emdash 0.12.0 → 0.13.0

package/dist/astro/routes/api/admin/themes/marketplace/index.mjs

@@ -0,0 +1,67 @@
+import "../../../../../../dialect-helpers-BKCvISIQ.mjs";
+import "../../../../../../content-D6YG26WG.mjs";
+import "../../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../../types-CwXMEPRr.mjs";
+import "../../../../../../media-Dg7he9uK.mjs";
+import "../../../../../../user-Dr1bOCqS.mjs";
+import "../../../../../../taxonomy-wPfusMK9.mjs";
+import "../../../../../../comment-Dd9MI82-.mjs";
+import "../../../../../../options-BL4X94qY.mjs";
+import "../../../../../../menus-DOzIecHi.mjs";
+import "../../../../../../redirect-DkaDxq8e.mjs";
+import "../../../../../../byline-D09BaS4j.mjs";
+import "../../../../../../seo-DRq9-EPP.mjs";
+import { u as handleThemeSearch } from "../../../../../../api-ayIQ7rIe.mjs";
+import "../../../../../../request-cache-dzCt8TZB.mjs";
+import "../../../../../../dashboard-BmWSIUwY.mjs";
+import "../../../../../../fts-manager-B633C-kQ.mjs";
+import "../../../../../../registry-BnCeHYsf.mjs";
+import "../../../../../../loader-Cs6-Bqe6.mjs";
+import "../../../../../../schema-BmqagCwG.mjs";
+import "../../../../../../zod-generator-DSyz01KE.mjs";
+import "../../../../../../seo-BoR4wCUh.mjs";
+import "../../../../../../sections-Cm-zb-gZ.mjs";
+import "../../../../../../settings-xQKsWnzQ.mjs";
+import "../../../../../../settings-CBBj7HUd.mjs";
+import "../../../../../../taxonomies-Cn9UpaR2.mjs";
+import "../../../../../../taxonomies-Dc0mzlms.mjs";
+import "../../../../../../manifest-schema-HCtSh4Jq.mjs";
+import "../../../../../../types-Db67HHlU.mjs";
+import "../../../../../../ssrf-DzFN_qV-.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-tSQWIl5U.mjs";
+import "../../../../../../parse-BFTPon-J.mjs";
+import "../../../../../../redirects-Dmj6KRU3.mjs";
+import "../../../../../../setup-BGAJ2uXs.mjs";
+import { n as requirePerm } from "../../../../../../authorize-BlyCH-96.mjs";
+
+//#region src/astro/routes/api/admin/themes/marketplace/index.ts
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const denied = requirePerm(user, "plugins:read");
+	if (denied) return denied;
+	const query = url.searchParams.get("q") ?? void 0;
+	const keyword = url.searchParams.get("keyword") ?? void 0;
+	const sortParam = url.searchParams.get("sort");
+	const validSorts = new Set([
+		"name",
+		"created",
+		"updated"
+	]);
+	let sort;
+	if (sortParam && validSorts.has(sortParam)) sort = sortParam;
+	const cursor = url.searchParams.get("cursor") ?? void 0;
+	const limitParam = url.searchParams.get("limit");
+	const limit = limitParam ? Math.min(Math.max(1, parseInt(limitParam, 10) || 50), 100) : void 0;
+	return unwrapResult(await handleThemeSearch(emdash.config.marketplace, query, {
+		keyword,
+		sort,
+		cursor,
+		limit
+	}));
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/admin/themes/marketplace/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/themes/marketplace/index.ts"],"sourcesContent":["/**\n * Theme marketplace search proxy endpoint\n *\n * GET /_emdash/api/admin/themes/marketplace - Search marketplace themes\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport { handleThemeSearch } from \"#api/index.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"plugins:read\");\n\tif (denied) return denied;\n\n\tconst query = url.searchParams.get(\"q\") ?? undefined;\n\tconst keyword = url.searchParams.get(\"keyword\") ?? undefined;\n\tconst sortParam = url.searchParams.get(\"sort\");\n\tconst validSorts = new Set([\"name\", \"created\", \"updated\"]);\n\tlet sort: \"name\" | \"created\" | \"updated\" | undefined;\n\tif (sortParam && validSorts.has(sortParam)) {\n\t\tsort = sortParam as \"name\" | \"created\" | \"updated\"; // eslint-disable-line typescript-eslint(no-unsafe-type-assertion) -- validated by Set.has()\n\t}\n\tconst cursor = url.searchParams.get(\"cursor\") ?? undefined;\n\tconst limitParam = url.searchParams.get(\"limit\");\n\tconst limit = limitParam ? Math.min(Math.max(1, parseInt(limitParam, 10) || 50), 100) : undefined;\n\n\tconst result = await handleThemeSearch(emdash.config.marketplace, query, {\n\t\tkeyword,\n\t\tsort,\n\t\tcursor,\n\t\tlimit,\n\t});\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,IAAI,aAAa,IAAI,IAAI,IAAI;CAC3C,MAAM,UAAU,IAAI,aAAa,IAAI,UAAU,IAAI;CACnD,MAAM,YAAY,IAAI,aAAa,IAAI,OAAO;CAC9C,MAAM,aAAa,IAAI,IAAI;EAAC;EAAQ;EAAW;EAAU,CAAC;CAC1D,IAAI;AACJ,KAAI,aAAa,WAAW,IAAI,UAAU,CACzC,QAAO;CAER,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CACjD,MAAM,aAAa,IAAI,aAAa,IAAI,QAAQ;CAChD,MAAM,QAAQ,aAAa,KAAK,IAAI,KAAK,IAAI,GAAG,SAAS,YAAY,GAAG,IAAI,GAAG,EAAE,IAAI,GAAG;AASxF,QAAO,aAPQ,MAAM,kBAAkB,OAAO,OAAO,aAAa,OAAO;EACxE;EACA;EACA;EACA;EACA,CAAC,CAEyB"}

package/dist/astro/routes/api/admin/users/_id_/disable.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/disable.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=disable.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/disable.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disable.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/disable.ts"],"mappings":";;;cAaa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/disable.mjs

@@ -0,0 +1,43 @@
+import "../../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../../types-CwXMEPRr.mjs";
+import { t as withTransaction } from "../../../../../../transaction-NQj4VJ7Z.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-tSQWIl5U.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { Role } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/admin/users/[id]/disable.ts
+/**
+* User disable endpoint
+*
+* POST /_emdash/api/admin/users/:id/disable - Soft-disable a user
+*/
+const prerender = false;
+const POST = async ({ params, locals }) => {
+	const { emdash, user: currentUser } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!currentUser || currentUser.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("VALIDATION_ERROR", "User ID required", 400);
+	if (id === currentUser.id) return apiError("VALIDATION_ERROR", "Cannot disable your own account", 400);
+	try {
+		const targetUser = await adapter.getUserById(id);
+		if (!targetUser) return apiError("NOT_FOUND", "User not found", 404);
+		if (await withTransaction(emdash.db, async (trx) => {
+			const trxAdapter = createKyselyAdapter(trx);
+			if (targetUser.role === Role.ADMIN) {
+				if (await trxAdapter.countAdmins() <= 1) return true;
+			}
+			await trxAdapter.updateUser(id, { disabled: true });
+			return false;
+		})) return apiError("VALIDATION_ERROR", "Cannot disable the last admin. Promote another user first.", 400);
+		await emdash.db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", id).execute();
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Failed to disable user", "USER_DISABLE_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=disable.mjs.map

package/dist/astro/routes/api/admin/users/_id_/disable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"disable.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/disable.ts"],"sourcesContent":["/**\n * User disable endpoint\n *\n * POST /_emdash/api/admin/users/:id/disable - Soft-disable a user\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { withTransaction } from \"#db/transaction.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!currentUser || currentUser.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"User ID required\", 400);\n\t}\n\n\t// Prevent disabling self\n\tif (id === currentUser.id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Cannot disable your own account\", 400);\n\t}\n\n\ttry {\n\t\t// Get target user\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Wrap admin check + disable in a transaction to prevent two\n\t\t// concurrent requests from both passing the count check.\n\t\tconst lastAdminBlocked = await withTransaction(emdash.db, async (trx) => {\n\t\t\tconst trxAdapter = createKyselyAdapter(trx);\n\t\t\tif (targetUser.role === Role.ADMIN) {\n\t\t\t\tconst adminCount = await trxAdapter.countAdmins();\n\t\t\t\tif (adminCount <= 1) return true;\n\t\t\t}\n\t\t\tawait trxAdapter.updateUser(id, { disabled: true });\n\t\t\treturn false;\n\t\t});\n\n\t\tif (lastAdminBlocked) {\n\t\t\treturn apiError(\n\t\t\t\t\"VALIDATION_ERROR\",\n\t\t\t\t\"Cannot disable the last admin. Promote another user first.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\t// SEC-43: Revoke all OAuth tokens for the disabled user.\n\t\t// Without this, existing refresh tokens remain valid for up to 90 days.\n\t\tawait emdash.db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", id).execute();\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to disable user\", \"USER_DISABLE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,aAAa;CAC3D,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,eAAe,YAAY,OAAO,KAAK,MAC3C,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAI7D,KAAI,OAAO,YAAY,GACtB,QAAO,SAAS,oBAAoB,mCAAmC,IAAI;AAG5E,KAAI;EAEH,MAAM,aAAa,MAAM,QAAQ,YAAY,GAAG;AAChD,MAAI,CAAC,WACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAepD,MAVyB,MAAM,gBAAgB,OAAO,IAAI,OAAO,QAAQ;GACxE,MAAM,aAAa,oBAAoB,IAAI;AAC3C,OAAI,WAAW,SAAS,KAAK,OAE5B;QADmB,MAAM,WAAW,aAAa,IAC/B,EAAG,QAAO;;AAE7B,SAAM,WAAW,WAAW,IAAI,EAAE,UAAU,MAAM,CAAC;AACnD,UAAO;IACN,CAGD,QAAO,SACN,oBACA,8DACA,IACA;AAKF,QAAM,OAAO,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,GAAG,CAAC,SAAS;AAEtF,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB"}

package/dist/astro/routes/api/admin/users/_id_/enable.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/enable.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=enable.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/enable.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/enable.ts"],"mappings":";;;cAYa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/enable.mjs

@@ -0,0 +1,32 @@
+import "../../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-tSQWIl5U.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { Role } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/admin/users/[id]/enable.ts
+/**
+* User enable endpoint
+*
+* POST /_emdash/api/admin/users/:id/enable - Re-enable a disabled user
+*/
+const prerender = false;
+const POST = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("VALIDATION_ERROR", "User ID required", 400);
+	try {
+		if (!await adapter.getUserById(id)) return apiError("NOT_FOUND", "User not found", 404);
+		await adapter.updateUser(id, { disabled: false });
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Failed to enable user", "USER_ENABLE_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=enable.mjs.map

package/dist/astro/routes/api/admin/users/_id_/enable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/enable.ts"],"sourcesContent":["/**\n * User enable endpoint\n *\n * POST /_emdash/api/admin/users/:id/enable - Re-enable a disabled user\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\t// Get target user\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Enable user\n\t\tawait adapter.updateUser(id, { disabled: false });\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to enable user\", \"USER_ENABLE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;AAYA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;AAGH,MAAI,CADe,MAAM,QAAQ,YAAY,GAAG,CAE/C,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAIpD,QAAM,QAAQ,WAAW,IAAI,EAAE,UAAU,OAAO,CAAC;AAEjD,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/admin/users/_id_/index.d.mts

@@ -0,0 +1,9 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/index.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const PUT: APIRoute;
+//#endregion
+export { GET, PUT, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/index.ts"],"mappings":";;;cAgBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA;AAAA,cAyDL,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/index.mjs

@@ -0,0 +1,106 @@
+import "../../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../../types-CwXMEPRr.mjs";
+import { t as withTransaction } from "../../../../../../transaction-NQj4VJ7Z.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-tSQWIl5U.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-BFTPon-J.mjs";
+import { E as userUpdateBody } from "../../../../../../redirects-Dmj6KRU3.mjs";
+import "../../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../../api/schemas/index.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { Role } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/admin/users/[id]/index.ts
+/**
+* User management detail endpoint
+*
+* GET /_emdash/api/admin/users/:id - Get user details
+* PUT /_emdash/api/admin/users/:id - Update user
+*/
+const prerender = false;
+const GET = async ({ params, locals }) => {
+	const { emdash, user: currentUser } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!currentUser || currentUser.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("MISSING_PARAM", "User ID required", 400);
+	try {
+		const result = await adapter.getUserWithDetails(id);
+		if (!result) return apiError("NOT_FOUND", "User not found", 404);
+		return apiSuccess({ item: {
+			id: result.user.id,
+			email: result.user.email,
+			name: result.user.name,
+			avatarUrl: result.user.avatarUrl,
+			role: result.user.role,
+			emailVerified: result.user.emailVerified,
+			disabled: result.user.disabled,
+			createdAt: result.user.createdAt.toISOString(),
+			updatedAt: result.user.updatedAt.toISOString(),
+			lastLogin: result.lastLogin?.toISOString() ?? null,
+			credentials: result.credentials.map((c) => ({
+				id: c.id,
+				name: c.name,
+				deviceType: c.deviceType,
+				createdAt: c.createdAt.toISOString(),
+				lastUsedAt: c.lastUsedAt.toISOString()
+			})),
+			oauthAccounts: result.oauthAccounts.map((a) => ({
+				provider: a.provider,
+				createdAt: a.createdAt.toISOString()
+			}))
+		} });
+	} catch (error) {
+		return handleError(error, "Failed to get user details", "USER_DETAIL_ERROR");
+	}
+};
+const PUT = async ({ params, request, locals }) => {
+	const { emdash, user: currentUser } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!currentUser || currentUser.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("MISSING_PARAM", "User ID required", 400);
+	try {
+		const targetUser = await adapter.getUserById(id);
+		if (!targetUser) return apiError("NOT_FOUND", "User not found", 404);
+		const body = await parseBody(request, userUpdateBody);
+		if (isParseError(body)) return body;
+		const role = body.role;
+		if (role !== void 0 && id === currentUser.id) return apiError("SELF_ROLE_CHANGE", "Cannot change your own role", 400);
+		if (body.email && body.email !== targetUser.email) {
+			if (await adapter.getUserByEmail(body.email)) return apiError("EMAIL_IN_USE", "Email already in use", 409);
+		}
+		const isDemotingAdmin = role !== void 0 && role < Role.ADMIN && targetUser.role === Role.ADMIN;
+		if (await withTransaction(emdash.db, async (trx) => {
+			const trxAdapter = createKyselyAdapter(trx);
+			if (isDemotingAdmin) {
+				if (await trxAdapter.countAdmins() <= 1) return true;
+			}
+			await trxAdapter.updateUser(id, {
+				name: body.name,
+				email: body.email,
+				role
+			});
+			return false;
+		})) return apiError("LAST_ADMIN", "Cannot demote the last admin. Promote another user first.", 400);
+		const updated = await adapter.getUserById(id);
+		return apiSuccess({ item: {
+			id: updated.id,
+			email: updated.email,
+			name: updated.name,
+			avatarUrl: updated.avatarUrl,
+			role: updated.role,
+			emailVerified: updated.emailVerified,
+			disabled: updated.disabled,
+			createdAt: updated.createdAt.toISOString(),
+			updatedAt: updated.updatedAt.toISOString()
+		} });
+	} catch (error) {
+		return handleError(error, "Failed to update user", "USER_UPDATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, PUT, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/admin/users/_id_/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/index.ts"],"sourcesContent":["/**\n * User management detail endpoint\n *\n * GET /_emdash/api/admin/users/:id - Get user details\n * PUT /_emdash/api/admin/users/:id - Update user\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { userUpdateBody } from \"#api/schemas.js\";\nimport { withTransaction } from \"#db/transaction.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!currentUser || currentUser.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\tconst result = await adapter.getUserWithDetails(id);\n\n\t\tif (!result) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Transform for JSON serialization\n\t\tconst item = {\n\t\t\tid: result.user.id,\n\t\t\temail: result.user.email,\n\t\t\tname: result.user.name,\n\t\t\tavatarUrl: result.user.avatarUrl,\n\t\t\trole: result.user.role,\n\t\t\temailVerified: result.user.emailVerified,\n\t\t\tdisabled: result.user.disabled,\n\t\t\tcreatedAt: result.user.createdAt.toISOString(),\n\t\t\tupdatedAt: result.user.updatedAt.toISOString(),\n\t\t\tlastLogin: result.lastLogin?.toISOString() ?? null,\n\t\t\tcredentials: result.credentials.map((c) => ({\n\t\t\t\tid: c.id,\n\t\t\t\tname: c.name,\n\t\t\t\tdeviceType: c.deviceType,\n\t\t\t\tcreatedAt: c.createdAt.toISOString(),\n\t\t\t\tlastUsedAt: c.lastUsedAt.toISOString(),\n\t\t\t})),\n\t\t\toauthAccounts: result.oauthAccounts.map((a) => ({\n\t\t\t\tprovider: a.provider,\n\t\t\t\tcreatedAt: a.createdAt.toISOString(),\n\t\t\t})),\n\t\t};\n\n\t\treturn apiSuccess({ item });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get user details\", \"USER_DETAIL_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!currentUser || currentUser.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\t// Get target user\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\tconst body = await parseBody(request, userUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Role is already validated as RoleLevel by Zod schema\n\t\tconst role = body.role;\n\n\t\t// Prevent editing own role (security: prevents self-demotion/lockout)\n\t\tif (role !== undefined && id === currentUser.id) {\n\t\t\treturn apiError(\"SELF_ROLE_CHANGE\", \"Cannot change your own role\", 400);\n\t\t}\n\n\t\t// Check email uniqueness if changing email\n\t\tif (body.email && body.email !== targetUser.email) {\n\t\t\tconst existing = await adapter.getUserByEmail(body.email);\n\t\t\tif (existing) {\n\t\t\t\treturn apiError(\"EMAIL_IN_USE\", \"Email already in use\", 409);\n\t\t\t}\n\t\t}\n\n\t\t// Wrap admin demotion guard + update in a transaction to prevent\n\t\t// two concurrent demotions from both passing the count check.\n\t\tconst isDemotingAdmin =\n\t\t\trole !== undefined && role < Role.ADMIN && targetUser.role === Role.ADMIN;\n\n\t\tconst lastAdminBlocked = await withTransaction(emdash.db, async (trx) => {\n\t\t\tconst trxAdapter = createKyselyAdapter(trx);\n\t\t\tif (isDemotingAdmin) {\n\t\t\t\tconst adminCount = await trxAdapter.countAdmins();\n\t\t\t\tif (adminCount <= 1) return true;\n\t\t\t}\n\t\t\tawait trxAdapter.updateUser(id, {\n\t\t\t\tname: body.name,\n\t\t\t\temail: body.email,\n\t\t\t\trole,\n\t\t\t});\n\t\t\treturn false;\n\t\t});\n\n\t\tif (lastAdminBlocked) {\n\t\t\treturn apiError(\n\t\t\t\t\"LAST_ADMIN\",\n\t\t\t\t\"Cannot demote the last admin. Promote another user first.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\t// Fetch updated user\n\t\tconst updated = await adapter.getUserById(id);\n\n\t\treturn apiSuccess({\n\t\t\titem: {\n\t\t\t\tid: updated!.id,\n\t\t\t\temail: updated!.email,\n\t\t\t\tname: updated!.name,\n\t\t\t\tavatarUrl: updated!.avatarUrl,\n\t\t\t\trole: updated!.role,\n\t\t\t\temailVerified: updated!.emailVerified,\n\t\t\t\tdisabled: updated!.disabled,\n\t\t\t\tcreatedAt: updated!.createdAt.toISOString(),\n\t\t\t\tupdatedAt: updated!.updatedAt.toISOString(),\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update user\", \"USER_UPDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,eAAe,YAAY,OAAO,KAAK,MAC3C,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,oBAAoB,IAAI;AAG1D,KAAI;EACH,MAAM,SAAS,MAAM,QAAQ,mBAAmB,GAAG;AAEnD,MAAI,CAAC,OACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AA4BpD,SAAO,WAAW,EAAE,MAxBP;GACZ,IAAI,OAAO,KAAK;GAChB,OAAO,OAAO,KAAK;GACnB,MAAM,OAAO,KAAK;GAClB,WAAW,OAAO,KAAK;GACvB,MAAM,OAAO,KAAK;GAClB,eAAe,OAAO,KAAK;GAC3B,UAAU,OAAO,KAAK;GACtB,WAAW,OAAO,KAAK,UAAU,aAAa;GAC9C,WAAW,OAAO,KAAK,UAAU,aAAa;GAC9C,WAAW,OAAO,WAAW,aAAa,IAAI;GAC9C,aAAa,OAAO,YAAY,KAAK,OAAO;IAC3C,IAAI,EAAE;IACN,MAAM,EAAE;IACR,YAAY,EAAE;IACd,WAAW,EAAE,UAAU,aAAa;IACpC,YAAY,EAAE,WAAW,aAAa;IACtC,EAAE;GACH,eAAe,OAAO,cAAc,KAAK,OAAO;IAC/C,UAAU,EAAE;IACZ,WAAW,EAAE,UAAU,aAAa;IACpC,EAAE;GACH,EAEyB,CAAC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,oBAAoB;;;AAI9E,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,eAAe,YAAY,OAAO,KAAK,MAC3C,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,oBAAoB,IAAI;AAG1D,KAAI;EAEH,MAAM,aAAa,MAAM,QAAQ,YAAY,GAAG;AAChD,MAAI,CAAC,WACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;EAGpD,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,KAAK;AAGlB,MAAI,SAAS,UAAa,OAAO,YAAY,GAC5C,QAAO,SAAS,oBAAoB,+BAA+B,IAAI;AAIxE,MAAI,KAAK,SAAS,KAAK,UAAU,WAAW,OAE3C;OADiB,MAAM,QAAQ,eAAe,KAAK,MAAM,CAExD,QAAO,SAAS,gBAAgB,wBAAwB,IAAI;;EAM9D,MAAM,kBACL,SAAS,UAAa,OAAO,KAAK,SAAS,WAAW,SAAS,KAAK;AAgBrE,MAdyB,MAAM,gBAAgB,OAAO,IAAI,OAAO,QAAQ;GACxE,MAAM,aAAa,oBAAoB,IAAI;AAC3C,OAAI,iBAEH;QADmB,MAAM,WAAW,aAAa,IAC/B,EAAG,QAAO;;AAE7B,SAAM,WAAW,WAAW,IAAI;IAC/B,MAAM,KAAK;IACX,OAAO,KAAK;IACZ;IACA,CAAC;AACF,UAAO;IACN,CAGD,QAAO,SACN,cACA,6DACA,IACA;EAIF,MAAM,UAAU,MAAM,QAAQ,YAAY,GAAG;AAE7C,SAAO,WAAW,EACjB,MAAM;GACL,IAAI,QAAS;GACb,OAAO,QAAS;GAChB,MAAM,QAAS;GACf,WAAW,QAAS;GACpB,MAAM,QAAS;GACf,eAAe,QAAS;GACxB,UAAU,QAAS;GACnB,WAAW,QAAS,UAAU,aAAa;GAC3C,WAAW,QAAS,UAAU,aAAa;GAC3C,EACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/admin/users/_id_/send-recovery.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/send-recovery.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=send-recovery.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/send-recovery.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-recovery.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/send-recovery.ts"],"mappings":";;;cAgBa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/send-recovery.mjs

@@ -0,0 +1,46 @@
+import "../../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../../types-CwXMEPRr.mjs";
+import { t as OptionsRepository } from "../../../../../../options-BL4X94qY.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-tSQWIl5U.mjs";
+import { t as getSiteBaseUrl } from "../../../../../../site-url-D-M4Fd8O.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { Role, sendMagicLink } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/admin/users/[id]/send-recovery.ts
+/**
+* Send recovery link endpoint
+*
+* POST /_emdash/api/admin/users/:id/send-recovery
+*
+* Admin-initiated account recovery — sends a recovery magic link to the user's email.
+*/
+const prerender = false;
+const POST = async ({ request, params, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const { id } = params;
+	if (!id) return apiError("VALIDATION_ERROR", "User ID required", 400);
+	try {
+		const adapter = createKyselyAdapter(emdash.db);
+		const targetUser = await adapter.getUserById(id);
+		if (!targetUser) return apiError("NOT_FOUND", "User not found", 404);
+		if (!emdash.email?.isAvailable()) return apiError("EMAIL_NOT_CONFIGURED", "Email is not configured. Recovery links require an email provider.", 503);
+		const options = new OptionsRepository(emdash.db);
+		await sendMagicLink({
+			baseUrl: await getSiteBaseUrl(emdash.db, request),
+			siteName: await options.get("emdash:site_title") ?? "EmDash",
+			email: (message) => emdash.email.send(message, "system")
+		}, adapter, targetUser.email, "recovery");
+		return apiSuccess({
+			success: true,
+			message: "Recovery link sent"
+		});
+	} catch (error) {
+		return handleError(error, "Failed to send recovery link", "RECOVERY_SEND_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=send-recovery.mjs.map

package/dist/astro/routes/api/admin/users/_id_/send-recovery.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-recovery.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/send-recovery.ts"],"sourcesContent":["/**\n * Send recovery link endpoint\n *\n * POST /_emdash/api/admin/users/:id/send-recovery\n *\n * Admin-initiated account recovery — sends a recovery magic link to the user's email.\n */\n\nimport { Role, sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ request, params, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Verify target user exists\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Recovery links require an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build config using stored site URL (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? \"EmDash\";\n\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t};\n\n\t\t// Send recovery link\n\t\tawait sendMagicLink(config, adapter, targetUser.email, \"recovery\");\n\n\t\treturn apiSuccess({ success: true, message: \"Recovery link sent\" });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to send recovery link\", \"RECOVERY_SEND_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,YAAY,GAAG;AAChD,MAAI,CAAC,WACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAIpD,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,sEACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAWhD,QAAM,cAP0B;GAC/B,SAJe,MAAM,eAAe,OAAO,IAAI,QAAQ;GAKvD,UAJiB,MAAM,QAAQ,IAAY,oBAAoB,IAAK;GAKpE,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EAG2B,SAAS,WAAW,OAAO,WAAW;AAElE,SAAO,WAAW;GAAE,SAAS;GAAM,SAAS;GAAsB,CAAC;UAC3D,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,sBAAsB"}

package/dist/astro/routes/api/admin/users/index.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/index.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/admin/users/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/admin/users/index.ts"],"mappings":";;;cAca,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/admin/users/index.mjs

@@ -0,0 +1,56 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../../parse-BFTPon-J.mjs";
+import { D as usersListQuery } from "../../../../../redirects-Dmj6KRU3.mjs";
+import "../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { Role } from "@emdash-cms/auth";
+
+//#region src/astro/routes/api/admin/users/index.ts
+/**
+* User management list endpoint
+*
+* GET /_emdash/api/admin/users - List users with search, filter, pagination
+*/
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	try {
+		const query = parseQuery(url, usersListQuery);
+		if (isParseError(query)) return query;
+		const result = await adapter.getUsers({
+			search: query.search,
+			role: query.role ? parseInt(query.role, 10) : void 0,
+			cursor: query.cursor,
+			limit: query.limit
+		});
+		return apiSuccess({
+			items: result.items.map((u) => ({
+				id: u.id,
+				email: u.email,
+				name: u.name,
+				avatarUrl: u.avatarUrl,
+				role: u.role,
+				emailVerified: u.emailVerified,
+				disabled: u.disabled,
+				createdAt: u.createdAt.toISOString(),
+				updatedAt: u.updatedAt.toISOString(),
+				lastLogin: u.lastLogin?.toISOString() ?? null,
+				credentialCount: u.credentialCount,
+				oauthProviders: u.oauthProviders
+			})),
+			nextCursor: result.nextCursor
+		});
+	} catch (error) {
+		return handleError(error, "Failed to list users", "USER_LIST_ERROR");
+	}
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/admin/users/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/users/index.ts"],"sourcesContent":["/**\n * User management list endpoint\n *\n * GET /_emdash/api/admin/users - List users with search, filter, pagination\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { usersListQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\t// Parse query parameters\n\t\tconst query = parseQuery(url, usersListQuery);\n\t\tif (isParseError(query)) return query;\n\n\t\t// Fetch users\n\t\tconst result = await adapter.getUsers({\n\t\t\tsearch: query.search,\n\t\t\trole: query.role ? parseInt(query.role, 10) : undefined,\n\t\t\tcursor: query.cursor,\n\t\t\tlimit: query.limit,\n\t\t});\n\n\t\t// Transform dates to ISO strings for JSON serialization\n\t\tconst items = result.items.map((u) => ({\n\t\t\tid: u.id,\n\t\t\temail: u.email,\n\t\t\tname: u.name,\n\t\t\tavatarUrl: u.avatarUrl,\n\t\t\trole: u.role,\n\t\t\temailVerified: u.emailVerified,\n\t\t\tdisabled: u.disabled,\n\t\t\tcreatedAt: u.createdAt.toISOString(),\n\t\t\tupdatedAt: u.updatedAt.toISOString(),\n\t\t\tlastLogin: u.lastLogin?.toISOString() ?? null,\n\t\t\tcredentialCount: u.credentialCount,\n\t\t\toauthProviders: u.oauthProviders,\n\t\t}));\n\n\t\treturn apiSuccess({\n\t\t\titems,\n\t\t\tnextCursor: result.nextCursor,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list users\", \"USER_LIST_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EAEH,MAAM,QAAQ,WAAW,KAAK,eAAe;AAC7C,MAAI,aAAa,MAAM,CAAE,QAAO;EAGhC,MAAM,SAAS,MAAM,QAAQ,SAAS;GACrC,QAAQ,MAAM;GACd,MAAM,MAAM,OAAO,SAAS,MAAM,MAAM,GAAG,GAAG;GAC9C,QAAQ,MAAM;GACd,OAAO,MAAM;GACb,CAAC;AAkBF,SAAO,WAAW;GACjB,OAhBa,OAAO,MAAM,KAAK,OAAO;IACtC,IAAI,EAAE;IACN,OAAO,EAAE;IACT,MAAM,EAAE;IACR,WAAW,EAAE;IACb,MAAM,EAAE;IACR,eAAe,EAAE;IACjB,UAAU,EAAE;IACZ,WAAW,EAAE,UAAU,aAAa;IACpC,WAAW,EAAE,UAAU,aAAa;IACpC,WAAW,EAAE,WAAW,aAAa,IAAI;IACzC,iBAAiB,EAAE;IACnB,gBAAgB,EAAE;IAClB,EAAE;GAIF,YAAY,OAAO;GACnB,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,kBAAkB"}

package/dist/astro/routes/api/auth/dev-bypass.d.mts

@@ -0,0 +1,9 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/dev-bypass.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=dev-bypass.d.mts.map

package/dist/astro/routes/api/auth/dev-bypass.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-bypass.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/auth/dev-bypass.ts"],"mappings":";;;cAmBa,SAAA;AAAA,cAsHA,GAAA,EAAK,QAAA;AAAA,cACL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/dev-bypass.mjs

@@ -0,0 +1,84 @@
+import { r as runMigrations } from "../../../../runner-DdnQIwz_.mjs";
+import "../../../../dialect-helpers-BKCvISIQ.mjs";
+import "../../../../base64-CqR-7kqF.mjs";
+import "../../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-tSQWIl5U.mjs";
+import { t as escapeHtml } from "../../../../escape-B8bdIryO.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-DGRsLO2I.mjs";
+import { ulid } from "ulidx";
+
+//#region src/astro/routes/api/auth/dev-bypass.ts
+const prerender = false;
+const DEV_USER_EMAIL = "dev@emdash.local";
+const DEV_USER_NAME = "Dev Admin";
+const ROLE_ADMIN = 50;
+async function handleDevBypass(context) {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Dev bypass is only available in development mode", 403);
+	const { locals, url, session } = context;
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		await runMigrations(emdash.db);
+		const existingUser = await emdash.db.selectFrom("users").selectAll().where("email", "=", DEV_USER_EMAIL).executeTakeFirst();
+		let user;
+		if (!existingUser) {
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const newUser = {
+				id: ulid(),
+				email: DEV_USER_EMAIL,
+				name: DEV_USER_NAME,
+				role: ROLE_ADMIN,
+				email_verified: 1,
+				created_at: now,
+				updated_at: now
+			};
+			await emdash.db.insertInto("users").values(newUser).execute();
+			user = {
+				id: newUser.id,
+				email: newUser.email,
+				name: newUser.name,
+				role: newUser.role
+			};
+			console.log("[dev-bypass] Created dev admin user:", user.email);
+		} else user = {
+			id: existingUser.id,
+			email: existingUser.email,
+			name: existingUser.name || DEV_USER_NAME,
+			role: existingUser.role
+		};
+		if (session) session.set("user", { id: user.id });
+		const redirect = url.searchParams.get("redirect");
+		if (redirect) {
+			if (!isSafeRedirect(redirect)) return apiError("INVALID_REDIRECT", "Redirect must be a local path", 400);
+			const html = `<!DOCTYPE html>
+<html>
+<head>
+	<meta http-equiv="refresh" content="0;url=${escapeHtml(redirect)}">
+</head>
+<body>Redirecting...</body>
+</html>`;
+			return new Response(html, {
+				status: 200,
+				headers: { "Content-Type": "text/html" }
+			});
+		}
+		return apiSuccess({
+			success: true,
+			message: "Dev session created",
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role
+			}
+		});
+	} catch (error) {
+		return handleError(error, "Dev bypass setup failed", "DEV_BYPASS_ERROR");
+	}
+}
+const GET = handleDevBypass;
+const POST = handleDevBypass;
+
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=dev-bypass.mjs.map

package/dist/astro/routes/api/auth/dev-bypass.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/dev-bypass\n * GET  /_emdash/api/auth/dev-bypass\n *\n * Development-only endpoint to bypass passkey authentication.\n * Creates or uses a test admin user and establishes a session.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/auth/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with user info\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/auth/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { runMigrations } from \"#db/migrations/runner.js\";\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Ensure migrations are run\n\t\tawait runMigrations(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tconsole.log(\"[dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev session created\",\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass setup failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,YAAY;AASzB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AAGtB,MAAM,aAAa;AAEnB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,QAAM,cAAc,OAAO,GAAG;EAG9B,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;AAEJ,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,WAAQ,IAAI,wCAAwC,KAAK,MAAM;QAE/D,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAIF,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,mBAAmB;;;AAK1E,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}

package/dist/astro/routes/api/auth/invite/accept.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/invite/accept.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=accept.d.mts.map

package/dist/astro/routes/api/auth/invite/accept.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/accept.ts"],"mappings":";;;cASa,SAAA;AAAA,cAOA,GAAA,EAAK,QAAA"}