Response.json(\n\t\t{\n\t\t\tdata: {\n\t\t\t\tauthMode: authMode.type === \"external\" ? authMode.providerType : \"passkey\",\n\t\t\t\tsignupEnabled,\n\t\t\t\tproviders,\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\theaders: {\n\t\t\t\t\"Cache-Control\": \"private, no-store\",\n\t\t\t},\n\t\t},\n\t);\n};\n"],"mappings":";;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,WAAW;CAEnB,MAAM,WAAW,YAAY,QAAQ,OAAO;CAG5C,IAAI,gBAAgB;AACpB,KAAI,QAAQ,MAAM,SAAS,SAAS,UACnC,KAAI;EACH,MAAM,EAAE,QAAQ,MAAM,OAAO;EAC7B,MAAM,SAAS,MAAM,GAAqB;;KAExC,QAAQ,OAAO,GAAG;AACpB,kBAAgB,OAAO,OAAO,KAAK,IAAI,OAAO,EAAE,GAAG;SAC5C;CAMT,MAAM,aAAa,QAAQ,QAAQ,iBAAiB,EAAE,EAAE,KAAK,OAAO;EACnE,IAAI,EAAE;EACN,OAAO,EAAE;EACT,EAAE;AAEH,QAAO,SAAS,KACf,EACC,MAAM;EACL,UAAU,SAAS,SAAS,aAAa,SAAS,eAAe;EACjE;EACA;EACA,EACD,EACD,EACC,SAAS,EACR,iBAAiB,qBACjB,EACD,CACD"}

package/dist/astro/routes/api/auth/oauth/_provider_/callback.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/oauth/[provider]/callback.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=callback.d.mts.map

package/dist/astro/routes/api/auth/oauth/_provider_/callback.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAsEA,GAAA,EAAK,QAAA"}