emdash 0.12.0 → 0.13.0

package/dist/astro/routes/api/taxonomies/_name_/terms/index.mjs

@@ -0,0 +1,59 @@
+import "../../../../../../dialect-helpers-BKCvISIQ.mjs";
+import "../../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../../types-CwXMEPRr.mjs";
+import "../../../../../../taxonomy-wPfusMK9.mjs";
+import "../../../../../../request-cache-dzCt8TZB.mjs";
+import "../../../../../../loader-Cs6-Bqe6.mjs";
+import "../../../../../../taxonomies-Cn9UpaR2.mjs";
+import { o as handleTermList, r as handleTermCreate } from "../../../../../../taxonomies-Dc0mzlms.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../error-tSQWIl5U.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../parse-BFTPon-J.mjs";
+import { An as localeFilterQuery, H as createTermBody } from "../../../../../../redirects-Dmj6KRU3.mjs";
+import "../../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../../api/schemas/index.mjs";
+import { n as requirePerm } from "../../../../../../authorize-BlyCH-96.mjs";
+
+//#region src/astro/routes/api/taxonomies/[name]/terms/index.ts
+const prerender = false;
+/**
+* List all terms for a taxonomy
+*/
+const GET = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name } = params;
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+	try {
+		return unwrapResult(await handleTermList(emdash.db, name, { locale: query.locale }));
+	} catch (error) {
+		return handleError(error, "Failed to list terms", "TERM_LIST_ERROR");
+	}
+};
+/**
+* Create a new term
+*/
+const POST = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name } = params;
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, createTermBody);
+		if (isParseError(body)) return body;
+		return unwrapResult(await handleTermCreate(emdash.db, name, body), 201);
+	} catch (error) {
+		return handleError(error, "Failed to create term", "TERM_CREATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/taxonomies/_name_/terms/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/taxonomies/[name]/terms/index.ts"],"sourcesContent":["/**\n * Taxonomy terms list and create endpoint\n *\n * GET  /_emdash/api/taxonomies/:name/terms[?locale=xx] - List terms (tree for hierarchical)\n * POST /_emdash/api/taxonomies/:name/terms              - Create a new term (body may include locale & translationOf)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleTermCreate, handleTermList } from \"#api/handlers/taxonomies.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createTermBody, localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n/**\n * List all terms for a taxonomy\n */\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { name } = params;\n\tif (!name) return apiError(\"VALIDATION_ERROR\", \"Taxonomy name required\", 400);\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"taxonomies:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleTermList(emdash.db, name, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list terms\", \"TERM_LIST_ERROR\");\n\t}\n};\n\n/**\n * Create a new term\n */\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { name } = params;\n\tif (!name) return apiError(\"VALIDATION_ERROR\", \"Taxonomy name required\", 400);\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"taxonomies:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createTermBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleTermCreate(emdash.db, name, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create term\", \"TERM_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,SAAS;AACjB,KAAI,CAAC,KAAM,QAAO,SAAS,oBAAoB,0BAA0B,IAAI;CAE7E,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,eAAe,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC,CACnD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,kBAAkB;;;;;;AAOtE,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,SAAS;AACjB,KAAI,CAAC,KAAM,QAAO,SAAS,oBAAoB,0BAA0B,IAAI;CAE7E,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,oBAAoB;AACrD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,iBAAiB,OAAO,IAAI,MAAM,KAAK,EAChC,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/taxonomies/index.d.mts

@@ -0,0 +1,15 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/taxonomies/index.d.ts
+declare const prerender = false;
+/**
+ * List taxonomy definitions
+ */
+declare const GET: APIRoute;
+/**
+ * Create a custom taxonomy definition
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/taxonomies/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/taxonomies/index.ts"],"mappings":";;;cAea,SAAA;AAKb;;;AAAA,cAAa,GAAA,EAAK,QAAA;;AAuBlB;;cAAa,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/taxonomies/index.mjs

@@ -0,0 +1,55 @@
+import "../../../../dialect-helpers-BKCvISIQ.mjs";
+import "../../../../base64-CqR-7kqF.mjs";
+import "../../../../types-CwXMEPRr.mjs";
+import "../../../../taxonomy-wPfusMK9.mjs";
+import "../../../../request-cache-dzCt8TZB.mjs";
+import "../../../../loader-Cs6-Bqe6.mjs";
+import "../../../../taxonomies-Cn9UpaR2.mjs";
+import { n as handleTaxonomyList, t as handleTaxonomyCreate } from "../../../../taxonomies-Dc0mzlms.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../error-tSQWIl5U.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-BFTPon-J.mjs";
+import { An as localeFilterQuery, V as createTaxonomyDefBody } from "../../../../redirects-Dmj6KRU3.mjs";
+import "../../../../setup-BGAJ2uXs.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as requirePerm } from "../../../../authorize-BlyCH-96.mjs";
+
+//#region src/astro/routes/api/taxonomies/index.ts
+const prerender = false;
+/**
+* List taxonomy definitions
+*/
+const GET = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+	try {
+		return unwrapResult(await handleTaxonomyList(emdash.db, { locale: query.locale }));
+	} catch (error) {
+		return handleError(error, "Failed to list taxonomies", "TAXONOMY_LIST_ERROR");
+	}
+};
+/**
+* Create a custom taxonomy definition
+*/
+const POST = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, createTaxonomyDefBody);
+		if (isParseError(body)) return body;
+		return unwrapResult(await handleTaxonomyCreate(emdash.db, body), 201);
+	} catch (error) {
+		return handleError(error, "Failed to create taxonomy", "TAXONOMY_CREATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/taxonomies/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/taxonomies/index.ts"],"sourcesContent":["/**\n * Taxonomy definitions endpoint\n *\n * GET  /_emdash/api/taxonomies[?locale=xx] - List taxonomy definitions\n * POST /_emdash/api/taxonomies              - Create a custom taxonomy definition\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleTaxonomyCreate, handleTaxonomyList } from \"#api/handlers/taxonomies.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createTaxonomyDefBody, localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n/**\n * List taxonomy definitions\n */\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"taxonomies:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleTaxonomyList(emdash.db, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list taxonomies\", \"TAXONOMY_LIST_ERROR\");\n\t}\n};\n\n/**\n * Create a custom taxonomy definition\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"taxonomies:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createTaxonomyDefBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleTaxonomyCreate(emdash.db, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create taxonomy\", \"TAXONOMY_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,mBAAmB,OAAO,IAAI,EAAE,QAAQ,MAAM,QAAQ,CAAC,CACjD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,sBAAsB;;;;;;AAO/E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,oBAAoB;AACrD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,KAAK,EAC9B,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}

package/dist/astro/routes/api/themes/preview.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/themes/preview.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=preview.d.mts.map

package/dist/astro/routes/api/themes/preview.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/themes/preview.ts"],"mappings":";;;cAsBa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/themes/preview.mjs

@@ -0,0 +1,49 @@
+import "../../../../base64-CqR-7kqF.mjs";
+import "../../../../types-CwXMEPRr.mjs";
+import "../../../../options-BL4X94qY.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../error-tSQWIl5U.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-CseXl9Fv.mjs";
+import { i as resolveSecretsCached } from "../../../../secrets-6pgZyq0K.mjs";
+import { n as requirePerm } from "../../../../authorize-BlyCH-96.mjs";
+
+//#region src/astro/routes/api/themes/preview.ts
+const prerender = false;
+const POST = async ({ request, url, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const denied = requirePerm(user, "plugins:read");
+	if (denied) return denied;
+	const { previewSecret: secret } = await resolveSecretsCached(emdash.db);
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return apiError("INVALID_REQUEST", "Invalid JSON body", 400);
+	}
+	if (!body.previewUrl || typeof body.previewUrl !== "string") return apiError("INVALID_REQUEST", "previewUrl is required", 400);
+	let parsedPreviewUrl;
+	try {
+		parsedPreviewUrl = new URL(body.previewUrl);
+	} catch {
+		return apiError("INVALID_REQUEST", "previewUrl must be a valid URL", 400);
+	}
+	if (parsedPreviewUrl.protocol !== "https:") return apiError("INVALID_REQUEST", "previewUrl must use HTTPS", 400);
+	const source = getPublicOrigin(url, emdash?.config);
+	const exp = Math.floor(Date.now() / 1e3) + 3600;
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const buffer = await crypto.subtle.sign("HMAC", key, encoder.encode(`${source}:${exp}`));
+	const sig = Array.from(new Uint8Array(buffer), (b) => b.toString(16).padStart(2, "0")).join("");
+	const previewUrl = new URL(body.previewUrl);
+	previewUrl.searchParams.set("source", source);
+	previewUrl.searchParams.set("exp", String(exp));
+	previewUrl.searchParams.set("sig", sig);
+	return apiSuccess({ url: previewUrl.toString() });
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=preview.mjs.map

package/dist/astro/routes/api/themes/preview.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.mjs","names":[],"sources":["../../../../../src/astro/routes/api/themes/preview.ts"],"sourcesContent":["/**\n * Theme preview signing endpoint\n *\n * POST /_emdash/api/themes/preview\n *\n * Generates a signed preview URL for the \"Try with my data\" feature.\n *\n * Uses the resolved preview secret: env override (`EMDASH_PREVIEW_SECRET`)\n * wins, otherwise an auto-generated stable per-site value persisted in the\n * options table is used. Processes that share the same database converge on\n * the same auto-generated value; only set `EMDASH_PREVIEW_SECRET` in both\n * processes when the verifying side runs without access to the EmDash DB\n * (e.g. a remote preview Worker).\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { resolveSecretsCached } from \"#config/secrets.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ request, url, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"plugins:read\");\n\tif (denied) return denied;\n\n\t// Always non-empty after resolution; env override wins, otherwise a\n\t// stable DB-stored value is used.\n\tconst { previewSecret: secret } = await resolveSecretsCached(emdash.db);\n\n\tlet body: { previewUrl: string };\n\ttry {\n\t\tbody = await request.json();\n\t} catch {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid JSON body\", 400);\n\t}\n\n\tif (!body.previewUrl || typeof body.previewUrl !== \"string\") {\n\t\treturn apiError(\"INVALID_REQUEST\", \"previewUrl is required\", 400);\n\t}\n\n\t// Validate previewUrl is a valid HTTPS URL\n\tlet parsedPreviewUrl: URL;\n\ttry {\n\t\tparsedPreviewUrl = new URL(body.previewUrl);\n\t} catch {\n\t\treturn apiError(\"INVALID_REQUEST\", \"previewUrl must be a valid URL\", 400);\n\t}\n\n\tif (parsedPreviewUrl.protocol !== \"https:\") {\n\t\treturn apiError(\"INVALID_REQUEST\", \"previewUrl must use HTTPS\", 400);\n\t}\n\n\tconst source = getPublicOrigin(url, emdash?.config);\n\tconst ttl = 3600; // 1 hour\n\tconst exp = Math.floor(Date.now() / 1000) + ttl;\n\n\t// HMAC-SHA256 sign: message = \"source:exp\"\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"sign\"],\n\t);\n\tconst buffer = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(`${source}:${exp}`));\n\tconst sig = Array.from(new Uint8Array(buffer), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n\tconst previewUrl = new URL(body.previewUrl);\n\tpreviewUrl.searchParams.set(\"source\", source);\n\tpreviewUrl.searchParams.set(\"exp\", String(exp));\n\tpreviewUrl.searchParams.set(\"sig\", sig);\n\n\treturn apiSuccess({ url: previewUrl.toString() });\n};\n"],"mappings":";;;;;;;;;AAsBA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,SAAS,KAAK,aAAa;CACjE,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAInB,MAAM,EAAE,eAAe,WAAW,MAAM,qBAAqB,OAAO,GAAG;CAEvE,IAAI;AACJ,KAAI;AACH,SAAO,MAAM,QAAQ,MAAM;SACpB;AACP,SAAO,SAAS,mBAAmB,qBAAqB,IAAI;;AAG7D,KAAI,CAAC,KAAK,cAAc,OAAO,KAAK,eAAe,SAClD,QAAO,SAAS,mBAAmB,0BAA0B,IAAI;CAIlE,IAAI;AACJ,KAAI;AACH,qBAAmB,IAAI,IAAI,KAAK,WAAW;SACpC;AACP,SAAO,SAAS,mBAAmB,kCAAkC,IAAI;;AAG1E,KAAI,iBAAiB,aAAa,SACjC,QAAO,SAAS,mBAAmB,6BAA6B,IAAI;CAGrE,MAAM,SAAS,gBAAgB,KAAK,QAAQ,OAAO;CAEnD,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAD7B;CAIZ,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACR;CACD,MAAM,SAAS,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;CACxF,MAAM,MAAM,MAAM,KAAK,IAAI,WAAW,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;CAE/F,MAAM,aAAa,IAAI,IAAI,KAAK,WAAW;AAC3C,YAAW,aAAa,IAAI,UAAU,OAAO;AAC7C,YAAW,aAAa,IAAI,OAAO,OAAO,IAAI,CAAC;AAC/C,YAAW,aAAa,IAAI,OAAO,IAAI;AAEvC,QAAO,WAAW,EAAE,KAAK,WAAW,UAAU,EAAE,CAAC"}

package/dist/astro/routes/api/typegen.d.mts

@@ -0,0 +1,18 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/typegen.d.ts
+declare const prerender = false;
+/**
+ * GET - Return types as plain text (for preview/debugging)
+ */
+declare const GET: APIRoute;
+/**
+ * POST - Generate types and return as JSON
+ *
+ * The caller writes the file to disk. Response shape:
+ * { types: string, hash: string, collections: number }
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=typegen.d.mts.map

package/dist/astro/routes/api/typegen.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typegen.d.mts","names":[],"sources":["../../../../src/astro/routes/api/typegen.ts"],"mappings":";;;cAmBa,SAAA;;;;cAwCA,GAAA,EAAK,QAAA;;;;;;;cAkCL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/typegen.mjs

@@ -0,0 +1,78 @@
+import "../../../base64-CqR-7kqF.mjs";
+import "../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../error-tSQWIl5U.mjs";
+
+//#region src/astro/routes/api/typegen.ts
+const prerender = false;
+/**
+* Safely list collections, returning empty array if tables don't exist yet
+*/
+async function safeListCollections(registry) {
+	try {
+		return await registry.listCollections();
+	} catch (error) {
+		if (error instanceof Error && error.message.includes("no such table")) return [];
+		throw error;
+	}
+}
+/**
+* Generate types content and metadata from the current schema.
+*/
+async function generateTypes(registry) {
+	const { generateTypesFile, generateSchemaHash } = await import("../../../zod-generator-DSyz01KE.mjs").then((n) => n.r);
+	const collections = await safeListCollections(registry);
+	const collectionsWithFields = await Promise.all(collections.map(async (c) => {
+		const fields = await registry.listFields(c.id);
+		return {
+			...c,
+			fields
+		};
+	}));
+	return {
+		types: generateTypesFile(collectionsWithFields),
+		hash: await generateSchemaHash(collectionsWithFields),
+		collections: collections.length
+	};
+}
+/**
+* GET - Return types as plain text (for preview/debugging)
+*/
+const GET = async ({ locals }) => {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Typegen is only available in development", 403);
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash not configured", 500);
+	try {
+		const { SchemaRegistry } = await import("../../../registry-BnCeHYsf.mjs").then((n) => n.r);
+		const { types } = await generateTypes(new SchemaRegistry(emdash.db));
+		return new Response(types, {
+			status: 200,
+			headers: {
+				"Content-Type": "text/typescript",
+				"Cache-Control": "private, no-store"
+			}
+		});
+	} catch (error) {
+		return handleError(error, "Typegen failed", "TYPEGEN_ERROR");
+	}
+};
+/**
+* POST - Generate types and return as JSON
+*
+* The caller writes the file to disk. Response shape:
+* { types: string, hash: string, collections: number }
+*/
+const POST = async ({ locals }) => {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Typegen is only available in development", 403);
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash not configured", 500);
+	try {
+		const { SchemaRegistry } = await import("../../../registry-BnCeHYsf.mjs").then((n) => n.r);
+		return apiSuccess(await generateTypes(new SchemaRegistry(emdash.db)));
+	} catch (error) {
+		return handleError(error, "Typegen failed", "TYPEGEN_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=typegen.mjs.map

package/dist/astro/routes/api/typegen.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"typegen.mjs","names":[],"sources":["../../../../src/astro/routes/api/typegen.ts"],"sourcesContent":["/**\n * Typegen endpoint - generates emdash-env.d.ts content\n *\n * POST /_emdash/api/typegen - Generate types and return as JSON\n * GET /_emdash/api/typegen - Return types as text (for preview/debugging)\n *\n * The caller (integration or CLI) is responsible for writing the file to disk.\n * This endpoint only generates the content — it has no filesystem access,\n * which is essential for Cloudflare Workers where process.cwd() is \"/\" and\n * node:fs may not be available.\n *\n * Dev-only endpoint - disabled in production.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport type { SchemaRegistry } from \"#schema/registry.js\";\n\nexport const prerender = false;\n\n/**\n * Safely list collections, returning empty array if tables don't exist yet\n */\nasync function safeListCollections(registry: SchemaRegistry) {\n\ttry {\n\t\treturn await registry.listCollections();\n\t} catch (error) {\n\t\t// Handle missing tables for new sites that haven't run setup yet\n\t\tif (error instanceof Error && error.message.includes(\"no such table\")) {\n\t\t\treturn [];\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Generate types content and metadata from the current schema.\n */\nasync function generateTypes(registry: SchemaRegistry) {\n\tconst { generateTypesFile, generateSchemaHash } = await import(\"#schema/zod-generator.js\");\n\n\tconst collections = await safeListCollections(registry);\n\tconst collectionsWithFields = await Promise.all(\n\t\tcollections.map(async (c) => {\n\t\t\tconst fields = await registry.listFields(c.id);\n\t\t\treturn { ...c, fields };\n\t\t}),\n\t);\n\n\tconst types = generateTypesFile(collectionsWithFields);\n\tconst hash: string = await generateSchemaHash(collectionsWithFields);\n\n\treturn { types, hash, collections: collections.length };\n}\n\n/**\n * GET - Return types as plain text (for preview/debugging)\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Typegen is only available in development\", 403);\n\t}\n\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst { SchemaRegistry } = await import(\"#schema/registry.js\");\n\t\tconst registry = new SchemaRegistry(emdash.db);\n\t\tconst { types } = await generateTypes(registry);\n\n\t\treturn new Response(types, {\n\t\t\tstatus: 200,\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"text/typescript\",\n\t\t\t\t\"Cache-Control\": \"private, no-store\",\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Typegen failed\", \"TYPEGEN_ERROR\");\n\t}\n};\n\n/**\n * POST - Generate types and return as JSON\n *\n * The caller writes the file to disk. Response shape:\n * { types: string, hash: string, collections: number }\n */\nexport const POST: APIRoute = async ({ locals }) => {\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Typegen is only available in development\", 403);\n\t}\n\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst { SchemaRegistry } = await import(\"#schema/registry.js\");\n\t\tconst registry = new SchemaRegistry(emdash.db);\n\t\tconst result = await generateTypes(registry);\n\n\t\treturn apiSuccess(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Typegen failed\", \"TYPEGEN_ERROR\");\n\t}\n};\n"],"mappings":";;;;;AAmBA,MAAa,YAAY;;;;AAKzB,eAAe,oBAAoB,UAA0B;AAC5D,KAAI;AACH,SAAO,MAAM,SAAS,iBAAiB;UAC/B,OAAO;AAEf,MAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,CACpE,QAAO,EAAE;AAEV,QAAM;;;;;;AAOR,eAAe,cAAc,UAA0B;CACtD,MAAM,EAAE,mBAAmB,uBAAuB,MAAM,OAAO;CAE/D,MAAM,cAAc,MAAM,oBAAoB,SAAS;CACvD,MAAM,wBAAwB,MAAM,QAAQ,IAC3C,YAAY,IAAI,OAAO,MAAM;EAC5B,MAAM,SAAS,MAAM,SAAS,WAAW,EAAE,GAAG;AAC9C,SAAO;GAAE,GAAG;GAAG;GAAQ;GACtB,CACF;AAKD,QAAO;EAAE,OAHK,kBAAkB,sBAAsB;EAGtC,MAFK,MAAM,mBAAmB,sBAAsB;EAE9C,aAAa,YAAY;EAAQ;;;;;AAMxD,MAAa,MAAgB,OAAO,EAAE,aAAa;AAClD,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,4CAA4C,IAAI;CAG9E,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,yBAAyB,IAAI;AAGhE,KAAI;EACH,MAAM,EAAE,mBAAmB,MAAM,OAAO;EAExC,MAAM,EAAE,UAAU,MAAM,cADP,IAAI,eAAe,OAAO,GAAG,CACC;AAE/C,SAAO,IAAI,SAAS,OAAO;GAC1B,QAAQ;GACR,SAAS;IACR,gBAAgB;IAChB,iBAAiB;IACjB;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,kBAAkB,gBAAgB;;;;;;;;;AAU9D,MAAa,OAAiB,OAAO,EAAE,aAAa;AACnD,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,4CAA4C,IAAI;CAG9E,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,yBAAyB,IAAI;AAGhE,KAAI;EACH,MAAM,EAAE,mBAAmB,MAAM,OAAO;AAIxC,SAAO,WAFQ,MAAM,cADJ,IAAI,eAAe,OAAO,GAAG,CACF,CAEnB;UACjB,OAAO;AACf,SAAO,YAAY,OAAO,kBAAkB,gBAAgB"}

package/dist/astro/routes/api/well-known/auth.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/well-known/auth.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=auth.d.mts.map

package/dist/astro/routes/api/well-known/auth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/well-known/auth.ts"],"mappings":";;;cAYa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/well-known/auth.mjs

@@ -0,0 +1,42 @@
+import { t as OptionsRepository } from "../../../../options-BL4X94qY.mjs";
+import { t as getAuthMode } from "../../../../mode-DPRPvJYm.mjs";
+
+//#region src/astro/routes/api/well-known/auth.ts
+const prerender = false;
+const GET = async ({ locals }) => {
+	const { emdash } = locals;
+	const config = emdash?.config;
+	const authMode = config ? getAuthMode(config) : null;
+	const isExternal = authMode?.type === "external";
+	let siteName = "EmDash";
+	if (emdash?.db) try {
+		siteName = await new OptionsRepository(emdash.db).get("emdash:site_title") || "EmDash";
+	} catch {}
+	const response = {
+		instance: {
+			name: siteName,
+			version: "0.1.0"
+		},
+		auth: {
+			mode: isExternal ? "external" : "passkey",
+			...isExternal && authMode.type === "external" ? { external_provider: authMode.entrypoint } : {},
+			methods: {
+				device_flow: !isExternal ? {
+					client_id: "emdash-cli",
+					device_authorization_endpoint: "/_emdash/api/oauth/device/code",
+					token_endpoint: "/_emdash/api/oauth/device/token"
+				} : void 0,
+				authorization_code: !isExternal ? {
+					authorization_endpoint: "/_emdash/oauth/authorize",
+					token_endpoint: "/_emdash/api/oauth/token"
+				} : void 0,
+				api_tokens: true
+			}
+		}
+	};
+	return Response.json(response, { headers: { "Cache-Control": "no-store" } });
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=auth.mjs.map

package/dist/astro/routes/api/well-known/auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.mjs","names":[],"sources":["../../../../../src/astro/routes/api/well-known/auth.ts"],"sourcesContent":["/**\n * GET /_emdash/.well-known/auth\n *\n * Auth discovery endpoint. Returns available auth mechanisms.\n * Public, unauthenticated. Used by CLI to determine how to authenticate.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { getAuthMode } from \"#auth/mode.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash } = locals;\n\n\t// Build discovery response\n\tconst config = emdash?.config;\n\tconst authMode = config ? getAuthMode(config) : null;\n\n\tconst isExternal = authMode?.type === \"external\";\n\n\t// Try to read site name from DB options\n\tlet siteName = \"EmDash\";\n\tif (emdash?.db) {\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\tsiteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\t\t} catch {\n\t\t\t// DB may not be initialized yet\n\t\t}\n\t}\n\n\tconst response: Record<string, unknown> = {\n\t\tinstance: {\n\t\t\tname: siteName,\n\t\t\tversion: \"0.1.0\",\n\t\t},\n\t\tauth: {\n\t\t\tmode: isExternal ? \"external\" : \"passkey\",\n\t\t\t...(isExternal && authMode.type === \"external\"\n\t\t\t\t? { external_provider: authMode.entrypoint }\n\t\t\t\t: {}),\n\t\t\tmethods: {\n\t\t\t\tdevice_flow: !isExternal\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tclient_id: \"emdash-cli\",\n\t\t\t\t\t\t\tdevice_authorization_endpoint: \"/_emdash/api/oauth/device/code\",\n\t\t\t\t\t\t\ttoken_endpoint: \"/_emdash/api/oauth/device/token\",\n\t\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t\tauthorization_code: !isExternal\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tauthorization_endpoint: \"/_emdash/oauth/authorize\",\n\t\t\t\t\t\t\ttoken_endpoint: \"/_emdash/api/oauth/token\",\n\t\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t\tapi_tokens: true,\n\t\t\t},\n\t\t},\n\t};\n\n\treturn Response.json(response, {\n\t\theaders: {\n\t\t\t\"Cache-Control\": \"no-store\",\n\t\t},\n\t});\n};\n"],"mappings":";;;;AAYA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,WAAW;CAGnB,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW,SAAS,YAAY,OAAO,GAAG;CAEhD,MAAM,aAAa,UAAU,SAAS;CAGtC,IAAI,WAAW;AACf,KAAI,QAAQ,GACX,KAAI;AAEH,aAAY,MADI,IAAI,kBAAkB,OAAO,GAAG,CACtB,IAAY,oBAAoB,IAAK;SACxD;CAKT,MAAM,WAAoC;EACzC,UAAU;GACT,MAAM;GACN,SAAS;GACT;EACD,MAAM;GACL,MAAM,aAAa,aAAa;GAChC,GAAI,cAAc,SAAS,SAAS,aACjC,EAAE,mBAAmB,SAAS,YAAY,GAC1C,EAAE;GACL,SAAS;IACR,aAAa,CAAC,aACX;KACA,WAAW;KACX,+BAA+B;KAC/B,gBAAgB;KAChB,GACA;IACH,oBAAoB,CAAC,aAClB;KACA,wBAAwB;KACxB,gBAAgB;KAChB,GACA;IACH,YAAY;IACZ;GACD;EACD;AAED,QAAO,SAAS,KAAK,UAAU,EAC9B,SAAS,EACR,iBAAiB,YACjB,EACD,CAAC"}

package/dist/astro/routes/api/well-known/oauth-authorization-server.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/well-known/oauth-authorization-server.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=oauth-authorization-server.d.mts.map

package/dist/astro/routes/api/well-known/oauth-authorization-server.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-server.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/well-known/oauth-authorization-server.ts"],"mappings":";;;cAgBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/well-known/oauth-authorization-server.mjs

@@ -0,0 +1,32 @@
+import { n as getPublicOrigin } from "../../../../public-url-CseXl9Fv.mjs";
+import { n as VALID_SCOPES } from "../../../../api-tokens-D3C9v02m.mjs";
+
+//#region src/astro/routes/api/well-known/oauth-authorization-server.ts
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const origin = getPublicOrigin(url, locals.emdash?.config);
+	const issuer = `${origin}/_emdash`;
+	return Response.json({
+		issuer,
+		authorization_endpoint: `${origin}/_emdash/oauth/authorize`,
+		token_endpoint: `${origin}/_emdash/api/oauth/token`,
+		scopes_supported: [...VALID_SCOPES],
+		response_types_supported: ["code"],
+		grant_types_supported: [
+			"authorization_code",
+			"refresh_token",
+			"urn:ietf:params:oauth:grant-type:device_code"
+		],
+		code_challenge_methods_supported: ["S256"],
+		registration_endpoint: `${origin}/_emdash/api/oauth/register`,
+		token_endpoint_auth_methods_supported: ["none"],
+		device_authorization_endpoint: `${origin}/_emdash/api/oauth/device/code`
+	}, { headers: {
+		"Cache-Control": "public, max-age=3600",
+		"Access-Control-Allow-Origin": "*"
+	} });
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=oauth-authorization-server.mjs.map

package/dist/astro/routes/api/well-known/oauth-authorization-server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-server.mjs","names":[],"sources":["../../../../../src/astro/routes/api/well-known/oauth-authorization-server.ts"],"sourcesContent":["/**\n * GET /.well-known/oauth-authorization-server/_emdash\n *\n * RFC 8414 Authorization Server Metadata. The path follows the RFC 8414\n * convention: the issuer's pathname (/_emdash) is appended after\n * /.well-known/oauth-authorization-server, so MCP clients can discover\n * it automatically from the authorization_servers URL.\n *\n * Public, unauthenticated.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { VALID_SCOPES } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst origin = getPublicOrigin(url, locals.emdash?.config);\n\tconst issuer = `${origin}/_emdash`;\n\n\treturn Response.json(\n\t\t{\n\t\t\tissuer,\n\t\t\tauthorization_endpoint: `${origin}/_emdash/oauth/authorize`,\n\t\t\ttoken_endpoint: `${origin}/_emdash/api/oauth/token`,\n\t\t\tscopes_supported: [...VALID_SCOPES],\n\t\t\tresponse_types_supported: [\"code\"],\n\t\t\tgrant_types_supported: [\n\t\t\t\t\"authorization_code\",\n\t\t\t\t\"refresh_token\",\n\t\t\t\t\"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t],\n\t\t\tcode_challenge_methods_supported: [\"S256\"],\n\t\t\tregistration_endpoint: `${origin}/_emdash/api/oauth/register`,\n\t\t\ttoken_endpoint_auth_methods_supported: [\"none\"],\n\t\t\tdevice_authorization_endpoint: `${origin}/_emdash/api/oauth/device/code`,\n\t\t},\n\t\t{\n\t\t\theaders: {\n\t\t\t\t\"Cache-Control\": \"public, max-age=3600\",\n\t\t\t\t\"Access-Control-Allow-Origin\": \"*\",\n\t\t\t},\n\t\t},\n\t);\n};\n"],"mappings":";;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,SAAS,gBAAgB,KAAK,OAAO,QAAQ,OAAO;CAC1D,MAAM,SAAS,GAAG,OAAO;AAEzB,QAAO,SAAS,KACf;EACC;EACA,wBAAwB,GAAG,OAAO;EAClC,gBAAgB,GAAG,OAAO;EAC1B,kBAAkB,CAAC,GAAG,aAAa;EACnC,0BAA0B,CAAC,OAAO;EAClC,uBAAuB;GACtB;GACA;GACA;GACA;EACD,kCAAkC,CAAC,OAAO;EAC1C,uBAAuB,GAAG,OAAO;EACjC,uCAAuC,CAAC,OAAO;EAC/C,+BAA+B,GAAG,OAAO;EACzC,EACD,EACC,SAAS;EACR,iBAAiB;EACjB,+BAA+B;EAC/B,EACD,CACD"}

package/dist/astro/routes/api/well-known/oauth-protected-resource.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/well-known/oauth-protected-resource.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=oauth-protected-resource.d.mts.map

package/dist/astro/routes/api/well-known/oauth-protected-resource.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-protected-resource.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/well-known/oauth-protected-resource.ts"],"mappings":";;;cAkBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/well-known/oauth-protected-resource.mjs

@@ -0,0 +1,21 @@
+import { n as getPublicOrigin } from "../../../../public-url-CseXl9Fv.mjs";
+import { n as VALID_SCOPES } from "../../../../api-tokens-D3C9v02m.mjs";
+
+//#region src/astro/routes/api/well-known/oauth-protected-resource.ts
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const origin = getPublicOrigin(url, locals.emdash?.config);
+	return Response.json({
+		resource: `${origin}/_emdash/api/mcp`,
+		authorization_servers: [`${origin}/_emdash`],
+		scopes_supported: [...VALID_SCOPES],
+		bearer_methods_supported: ["header"]
+	}, { headers: {
+		"Cache-Control": "public, max-age=3600",
+		"Access-Control-Allow-Origin": "*"
+	} });
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=oauth-protected-resource.mjs.map

package/dist/astro/routes/api/well-known/oauth-protected-resource.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-protected-resource.mjs","names":[],"sources":["../../../../../src/astro/routes/api/well-known/oauth-protected-resource.ts"],"sourcesContent":["/**\n * GET /.well-known/oauth-protected-resource\n *\n * RFC 9728 Protected Resource Metadata. Tells MCP clients where to find\n * the authorization server. Injected at the site root (not under /_emdash/)\n * because RFC 9728 requires it at the well-known URI of the resource's origin.\n *\n * Also serves as `/.well-known/oauth-protected-resource/_emdash/api/mcp`\n * (path-scoped variant) when Astro's routing allows.\n *\n * Public, unauthenticated.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { VALID_SCOPES } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst origin = getPublicOrigin(url, locals.emdash?.config);\n\n\treturn Response.json(\n\t\t{\n\t\t\tresource: `${origin}/_emdash/api/mcp`,\n\t\t\tauthorization_servers: [`${origin}/_emdash`],\n\t\t\tscopes_supported: [...VALID_SCOPES],\n\t\t\tbearer_methods_supported: [\"header\"],\n\t\t},\n\t\t{\n\t\t\theaders: {\n\t\t\t\t\"Cache-Control\": \"public, max-age=3600\",\n\t\t\t\t\"Access-Control-Allow-Origin\": \"*\",\n\t\t\t},\n\t\t},\n\t);\n};\n"],"mappings":";;;;AAkBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,SAAS,gBAAgB,KAAK,OAAO,QAAQ,OAAO;AAE1D,QAAO,SAAS,KACf;EACC,UAAU,GAAG,OAAO;EACpB,uBAAuB,CAAC,GAAG,OAAO,UAAU;EAC5C,kBAAkB,CAAC,GAAG,aAAa;EACnC,0BAA0B,CAAC,SAAS;EACpC,EACD,EACC,SAAS;EACR,iBAAiB;EACjB,+BAA+B;EAC/B,EACD,CACD"}

package/dist/astro/routes/api/widget-areas/_name_/reorder.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/widget-areas/[name]/reorder.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=reorder.d.mts.map

package/dist/astro/routes/api/widget-areas/_name_/reorder.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reorder.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/widget-areas/[name]/reorder.ts"],"mappings":";;;cAaa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/widget-areas/_name_/reorder.mjs

@@ -0,0 +1,36 @@
+import "../../../../../base64-CqR-7kqF.mjs";
+import "../../../../../types-CwXMEPRr.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-tSQWIl5U.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BFTPon-J.mjs";
+import { h as reorderWidgetsBody } from "../../../../../redirects-Dmj6KRU3.mjs";
+import "../../../../../setup-BGAJ2uXs.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { n as requirePerm } from "../../../../../authorize-BlyCH-96.mjs";
+
+//#region src/astro/routes/api/widget-areas/[name]/reorder.ts
+const prerender = false;
+const POST = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+	const { name } = params;
+	const denied = requirePerm(user, "widgets:manage");
+	if (denied) return denied;
+	if (!name) return apiError("VALIDATION_ERROR", "name is required", 400);
+	try {
+		const area = await db.selectFrom("_emdash_widget_areas").select("id").where("name", "=", name).executeTakeFirst();
+		if (!area) return apiError("NOT_FOUND", `Widget area "${name}" not found`, 404);
+		const body = await parseBody(request, reorderWidgetsBody);
+		if (isParseError(body)) return body;
+		const existingWidgets = await db.selectFrom("_emdash_widgets").select("id").where("area_id", "=", area.id).execute();
+		const existingIds = new Set(existingWidgets.map((w) => w.id));
+		for (const id of body.widgetIds) if (!existingIds.has(id)) return apiError("VALIDATION_ERROR", `Widget "${id}" not found in area "${name}"`, 400);
+		await Promise.all(body.widgetIds.map((id, index) => db.updateTable("_emdash_widgets").set({ sort_order: index }).where("id", "=", id).execute()));
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Failed to reorder widgets", "WIDGET_REORDER_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=reorder.mjs.map

package/dist/astro/routes/api/widget-areas/_name_/reorder.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reorder.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/widget-areas/[name]/reorder.ts"],"sourcesContent":["/**\n * Reorder widgets endpoint\n *\n * POST /_emdash/api/widget-areas/:name/reorder\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { reorderWidgetsBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst db = emdash.db;\n\tconst { name } = params;\n\n\tconst denied = requirePerm(user, \"widgets:manage\");\n\tif (denied) return denied;\n\n\tif (!name) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"name is required\", 400);\n\t}\n\n\ttry {\n\t\t// Get the area\n\t\tconst area = await db\n\t\t\t.selectFrom(\"_emdash_widget_areas\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!area) {\n\t\t\treturn apiError(\"NOT_FOUND\", `Widget area \"${name}\" not found`, 404);\n\t\t}\n\n\t\tconst body = await parseBody(request, reorderWidgetsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Verify all widget IDs belong to this area\n\t\tconst existingWidgets = await db\n\t\t\t.selectFrom(\"_emdash_widgets\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"area_id\", \"=\", area.id)\n\t\t\t.execute();\n\n\t\tconst existingIds = new Set(existingWidgets.map((w) => w.id));\n\t\tfor (const id of body.widgetIds) {\n\t\t\tif (!existingIds.has(id)) {\n\t\t\t\treturn apiError(\"VALIDATION_ERROR\", `Widget \"${id}\" not found in area \"${name}\"`, 400);\n\t\t\t}\n\t\t}\n\n\t\t// Update sort_order for each widget\n\t\tawait Promise.all(\n\t\t\tbody.widgetIds.map((id, index) =>\n\t\t\t\tdb.updateTable(\"_emdash_widgets\").set({ sort_order: index }).where(\"id\", \"=\", id).execute(),\n\t\t\t),\n\t\t);\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to reorder widgets\", \"WIDGET_REORDER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;AAaA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,KAAK,OAAO;CAClB,MAAM,EAAE,SAAS;CAEjB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,KACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;EAEH,MAAM,OAAO,MAAM,GACjB,WAAW,uBAAuB,CAClC,OAAO,KAAK,CACZ,MAAM,QAAQ,KAAK,KAAK,CACxB,kBAAkB;AAEpB,MAAI,CAAC,KACJ,QAAO,SAAS,aAAa,gBAAgB,KAAK,cAAc,IAAI;EAGrE,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,kBAAkB,MAAM,GAC5B,WAAW,kBAAkB,CAC7B,OAAO,KAAK,CACZ,MAAM,WAAW,KAAK,KAAK,GAAG,CAC9B,SAAS;EAEX,MAAM,cAAc,IAAI,IAAI,gBAAgB,KAAK,MAAM,EAAE,GAAG,CAAC;AAC7D,OAAK,MAAM,MAAM,KAAK,UACrB,KAAI,CAAC,YAAY,IAAI,GAAG,CACvB,QAAO,SAAS,oBAAoB,WAAW,GAAG,uBAAuB,KAAK,IAAI,IAAI;AAKxF,QAAM,QAAQ,IACb,KAAK,UAAU,KAAK,IAAI,UACvB,GAAG,YAAY,kBAAkB,CAAC,IAAI,EAAE,YAAY,OAAO,CAAC,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,SAAS,CAC3F,CACD;AAED,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,uBAAuB"}

package/dist/astro/routes/api/widget-areas/_name_/widgets/_id_.d.mts

@@ -0,0 +1,9 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/widget-areas/[name]/widgets/[id].d.ts
+declare const prerender = false;
+declare const PUT: APIRoute;
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, PUT, prerender };
+//# sourceMappingURL=_id_.d.mts.map

package/dist/astro/routes/api/widget-areas/_name_/widgets/_id_.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_id_.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/widget-areas/[name]/widgets/[id].ts"],"mappings":";;;cAgBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA;AAAA,cAqEL,MAAA,EAAQ,QAAA"}