emdash 0.13.0 → 0.15.0

package/dist/astro/middleware/auth.d.mts

@@ -1,12 +1,12 @@
-import "../../options-Cq64Wx0O.mjs";
-import "../../types-C1KKK4VP.mjs";
-import "../../types-B05e2naf.mjs";
-import "../../bylines-C6eYUWlZ.mjs";
-import "../../index-UmOMt9T-.mjs";
-import "../../runner-DcfZewkO.mjs";
-import "../../index-D2gvztOP.mjs";
-import "../../types-Cb2UCDJg.mjs";
-import "../../validate-BpQGsmd7.mjs";
+import "../../options-DhV-gwJb.mjs";
+import "../../types-DaqNzqVt.mjs";
+import "../../types-DGHWRQgr.mjs";
+import "../../bylines-DtDRNF1n.mjs";
+import "../../index-Bv1Wf1zB.mjs";
+import "../../runner-CNHRo1mT.mjs";
+import "../../index-CC42STEm.mjs";
+import "../../types-bYmRn_Uy.mjs";
+import "../../validate-DQtHw9NT.mjs";
 import { EmDashHandlers } from "../types.mjs";
 import { User } from "@emdash-cms/auth";
 import * as astro from "astro";

package/dist/astro/middleware/auth.mjs

@@ -1,10 +1,10 @@
 import "../../base64-CqR-7kqF.mjs";
-import "../../types-CwXMEPRr.mjs";
-import { t as apiError } from "../../error-tSQWIl5U.mjs";
-import { n as getPublicOrigin } from "../../public-url-CseXl9Fv.mjs";
-import { t as getAuthMode } from "../../mode-DPRPvJYm.mjs";
-import { i as hasScope } from "../../api-tokens-D3C9v02m.mjs";
-import { a as resolveOAuthToken, i as resolveApiToken } from "../../api-tokens-eYymBhIT.mjs";
+import "../../types-ByV5sgsv.mjs";
+import { t as apiError } from "../../error-CPh_8eLq.mjs";
+import { n as getPublicOrigin } from "../../public-url-CUWWFME2.mjs";
+import { t as getAuthMode } from "../../mode-CaaiebZI.mjs";
+import { i as hasScope } from "../../api-tokens-iPIHAY8N.mjs";
+import { a as resolveOAuthToken, i as resolveApiToken } from "../../api-tokens-ucpcNXDt.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";

package/dist/astro/middleware/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","names":["virtualAuthenticate"],"sources":["../../../src/api/csrf.ts","../../../src/astro/middleware/csp.ts","../../../src/astro/middleware/auth.ts"],"sourcesContent":["/**\n * CSRF protection utilities.\n *\n * Two mechanisms:\n * 1. Custom header check (X-EmDash-Request: 1) — used for authenticated API routes.\n *    Browsers block cross-origin custom headers, so presence proves same-origin.\n * 2. Origin check — used for public API routes that skip auth. Compares the Origin\n *    header against the request origin. Same approach as Astro's `checkOrigin`.\n */\n\nimport { apiError } from \"./error.js\";\n\n/**\n * Origin-based CSRF check for public API routes that skip auth.\n *\n * State-changing requests (POST/PUT/DELETE) to public endpoints must either:\n *   1. Include the X-EmDash-Request: 1 header (custom header blocked cross-origin), OR\n *   2. Have an Origin header matching the request origin (or the configured public origin)\n *\n * This prevents cross-origin form submissions (which can't set custom headers)\n * and cross-origin fetch (blocked by CORS unless allowed). Same-origin requests\n * always include a matching Origin header.\n *\n * Returns a 403 Response if the check fails, or null if allowed.\n *\n * @param request  The incoming request\n * @param url      The request URL (internal origin)\n * @param publicOrigin  The public-facing origin from config.siteUrl. Must be\n *        `undefined` when absent — never `null` or `\"\"` (security invariant H-1a).\n */\nexport function checkPublicCsrf(\n\trequest: Request,\n\turl: URL,\n\tpublicOrigin?: string,\n): Response | null {\n\t// Custom header present — browser blocks cross-origin custom headers\n\tconst csrfHeader = request.headers.get(\"X-EmDash-Request\");\n\tif (csrfHeader === \"1\") return null;\n\n\t// Check Origin header — present on all POST/PUT/DELETE from browsers\n\tconst origin = request.headers.get(\"Origin\");\n\tif (origin) {\n\t\ttry {\n\t\t\tconst originUrl = new URL(origin);\n\t\t\t// Accept if Origin matches either the internal or public origin\n\t\t\tif (originUrl.origin === url.origin) return null;\n\t\t\tif (publicOrigin && originUrl.origin === publicOrigin) return null;\n\t\t} catch {\n\t\t\t// Malformed Origin — fall through to reject\n\t\t}\n\n\t\treturn apiError(\"CSRF_REJECTED\", \"Cross-origin request blocked\", 403);\n\t}\n\n\t// No Origin header — non-browser client (curl, server-to-server).\n\t// Allow these through since CSRF is a browser-specific attack vector.\n\t// Server-to-server requests don't carry ambient credentials (cookies).\n\treturn null;\n}\n","/**\n * Strict Content-Security-Policy for /_emdash routes (admin + API).\n *\n * Applied via middleware header rather than Astro's built-in CSP because\n * Astro's auto-hashing defeats 'unsafe-inline' (CSP3 ignores 'unsafe-inline'\n * when hashes are present), which would break user-facing pages.\n *\n * img-src allows any HTTPS origin because the admin renders user content that\n * may reference external images (migrations, external hosting, embeds).\n * Plugin security does not rely on img-src -- plugins run in V8 isolates with\n * no DOM access. connect-src stays at 'self' unless the experimental registry\n * is configured, in which case the configured aggregator origin is allowed.\n */\nimport type { RegistryConfigInput } from \"../../registry/types.js\";\n\nfunction getRegistryAggregatorOrigin(\n\tregistry: RegistryConfigInput | undefined,\n): string | undefined {\n\tconst aggregatorUrl = typeof registry === \"string\" ? registry : registry?.aggregatorUrl;\n\tif (!aggregatorUrl) return undefined;\n\n\ttry {\n\t\tconst url = new URL(aggregatorUrl);\n\t\tif (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n\t\treturn url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function buildEmDashCsp(registry?: RegistryConfigInput): string {\n\tconst connectSrc = [\"connect-src 'self'\"];\n\tconst registryAggregatorOrigin = getRegistryAggregatorOrigin(registry);\n\tif (registryAggregatorOrigin) connectSrc.push(registryAggregatorOrigin);\n\n\treturn [\n\t\t\"default-src 'self'\",\n\t\t\"script-src 'self' 'unsafe-inline'\",\n\t\t\"style-src 'self' 'unsafe-inline'\",\n\t\tconnectSrc.join(\" \"),\n\t\t\"form-action 'self'\",\n\t\t\"frame-ancestors 'none'\",\n\t\t\"img-src 'self' https: data: blob:\",\n\t\t\"object-src 'none'\",\n\t\t\"base-uri 'self'\",\n\t].join(\"; \");\n}\n","/**\n * Auth middleware for admin routes\n *\n * Checks if the user is authenticated and has appropriate permissions.\n * Supports two auth modes:\n * - Passkey (default): Session-based auth with passkey login\n * - External providers: JWT-based auth (Cloudflare Access, etc.)\n *\n * This middleware runs AFTER the setup middleware - so if we get here,\n * we know setup is complete and users exist.\n */\n\nimport type { User, RoleLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { defineMiddleware } from \"astro:middleware\";\nimport { ulid } from \"ulidx\";\n// Import auth provider via virtual module (statically bundled)\n// This avoids dynamic import issues in Cloudflare Workers\nimport { authenticate as virtualAuthenticate } from \"virtual:emdash/auth\";\n// @ts-ignore - virtual module\nimport virtualConfig from \"virtual:emdash/config\";\n\nimport { checkPublicCsrf } from \"../../api/csrf.js\";\nimport { apiError } from \"../../api/error.js\";\nimport { getPublicOrigin } from \"../../api/public-url.js\";\n\n/** Cache headers for middleware error responses (matches API_CACHE_HEADERS in api/error.ts) */\nconst MW_CACHE_HEADERS = {\n\t\"Cache-Control\": \"private, no-store\",\n} as const;\nimport { resolveApiToken, resolveOAuthToken } from \"../../api/handlers/api-tokens.js\";\nimport { hasScope } from \"../../auth/api-tokens.js\";\nimport { getAuthMode, type ExternalAuthMode } from \"../../auth/mode.js\";\nimport type { ExternalAuthConfig } from \"../../auth/types.js\";\nimport type { EmDashHandlers } from \"../types.js\";\nimport { buildEmDashCsp } from \"./csp.js\";\n\ndeclare global {\n\tnamespace App {\n\t\tinterface Locals {\n\t\t\tuser?: User;\n\t\t\t/** Token scopes when authenticated via API token or OAuth token. Undefined for session auth. */\n\t\t\ttokenScopes?: string[];\n\t\t\temdash?: EmDashHandlers;\n\t\t}\n\t\tinterface SessionData {\n\t\t\tuser: { id: string };\n\t\t\thasSeenWelcome: boolean;\n\t\t}\n\t}\n}\n\n// Role level constants (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\nconst MCP_ENDPOINT_PATH = \"/_emdash/api/mcp\";\n\nfunction isUnsafeMethod(method: string): boolean {\n\treturn method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\";\n}\n\nfunction csrfRejectedResponse(): Response {\n\treturn new Response(\n\t\tJSON.stringify({ error: { code: \"CSRF_REJECTED\", message: \"Missing required header\" } }),\n\t\t{\n\t\t\tstatus: 403,\n\t\t\theaders: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS },\n\t\t},\n\t);\n}\n\nfunction mcpUnauthorizedResponse(\n\turl: URL,\n\tconfig?: Parameters<typeof getPublicOrigin>[1],\n): Response {\n\tconst origin = getPublicOrigin(url, config);\n\treturn Response.json(\n\t\t{ error: { code: \"NOT_AUTHENTICATED\", message: \"Not authenticated\" } },\n\t\t{\n\t\t\tstatus: 401,\n\t\t\theaders: {\n\t\t\t\t\"WWW-Authenticate\": `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`,\n\t\t\t\t...MW_CACHE_HEADERS,\n\t\t\t},\n\t\t},\n\t);\n}\n\n/**\n * API routes that skip auth — each handles its own access control.\n *\n * Prefix entries match any path starting with that prefix.\n * Exact entries (no trailing slash or wildcard) match that path only.\n */\nconst PUBLIC_API_PREFIXES = [\n\t\"/_emdash/api/setup\",\n\t\"/_emdash/api/auth/login\",\n\t\"/_emdash/api/auth/register\",\n\t\"/_emdash/api/auth/dev-bypass\",\n\t\"/_emdash/api/auth/signup/\",\n\t\"/_emdash/api/auth/magic-link/\",\n\t\"/_emdash/api/auth/invite/\",\n\t\"/_emdash/api/auth/oauth/\",\n\t\"/_emdash/api/oauth/device/token\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/comments/\",\n\t\"/_emdash/api/media/file/\",\n\t\"/_emdash/.well-known/\",\n];\n\nconst PUBLIC_API_EXACT = new Set([\n\t\"/_emdash/api/auth/passkey/options\",\n\t\"/_emdash/api/auth/passkey/verify\",\n\t\"/_emdash/api/auth/mode\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/snapshot\",\n\t// Public site search — read-only. The query layer hardcodes status='published'\n\t// so unauthenticated callers only see published content. Admin endpoints\n\t// (/enable, /rebuild, /stats) remain private because they're not in this set.\n\t\"/_emdash/api/search\",\n]);\n\n// Build merged public routes at module load from auth provider descriptors.\n// Routes ending with \"/\" are treated as prefixes; all others are exact matches.\nconst { exact: _providerExactRoutes, prefixes: _providerPrefixRoutes } = (() => {\n\tconst exact = new Set<string>();\n\tconst prefixes: string[] = [];\n\tif (!virtualConfig?.authProviders) return { exact, prefixes };\n\tfor (const route of virtualConfig.authProviders.flatMap((p) => p.publicRoutes ?? [])) {\n\t\tif (route.endsWith(\"/\")) {\n\t\t\tprefixes.push(route);\n\t\t} else {\n\t\t\texact.add(route);\n\t\t}\n\t}\n\treturn { exact, prefixes };\n})();\n\n/**\n * OAuth protocol endpoints that are CSRF-exempt by design.\n *\n * These are RFC-defined endpoints (RFC 6749 §3.2, RFC 7591 §3, RFC 8628 §3.1/§3.4)\n * specified to be called cross-origin by external clients (MCP clients, CLIs,\n * native apps). They authenticate each request on its own merits:\n *\n * - /oauth/token: requires PKCE code_verifier, device_code, or refresh_token\n * - /oauth/register: RFC 7591 dynamic client registration — anonymous by design\n * - /oauth/device/code: RFC 8628 device flow initiation — anonymous by design\n * - /oauth/device/token: requires device_code the client already holds\n *\n * None of these rely on ambient cookie credentials, so browser-based CSRF\n * attacks have nothing to exploit. The endpoints themselves advertise\n * `Access-Control-Allow-Origin: *`. Note: /oauth/device/authorize (the user\n * consent step) is NOT in this list — it is session-authenticated.\n */\nconst CSRF_EXEMPT_PUBLIC_ROUTES = new Set([\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/device/token\",\n]);\n\nfunction isPublicEmDashRoute(pathname: string): boolean {\n\tif (PUBLIC_API_EXACT.has(pathname)) return true;\n\tif (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;\n\tif (_providerExactRoutes.has(pathname)) return true;\n\tif (_providerPrefixRoutes.some((p) => pathname.startsWith(p))) return true;\n\tif (import.meta.env.DEV && pathname === \"/_emdash/api/typegen\") return true;\n\treturn false;\n}\n\nfunction isCsrfExemptPublicRoute(pathname: string): boolean {\n\treturn CSRF_EXEMPT_PUBLIC_ROUTES.has(pathname);\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { url } = context;\n\n\t// Only check auth on admin routes and API routes\n\tconst isAdminRoute = url.pathname.startsWith(\"/_emdash/admin\");\n\tconst isSetupRoute = url.pathname.startsWith(\"/_emdash/admin/setup\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\tconst isPublicApiRoute = isPublicEmDashRoute(url.pathname);\n\n\tconst isPublicRoute = !isAdminRoute && !isApiRoute;\n\n\t// Public API routes skip auth but still need CSRF protection on state-changing methods.\n\t// We check Origin header against the request host (same approach as Astro's checkOrigin).\n\t// This prevents cross-origin form submissions and fetch requests from malicious sites.\n\tif (isPublicApiRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (\n\t\t\tisUnsafeMethod(method) &&\n\t\t\t!isCsrfExemptPublicRoute(url.pathname) // OAuth protocol endpoints — cross-origin by design\n\t\t) {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\treturn next();\n\t}\n\n\t// Plugin routes: soft auth (resolve user if credentials present, but never block).\n\t// The catch-all handler decides per-route whether auth is required (public vs private).\n\t// Public plugin routes that accept POST are vulnerable to cross-origin form submissions,\n\t// so we apply the same Origin-based CSRF check as other public routes.\n\tconst isPluginRoute = url.pathname.startsWith(\"/_emdash/api/plugins/\");\n\tif (isPluginRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\treturn handlePluginRouteAuth(context, next);\n\t}\n\n\t// Setup routes: skip auth but still enforce CSRF on state-changing methods\n\tif (isSetupRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\t\tif (csrfHeader !== \"1\") {\n\t\t\t\treturn new Response(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\terror: { code: \"CSRF_REJECTED\", message: \"Missing required header\" },\n\t\t\t\t\t}),\n\t\t\t\t\t{\n\t\t\t\t\t\tstatus: 403,\n\t\t\t\t\t\theaders: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS },\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn next();\n\t}\n\n\t// For public routes: soft auth check (set locals.user if session exists, but never block)\n\tif (isPublicRoute) {\n\t\treturn handlePublicRouteAuth(context, next);\n\t}\n\n\t// --- Everything below is /_emdash (admin + API) ---\n\n\t// Try Bearer token auth first (API tokens and OAuth tokens).\n\t// If successful, skip CSRF (tokens aren't ambient credentials like cookies).\n\tconst bearerResult = await handleBearerAuth(context);\n\n\tif (bearerResult === \"invalid\") {\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...MW_CACHE_HEADERS,\n\t\t};\n\t\t// Add WWW-Authenticate header on MCP endpoint 401s to trigger OAuth discovery\n\t\tif (url.pathname === \"/_emdash/api/mcp\") {\n\t\t\tconst origin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\theaders[\"WWW-Authenticate\"] =\n\t\t\t\t`Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`;\n\t\t}\n\t\treturn new Response(\n\t\t\tJSON.stringify({ error: { code: \"INVALID_TOKEN\", message: \"Invalid or expired token\" } }),\n\t\t\t{ status: 401, headers },\n\t\t);\n\t}\n\n\tconst isTokenAuth = bearerResult === \"authenticated\";\n\n\t// MCP discovery/tooling is bearer-only. Session/external auth should never\n\t// be consulted for this endpoint, and unauthenticated requests must return\n\t// the OAuth discovery-style 401 response.\n\tconst method = context.request.method.toUpperCase();\n\tconst isMcpEndpoint = url.pathname === MCP_ENDPOINT_PATH;\n\tif (isMcpEndpoint && !isTokenAuth) {\n\t\treturn mcpUnauthorizedResponse(url, context.locals.emdash?.config);\n\t}\n\n\t// CSRF protection: require X-EmDash-Request header on state-changing requests.\n\t// Skip for token-authenticated requests (tokens aren't ambient credentials).\n\t// Browsers block cross-origin custom headers, so this prevents CSRF without tokens.\n\t// OAuth authorize consent is exempt: it's a standard HTML form POST that can't\n\t// include custom headers. The consent flow is protected by session + single-use codes.\n\tconst isOAuthConsent = url.pathname.startsWith(\"/_emdash/oauth/authorize\");\n\tif (\n\t\tisApiRoute &&\n\t\t!isTokenAuth &&\n\t\t!isOAuthConsent &&\n\t\tisUnsafeMethod(method) &&\n\t\t!isPublicApiRoute\n\t) {\n\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\tif (csrfHeader !== \"1\") {\n\t\t\treturn csrfRejectedResponse();\n\t\t}\n\t}\n\n\t// If already authenticated via Bearer token, enforce scope then skip session/external auth\n\tif (isTokenAuth) {\n\t\t// Enforce API token scopes based on URL pattern + HTTP method\n\t\tconst scopeError = enforceTokenScope(url.pathname, method, context.locals.tokenScopes);\n\t\tif (scopeError) return scopeError;\n\n\t\tconst response = await next();\n\t\tif (!import.meta.env.DEV) {\n\t\t\tresponse.headers.set(\n\t\t\t\t\"Content-Security-Policy\",\n\t\t\t\tbuildEmDashCsp(context.locals.emdash?.config.experimental?.registry),\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\tconst response = await handleEmDashAuth(context, next);\n\n\t// Set strict CSP on all /_emdash responses (prod only)\n\tif (!import.meta.env.DEV) {\n\t\tresponse.headers.set(\n\t\t\t\"Content-Security-Policy\",\n\t\t\tbuildEmDashCsp(context.locals.emdash?.config.experimental?.registry),\n\t\t);\n\t}\n\n\treturn response;\n});\n\n/**\n * Auth handling for /_emdash routes. Returns a Response from either\n * an auth error/redirect or the downstream route handler.\n */\nasync function handleEmDashAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { url, locals } = context;\n\tconst { emdash } = locals;\n\n\tconst isPublicAdminRoute =\n\t\turl.pathname.startsWith(\"/_emdash/admin/login\") ||\n\t\turl.pathname.startsWith(\"/_emdash/admin/invite/accept\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\n\tif (!emdash?.db) {\n\t\t// No database - let the admin handle this error\n\t\treturn next();\n\t}\n\n\t// Determine auth mode from config\n\tconst authMode = getAuthMode(emdash.config);\n\n\tif (authMode.type === \"external\") {\n\t\t// In dev mode, fall back to passkey auth since external JWT won't be present\n\t\tif (import.meta.env.DEV) {\n\t\t\tif (isPublicAdminRoute) {\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\treturn handlePasskeyAuth(context, next, isApiRoute);\n\t\t}\n\n\t\t// External auth provider (Cloudflare Access, etc.)\n\t\treturn handleExternalAuth(context, next, authMode, isApiRoute);\n\t}\n\n\t// Passkey authentication (default)\n\tif (isPublicAdminRoute) {\n\t\treturn next();\n\t}\n\n\treturn handlePasskeyAuth(context, next, isApiRoute);\n}\n\n/**\n * Soft auth for plugin routes: resolve user from Bearer token or session if present,\n * but never block unauthenticated requests. The catch-all handler checks route\n * metadata to decide whether auth is required (public vs private routes).\n */\nasync function handlePluginRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Try Bearer token auth first (API tokens and OAuth tokens)\n\t\tconst bearerResult = await handleBearerAuth(context);\n\t\tif (bearerResult === \"authenticated\") {\n\t\t\t// User and tokenScopes are set on locals by handleBearerAuth\n\t\t\treturn next();\n\t\t}\n\t\tif (bearerResult === \"invalid\") {\n\t\t\t// A token was presented but is invalid/expired — return 401 so the\n\t\t\t// caller knows their token is bad (don't silently downgrade to no-auth).\n\t\t\treturn new Response(\n\t\t\t\tJSON.stringify({ error: { code: \"INVALID_TOKEN\", message: \"Invalid or expired token\" } }),\n\t\t\t\t{\n\t\t\t\t\tstatus: 401,\n\t\t\t\t\theaders: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS },\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\t// \"none\" — no token presented, try session auth below.\n\t} catch (error) {\n\t\tconsole.error(\"Plugin route bearer auth error:\", error);\n\t}\n\n\ttry {\n\t\t// Try session auth (sets locals.user if session exists)\n\t\tconst { session } = context;\n\t\tconst sessionUser = await session?.get(\"user\");\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\t// Log but don't block — public routes should still work without session\n\t\tconsole.error(\"Plugin route session auth error:\", error);\n\t}\n\n\treturn next();\n}\n\n/**\n * Soft auth check for public routes with edit mode cookie.\n * Checks the session and sets locals.user if valid, but never blocks the request.\n */\nasync function handlePublicRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\tconst sessionUser = await session?.get(\"user\");\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch {\n\t\t// Silently continue — public page should render normally\n\t}\n\n\treturn next();\n}\n\n/**\n * Handle external auth provider authentication (Cloudflare Access, etc.)\n */\nasync function handleExternalAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tauthMode: ExternalAuthMode,\n\t_isApiRoute: boolean,\n): Promise<Response> {\n\tconst { locals, request } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Use the authenticate function from the virtual module\n\t\t// (statically imported at build time to work with Cloudflare Workers)\n\t\tif (typeof virtualAuthenticate !== \"function\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Auth provider ${authMode.entrypoint} does not export an authenticate function`,\n\t\t\t);\n\t\t}\n\n\t\t// Authenticate via the provider\n\t\tconst authResult = await virtualAuthenticate(request, authMode.config);\n\n\t\t// Get external auth config for auto-provision settings\n\t\t// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowing AuthModeConfig to ExternalAuthConfig after provider check\n\t\tconst externalConfig = authMode.config as ExternalAuthConfig;\n\n\t\t// Find or create user\n\t\tconst adapter = createKyselyAdapter(emdash!.db);\n\t\tlet user = await adapter.getUserByEmail(authResult.email);\n\n\t\tif (!user) {\n\t\t\t// User doesn't exist\n\t\t\tif (externalConfig.autoProvision === false) {\n\t\t\t\treturn new Response(\"User not authorized\", {\n\t\t\t\t\tstatus: 403,\n\t\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Check if this is the first user (they become admin)\n\t\t\tconst userCount = await emdash!.db\n\t\t\t\t.selectFrom(\"users\")\n\t\t\t\t.select(emdash!.db.fn.count(\"id\").as(\"count\"))\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tconst isFirstUser = Number(userCount?.count ?? 0) === 0;\n\t\t\tconst role = isFirstUser ? ROLE_ADMIN : authResult.role;\n\n\t\t\t// Create user\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: authResult.email,\n\t\t\t\tname: authResult.name,\n\t\t\t\trole,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash!.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = await adapter.getUserByEmail(authResult.email);\n\n\t\t\tconsole.log(\n\t\t\t\t`[external-auth] Provisioned user: ${authResult.email} (role: ${role}, first: ${isFirstUser})`,\n\t\t\t);\n\t\t} else {\n\t\t\t// User exists - check if we need to sync anything\n\t\t\tconst updates: Record<string, unknown> = {};\n\t\t\tlet newName: string | undefined;\n\t\t\tlet newRole: RoleLevel | undefined;\n\n\t\t\t// Sync name from provider if provider provides one and local differs\n\t\t\tif (authResult.name && user.name !== authResult.name) {\n\t\t\t\tnewName = authResult.name;\n\t\t\t\tupdates.name = newName;\n\t\t\t}\n\n\t\t\t// Sync role if enabled\n\t\t\tif (externalConfig.syncRoles && user.role !== authResult.role) {\n\t\t\t\tnewRole = authResult.role;\n\t\t\t\tupdates.role = newRole;\n\t\t\t}\n\n\t\t\tif (Object.keys(updates).length > 0) {\n\t\t\t\tupdates.updated_at = new Date().toISOString();\n\t\t\t\tawait emdash!.db.updateTable(\"users\").set(updates).where(\"id\", \"=\", user.id).execute();\n\n\t\t\t\tuser = {\n\t\t\t\t\t...user,\n\t\t\t\t\t...(newName ? { name: newName } : {}),\n\t\t\t\t\t...(newRole ? { role: newRole } : {}),\n\t\t\t\t};\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`[external-auth] Updated user ${authResult.email}:`,\n\t\t\t\t\tObject.keys(updates).filter((k) => k !== \"updated_at\"),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (!user) {\n\t\t\t// This shouldn't happen, but handle it gracefully\n\t\t\treturn new Response(\"Failed to provision user\", {\n\t\t\t\tstatus: 500,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Check if user is disabled locally\n\t\tif (user.disabled) {\n\t\t\treturn new Response(\"Account disabled\", {\n\t\t\t\tstatus: 403,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Set user in locals\n\t\tlocals.user = user;\n\n\t\t// Persist to session so public pages can identify the user\n\t\t// (external auth headers are only verified on /_emdash routes)\n\t\tconst { session } = context;\n\t\tsession?.set(\"user\", { id: user.id });\n\n\t\treturn next();\n\t} catch (error) {\n\t\tconsole.error(\"[external-auth] Auth error:\", error);\n\n\t\treturn new Response(\"Authentication failed\", {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t});\n\t}\n}\n\n/**\n * Try to authenticate via Bearer token (API token or OAuth token).\n *\n * Returns:\n * - \"authenticated\" if token is valid and user is resolved\n * - \"invalid\" if a token was provided but is invalid/expired\n * - \"none\" if no Bearer token was provided\n */\nasync function handleBearerAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n): Promise<\"authenticated\" | \"invalid\" | \"none\"> {\n\tconst authHeader = context.request.headers.get(\"Authorization\");\n\tif (!authHeader?.startsWith(\"Bearer \")) return \"none\";\n\n\tconst token = authHeader.slice(7);\n\tif (!token) return \"none\";\n\n\tconst { locals } = context;\n\tconst { emdash } = locals;\n\tif (!emdash?.db) return \"none\";\n\n\t// Resolve token based on prefix\n\tlet resolved: { userId: string; scopes: string[] } | null = null;\n\n\tif (token.startsWith(\"ec_pat_\")) {\n\t\tresolved = await resolveApiToken(emdash.db, token);\n\t} else if (token.startsWith(\"ec_oat_\")) {\n\t\tresolved = await resolveOAuthToken(emdash.db, token);\n\t} else {\n\t\t// Unknown token format\n\t\treturn \"invalid\";\n\t}\n\n\tif (!resolved) return \"invalid\";\n\n\t// Look up the user\n\tconst adapter = createKyselyAdapter(emdash.db);\n\tconst user = await adapter.getUserById(resolved.userId);\n\n\tif (!user || user.disabled) return \"invalid\";\n\n\t// Set user and scopes on locals\n\tlocals.user = user;\n\tlocals.tokenScopes = resolved.scopes;\n\n\treturn \"authenticated\";\n}\n\n/**\n * Handle passkey (session-based) authentication\n */\nasync function handlePasskeyAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tisApiRoute: boolean,\n): Promise<Response> {\n\tconst { url, locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Check session for user (session.get returns a Promise)\n\t\tconst sessionUser = await session?.get(\"user\");\n\n\t\tif (!sessionUser?.id) {\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ error: { code: \"NOT_AUTHENTICATED\", message: \"Not authenticated\" } },\n\t\t\t\t\t{ status: 401, headers: MW_CACHE_HEADERS },\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\tloginUrl.searchParams.set(\"redirect\", url.pathname);\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Get full user from database\n\t\tconst adapter = createKyselyAdapter(emdash!.db);\n\t\tconst user = await adapter.getUserById(sessionUser.id);\n\n\t\tif (!user) {\n\t\t\t// User no longer exists - clear session\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ error: { code: \"NOT_FOUND\", message: \"User not found\" } },\n\t\t\t\t\t{ status: 401, headers: MW_CACHE_HEADERS },\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Check if user is disabled\n\t\tif (user.disabled) {\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"ACCOUNT_DISABLED\", \"Account disabled\", 403);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\tloginUrl.searchParams.set(\"error\", \"account_disabled\");\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Set user in locals for use by routes\n\t\tlocals.user = user;\n\t} catch (error) {\n\t\tconsole.error(\"Auth middleware error:\", error);\n\t\t// On error, redirect to login\n\t\treturn context.redirect(\"/_emdash/admin/login\");\n\t}\n\n\treturn next();\n}\n\n// =============================================================================\n// Token scope enforcement\n// =============================================================================\n\n/**\n * Scope rules: ordered list of (pathPrefix, method, requiredScope) tuples.\n * First matching rule wins. Methods: \"*\" = any, \"WRITE\" = POST/PUT/PATCH/DELETE.\n *\n * Routes not matched by any rule default to \"admin\" scope (fail-closed).\n */\nconst SCOPE_RULES: Array<[prefix: string, method: string, scope: string]> = [\n\t// Content routes\n\t[\"/_emdash/api/content\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/content\", \"WRITE\", \"content:write\"],\n\n\t// Media routes (excluding /file/ which is public)\n\t[\"/_emdash/api/media/file\", \"*\", \"media:read\"], // public anyway, but scope if token-authed\n\t[\"/_emdash/api/media\", \"GET\", \"media:read\"],\n\t[\"/_emdash/api/media\", \"WRITE\", \"media:write\"],\n\n\t// Schema routes\n\t[\"/_emdash/api/schema\", \"GET\", \"schema:read\"],\n\t[\"/_emdash/api/schema\", \"WRITE\", \"schema:write\"],\n\n\t// Taxonomy, menu, section, widget, revision — all content domain\n\t// GET uses content:read (implicit from taxonomies:read / menus:read via role).\n\t// WRITE uses the granular scope so tokens with only taxonomies:manage or\n\t// menus:manage are not rejected. content:write implicitly grants these via\n\t// IMPLICIT_SCOPE_GRANTS in @emdash-cms/auth.\n\t[\"/_emdash/api/taxonomies\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/taxonomies\", \"WRITE\", \"taxonomies:manage\"],\n\t[\"/_emdash/api/menus\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/menus\", \"WRITE\", \"menus:manage\"],\n\t[\"/_emdash/api/sections\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/sections\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/widget-areas\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/widget-areas\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/revisions\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/revisions\", \"WRITE\", \"content:write\"],\n\n\t// Search\n\t[\"/_emdash/api/search\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/search\", \"WRITE\", \"admin\"],\n\n\t// Import, admin, plugins — all require admin scope\n\t[\"/_emdash/api/import\", \"*\", \"admin\"],\n\t[\"/_emdash/api/admin\", \"*\", \"admin\"],\n\t[\"/_emdash/api/plugins\", \"*\", \"admin\"],\n\n\t// Settings — use granular scopes so tokens with settings:read or\n\t// settings:manage are not rejected at the middleware level.\n\t[\"/_emdash/api/settings\", \"GET\", \"settings:read\"],\n\t[\"/_emdash/api/settings\", \"WRITE\", \"settings:manage\"],\n\n\t// MCP endpoint — scopes enforced per-tool inside mcp/server.ts\n\t[\"/_emdash/api/mcp\", \"*\", \"content:read\"],\n];\n\nconst WRITE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Enforce API token scopes based on the request URL and HTTP method.\n * Returns a 403 Response if the scope is insufficient, or null if allowed.\n *\n * Session-authenticated requests (tokenScopes === undefined) are never checked.\n */\nfunction enforceTokenScope(\n\tpathname: string,\n\tmethod: string,\n\ttokenScopes: string[] | undefined,\n): Response | null {\n\t// Session auth — implicit full access, no scope restrictions\n\tif (!tokenScopes) return null;\n\n\tconst isWrite = WRITE_METHODS.has(method);\n\n\tfor (const [prefix, ruleMethod, scope] of SCOPE_RULES) {\n\t\t// Match exact prefix or prefix followed by /\n\t\tif (pathname !== prefix && !pathname.startsWith(prefix + \"/\")) continue;\n\n\t\t// Check method match\n\t\tif (ruleMethod === \"*\" || (ruleMethod === \"WRITE\" && isWrite) || ruleMethod === method) {\n\t\t\tif (hasScope(tokenScopes, scope)) return null;\n\n\t\t\treturn new Response(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"INSUFFICIENT_SCOPE\",\n\t\t\t\t\t\tmessage: `Token lacks required scope: ${scope}`,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t\t{ status: 403, headers: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS } },\n\t\t\t);\n\t\t}\n\t}\n\n\t// No rule matched — default to admin scope (fail-closed)\n\tif (hasScope(tokenScopes, \"admin\")) return null;\n\n\treturn new Response(\n\t\tJSON.stringify({\n\t\t\terror: {\n\t\t\t\tcode: \"INSUFFICIENT_SCOPE\",\n\t\t\t\tmessage: \"Token lacks required scope: admin\",\n\t\t\t},\n\t\t}),\n\t\t{ status: 403, headers: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS } },\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,gBACf,SACA,KACA,cACkB;AAGlB,KADmB,QAAQ,QAAQ,IAAI,mBAAmB,KACvC,IAAK,QAAO;CAG/B,MAAM,SAAS,QAAQ,QAAQ,IAAI,SAAS;AAC5C,KAAI,QAAQ;AACX,MAAI;GACH,MAAM,YAAY,IAAI,IAAI,OAAO;AAEjC,OAAI,UAAU,WAAW,IAAI,OAAQ,QAAO;AAC5C,OAAI,gBAAgB,UAAU,WAAW,aAAc,QAAO;UACvD;AAIR,SAAO,SAAS,iBAAiB,gCAAgC,IAAI;;AAMtE,QAAO;;;;;AC1CR,SAAS,4BACR,UACqB;CACrB,MAAM,gBAAgB,OAAO,aAAa,WAAW,WAAW,UAAU;AAC1E,KAAI,CAAC,cAAe,QAAO;AAE3B,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,cAAc;AAClC,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,SAAO,IAAI;SACJ;AACP;;;AAIF,SAAgB,eAAe,UAAwC;CACtE,MAAM,aAAa,CAAC,qBAAqB;CACzC,MAAM,2BAA2B,4BAA4B,SAAS;AACtE,KAAI,yBAA0B,YAAW,KAAK,yBAAyB;AAEvE,QAAO;EACN;EACA;EACA;EACA,WAAW,KAAK,IAAI;EACpB;EACA;EACA;EACA;EACA;EACA,CAAC,KAAK,KAAK;;;;;;AClBb,MAAM,mBAAmB,EACxB,iBAAiB,qBACjB;AAwBD,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAE1B,SAAS,eAAe,QAAyB;AAChD,QAAO,WAAW,SAAS,WAAW,UAAU,WAAW;;AAG5D,SAAS,uBAAiC;AACzC,QAAO,IAAI,SACV,KAAK,UAAU,EAAE,OAAO;EAAE,MAAM;EAAiB,SAAS;EAA2B,EAAE,CAAC,EACxF;EACC,QAAQ;EACR,SAAS;GAAE,gBAAgB;GAAoB,GAAG;GAAkB;EACpE,CACD;;AAGF,SAAS,wBACR,KACA,QACW;CACX,MAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,QAAO,SAAS,KACf,EAAE,OAAO;EAAE,MAAM;EAAqB,SAAS;EAAqB,EAAE,EACtE;EACC,QAAQ;EACR,SAAS;GACR,oBAAoB,6BAA6B,OAAO;GACxD,GAAG;GACH;EACD,CACD;;;;;;;;AASF,MAAM,sBAAsB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAM,mBAAmB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CAIA;CACA,CAAC;AAIF,MAAM,EAAE,OAAO,sBAAsB,UAAU,iCAAiC;CAC/E,MAAM,wBAAQ,IAAI,KAAa;CAC/B,MAAM,WAAqB,EAAE;AAC7B,KAAI,CAAC,eAAe,cAAe,QAAO;EAAE;EAAO;EAAU;AAC7D,MAAK,MAAM,SAAS,cAAc,cAAc,SAAS,MAAM,EAAE,gBAAgB,EAAE,CAAC,CACnF,KAAI,MAAM,SAAS,IAAI,CACtB,UAAS,KAAK,MAAM;KAEpB,OAAM,IAAI,MAAM;AAGlB,QAAO;EAAE;EAAO;EAAU;IACvB;;;;;;;;;;;;;;;;;;AAmBJ,MAAM,4BAA4B,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,oBAAoB,UAA2B;AACvD,KAAI,iBAAiB,IAAI,SAAS,CAAE,QAAO;AAC3C,KAAI,oBAAoB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACpE,KAAI,qBAAqB,IAAI,SAAS,CAAE,QAAO;AAC/C,KAAI,sBAAsB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACtE,KAAI,OAAO,KAAK,IAAI,OAAO,aAAa,uBAAwB,QAAO;AACvE,QAAO;;AAGR,SAAS,wBAAwB,UAA2B;AAC3D,QAAO,0BAA0B,IAAI,SAAS;;AAG/C,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,QAAQ;CAGhB,MAAM,eAAe,IAAI,SAAS,WAAW,iBAAiB;CAC9D,MAAM,eAAe,IAAI,SAAS,WAAW,uBAAuB;CACpE,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;CAC1D,MAAM,mBAAmB,oBAAoB,IAAI,SAAS;CAE1D,MAAM,gBAAgB,CAAC,gBAAgB,CAAC;AAKxC,KAAI,kBAAkB;AAErB,MACC,eAFc,QAAQ,QAAQ,OAAO,aAAa,CAE5B,IACtB,CAAC,wBAAwB,IAAI,SAAS,EACrC;GACD,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,SAAO,MAAM;;AAQd,KADsB,IAAI,SAAS,WAAW,wBAAwB,EACnD;EAClB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;GAClE,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,SAAO,sBAAsB,SAAS,KAAK;;AAI5C,KAAI,cAAc;EACjB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAEvD;OADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,IAAI,SACV,KAAK,UAAU,EACd,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA2B,EACpE,CAAC,EACF;IACC,QAAQ;IACR,SAAS;KAAE,gBAAgB;KAAoB,GAAG;KAAkB;IACpE,CACD;;AAGH,SAAO,MAAM;;AAId,KAAI,cACH,QAAO,sBAAsB,SAAS,KAAK;CAO5C,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AAEpD,KAAI,iBAAiB,WAAW;EAC/B,MAAM,UAAkC;GACvC,gBAAgB;GAChB,GAAG;GACH;AAED,MAAI,IAAI,aAAa,mBAEpB,SAAQ,sBACP,6BAFc,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO,CAE7B;AAEtC,SAAO,IAAI,SACV,KAAK,UAAU,EAAE,OAAO;GAAE,MAAM;GAAiB,SAAS;GAA4B,EAAE,CAAC,EACzF;GAAE,QAAQ;GAAK;GAAS,CACxB;;CAGF,MAAM,cAAc,iBAAiB;CAKrC,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AAEnD,KADsB,IAAI,aAAa,qBAClB,CAAC,YACrB,QAAO,wBAAwB,KAAK,QAAQ,OAAO,QAAQ,OAAO;CAQnE,MAAM,iBAAiB,IAAI,SAAS,WAAW,2BAA2B;AAC1E,KACC,cACA,CAAC,eACD,CAAC,kBACD,eAAe,OAAO,IACtB,CAAC,kBAGD;MADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,sBAAsB;;AAK/B,KAAI,aAAa;EAEhB,MAAM,aAAa,kBAAkB,IAAI,UAAU,QAAQ,QAAQ,OAAO,YAAY;AACtF,MAAI,WAAY,QAAO;EAEvB,MAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eAAe,QAAQ,OAAO,QAAQ,OAAO,cAAc,SAAS,CACpE;AAEF,SAAO;;CAGR,MAAM,WAAW,MAAM,iBAAiB,SAAS,KAAK;AAGtD,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eAAe,QAAQ,OAAO,QAAQ,OAAO,cAAc,SAAS,CACpE;AAGF,QAAO;EACN;;;;;AAMF,eAAe,iBACd,SACA,MACoB;CACpB,MAAM,EAAE,KAAK,WAAW;CACxB,MAAM,EAAE,WAAW;CAEnB,MAAM,qBACL,IAAI,SAAS,WAAW,uBAAuB,IAC/C,IAAI,SAAS,WAAW,+BAA+B;CACxD,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;AAE1D,KAAI,CAAC,QAAQ,GAEZ,QAAO,MAAM;CAId,MAAM,WAAW,YAAY,OAAO,OAAO;AAE3C,KAAI,SAAS,SAAS,YAAY;AAEjC,MAAI,OAAO,KAAK,IAAI,KAAK;AACxB,OAAI,mBACH,QAAO,MAAM;AAGd,UAAO,kBAAkB,SAAS,MAAM,WAAW;;AAIpD,SAAO,mBAAmB,SAAS,MAAM,UAAU,WAAW;;AAI/D,KAAI,mBACH,QAAO,MAAM;AAGd,QAAO,kBAAkB,SAAS,MAAM,WAAW;;;;;;;AAQpD,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AACpD,MAAI,iBAAiB,gBAEpB,QAAO,MAAM;AAEd,MAAI,iBAAiB,UAGpB,QAAO,IAAI,SACV,KAAK,UAAU,EAAE,OAAO;GAAE,MAAM;GAAiB,SAAS;GAA4B,EAAE,CAAC,EACzF;GACC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,GAAG;IAAkB;GACpE,CACD;UAGM,OAAO;AACf,UAAQ,MAAM,mCAAmC,MAAM;;AAGxD,KAAI;EAEH,MAAM,EAAE,YAAY;EACpB,MAAM,cAAc,MAAM,SAAS,IAAI,OAAO;AAC9C,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;UAGR,OAAO;AAEf,UAAQ,MAAM,oCAAoC,MAAM;;AAGzD,QAAO,MAAM;;;;;;AAOd,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;EACH,MAAM,cAAc,MAAM,SAAS,IAAI,OAAO;AAC9C,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;SAGT;AAIR,QAAO,MAAM;;;;;AAMd,eAAe,mBACd,SACA,MACA,UACA,aACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;AAGH,MAAI,OAAOA,iBAAwB,WAClC,OAAM,IAAI,MACT,iBAAiB,SAAS,WAAW,2CACrC;EAIF,MAAM,aAAa,MAAMA,aAAoB,SAAS,SAAS,OAAO;EAItE,MAAM,iBAAiB,SAAS;EAGhC,MAAM,UAAU,oBAAoB,OAAQ,GAAG;EAC/C,IAAI,OAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAEzD,MAAI,CAAC,MAAM;AAEV,OAAI,eAAe,kBAAkB,MACpC,QAAO,IAAI,SAAS,uBAAuB;IAC1C,QAAQ;IACR,SAAS;KAAE,gBAAgB;KAAc,GAAG;KAAkB;IAC9D,CAAC;GAIH,MAAM,YAAY,MAAM,OAAQ,GAC9B,WAAW,QAAQ,CACnB,OAAO,OAAQ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,CAC7C,kBAAkB;GAEpB,MAAM,cAAc,OAAO,WAAW,SAAS,EAAE,KAAK;GACtD,MAAM,OAAO,cAAc,aAAa,WAAW;GAGnD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO,WAAW;IAClB,MAAM,WAAW;IACjB;IACA,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAQ,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE9D,UAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAErD,WAAQ,IACP,qCAAqC,WAAW,MAAM,UAAU,KAAK,WAAW,YAAY,GAC5F;SACK;GAEN,MAAM,UAAmC,EAAE;GAC3C,IAAI;GACJ,IAAI;AAGJ,OAAI,WAAW,QAAQ,KAAK,SAAS,WAAW,MAAM;AACrD,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAIhB,OAAI,eAAe,aAAa,KAAK,SAAS,WAAW,MAAM;AAC9D,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAGhB,OAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,YAAQ,8BAAa,IAAI,MAAM,EAAC,aAAa;AAC7C,UAAM,OAAQ,GAAG,YAAY,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,KAAK,GAAG,CAAC,SAAS;AAEtF,WAAO;KACN,GAAG;KACH,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC;AAED,YAAQ,IACP,gCAAgC,WAAW,MAAM,IACjD,OAAO,KAAK,QAAQ,CAAC,QAAQ,MAAM,MAAM,aAAa,CACtD;;;AAIH,MAAI,CAAC,KAEJ,QAAO,IAAI,SAAS,4BAA4B;GAC/C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,MAAI,KAAK,SACR,QAAO,IAAI,SAAS,oBAAoB;GACvC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,SAAO,OAAO;EAId,MAAM,EAAE,YAAY;AACpB,WAAS,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAErC,SAAO,MAAM;UACL,OAAO;AACf,UAAQ,MAAM,+BAA+B,MAAM;AAEnD,SAAO,IAAI,SAAS,yBAAyB;GAC5C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;;;;;;;;;;;AAYJ,eAAe,iBACd,SACgD;CAChD,MAAM,aAAa,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB;AAC/D,KAAI,CAAC,YAAY,WAAW,UAAU,CAAE,QAAO;CAE/C,MAAM,QAAQ,WAAW,MAAM,EAAE;AACjC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,WAAW;AACnB,KAAI,CAAC,QAAQ,GAAI,QAAO;CAGxB,IAAI,WAAwD;AAE5D,KAAI,MAAM,WAAW,UAAU,CAC9B,YAAW,MAAM,gBAAgB,OAAO,IAAI,MAAM;UACxC,MAAM,WAAW,UAAU,CACrC,YAAW,MAAM,kBAAkB,OAAO,IAAI,MAAM;KAGpD,QAAO;AAGR,KAAI,CAAC,SAAU,QAAO;CAItB,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,SAAS,OAAO;AAEvD,KAAI,CAAC,QAAQ,KAAK,SAAU,QAAO;AAGnC,QAAO,OAAO;AACd,QAAO,cAAc,SAAS;AAE9B,QAAO;;;;;AAMR,eAAe,kBACd,SACA,MACA,YACoB;CACpB,MAAM,EAAE,KAAK,QAAQ,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,cAAc,MAAM,SAAS,IAAI,OAAO;AAE9C,MAAI,CAAC,aAAa,IAAI;AACrB,OAAI,WACH,QAAO,SAAS,KACf,EAAE,OAAO;IAAE,MAAM;IAAqB,SAAS;IAAqB,EAAE,EACtE;IAAE,QAAQ;IAAK,SAAS;IAAkB,CAC1C;GAEF,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,YAAS,aAAa,IAAI,YAAY,IAAI,SAAS;AACnD,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;EAK7C,MAAM,OAAO,MADG,oBAAoB,OAAQ,GAAG,CACpB,YAAY,YAAY,GAAG;AAEtD,MAAI,CAAC,MAAM;AAEV,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,KACf,EAAE,OAAO;IAAE,MAAM;IAAa,SAAS;IAAkB,EAAE,EAC3D;IAAE,QAAQ;IAAK,SAAS;IAAkB,CAC1C;GAEF,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,MAAI,KAAK,UAAU;AAClB,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;GAE7D,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,YAAS,aAAa,IAAI,SAAS,mBAAmB;AACtD,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,SAAO,OAAO;UACN,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAE9C,SAAO,QAAQ,SAAS,uBAAuB;;AAGhD,QAAO,MAAM;;;;;;;;AAad,MAAM,cAAsE;CAE3E;EAAC;EAAwB;EAAO;EAAe;CAC/C;EAAC;EAAwB;EAAS;EAAgB;CAGlD;EAAC;EAA2B;EAAK;EAAa;CAC9C;EAAC;EAAsB;EAAO;EAAa;CAC3C;EAAC;EAAsB;EAAS;EAAc;CAG9C;EAAC;EAAuB;EAAO;EAAc;CAC7C;EAAC;EAAuB;EAAS;EAAe;CAOhD;EAAC;EAA2B;EAAO;EAAe;CAClD;EAAC;EAA2B;EAAS;EAAoB;CACzD;EAAC;EAAsB;EAAO;EAAe;CAC7C;EAAC;EAAsB;EAAS;EAAe;CAC/C;EAAC;EAAyB;EAAO;EAAe;CAChD;EAAC;EAAyB;EAAS;EAAgB;CACnD;EAAC;EAA6B;EAAO;EAAe;CACpD;EAAC;EAA6B;EAAS;EAAgB;CACvD;EAAC;EAA0B;EAAO;EAAe;CACjD;EAAC;EAA0B;EAAS;EAAgB;CAGpD;EAAC;EAAuB;EAAO;EAAe;CAC9C;EAAC;EAAuB;EAAS;EAAQ;CAGzC;EAAC;EAAuB;EAAK;EAAQ;CACrC;EAAC;EAAsB;EAAK;EAAQ;CACpC;EAAC;EAAwB;EAAK;EAAQ;CAItC;EAAC;EAAyB;EAAO;EAAgB;CACjD;EAAC;EAAyB;EAAS;EAAkB;CAGrD;EAAC;EAAoB;EAAK;EAAe;CACzC;AAED,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;CAAS,CAAC;;;;;;;AAQjE,SAAS,kBACR,UACA,QACA,aACkB;AAElB,KAAI,CAAC,YAAa,QAAO;CAEzB,MAAM,UAAU,cAAc,IAAI,OAAO;AAEzC,MAAK,MAAM,CAAC,QAAQ,YAAY,UAAU,aAAa;AAEtD,MAAI,aAAa,UAAU,CAAC,SAAS,WAAW,SAAS,IAAI,CAAE;AAG/D,MAAI,eAAe,OAAQ,eAAe,WAAW,WAAY,eAAe,QAAQ;AACvF,OAAI,SAAS,aAAa,MAAM,CAAE,QAAO;AAEzC,UAAO,IAAI,SACV,KAAK,UAAU,EACd,OAAO;IACN,MAAM;IACN,SAAS,+BAA+B;IACxC,EACD,CAAC,EACF;IAAE,QAAQ;IAAK,SAAS;KAAE,gBAAgB;KAAoB,GAAG;KAAkB;IAAE,CACrF;;;AAKH,KAAI,SAAS,aAAa,QAAQ,CAAE,QAAO;AAE3C,QAAO,IAAI,SACV,KAAK,UAAU,EACd,OAAO;EACN,MAAM;EACN,SAAS;EACT,EACD,CAAC,EACF;EAAE,QAAQ;EAAK,SAAS;GAAE,gBAAgB;GAAoB,GAAG;GAAkB;EAAE,CACrF"}
+{"version":3,"file":"auth.mjs","names":["virtualAuthenticate"],"sources":["../../../src/api/csrf.ts","../../../src/astro/middleware/csp.ts","../../../src/astro/middleware/auth.ts"],"sourcesContent":["/**\n * CSRF protection utilities.\n *\n * Two mechanisms:\n * 1. Custom header check (X-EmDash-Request: 1) — used for authenticated API routes.\n *    Browsers block cross-origin custom headers, so presence proves same-origin.\n * 2. Origin check — used for public API routes that skip auth. Compares the Origin\n *    header against the request origin. Same approach as Astro's `checkOrigin`.\n */\n\nimport { apiError } from \"./error.js\";\n\n/**\n * Origin-based CSRF check for public API routes that skip auth.\n *\n * State-changing requests (POST/PUT/DELETE) to public endpoints must either:\n *   1. Include the X-EmDash-Request: 1 header (custom header blocked cross-origin), OR\n *   2. Have an Origin header matching the request origin (or the configured public origin)\n *\n * This prevents cross-origin form submissions (which can't set custom headers)\n * and cross-origin fetch (blocked by CORS unless allowed). Same-origin requests\n * always include a matching Origin header.\n *\n * Returns a 403 Response if the check fails, or null if allowed.\n *\n * @param request  The incoming request\n * @param url      The request URL (internal origin)\n * @param publicOrigin  The public-facing origin from config.siteUrl. Must be\n *        `undefined` when absent — never `null` or `\"\"` (security invariant H-1a).\n */\nexport function checkPublicCsrf(\n\trequest: Request,\n\turl: URL,\n\tpublicOrigin?: string,\n): Response | null {\n\t// Custom header present — browser blocks cross-origin custom headers\n\tconst csrfHeader = request.headers.get(\"X-EmDash-Request\");\n\tif (csrfHeader === \"1\") return null;\n\n\t// Check Origin header — present on all POST/PUT/DELETE from browsers\n\tconst origin = request.headers.get(\"Origin\");\n\tif (origin) {\n\t\ttry {\n\t\t\tconst originUrl = new URL(origin);\n\t\t\t// Accept if Origin matches either the internal or public origin\n\t\t\tif (originUrl.origin === url.origin) return null;\n\t\t\tif (publicOrigin && originUrl.origin === publicOrigin) return null;\n\t\t} catch {\n\t\t\t// Malformed Origin — fall through to reject\n\t\t}\n\n\t\treturn apiError(\"CSRF_REJECTED\", \"Cross-origin request blocked\", 403);\n\t}\n\n\t// No Origin header — non-browser client (curl, server-to-server).\n\t// Allow these through since CSRF is a browser-specific attack vector.\n\t// Server-to-server requests don't carry ambient credentials (cookies).\n\treturn null;\n}\n","/**\n * Strict Content-Security-Policy for /_emdash routes (admin + API).\n *\n * Applied via middleware header rather than Astro's built-in CSP because\n * Astro's auto-hashing defeats 'unsafe-inline' (CSP3 ignores 'unsafe-inline'\n * when hashes are present), which would break user-facing pages.\n *\n * img-src allows any HTTPS origin because the admin renders user content that\n * may reference external images (migrations, external hosting, embeds).\n * Plugin security does not rely on img-src -- plugins run in V8 isolates with\n * no DOM access. connect-src stays at 'self' unless the experimental registry\n * is configured, in which case the configured aggregator origin is allowed.\n */\nimport type { RegistryConfigInput } from \"../../registry/types.js\";\n\nfunction getRegistryAggregatorOrigin(\n\tregistry: RegistryConfigInput | undefined,\n): string | undefined {\n\tconst aggregatorUrl = typeof registry === \"string\" ? registry : registry?.aggregatorUrl;\n\tif (!aggregatorUrl) return undefined;\n\n\ttry {\n\t\tconst url = new URL(aggregatorUrl);\n\t\tif (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n\t\treturn url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function buildEmDashCsp(registry?: RegistryConfigInput): string {\n\tconst connectSrc = [\"connect-src 'self'\"];\n\tconst registryAggregatorOrigin = getRegistryAggregatorOrigin(registry);\n\tif (registryAggregatorOrigin) connectSrc.push(registryAggregatorOrigin);\n\n\treturn [\n\t\t\"default-src 'self'\",\n\t\t\"script-src 'self' 'unsafe-inline'\",\n\t\t\"style-src 'self' 'unsafe-inline'\",\n\t\tconnectSrc.join(\" \"),\n\t\t\"form-action 'self'\",\n\t\t\"frame-ancestors 'none'\",\n\t\t\"img-src 'self' https: data: blob:\",\n\t\t\"object-src 'none'\",\n\t\t\"base-uri 'self'\",\n\t].join(\"; \");\n}\n","/**\n * Auth middleware for admin routes\n *\n * Checks if the user is authenticated and has appropriate permissions.\n * Supports two auth modes:\n * - Passkey (default): Session-based auth with passkey login\n * - External providers: JWT-based auth (Cloudflare Access, etc.)\n *\n * This middleware runs AFTER the setup middleware - so if we get here,\n * we know setup is complete and users exist.\n */\n\nimport type { User, RoleLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { defineMiddleware } from \"astro:middleware\";\nimport { ulid } from \"ulidx\";\n// Import auth provider via virtual module (statically bundled)\n// This avoids dynamic import issues in Cloudflare Workers\nimport { authenticate as virtualAuthenticate } from \"virtual:emdash/auth\";\n// @ts-ignore - virtual module\nimport virtualConfig from \"virtual:emdash/config\";\n\nimport { checkPublicCsrf } from \"../../api/csrf.js\";\nimport { apiError } from \"../../api/error.js\";\nimport { getPublicOrigin } from \"../../api/public-url.js\";\n\n/** Cache headers for middleware error responses (matches API_CACHE_HEADERS in api/error.ts) */\nconst MW_CACHE_HEADERS = {\n\t\"Cache-Control\": \"private, no-store\",\n} as const;\nimport { resolveApiToken, resolveOAuthToken } from \"../../api/handlers/api-tokens.js\";\nimport { hasScope } from \"../../auth/api-tokens.js\";\nimport { getAuthMode, type ExternalAuthMode } from \"../../auth/mode.js\";\nimport type { ExternalAuthConfig } from \"../../auth/types.js\";\nimport type { EmDashHandlers } from \"../types.js\";\nimport { buildEmDashCsp } from \"./csp.js\";\n\ndeclare global {\n\tnamespace App {\n\t\tinterface Locals {\n\t\t\tuser?: User;\n\t\t\t/** Token scopes when authenticated via API token or OAuth token. Undefined for session auth. */\n\t\t\ttokenScopes?: string[];\n\t\t\temdash?: EmDashHandlers;\n\t\t}\n\t\tinterface SessionData {\n\t\t\tuser: { id: string };\n\t\t\thasSeenWelcome: boolean;\n\t\t}\n\t}\n}\n\n// Role level constants (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\nconst MCP_ENDPOINT_PATH = \"/_emdash/api/mcp\";\n\nfunction isUnsafeMethod(method: string): boolean {\n\treturn method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\";\n}\n\nfunction csrfRejectedResponse(): Response {\n\treturn new Response(\n\t\tJSON.stringify({ error: { code: \"CSRF_REJECTED\", message: \"Missing required header\" } }),\n\t\t{\n\t\t\tstatus: 403,\n\t\t\theaders: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS },\n\t\t},\n\t);\n}\n\nfunction mcpUnauthorizedResponse(\n\turl: URL,\n\tconfig?: Parameters<typeof getPublicOrigin>[1],\n): Response {\n\tconst origin = getPublicOrigin(url, config);\n\treturn Response.json(\n\t\t{ error: { code: \"NOT_AUTHENTICATED\", message: \"Not authenticated\" } },\n\t\t{\n\t\t\tstatus: 401,\n\t\t\theaders: {\n\t\t\t\t\"WWW-Authenticate\": `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`,\n\t\t\t\t...MW_CACHE_HEADERS,\n\t\t\t},\n\t\t},\n\t);\n}\n\n/**\n * API routes that skip auth — each handles its own access control.\n *\n * Prefix entries match any path starting with that prefix.\n * Exact entries (no trailing slash or wildcard) match that path only.\n */\nconst PUBLIC_API_PREFIXES = [\n\t\"/_emdash/api/setup\",\n\t\"/_emdash/api/auth/login\",\n\t\"/_emdash/api/auth/register\",\n\t\"/_emdash/api/auth/dev-bypass\",\n\t\"/_emdash/api/auth/signup/\",\n\t\"/_emdash/api/auth/magic-link/\",\n\t\"/_emdash/api/auth/invite/\",\n\t\"/_emdash/api/auth/oauth/\",\n\t\"/_emdash/api/oauth/device/token\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/comments/\",\n\t\"/_emdash/api/media/file/\",\n\t\"/_emdash/.well-known/\",\n];\n\nconst PUBLIC_API_EXACT = new Set([\n\t\"/_emdash/api/auth/passkey/options\",\n\t\"/_emdash/api/auth/passkey/verify\",\n\t\"/_emdash/api/auth/mode\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/snapshot\",\n\t// Public site search — read-only. The query layer hardcodes status='published'\n\t// so unauthenticated callers only see published content. Admin endpoints\n\t// (/enable, /rebuild, /stats) remain private because they're not in this set.\n\t\"/_emdash/api/search\",\n]);\n\n// Build merged public routes at module load from auth provider descriptors.\n// Routes ending with \"/\" are treated as prefixes; all others are exact matches.\nconst { exact: _providerExactRoutes, prefixes: _providerPrefixRoutes } = (() => {\n\tconst exact = new Set<string>();\n\tconst prefixes: string[] = [];\n\tif (!virtualConfig?.authProviders) return { exact, prefixes };\n\tfor (const route of virtualConfig.authProviders.flatMap((p) => p.publicRoutes ?? [])) {\n\t\tif (route.endsWith(\"/\")) {\n\t\t\tprefixes.push(route);\n\t\t} else {\n\t\t\texact.add(route);\n\t\t}\n\t}\n\treturn { exact, prefixes };\n})();\n\n/**\n * OAuth protocol endpoints that are CSRF-exempt by design.\n *\n * These are RFC-defined endpoints (RFC 6749 §3.2, RFC 7591 §3, RFC 8628 §3.1/§3.4)\n * specified to be called cross-origin by external clients (MCP clients, CLIs,\n * native apps). They authenticate each request on its own merits:\n *\n * - /oauth/token: requires PKCE code_verifier, device_code, or refresh_token\n * - /oauth/register: RFC 7591 dynamic client registration — anonymous by design\n * - /oauth/device/code: RFC 8628 device flow initiation — anonymous by design\n * - /oauth/device/token: requires device_code the client already holds\n *\n * None of these rely on ambient cookie credentials, so browser-based CSRF\n * attacks have nothing to exploit. The endpoints themselves advertise\n * `Access-Control-Allow-Origin: *`. Note: /oauth/device/authorize (the user\n * consent step) is NOT in this list — it is session-authenticated.\n */\nconst CSRF_EXEMPT_PUBLIC_ROUTES = new Set([\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/device/token\",\n]);\n\nfunction isPublicEmDashRoute(pathname: string): boolean {\n\tif (PUBLIC_API_EXACT.has(pathname)) return true;\n\tif (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;\n\tif (_providerExactRoutes.has(pathname)) return true;\n\tif (_providerPrefixRoutes.some((p) => pathname.startsWith(p))) return true;\n\tif (import.meta.env.DEV && pathname === \"/_emdash/api/typegen\") return true;\n\treturn false;\n}\n\nfunction isCsrfExemptPublicRoute(pathname: string): boolean {\n\treturn CSRF_EXEMPT_PUBLIC_ROUTES.has(pathname);\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { url } = context;\n\n\t// Only check auth on admin routes and API routes\n\tconst isAdminRoute = url.pathname.startsWith(\"/_emdash/admin\");\n\tconst isSetupRoute = url.pathname.startsWith(\"/_emdash/admin/setup\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\tconst isPublicApiRoute = isPublicEmDashRoute(url.pathname);\n\n\tconst isPublicRoute = !isAdminRoute && !isApiRoute;\n\n\t// Public API routes skip auth but still need CSRF protection on state-changing methods.\n\t// We check Origin header against the request host (same approach as Astro's checkOrigin).\n\t// This prevents cross-origin form submissions and fetch requests from malicious sites.\n\tif (isPublicApiRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (\n\t\t\tisUnsafeMethod(method) &&\n\t\t\t!isCsrfExemptPublicRoute(url.pathname) // OAuth protocol endpoints — cross-origin by design\n\t\t) {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\treturn next();\n\t}\n\n\t// Plugin routes: soft auth (resolve user if credentials present, but never block).\n\t// The catch-all handler decides per-route whether auth is required (public vs private).\n\t// Public plugin routes that accept POST are vulnerable to cross-origin form submissions,\n\t// so we apply the same Origin-based CSRF check as other public routes.\n\tconst isPluginRoute = url.pathname.startsWith(\"/_emdash/api/plugins/\");\n\tif (isPluginRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\treturn handlePluginRouteAuth(context, next);\n\t}\n\n\t// Setup routes: skip auth but still enforce CSRF on state-changing methods\n\tif (isSetupRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\t\tif (csrfHeader !== \"1\") {\n\t\t\t\treturn new Response(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\terror: { code: \"CSRF_REJECTED\", message: \"Missing required header\" },\n\t\t\t\t\t}),\n\t\t\t\t\t{\n\t\t\t\t\t\tstatus: 403,\n\t\t\t\t\t\theaders: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS },\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn next();\n\t}\n\n\t// For public routes: soft auth check (set locals.user if session exists, but never block)\n\tif (isPublicRoute) {\n\t\treturn handlePublicRouteAuth(context, next);\n\t}\n\n\t// --- Everything below is /_emdash (admin + API) ---\n\n\t// Try Bearer token auth first (API tokens and OAuth tokens).\n\t// If successful, skip CSRF (tokens aren't ambient credentials like cookies).\n\tconst bearerResult = await handleBearerAuth(context);\n\n\tif (bearerResult === \"invalid\") {\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t...MW_CACHE_HEADERS,\n\t\t};\n\t\t// Add WWW-Authenticate header on MCP endpoint 401s to trigger OAuth discovery\n\t\tif (url.pathname === \"/_emdash/api/mcp\") {\n\t\t\tconst origin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\theaders[\"WWW-Authenticate\"] =\n\t\t\t\t`Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`;\n\t\t}\n\t\treturn new Response(\n\t\t\tJSON.stringify({ error: { code: \"INVALID_TOKEN\", message: \"Invalid or expired token\" } }),\n\t\t\t{ status: 401, headers },\n\t\t);\n\t}\n\n\tconst isTokenAuth = bearerResult === \"authenticated\";\n\n\t// MCP discovery/tooling is bearer-only. Session/external auth should never\n\t// be consulted for this endpoint, and unauthenticated requests must return\n\t// the OAuth discovery-style 401 response.\n\tconst method = context.request.method.toUpperCase();\n\tconst isMcpEndpoint = url.pathname === MCP_ENDPOINT_PATH;\n\tif (isMcpEndpoint && !isTokenAuth) {\n\t\treturn mcpUnauthorizedResponse(url, context.locals.emdash?.config);\n\t}\n\n\t// CSRF protection: require X-EmDash-Request header on state-changing requests.\n\t// Skip for token-authenticated requests (tokens aren't ambient credentials).\n\t// Browsers block cross-origin custom headers, so this prevents CSRF without tokens.\n\t// OAuth authorize consent is exempt: it's a standard HTML form POST that can't\n\t// include custom headers. The consent flow is protected by session + single-use codes.\n\tconst isOAuthConsent = url.pathname.startsWith(\"/_emdash/oauth/authorize\");\n\tif (\n\t\tisApiRoute &&\n\t\t!isTokenAuth &&\n\t\t!isOAuthConsent &&\n\t\tisUnsafeMethod(method) &&\n\t\t!isPublicApiRoute\n\t) {\n\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\tif (csrfHeader !== \"1\") {\n\t\t\treturn csrfRejectedResponse();\n\t\t}\n\t}\n\n\t// If already authenticated via Bearer token, enforce scope then skip session/external auth\n\tif (isTokenAuth) {\n\t\t// Enforce API token scopes based on URL pattern + HTTP method\n\t\tconst scopeError = enforceTokenScope(url.pathname, method, context.locals.tokenScopes);\n\t\tif (scopeError) return scopeError;\n\n\t\tconst response = await next();\n\t\tif (!import.meta.env.DEV) {\n\t\t\tresponse.headers.set(\n\t\t\t\t\"Content-Security-Policy\",\n\t\t\t\tbuildEmDashCsp(context.locals.emdash?.config.experimental?.registry),\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\tconst response = await handleEmDashAuth(context, next);\n\n\t// Set strict CSP on all /_emdash responses (prod only)\n\tif (!import.meta.env.DEV) {\n\t\tresponse.headers.set(\n\t\t\t\"Content-Security-Policy\",\n\t\t\tbuildEmDashCsp(context.locals.emdash?.config.experimental?.registry),\n\t\t);\n\t}\n\n\treturn response;\n});\n\n/**\n * Auth handling for /_emdash routes. Returns a Response from either\n * an auth error/redirect or the downstream route handler.\n */\nasync function handleEmDashAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { url, locals } = context;\n\tconst { emdash } = locals;\n\n\tconst isPublicAdminRoute =\n\t\turl.pathname.startsWith(\"/_emdash/admin/login\") ||\n\t\turl.pathname.startsWith(\"/_emdash/admin/invite/accept\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\n\tif (!emdash?.db) {\n\t\t// No database - let the admin handle this error\n\t\treturn next();\n\t}\n\n\t// Determine auth mode from config\n\tconst authMode = getAuthMode(emdash.config);\n\n\tif (authMode.type === \"external\") {\n\t\t// In dev mode, fall back to passkey auth since external JWT won't be present\n\t\tif (import.meta.env.DEV) {\n\t\t\tif (isPublicAdminRoute) {\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\treturn handlePasskeyAuth(context, next, isApiRoute);\n\t\t}\n\n\t\t// External auth provider (Cloudflare Access, etc.)\n\t\treturn handleExternalAuth(context, next, authMode, isApiRoute);\n\t}\n\n\t// Passkey authentication (default)\n\tif (isPublicAdminRoute) {\n\t\treturn next();\n\t}\n\n\treturn handlePasskeyAuth(context, next, isApiRoute);\n}\n\n/**\n * Soft auth for plugin routes: resolve user from Bearer token or session if present,\n * but never block unauthenticated requests. The catch-all handler checks route\n * metadata to decide whether auth is required (public vs private routes).\n */\nasync function handlePluginRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Try Bearer token auth first (API tokens and OAuth tokens)\n\t\tconst bearerResult = await handleBearerAuth(context);\n\t\tif (bearerResult === \"authenticated\") {\n\t\t\t// User and tokenScopes are set on locals by handleBearerAuth\n\t\t\treturn next();\n\t\t}\n\t\tif (bearerResult === \"invalid\") {\n\t\t\t// A token was presented but is invalid/expired — return 401 so the\n\t\t\t// caller knows their token is bad (don't silently downgrade to no-auth).\n\t\t\treturn new Response(\n\t\t\t\tJSON.stringify({ error: { code: \"INVALID_TOKEN\", message: \"Invalid or expired token\" } }),\n\t\t\t\t{\n\t\t\t\t\tstatus: 401,\n\t\t\t\t\theaders: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS },\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\t// \"none\" — no token presented, try session auth below.\n\t} catch (error) {\n\t\tconsole.error(\"Plugin route bearer auth error:\", error);\n\t}\n\n\ttry {\n\t\t// Try session auth (sets locals.user if session exists)\n\t\tconst { session } = context;\n\t\tconst sessionUser = await session?.get(\"user\");\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\t// Log but don't block — public routes should still work without session\n\t\tconsole.error(\"Plugin route session auth error:\", error);\n\t}\n\n\treturn next();\n}\n\n/**\n * Soft auth check for public routes with edit mode cookie.\n * Checks the session and sets locals.user if valid, but never blocks the request.\n */\nasync function handlePublicRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\tconst sessionUser = await session?.get(\"user\");\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch {\n\t\t// Silently continue — public page should render normally\n\t}\n\n\treturn next();\n}\n\n/**\n * Handle external auth provider authentication (Cloudflare Access, etc.)\n */\nasync function handleExternalAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tauthMode: ExternalAuthMode,\n\t_isApiRoute: boolean,\n): Promise<Response> {\n\tconst { locals, request } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Use the authenticate function from the virtual module\n\t\t// (statically imported at build time to work with Cloudflare Workers)\n\t\tif (typeof virtualAuthenticate !== \"function\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Auth provider ${authMode.entrypoint} does not export an authenticate function`,\n\t\t\t);\n\t\t}\n\n\t\t// Authenticate via the provider\n\t\tconst authResult = await virtualAuthenticate(request, authMode.config);\n\n\t\t// Get external auth config for auto-provision settings\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowing AuthModeConfig to ExternalAuthConfig after provider check\n\t\tconst externalConfig = authMode.config as ExternalAuthConfig;\n\n\t\t// Find or create user\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tlet user = await adapter.getUserByEmail(authResult.email);\n\n\t\tif (!user) {\n\t\t\t// User doesn't exist\n\t\t\tif (externalConfig.autoProvision === false) {\n\t\t\t\treturn new Response(\"User not authorized\", {\n\t\t\t\t\tstatus: 403,\n\t\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Check if this is the first user (they become admin)\n\t\t\tconst userCount = await emdash.db\n\t\t\t\t.selectFrom(\"users\")\n\t\t\t\t.select(emdash.db.fn.count(\"id\").as(\"count\"))\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tconst isFirstUser = Number(userCount?.count ?? 0) === 0;\n\t\t\tconst role = isFirstUser ? ROLE_ADMIN : authResult.role;\n\n\t\t\t// Create user\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: authResult.email,\n\t\t\t\tname: authResult.name,\n\t\t\t\trole,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = await adapter.getUserByEmail(authResult.email);\n\n\t\t\tconsole.log(\n\t\t\t\t`[external-auth] Provisioned user: ${authResult.email} (role: ${role}, first: ${isFirstUser})`,\n\t\t\t);\n\t\t} else {\n\t\t\t// User exists - check if we need to sync anything\n\t\t\tconst updates: Record<string, unknown> = {};\n\t\t\tlet newName: string | undefined;\n\t\t\tlet newRole: RoleLevel | undefined;\n\n\t\t\t// Sync name from provider if provider provides one and local differs\n\t\t\tif (authResult.name && user.name !== authResult.name) {\n\t\t\t\tnewName = authResult.name;\n\t\t\t\tupdates.name = newName;\n\t\t\t}\n\n\t\t\t// Sync role if enabled\n\t\t\tif (externalConfig.syncRoles && user.role !== authResult.role) {\n\t\t\t\tnewRole = authResult.role;\n\t\t\t\tupdates.role = newRole;\n\t\t\t}\n\n\t\t\tif (Object.keys(updates).length > 0) {\n\t\t\t\tupdates.updated_at = new Date().toISOString();\n\t\t\t\tawait emdash.db.updateTable(\"users\").set(updates).where(\"id\", \"=\", user.id).execute();\n\n\t\t\t\tuser = {\n\t\t\t\t\t...user,\n\t\t\t\t\t...(newName ? { name: newName } : {}),\n\t\t\t\t\t...(newRole ? { role: newRole } : {}),\n\t\t\t\t};\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`[external-auth] Updated user ${authResult.email}:`,\n\t\t\t\t\tObject.keys(updates).filter((k) => k !== \"updated_at\"),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (!user) {\n\t\t\t// This shouldn't happen, but handle it gracefully\n\t\t\treturn new Response(\"Failed to provision user\", {\n\t\t\t\tstatus: 500,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Check if user is disabled locally\n\t\tif (user.disabled) {\n\t\t\treturn new Response(\"Account disabled\", {\n\t\t\t\tstatus: 403,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Set user in locals\n\t\tlocals.user = user;\n\n\t\t// Persist to session so public pages can identify the user\n\t\t// (external auth headers are only verified on /_emdash routes)\n\t\tconst { session } = context;\n\t\tsession?.set(\"user\", { id: user.id });\n\n\t\treturn next();\n\t} catch (error) {\n\t\tconsole.error(\"[external-auth] Auth error:\", error);\n\n\t\treturn new Response(\"Authentication failed\", {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t});\n\t}\n}\n\n/**\n * Try to authenticate via Bearer token (API token or OAuth token).\n *\n * Returns:\n * - \"authenticated\" if token is valid and user is resolved\n * - \"invalid\" if a token was provided but is invalid/expired\n * - \"none\" if no Bearer token was provided\n */\nasync function handleBearerAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n): Promise<\"authenticated\" | \"invalid\" | \"none\"> {\n\tconst authHeader = context.request.headers.get(\"Authorization\");\n\tif (!authHeader?.startsWith(\"Bearer \")) return \"none\";\n\n\tconst token = authHeader.slice(7);\n\tif (!token) return \"none\";\n\n\tconst { locals } = context;\n\tconst { emdash } = locals;\n\tif (!emdash?.db) return \"none\";\n\n\t// Resolve token based on prefix\n\tlet resolved: { userId: string; scopes: string[] } | null = null;\n\n\tif (token.startsWith(\"ec_pat_\")) {\n\t\tresolved = await resolveApiToken(emdash.db, token);\n\t} else if (token.startsWith(\"ec_oat_\")) {\n\t\tresolved = await resolveOAuthToken(emdash.db, token);\n\t} else {\n\t\t// Unknown token format\n\t\treturn \"invalid\";\n\t}\n\n\tif (!resolved) return \"invalid\";\n\n\t// Look up the user\n\tconst adapter = createKyselyAdapter(emdash.db);\n\tconst user = await adapter.getUserById(resolved.userId);\n\n\tif (!user || user.disabled) return \"invalid\";\n\n\t// Set user and scopes on locals\n\tlocals.user = user;\n\tlocals.tokenScopes = resolved.scopes;\n\n\treturn \"authenticated\";\n}\n\n/**\n * Handle passkey (session-based) authentication\n */\nasync function handlePasskeyAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tisApiRoute: boolean,\n): Promise<Response> {\n\tconst { url, locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Check session for user (session.get returns a Promise)\n\t\tconst sessionUser = await session?.get(\"user\");\n\n\t\tif (!sessionUser?.id) {\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ error: { code: \"NOT_AUTHENTICATED\", message: \"Not authenticated\" } },\n\t\t\t\t\t{ status: 401, headers: MW_CACHE_HEADERS },\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\tloginUrl.searchParams.set(\"redirect\", url.pathname);\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Get full user from database\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await adapter.getUserById(sessionUser.id);\n\n\t\tif (!user) {\n\t\t\t// User no longer exists - clear session\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn Response.json(\n\t\t\t\t\t{ error: { code: \"NOT_FOUND\", message: \"User not found\" } },\n\t\t\t\t\t{ status: 401, headers: MW_CACHE_HEADERS },\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Check if user is disabled\n\t\tif (user.disabled) {\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"ACCOUNT_DISABLED\", \"Account disabled\", 403);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\tloginUrl.searchParams.set(\"error\", \"account_disabled\");\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Set user in locals for use by routes\n\t\tlocals.user = user;\n\t} catch (error) {\n\t\tconsole.error(\"Auth middleware error:\", error);\n\t\t// On error, redirect to login\n\t\treturn context.redirect(\"/_emdash/admin/login\");\n\t}\n\n\treturn next();\n}\n\n// =============================================================================\n// Token scope enforcement\n// =============================================================================\n\n/**\n * Scope rules: ordered list of (pathPrefix, method, requiredScope) tuples.\n * First matching rule wins. Methods: \"*\" = any, \"WRITE\" = POST/PUT/PATCH/DELETE.\n *\n * Routes not matched by any rule default to \"admin\" scope (fail-closed).\n */\nconst SCOPE_RULES: Array<[prefix: string, method: string, scope: string]> = [\n\t// Content routes\n\t[\"/_emdash/api/content\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/content\", \"WRITE\", \"content:write\"],\n\n\t// Media routes (excluding /file/ which is public)\n\t[\"/_emdash/api/media/file\", \"*\", \"media:read\"], // public anyway, but scope if token-authed\n\t[\"/_emdash/api/media\", \"GET\", \"media:read\"],\n\t[\"/_emdash/api/media\", \"WRITE\", \"media:write\"],\n\n\t// Schema routes\n\t[\"/_emdash/api/schema\", \"GET\", \"schema:read\"],\n\t[\"/_emdash/api/schema\", \"WRITE\", \"schema:write\"],\n\n\t// Taxonomy, menu, section, widget, revision — all content domain\n\t// GET uses content:read (implicit from taxonomies:read / menus:read via role).\n\t// WRITE uses the granular scope so tokens with only taxonomies:manage or\n\t// menus:manage are not rejected. content:write implicitly grants these via\n\t// IMPLICIT_SCOPE_GRANTS in @emdash-cms/auth.\n\t[\"/_emdash/api/taxonomies\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/taxonomies\", \"WRITE\", \"taxonomies:manage\"],\n\t[\"/_emdash/api/menus\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/menus\", \"WRITE\", \"menus:manage\"],\n\t[\"/_emdash/api/sections\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/sections\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/widget-areas\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/widget-areas\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/revisions\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/revisions\", \"WRITE\", \"content:write\"],\n\n\t// Search\n\t[\"/_emdash/api/search\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/search\", \"WRITE\", \"admin\"],\n\n\t// Import, admin, plugins — all require admin scope\n\t[\"/_emdash/api/import\", \"*\", \"admin\"],\n\t[\"/_emdash/api/admin\", \"*\", \"admin\"],\n\t[\"/_emdash/api/plugins\", \"*\", \"admin\"],\n\n\t// Settings — use granular scopes so tokens with settings:read or\n\t// settings:manage are not rejected at the middleware level.\n\t[\"/_emdash/api/settings\", \"GET\", \"settings:read\"],\n\t[\"/_emdash/api/settings\", \"WRITE\", \"settings:manage\"],\n\n\t// MCP endpoint — scopes enforced per-tool inside mcp/server.ts\n\t[\"/_emdash/api/mcp\", \"*\", \"content:read\"],\n];\n\nconst WRITE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Enforce API token scopes based on the request URL and HTTP method.\n * Returns a 403 Response if the scope is insufficient, or null if allowed.\n *\n * Session-authenticated requests (tokenScopes === undefined) are never checked.\n */\nfunction enforceTokenScope(\n\tpathname: string,\n\tmethod: string,\n\ttokenScopes: string[] | undefined,\n): Response | null {\n\t// Session auth — implicit full access, no scope restrictions\n\tif (!tokenScopes) return null;\n\n\tconst isWrite = WRITE_METHODS.has(method);\n\n\tfor (const [prefix, ruleMethod, scope] of SCOPE_RULES) {\n\t\t// Match exact prefix or prefix followed by /\n\t\tif (pathname !== prefix && !pathname.startsWith(prefix + \"/\")) continue;\n\n\t\t// Check method match\n\t\tif (ruleMethod === \"*\" || (ruleMethod === \"WRITE\" && isWrite) || ruleMethod === method) {\n\t\t\tif (hasScope(tokenScopes, scope)) return null;\n\n\t\t\treturn new Response(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"INSUFFICIENT_SCOPE\",\n\t\t\t\t\t\tmessage: `Token lacks required scope: ${scope}`,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t\t{ status: 403, headers: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS } },\n\t\t\t);\n\t\t}\n\t}\n\n\t// No rule matched — default to admin scope (fail-closed)\n\tif (hasScope(tokenScopes, \"admin\")) return null;\n\n\treturn new Response(\n\t\tJSON.stringify({\n\t\t\terror: {\n\t\t\t\tcode: \"INSUFFICIENT_SCOPE\",\n\t\t\t\tmessage: \"Token lacks required scope: admin\",\n\t\t\t},\n\t\t}),\n\t\t{ status: 403, headers: { \"Content-Type\": \"application/json\", ...MW_CACHE_HEADERS } },\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,gBACf,SACA,KACA,cACkB;AAGlB,KADmB,QAAQ,QAAQ,IAAI,mBAAmB,KACvC,IAAK,QAAO;CAG/B,MAAM,SAAS,QAAQ,QAAQ,IAAI,SAAS;AAC5C,KAAI,QAAQ;AACX,MAAI;GACH,MAAM,YAAY,IAAI,IAAI,OAAO;AAEjC,OAAI,UAAU,WAAW,IAAI,OAAQ,QAAO;AAC5C,OAAI,gBAAgB,UAAU,WAAW,aAAc,QAAO;UACvD;AAIR,SAAO,SAAS,iBAAiB,gCAAgC,IAAI;;AAMtE,QAAO;;;;;AC1CR,SAAS,4BACR,UACqB;CACrB,MAAM,gBAAgB,OAAO,aAAa,WAAW,WAAW,UAAU;AAC1E,KAAI,CAAC,cAAe,QAAO;AAE3B,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,cAAc;AAClC,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,SAAO,IAAI;SACJ;AACP;;;AAIF,SAAgB,eAAe,UAAwC;CACtE,MAAM,aAAa,CAAC,qBAAqB;CACzC,MAAM,2BAA2B,4BAA4B,SAAS;AACtE,KAAI,yBAA0B,YAAW,KAAK,yBAAyB;AAEvE,QAAO;EACN;EACA;EACA;EACA,WAAW,KAAK,IAAI;EACpB;EACA;EACA;EACA;EACA;EACA,CAAC,KAAK,KAAK;;;;;;AClBb,MAAM,mBAAmB,EACxB,iBAAiB,qBACjB;AAwBD,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAE1B,SAAS,eAAe,QAAyB;AAChD,QAAO,WAAW,SAAS,WAAW,UAAU,WAAW;;AAG5D,SAAS,uBAAiC;AACzC,QAAO,IAAI,SACV,KAAK,UAAU,EAAE,OAAO;EAAE,MAAM;EAAiB,SAAS;EAA2B,EAAE,CAAC,EACxF;EACC,QAAQ;EACR,SAAS;GAAE,gBAAgB;GAAoB,GAAG;GAAkB;EACpE,CACD;;AAGF,SAAS,wBACR,KACA,QACW;CACX,MAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,QAAO,SAAS,KACf,EAAE,OAAO;EAAE,MAAM;EAAqB,SAAS;EAAqB,EAAE,EACtE;EACC,QAAQ;EACR,SAAS;GACR,oBAAoB,6BAA6B,OAAO;GACxD,GAAG;GACH;EACD,CACD;;;;;;;;AASF,MAAM,sBAAsB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAM,mBAAmB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CAIA;CACA,CAAC;AAIF,MAAM,EAAE,OAAO,sBAAsB,UAAU,iCAAiC;CAC/E,MAAM,wBAAQ,IAAI,KAAa;CAC/B,MAAM,WAAqB,EAAE;AAC7B,KAAI,CAAC,eAAe,cAAe,QAAO;EAAE;EAAO;EAAU;AAC7D,MAAK,MAAM,SAAS,cAAc,cAAc,SAAS,MAAM,EAAE,gBAAgB,EAAE,CAAC,CACnF,KAAI,MAAM,SAAS,IAAI,CACtB,UAAS,KAAK,MAAM;KAEpB,OAAM,IAAI,MAAM;AAGlB,QAAO;EAAE;EAAO;EAAU;IACvB;;;;;;;;;;;;;;;;;;AAmBJ,MAAM,4BAA4B,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,oBAAoB,UAA2B;AACvD,KAAI,iBAAiB,IAAI,SAAS,CAAE,QAAO;AAC3C,KAAI,oBAAoB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACpE,KAAI,qBAAqB,IAAI,SAAS,CAAE,QAAO;AAC/C,KAAI,sBAAsB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACtE,KAAI,OAAO,KAAK,IAAI,OAAO,aAAa,uBAAwB,QAAO;AACvE,QAAO;;AAGR,SAAS,wBAAwB,UAA2B;AAC3D,QAAO,0BAA0B,IAAI,SAAS;;AAG/C,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,QAAQ;CAGhB,MAAM,eAAe,IAAI,SAAS,WAAW,iBAAiB;CAC9D,MAAM,eAAe,IAAI,SAAS,WAAW,uBAAuB;CACpE,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;CAC1D,MAAM,mBAAmB,oBAAoB,IAAI,SAAS;CAE1D,MAAM,gBAAgB,CAAC,gBAAgB,CAAC;AAKxC,KAAI,kBAAkB;AAErB,MACC,eAFc,QAAQ,QAAQ,OAAO,aAAa,CAE5B,IACtB,CAAC,wBAAwB,IAAI,SAAS,EACrC;GACD,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,SAAO,MAAM;;AAQd,KADsB,IAAI,SAAS,WAAW,wBAAwB,EACnD;EAClB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;GAClE,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,SAAO,sBAAsB,SAAS,KAAK;;AAI5C,KAAI,cAAc;EACjB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAEvD;OADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,IAAI,SACV,KAAK,UAAU,EACd,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA2B,EACpE,CAAC,EACF;IACC,QAAQ;IACR,SAAS;KAAE,gBAAgB;KAAoB,GAAG;KAAkB;IACpE,CACD;;AAGH,SAAO,MAAM;;AAId,KAAI,cACH,QAAO,sBAAsB,SAAS,KAAK;CAO5C,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AAEpD,KAAI,iBAAiB,WAAW;EAC/B,MAAM,UAAkC;GACvC,gBAAgB;GAChB,GAAG;GACH;AAED,MAAI,IAAI,aAAa,mBAEpB,SAAQ,sBACP,6BAFc,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO,CAE7B;AAEtC,SAAO,IAAI,SACV,KAAK,UAAU,EAAE,OAAO;GAAE,MAAM;GAAiB,SAAS;GAA4B,EAAE,CAAC,EACzF;GAAE,QAAQ;GAAK;GAAS,CACxB;;CAGF,MAAM,cAAc,iBAAiB;CAKrC,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AAEnD,KADsB,IAAI,aAAa,qBAClB,CAAC,YACrB,QAAO,wBAAwB,KAAK,QAAQ,OAAO,QAAQ,OAAO;CAQnE,MAAM,iBAAiB,IAAI,SAAS,WAAW,2BAA2B;AAC1E,KACC,cACA,CAAC,eACD,CAAC,kBACD,eAAe,OAAO,IACtB,CAAC,kBAGD;MADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,sBAAsB;;AAK/B,KAAI,aAAa;EAEhB,MAAM,aAAa,kBAAkB,IAAI,UAAU,QAAQ,QAAQ,OAAO,YAAY;AACtF,MAAI,WAAY,QAAO;EAEvB,MAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eAAe,QAAQ,OAAO,QAAQ,OAAO,cAAc,SAAS,CACpE;AAEF,SAAO;;CAGR,MAAM,WAAW,MAAM,iBAAiB,SAAS,KAAK;AAGtD,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eAAe,QAAQ,OAAO,QAAQ,OAAO,cAAc,SAAS,CACpE;AAGF,QAAO;EACN;;;;;AAMF,eAAe,iBACd,SACA,MACoB;CACpB,MAAM,EAAE,KAAK,WAAW;CACxB,MAAM,EAAE,WAAW;CAEnB,MAAM,qBACL,IAAI,SAAS,WAAW,uBAAuB,IAC/C,IAAI,SAAS,WAAW,+BAA+B;CACxD,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;AAE1D,KAAI,CAAC,QAAQ,GAEZ,QAAO,MAAM;CAId,MAAM,WAAW,YAAY,OAAO,OAAO;AAE3C,KAAI,SAAS,SAAS,YAAY;AAEjC,MAAI,OAAO,KAAK,IAAI,KAAK;AACxB,OAAI,mBACH,QAAO,MAAM;AAGd,UAAO,kBAAkB,SAAS,MAAM,WAAW;;AAIpD,SAAO,mBAAmB,SAAS,MAAM,UAAU,WAAW;;AAI/D,KAAI,mBACH,QAAO,MAAM;AAGd,QAAO,kBAAkB,SAAS,MAAM,WAAW;;;;;;;AAQpD,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AACpD,MAAI,iBAAiB,gBAEpB,QAAO,MAAM;AAEd,MAAI,iBAAiB,UAGpB,QAAO,IAAI,SACV,KAAK,UAAU,EAAE,OAAO;GAAE,MAAM;GAAiB,SAAS;GAA4B,EAAE,CAAC,EACzF;GACC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAoB,GAAG;IAAkB;GACpE,CACD;UAGM,OAAO;AACf,UAAQ,MAAM,mCAAmC,MAAM;;AAGxD,KAAI;EAEH,MAAM,EAAE,YAAY;EACpB,MAAM,cAAc,MAAM,SAAS,IAAI,OAAO;AAC9C,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;UAGR,OAAO;AAEf,UAAQ,MAAM,oCAAoC,MAAM;;AAGzD,QAAO,MAAM;;;;;;AAOd,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;EACH,MAAM,cAAc,MAAM,SAAS,IAAI,OAAO;AAC9C,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;SAGT;AAIR,QAAO,MAAM;;;;;AAMd,eAAe,mBACd,SACA,MACA,UACA,aACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;AAGH,MAAI,OAAOA,iBAAwB,WAClC,OAAM,IAAI,MACT,iBAAiB,SAAS,WAAW,2CACrC;EAIF,MAAM,aAAa,MAAMA,aAAoB,SAAS,SAAS,OAAO;EAItE,MAAM,iBAAiB,SAAS;EAGhC,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,IAAI,OAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAEzD,MAAI,CAAC,MAAM;AAEV,OAAI,eAAe,kBAAkB,MACpC,QAAO,IAAI,SAAS,uBAAuB;IAC1C,QAAQ;IACR,SAAS;KAAE,gBAAgB;KAAc,GAAG;KAAkB;IAC9D,CAAC;GAIH,MAAM,YAAY,MAAM,OAAO,GAC7B,WAAW,QAAQ,CACnB,OAAO,OAAO,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,CAC5C,kBAAkB;GAEpB,MAAM,cAAc,OAAO,WAAW,SAAS,EAAE,KAAK;GACtD,MAAM,OAAO,cAAc,aAAa,WAAW;GAGnD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO,WAAW;IAClB,MAAM,WAAW;IACjB;IACA,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAErD,WAAQ,IACP,qCAAqC,WAAW,MAAM,UAAU,KAAK,WAAW,YAAY,GAC5F;SACK;GAEN,MAAM,UAAmC,EAAE;GAC3C,IAAI;GACJ,IAAI;AAGJ,OAAI,WAAW,QAAQ,KAAK,SAAS,WAAW,MAAM;AACrD,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAIhB,OAAI,eAAe,aAAa,KAAK,SAAS,WAAW,MAAM;AAC9D,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAGhB,OAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,YAAQ,8BAAa,IAAI,MAAM,EAAC,aAAa;AAC7C,UAAM,OAAO,GAAG,YAAY,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,KAAK,GAAG,CAAC,SAAS;AAErF,WAAO;KACN,GAAG;KACH,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC;AAED,YAAQ,IACP,gCAAgC,WAAW,MAAM,IACjD,OAAO,KAAK,QAAQ,CAAC,QAAQ,MAAM,MAAM,aAAa,CACtD;;;AAIH,MAAI,CAAC,KAEJ,QAAO,IAAI,SAAS,4BAA4B;GAC/C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,MAAI,KAAK,SACR,QAAO,IAAI,SAAS,oBAAoB;GACvC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,SAAO,OAAO;EAId,MAAM,EAAE,YAAY;AACpB,WAAS,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAErC,SAAO,MAAM;UACL,OAAO;AACf,UAAQ,MAAM,+BAA+B,MAAM;AAEnD,SAAO,IAAI,SAAS,yBAAyB;GAC5C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;;;;;;;;;;;AAYJ,eAAe,iBACd,SACgD;CAChD,MAAM,aAAa,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB;AAC/D,KAAI,CAAC,YAAY,WAAW,UAAU,CAAE,QAAO;CAE/C,MAAM,QAAQ,WAAW,MAAM,EAAE;AACjC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,WAAW;AACnB,KAAI,CAAC,QAAQ,GAAI,QAAO;CAGxB,IAAI,WAAwD;AAE5D,KAAI,MAAM,WAAW,UAAU,CAC9B,YAAW,MAAM,gBAAgB,OAAO,IAAI,MAAM;UACxC,MAAM,WAAW,UAAU,CACrC,YAAW,MAAM,kBAAkB,OAAO,IAAI,MAAM;KAGpD,QAAO;AAGR,KAAI,CAAC,SAAU,QAAO;CAItB,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,SAAS,OAAO;AAEvD,KAAI,CAAC,QAAQ,KAAK,SAAU,QAAO;AAGnC,QAAO,OAAO;AACd,QAAO,cAAc,SAAS;AAE9B,QAAO;;;;;AAMR,eAAe,kBACd,SACA,MACA,YACoB;CACpB,MAAM,EAAE,KAAK,QAAQ,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,cAAc,MAAM,SAAS,IAAI,OAAO;AAE9C,MAAI,CAAC,aAAa,IAAI;AACrB,OAAI,WACH,QAAO,SAAS,KACf,EAAE,OAAO;IAAE,MAAM;IAAqB,SAAS;IAAqB,EAAE,EACtE;IAAE,QAAQ;IAAK,SAAS;IAAkB,CAC1C;GAEF,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,YAAS,aAAa,IAAI,YAAY,IAAI,SAAS;AACnD,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;EAK7C,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AAEtD,MAAI,CAAC,MAAM;AAEV,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,KACf,EAAE,OAAO;IAAE,MAAM;IAAa,SAAS;IAAkB,EAAE,EAC3D;IAAE,QAAQ;IAAK,SAAS;IAAkB,CAC1C;GAEF,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,MAAI,KAAK,UAAU;AAClB,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;GAE7D,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,YAAS,aAAa,IAAI,SAAS,mBAAmB;AACtD,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,SAAO,OAAO;UACN,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAE9C,SAAO,QAAQ,SAAS,uBAAuB;;AAGhD,QAAO,MAAM;;;;;;;;AAad,MAAM,cAAsE;CAE3E;EAAC;EAAwB;EAAO;EAAe;CAC/C;EAAC;EAAwB;EAAS;EAAgB;CAGlD;EAAC;EAA2B;EAAK;EAAa;CAC9C;EAAC;EAAsB;EAAO;EAAa;CAC3C;EAAC;EAAsB;EAAS;EAAc;CAG9C;EAAC;EAAuB;EAAO;EAAc;CAC7C;EAAC;EAAuB;EAAS;EAAe;CAOhD;EAAC;EAA2B;EAAO;EAAe;CAClD;EAAC;EAA2B;EAAS;EAAoB;CACzD;EAAC;EAAsB;EAAO;EAAe;CAC7C;EAAC;EAAsB;EAAS;EAAe;CAC/C;EAAC;EAAyB;EAAO;EAAe;CAChD;EAAC;EAAyB;EAAS;EAAgB;CACnD;EAAC;EAA6B;EAAO;EAAe;CACpD;EAAC;EAA6B;EAAS;EAAgB;CACvD;EAAC;EAA0B;EAAO;EAAe;CACjD;EAAC;EAA0B;EAAS;EAAgB;CAGpD;EAAC;EAAuB;EAAO;EAAe;CAC9C;EAAC;EAAuB;EAAS;EAAQ;CAGzC;EAAC;EAAuB;EAAK;EAAQ;CACrC;EAAC;EAAsB;EAAK;EAAQ;CACpC;EAAC;EAAwB;EAAK;EAAQ;CAItC;EAAC;EAAyB;EAAO;EAAgB;CACjD;EAAC;EAAyB;EAAS;EAAkB;CAGrD;EAAC;EAAoB;EAAK;EAAe;CACzC;AAED,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;CAAS,CAAC;;;;;;;AAQjE,SAAS,kBACR,UACA,QACA,aACkB;AAElB,KAAI,CAAC,YAAa,QAAO;CAEzB,MAAM,UAAU,cAAc,IAAI,OAAO;AAEzC,MAAK,MAAM,CAAC,QAAQ,YAAY,UAAU,aAAa;AAEtD,MAAI,aAAa,UAAU,CAAC,SAAS,WAAW,SAAS,IAAI,CAAE;AAG/D,MAAI,eAAe,OAAQ,eAAe,WAAW,WAAY,eAAe,QAAQ;AACvF,OAAI,SAAS,aAAa,MAAM,CAAE,QAAO;AAEzC,UAAO,IAAI,SACV,KAAK,UAAU,EACd,OAAO;IACN,MAAM;IACN,SAAS,+BAA+B;IACxC,EACD,CAAC,EACF;IAAE,QAAQ;IAAK,SAAS;KAAE,gBAAgB;KAAoB,GAAG;KAAkB;IAAE,CACrF;;;AAKH,KAAI,SAAS,aAAa,QAAQ,CAAE,QAAO;AAE3C,QAAO,IAAI,SACV,KAAK,UAAU,EACd,OAAO;EACN,MAAM;EACN,SAAS;EACT,EACD,CAAC,EACF;EAAE,QAAQ;EAAK,SAAS;GAAE,gBAAgB;GAAoB,GAAG;GAAkB;EAAE,CACrF"}

package/dist/astro/middleware/redirect.mjs

@@ -1,9 +1,9 @@
 import "../../dialect-helpers-BKCvISIQ.mjs";
 import "../../base64-CqR-7kqF.mjs";
-import "../../types-CwXMEPRr.mjs";
-import { t as RedirectRepository } from "../../redirect-DkaDxq8e.mjs";
-import { a as setCachedRedirects, i as matchCachedPatterns, n as getCachedRedirects } from "../../cache-CXCpjWiL.mjs";
-import { r as getDb } from "../../loader-Cs6-Bqe6.mjs";
+import "../../types-ByV5sgsv.mjs";
+import { t as RedirectRepository } from "../../redirect-CNv4mHX2.mjs";
+import { a as setCachedRedirects, i as matchCachedPatterns, n as getCachedRedirects } from "../../cache-CNk1jIxp.mjs";
+import { r as getDb } from "../../loader-Chm5h7Gr.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/redirect.ts

package/dist/astro/middleware/request-context.mjs

@@ -1,8 +1,8 @@
 import { getRequestContext, runWithContext } from "../../request-context.mjs";
 import "../../base64-CqR-7kqF.mjs";
 import "../../options-BL4X94qY.mjs";
-import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-DILYNZMi.mjs";
-import { i as resolveSecretsCached } from "../../secrets-6pgZyq0K.mjs";
+import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-N8otWMmj.mjs";
+import { i as resolveSecretsCached } from "../../secrets-rPdhEBkD.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/visual-editing/toolbar.ts

package/dist/astro/middleware/request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.mjs","names":[],"sources":["../../../src/visual-editing/toolbar.ts","../../../src/astro/middleware/request-context.ts"],"sourcesContent":["/**\n * EmDash Visual Editing Toolbar\n *\n * A floating pill injected via middleware for authenticated editors.\n * Renders as a plain HTML string with inline styles and a <script> tag.\n * No dependencies — works on any page with a </body> tag.\n */\n\ninterface ToolbarConfig {\n\teditMode: boolean;\n\tisPreview: boolean;\n}\n\nexport function renderToolbar(config: ToolbarConfig): string {\n\tconst { editMode, isPreview } = config;\n\n\treturn `\n<!-- EmDash Visual Editing Toolbar -->\n<div id=\"emdash-toolbar\" data-edit-mode=\"${editMode}\" data-preview=\"${isPreview}\">\n  <div class=\"emdash-tb-inner\">\n    <span class=\"emdash-tb-logo\">EmDash</span>\n\n    <div class=\"emdash-tb-divider\"></div>\n\n    <label class=\"emdash-tb-toggle\" title=\"Toggle edit mode\">\n      <input type=\"checkbox\" id=\"emdash-edit-toggle\" ${editMode ? \"checked\" : \"\"} />\n      <span class=\"emdash-tb-toggle-track\">\n        <span class=\"emdash-tb-toggle-thumb\"></span>\n      </span>\n      <span class=\"emdash-tb-toggle-label\">Edit</span>\n    </label>\n\n    <span class=\"emdash-tb-status\" id=\"emdash-tb-status\"></span>\n\n    <span class=\"emdash-tb-save-status\" id=\"emdash-tb-save-status\"></span>\n\n    <a class=\"emdash-tb-admin\" id=\"emdash-tb-admin\" href=\"#\" target=\"emdash-admin\" style=\"display:none\" title=\"Open in admin\">\n      <svg width=\"14\" height=\"14\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6\"/><polyline points=\"15 3 21 3 21 9\"/><line x1=\"10\" y1=\"14\" x2=\"21\" y2=\"3\"/></svg>\n    </a>\n\n    <button class=\"emdash-tb-publish\" id=\"emdash-tb-publish\" style=\"display:none\">Publish</button>\n  </div>\n</div>\n\n<style>\n  #emdash-toolbar {\n    position: fixed;\n    bottom: 16px;\n    left: 50%;\n    transform: translateX(-50%);\n    z-index: 999999;\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, sans-serif;\n    font-size: 13px;\n    line-height: 1;\n    -webkit-font-smoothing: antialiased;\n  }\n\n  .emdash-tb-inner {\n    display: flex;\n    align-items: center;\n    gap: 10px;\n    padding: 8px 16px;\n    background: #1a1a1a;\n    color: #e0e0e0;\n    border-radius: 999px;\n    box-shadow: 0 4px 24px rgba(0,0,0,0.3), 0 0 0 1px rgba(255,255,255,0.08);\n    white-space: nowrap;\n    user-select: none;\n  }\n\n  .emdash-tb-logo {\n    font-weight: 600;\n    font-size: 12px;\n    letter-spacing: 0.02em;\n    color: #fff;\n    opacity: 0.7;\n  }\n\n  .emdash-tb-divider {\n    width: 1px;\n    height: 16px;\n    background: rgba(255,255,255,0.15);\n  }\n\n  /* Toggle switch */\n  .emdash-tb-toggle {\n    display: flex;\n    align-items: center;\n    gap: 6px;\n    cursor: pointer;\n  }\n\n  .emdash-tb-toggle input {\n    position: absolute;\n    opacity: 0;\n    width: 0;\n    height: 0;\n  }\n\n  .emdash-tb-toggle-track {\n    position: relative;\n    width: 32px;\n    height: 18px;\n    background: #444;\n    border-radius: 9px;\n    transition: background 0.2s;\n  }\n\n  .emdash-tb-toggle input:checked + .emdash-tb-toggle-track {\n    background: #3b82f6;\n  }\n\n  .emdash-tb-toggle-thumb {\n    position: absolute;\n    top: 2px;\n    left: 2px;\n    width: 14px;\n    height: 14px;\n    background: #fff;\n    border-radius: 50%;\n    transition: transform 0.2s;\n  }\n\n  .emdash-tb-toggle input:checked + .emdash-tb-toggle-track .emdash-tb-toggle-thumb {\n    transform: translateX(14px);\n  }\n\n  .emdash-tb-toggle-label {\n    font-size: 12px;\n    color: #aaa;\n  }\n\n  .emdash-tb-toggle input:checked ~ .emdash-tb-toggle-label {\n    color: #fff;\n  }\n\n  /* Status area — flex for multiple badges */\n  .emdash-tb-status {\n    display: inline-flex;\n    gap: 6px;\n    align-items: center;\n  }\n\n  /* Badges */\n  .emdash-tb-badge {\n    display: inline-flex;\n    align-items: center;\n    padding: 3px 8px;\n    border-radius: 999px;\n    font-size: 11px;\n    font-weight: 600;\n    letter-spacing: 0.02em;\n    text-transform: uppercase;\n  }\n\n  .emdash-tb-badge--preview {\n    background: rgba(139,92,246,0.2);\n    color: #a78bfa;\n  }\n\n  .emdash-tb-badge--draft {\n    background: rgba(245,158,11,0.2);\n    color: #fbbf24;\n  }\n\n  .emdash-tb-badge--published {\n    background: rgba(34,197,94,0.2);\n    color: #4ade80;\n  }\n\n  .emdash-tb-badge--pending {\n    background: rgba(59,130,246,0.2);\n    color: #60a5fa;\n  }\n\n  .emdash-tb-badge--unsaved {\n    background: rgba(245,158,11,0.2);\n    color: #fbbf24;\n  }\n\n  .emdash-tb-badge--saving {\n    background: rgba(148,163,184,0.2);\n    color: #94a3b8;\n  }\n\n  .emdash-tb-badge--saved {\n    background: rgba(34,197,94,0.2);\n    color: #4ade80;\n    transition: opacity 0.3s;\n  }\n\n  .emdash-tb-badge--error {\n    background: rgba(239,68,68,0.2);\n    color: #f87171;\n  }\n\n  /* Admin link */\n  .emdash-tb-admin {\n    display: inline-flex;\n    align-items: center;\n    justify-content: center;\n    color: #888;\n    text-decoration: none;\n    padding: 2px;\n    border-radius: 4px;\n    transition: color 0.15s;\n  }\n\n  .emdash-tb-admin:hover {\n    color: #fff;\n  }\n\n  /* Publish button */\n  .emdash-tb-publish {\n    padding: 4px 12px;\n    background: #3b82f6;\n    color: #fff;\n    border: none;\n    border-radius: 999px;\n    font-size: 12px;\n    font-weight: 600;\n    cursor: pointer;\n    transition: background 0.15s;\n    font-family: inherit;\n  }\n\n  .emdash-tb-publish:hover {\n    background: #2563eb;\n  }\n\n  .emdash-tb-publish:disabled {\n    opacity: 0.5;\n    cursor: not-allowed;\n  }\n\n  /* Edit mode: editable hover styles — uses :has() to check toolbar state */\n  body:has(#emdash-toolbar[data-edit-mode=\"true\"]) [data-emdash-ref] {\n    transition: box-shadow 0.15s, background-color 0.15s;\n  }\n\n  body:has(#emdash-toolbar[data-edit-mode=\"true\"]) [data-emdash-ref]:hover {\n    box-shadow: 0 0 0 2px rgba(59,130,246,0.5);\n    border-radius: 4px;\n    background-color: rgba(59,130,246,0.04);\n    cursor: text;\n  }\n\n  /* Active editing state — override hover pencil cursor */\n  [data-emdash-editing] {\n    box-shadow: 0 0 0 2px #3b82f6 !important;\n    border-radius: 4px !important;\n    background-color: rgba(59,130,246,0.04) !important;\n    cursor: text !important;\n  }\n\n  /* Suppress browser focus ring on contenteditable and tiptap editor */\n  [data-emdash-editing]:focus,\n  [data-emdash-ref] .tiptap:focus,\n  [data-emdash-ref] .ProseMirror:focus {\n    outline: none !important;\n  }\n\n  /* Image editor popover */\n  .emdash-img-popover {\n    position: fixed;\n    z-index: 1000000;\n    background: #1a1a1a;\n    border-radius: 12px;\n    box-shadow: 0 8px 32px rgba(0,0,0,0.4), 0 0 0 1px rgba(255,255,255,0.08);\n    color: #e0e0e0;\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, sans-serif;\n    font-size: 13px;\n    width: 320px;\n    overflow: hidden;\n    animation: emdash-img-fadein 0.15s ease-out;\n  }\n\n  @keyframes emdash-img-fadein {\n    from { opacity: 0; transform: translateY(4px); }\n    to { opacity: 1; transform: translateY(0); }\n  }\n\n  .emdash-img-popover-header {\n    display: flex;\n    align-items: center;\n    justify-content: space-between;\n    padding: 10px 12px;\n    border-bottom: 1px solid rgba(255,255,255,0.08);\n  }\n\n  .emdash-img-popover-title {\n    font-weight: 600;\n    font-size: 12px;\n    text-transform: uppercase;\n    letter-spacing: 0.04em;\n    color: #999;\n  }\n\n  .emdash-img-popover-close {\n    background: none;\n    border: none;\n    color: #666;\n    cursor: pointer;\n    padding: 2px;\n    line-height: 1;\n    font-size: 16px;\n    border-radius: 4px;\n    transition: color 0.15s;\n  }\n\n  .emdash-img-popover-close:hover {\n    color: #fff;\n  }\n\n  .emdash-img-popover-body {\n    padding: 12px;\n    display: flex;\n    flex-direction: column;\n    gap: 10px;\n  }\n\n  .emdash-img-preview {\n    width: 100%;\n    max-height: 160px;\n    object-fit: contain;\n    border-radius: 6px;\n    background: #111;\n  }\n\n  .emdash-img-empty {\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    height: 80px;\n    border: 2px dashed rgba(255,255,255,0.15);\n    border-radius: 6px;\n    color: #666;\n    font-size: 12px;\n  }\n\n  .emdash-img-field {\n    display: flex;\n    flex-direction: column;\n    gap: 4px;\n  }\n\n  .emdash-img-field label {\n    font-size: 11px;\n    font-weight: 600;\n    color: #888;\n    text-transform: uppercase;\n    letter-spacing: 0.04em;\n  }\n\n  .emdash-img-field input[type=\"text\"] {\n    background: #111;\n    border: 1px solid rgba(255,255,255,0.12);\n    border-radius: 6px;\n    color: #e0e0e0;\n    padding: 6px 8px;\n    font-size: 13px;\n    font-family: inherit;\n    outline: none;\n    transition: border-color 0.15s;\n  }\n\n  .emdash-img-field input[type=\"text\"]:focus {\n    border-color: #3b82f6;\n  }\n\n  .emdash-img-actions {\n    display: flex;\n    gap: 6px;\n  }\n\n  .emdash-img-btn {\n    flex: 1;\n    padding: 6px 10px;\n    border: 1px solid rgba(255,255,255,0.12);\n    border-radius: 6px;\n    background: #222;\n    color: #e0e0e0;\n    font-size: 12px;\n    font-family: inherit;\n    cursor: pointer;\n    transition: background 0.15s, border-color 0.15s;\n    text-align: center;\n    white-space: nowrap;\n  }\n\n  .emdash-img-btn:hover {\n    background: #333;\n    border-color: rgba(255,255,255,0.2);\n  }\n\n  .emdash-img-btn--primary {\n    background: #3b82f6;\n    border-color: #3b82f6;\n    color: #fff;\n  }\n\n  .emdash-img-btn--primary:hover {\n    background: #2563eb;\n    border-color: #2563eb;\n  }\n\n  .emdash-img-btn--danger {\n    color: #f87171;\n    border-color: rgba(248,113,113,0.3);\n  }\n\n  .emdash-img-btn--danger:hover {\n    background: rgba(248,113,113,0.1);\n    border-color: rgba(248,113,113,0.5);\n  }\n\n  /* Media browser within the popover */\n  .emdash-img-browser {\n    border-top: 1px solid rgba(255,255,255,0.08);\n    padding: 12px;\n  }\n\n  .emdash-img-browser-header {\n    display: flex;\n    align-items: center;\n    justify-content: space-between;\n    margin-bottom: 8px;\n  }\n\n  .emdash-img-browser-title {\n    font-size: 12px;\n    font-weight: 600;\n    color: #999;\n  }\n\n  .emdash-img-browser-back {\n    background: none;\n    border: none;\n    color: #3b82f6;\n    cursor: pointer;\n    font-size: 12px;\n    font-family: inherit;\n    padding: 2px 4px;\n  }\n\n  .emdash-img-browser-back:hover {\n    text-decoration: underline;\n  }\n\n  .emdash-img-grid {\n    display: grid;\n    grid-template-columns: repeat(3, 1fr);\n    gap: 6px;\n    max-height: 240px;\n    overflow-y: auto;\n  }\n\n  .emdash-img-grid-item {\n    aspect-ratio: 1;\n    border-radius: 4px;\n    overflow: hidden;\n    cursor: pointer;\n    border: 2px solid transparent;\n    transition: border-color 0.15s;\n    background: #111;\n  }\n\n  .emdash-img-grid-item:hover {\n    border-color: rgba(59,130,246,0.5);\n  }\n\n  .emdash-img-grid-item--selected {\n    border-color: #3b82f6;\n  }\n\n  .emdash-img-grid-item img {\n    width: 100%;\n    height: 100%;\n    object-fit: cover;\n  }\n\n  .emdash-img-loading {\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    height: 80px;\n    color: #666;\n    font-size: 12px;\n  }\n\n  .emdash-img-drop {\n    border: 2px dashed #3b82f6;\n    background: rgba(59,130,246,0.05);\n  }\n\n  .emdash-img-uploading {\n    display: flex;\n    align-items: center;\n    gap: 8px;\n    padding: 8px 0;\n    color: #999;\n    font-size: 12px;\n  }\n\n  .emdash-img-popover-backdrop {\n    position: fixed;\n    inset: 0;\n    z-index: 999999;\n  }\n</style>\n\n<script>\n(function() {\n  var toolbar = document.getElementById(\"emdash-toolbar\");\n  var toggle = document.getElementById(\"emdash-edit-toggle\");\n  var statusEl = document.getElementById(\"emdash-tb-status\");\n  var saveStatusEl = document.getElementById(\"emdash-tb-save-status\");\n  var publishBtn = document.getElementById(\"emdash-tb-publish\");\n  if (!toolbar || !toggle || !statusEl || !publishBtn || !saveStatusEl) return;\n\n  var isEditMode = toolbar.getAttribute(\"data-edit-mode\") === \"true\";\n\n  // CSRF-protected fetch — adds X-EmDash-Request header to all API calls\n  function ecFetch(url, init) {\n    init = init || {};\n    init.headers = Object.assign({ \"X-EmDash-Request\": \"1\" }, init.headers || {});\n    return fetch(url, init);\n  }\n\n  // --- Save status tracking ---\n  var saveState = \"idle\"; // idle | unsaved | saving | saved | error\n  var saveHideTimer = null;\n  var pendingSavePromise = null;\n\n  function setSaveState(state) {\n    saveState = state;\n    clearTimeout(saveHideTimer);\n\n    switch (state) {\n      case \"unsaved\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--unsaved\">Unsaved</span>';\n        break;\n      case \"saving\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--saving\">Saving\\u2026</span>';\n        break;\n      case \"saved\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--saved\">Saved</span>';\n        saveHideTimer = setTimeout(function() {\n          saveStatusEl.innerHTML = \"\";\n          saveState = \"idle\";\n        }, 2000);\n        break;\n      case \"error\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--error\">Save failed</span>';\n        saveHideTimer = setTimeout(function() {\n          saveStatusEl.innerHTML = \"\";\n          saveState = \"idle\";\n        }, 3000);\n        break;\n      default:\n        saveStatusEl.innerHTML = \"\";\n    }\n  }\n\n  // Listen for save events from inline editors (e.g. PT editor)\n  document.addEventListener(\"emdash:save\", function(e) {\n    var detail = e.detail || {};\n    if (detail.state) {\n      setSaveState(detail.state);\n    }\n  });\n\n  document.addEventListener(\"emdash:content-changed\", function(e) {\n    var detail = e.detail || {};\n    if (detail.collection && detail.id) {\n      showUnpublishedChanges(detail.collection, detail.id);\n    }\n  });\n\n  // --- Entry status ---\n  var entryRef = null;\n\n  function updateStatus() {\n    if (!isEditMode) {\n      statusEl.innerHTML = \"\";\n      publishBtn.style.display = \"none\";\n      return;\n    }\n\n    var first = document.querySelector(\"[data-emdash-ref]\");\n    if (!first) {\n      statusEl.innerHTML = \"\";\n      publishBtn.style.display = \"none\";\n      return;\n    }\n\n    try {\n      var ref = JSON.parse(first.getAttribute(\"data-emdash-ref\"));\n      entryRef = ref;\n      if (!ref.status) return;\n\n      // Show admin link\n      var adminLink = document.getElementById(\"emdash-tb-admin\");\n      if (adminLink) {\n        adminLink.href = \"/_emdash/admin/content/\" + encodeURIComponent(ref.collection) + \"/\" + encodeURIComponent(ref.id);\n        adminLink.style.display = \"\";\n      }\n\n      if (ref.status === \"draft\") {\n        statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--draft\">Draft</span>';\n        publishBtn.style.display = \"\";\n        publishBtn.onclick = function() { publish(ref.collection, ref.id); };\n      } else if (ref.status === \"published\" && ref.hasDraft) {\n        statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--pending\">Unpublished changes</span>';\n        publishBtn.style.display = \"\";\n        publishBtn.onclick = function() { publish(ref.collection, ref.id); };\n      } else if (ref.status === \"published\") {\n        statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--published\">Published</span>';\n        publishBtn.style.display = \"none\";\n      }\n    } catch (e) {\n      // ignore parse errors\n    }\n  }\n\n  // Publish action\n  function publish(collection, id) {\n    if (pendingSavePromise) {\n      pendingSavePromise.then(function() { publish(collection, id); });\n      return;\n    }\n\n    publishBtn.disabled = true;\n    publishBtn.textContent = \"Publishing\\u2026\";\n\n    ecFetch(\"/_emdash/api/content/\" + encodeURIComponent(collection) + \"/\" + encodeURIComponent(id) + \"/publish\", {\n      method: \"POST\",\n      credentials: \"same-origin\",\n    })\n    .then(function(res) {\n      if (res.ok) {\n        if (document.startViewTransition) {\n          document.startViewTransition(function() { location.reload(); });\n        } else {\n          location.reload();\n        }\n      } else {\n        publishBtn.disabled = false;\n        publishBtn.textContent = \"Publish\";\n        console.error(\"Publish failed:\", res.status);\n      }\n    })\n    .catch(function(err) {\n      publishBtn.disabled = false;\n      publishBtn.textContent = \"Publish\";\n      console.error(\"Publish failed:\", err);\n    });\n  }\n\n  // Edit mode toggle\n  toggle.addEventListener(\"change\", function() {\n    if (toggle.checked) {\n      document.cookie = \"emdash-edit-mode=true;path=/;samesite=lax\";\n    } else {\n      document.cookie = \"emdash-edit-mode=;path=/;expires=Thu, 01 Jan 1970 00:00:00 GMT\";\n    }\n\n    if (document.startViewTransition) {\n      document.startViewTransition(function() { location.replace(location.href); });\n    } else {\n      location.replace(location.href);\n    }\n  });\n\n  // --- Inline editing ---\n\n  // Cached manifest (fetched once on first edit click)\n  var manifestCache = null;\n  var manifestPromise = null;\n\n  function fetchManifest() {\n    if (manifestCache) return Promise.resolve(manifestCache);\n    if (manifestPromise) return manifestPromise;\n    manifestPromise = ecFetch(\"/_emdash/api/manifest\", { credentials: \"same-origin\" })\n      .then(function(r) { return r.json(); })\n      .then(function(m) {\n        // The manifest endpoint wraps the payload in a { data } envelope (ApiResponse shape).\n        // Unwrap it so getFieldKind can read manifest.collections directly.\n        manifestCache = m && m.data ? m.data : m;\n        return manifestCache;\n      });\n    return manifestPromise;\n  }\n\n  function getFieldKind(manifest, collection, field) {\n    var col = manifest.collections && manifest.collections[collection];\n    if (!col || !col.fields) return null;\n    var f = col.fields[field];\n    return f ? f.kind : null;\n  }\n\n  // Load manifest early so the first click can resolve field kinds without racing the event.\n  if (isEditMode) {\n    fetchManifest();\n  }\n\n  // Save a single field value\n  function saveField(collection, id, field, value) {\n    setSaveState(\"saving\");\n    return ecFetch(\"/_emdash/api/content/\" + encodeURIComponent(collection) + \"/\" + encodeURIComponent(id), {\n      method: \"PUT\",\n      credentials: \"same-origin\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ data: { [field]: value } }),\n    })\n    .then(function(res) {\n      if (res.ok) {\n        setSaveState(\"saved\");\n        // A save creates/updates a draft — show unpublished changes\n        showUnpublishedChanges(collection, id);\n      } else {\n        setSaveState(\"error\");\n        console.error(\"Save failed:\", res.status);\n      }\n    })\n    .catch(function(err) {\n      setSaveState(\"error\");\n      console.error(\"Save failed:\", err);\n    });\n  }\n\n  function showUnpublishedChanges(collection, id) {\n    statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--pending\">Unpublished changes</span>';\n    publishBtn.style.display = \"\";\n    publishBtn.disabled = false;\n    publishBtn.textContent = \"Publish\";\n    publishBtn.onclick = function() { publish(collection, id); };\n  }\n\n  // Plain text inline editing (contenteditable)\n  var currentlyEditing = null;\n\n  function startTextEdit(element, annotation) {\n    if (currentlyEditing === element) return;\n    if (currentlyEditing) endCurrentEdit();\n\n    currentlyEditing = element;\n    var originalText = element.textContent || \"\";\n\n    element.setAttribute(\"data-emdash-editing\", \"\");\n    element.contentEditable = \"plaintext-only\";\n    element.focus();\n\n    // Select all text\n    var range = document.createRange();\n    range.selectNodeContents(element);\n    var sel = window.getSelection();\n    sel.removeAllRanges();\n    sel.addRange(range);\n\n    // Track dirty state via input events\n    function handleInput() {\n      var current = (element.textContent || \"\").trim();\n      if (current !== originalText.trim()) {\n        setSaveState(\"unsaved\");\n      } else {\n        setSaveState(\"idle\");\n      }\n    }\n\n    function handleBlur() {\n      element.removeEventListener(\"blur\", handleBlur);\n      element.removeEventListener(\"keydown\", handleKeydown);\n      element.removeEventListener(\"input\", handleInput);\n      element.contentEditable = \"false\";\n      element.removeAttribute(\"data-emdash-editing\");\n      currentlyEditing = null;\n\n      var newValue = (element.textContent || \"\").trim();\n      if (newValue !== originalText.trim()) {\n        pendingSavePromise = saveField(annotation.collection, annotation.id, annotation.field, newValue).then(function() {\n          pendingSavePromise = null;\n        }, function() {\n          pendingSavePromise = null;\n        });\n      } else {\n        setSaveState(\"idle\");\n      }\n    }\n\n    function handleKeydown(e) {\n      if (e.key === \"Enter\" && !e.shiftKey) {\n        e.preventDefault();\n        element.blur();\n      }\n      if (e.key === \"Escape\") {\n        element.textContent = originalText;\n        setSaveState(\"idle\");\n        element.blur();\n      }\n    }\n\n    element.addEventListener(\"input\", handleInput);\n    element.addEventListener(\"blur\", handleBlur);\n    element.addEventListener(\"keydown\", handleKeydown);\n  }\n\n  function endCurrentEdit() {\n    if (currentlyEditing) {\n      currentlyEditing.blur();\n    }\n  }\n\n  // Fallback: open admin\n  function openAdmin(annotation) {\n    var url = \"/_emdash/admin/content/\" + encodeURIComponent(annotation.collection) + \"/\" + encodeURIComponent(annotation.id);\n    if (annotation.field) {\n      url += \"?field=\" + encodeURIComponent(annotation.field);\n    }\n    window.open(url, \"emdash-admin\");\n  }\n\n  // --- Inline image editing ---\n  var activeImagePopover = null;\n\n  function closeImagePopover() {\n    if (activeImagePopover) {\n      activeImagePopover.backdrop.remove();\n      activeImagePopover.popover.remove();\n      if (activeImagePopover.escapeHandler) {\n        document.removeEventListener(\"keydown\", activeImagePopover.escapeHandler);\n      }\n      activeImagePopover = null;\n    }\n  }\n\n  function startImageEdit(element, annotation) {\n    closeImagePopover();\n\n    // Find the current image value by fetching the entry\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    // Find img element inside the annotated container (or the element itself if it's an img)\n    var imgEl = element.tagName === \"IMG\" ? element : element.querySelector(\"img\");\n\n    // Fetch current field value from the content API\n    ecFetch(\"/_emdash/api/content/\" + encodeURIComponent(collection) + \"/\" + encodeURIComponent(id), {\n      credentials: \"same-origin\"\n    })\n    .then(function(r) { return r.json(); })\n    .then(function(entry) {\n      var currentValue = entry.data && entry.data[field];\n      showImagePopover(element, imgEl, annotation, currentValue);\n    })\n    .catch(function() {\n      // If fetch fails, still show popover with what we can infer from DOM\n      showImagePopover(element, imgEl, annotation, null);\n    });\n  }\n\n  function showImagePopover(element, imgEl, annotation, currentValue) {\n    closeImagePopover();\n\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    // Position near the element\n    var rect = element.getBoundingClientRect();\n    var viewportH = window.innerHeight;\n    var viewportW = window.innerWidth;\n\n    // Create backdrop for click-outside-to-close\n    var backdrop = document.createElement(\"div\");\n    backdrop.className = \"emdash-img-popover-backdrop\";\n    backdrop.addEventListener(\"click\", function(e) {\n      if (e.target === backdrop) closeImagePopover();\n    });\n\n    // Create popover\n    var popover = document.createElement(\"div\");\n    popover.className = \"emdash-img-popover\";\n\n    var currentSrc = currentValue ? (currentValue.previewUrl || currentValue.src) : (imgEl ? imgEl.src : null);\n    var currentAlt = currentValue ? (currentValue.alt || \"\") : (imgEl ? (imgEl.alt || \"\") : \"\");\n\n    // Build popover HTML\n    var html = '';\n    html += '<div class=\"emdash-img-popover-header\">';\n    html += '  <span class=\"emdash-img-popover-title\">Image</span>';\n    html += '  <button class=\"emdash-img-popover-close\" data-action=\"close\">&times;</button>';\n    html += '</div>';\n    html += '<div class=\"emdash-img-popover-body\" id=\"emdash-img-main\">';\n\n    if (currentSrc) {\n      html += '<img class=\"emdash-img-preview\" src=\"' + escapeAttr(currentSrc) + '\" alt=\"\" />';\n    } else {\n      html += '<div class=\"emdash-img-empty\">No image selected</div>';\n    }\n\n    html += '<div class=\"emdash-img-field\">';\n    html += '  <label for=\"emdash-img-alt\">Alt text</label>';\n    html += '  <input type=\"text\" id=\"emdash-img-alt\" value=\"' + escapeAttr(currentAlt) + '\" placeholder=\"Describe the image\" />';\n    html += '</div>';\n\n    html += '<div class=\"emdash-img-actions\">';\n    html += '  <button class=\"emdash-img-btn emdash-img-btn--primary\" data-action=\"browse\">Replace</button>';\n    html += '  <label class=\"emdash-img-btn\" style=\"cursor:pointer\">';\n    html += '    Upload';\n    html += '    <input type=\"file\" accept=\"image/*\" id=\"emdash-img-upload\" style=\"display:none\" />';\n    html += '  </label>';\n    if (currentSrc) {\n      html += '  <button class=\"emdash-img-btn emdash-img-btn--danger\" data-action=\"remove\">Remove</button>';\n    }\n    html += '</div>';\n    html += '</div>';\n\n    popover.innerHTML = html;\n\n    backdrop.appendChild(popover);\n    document.body.appendChild(backdrop);\n\n    // Position the popover\n    positionPopover(popover, rect, viewportW, viewportH);\n\n    // Escape key handler\n    function handleEscape(e) {\n      if (e.key === \"Escape\") {\n        closeImagePopover();\n        document.removeEventListener(\"keydown\", handleEscape);\n      }\n    }\n    document.addEventListener(\"keydown\", handleEscape);\n\n    activeImagePopover = {\n      backdrop: backdrop,\n      popover: popover,\n      annotation: annotation,\n      currentValue: currentValue,\n      element: element,\n      imgEl: imgEl,\n      escapeHandler: handleEscape\n    };\n\n    // Event handlers\n    popover.querySelector('[data-action=\"close\"]').addEventListener(\"click\", closeImagePopover);\n\n    popover.querySelector('[data-action=\"browse\"]').addEventListener(\"click\", function() {\n      showMediaBrowser(popover, annotation, currentValue, element, imgEl);\n    });\n\n    var uploadInput = popover.querySelector(\"#emdash-img-upload\");\n    uploadInput.addEventListener(\"change\", function(e) {\n      var file = e.target.files && e.target.files[0];\n      if (file) handleImageUpload(file, popover, annotation, element, imgEl);\n    });\n\n    var removeBtn = popover.querySelector('[data-action=\"remove\"]');\n    if (removeBtn) {\n      removeBtn.addEventListener(\"click\", function() {\n        saveField(collection, id, field, null).then(function() {\n          if (imgEl) {\n            imgEl.style.display = \"none\";\n          }\n          closeImagePopover();\n        });\n      });\n    }\n\n    // Save alt text on change (debounced)\n    var altInput = popover.querySelector(\"#emdash-img-alt\");\n    var altTimer = null;\n    altInput.addEventListener(\"input\", function() {\n      clearTimeout(altTimer);\n      altTimer = setTimeout(function() {\n        var newAlt = altInput.value;\n        if (currentValue) {\n          var updated = Object.assign({}, currentValue, { alt: newAlt });\n          saveField(collection, id, field, updated);\n          if (imgEl) imgEl.alt = newAlt;\n        }\n      }, 500);\n    });\n\n    // Handle drag and drop on the popover body\n    var body = popover.querySelector(\".emdash-img-popover-body\");\n    body.addEventListener(\"dragover\", function(e) {\n      e.preventDefault();\n      body.classList.add(\"emdash-img-drop\");\n    });\n    body.addEventListener(\"dragleave\", function() {\n      body.classList.remove(\"emdash-img-drop\");\n    });\n    body.addEventListener(\"drop\", function(e) {\n      e.preventDefault();\n      body.classList.remove(\"emdash-img-drop\");\n      var file = e.dataTransfer && e.dataTransfer.files && e.dataTransfer.files[0];\n      if (file && file.type.startsWith(\"image/\")) {\n        handleImageUpload(file, popover, annotation, element, imgEl);\n      }\n    });\n  }\n\n  function positionPopover(popover, targetRect, viewportW, viewportH) {\n    var popoverW = 320;\n    var gap = 8;\n\n    // Try to place to the right of the element\n    var left = targetRect.right + gap;\n    var top = targetRect.top;\n\n    // If it overflows right, place to the left\n    if (left + popoverW > viewportW - 16) {\n      left = targetRect.left - popoverW - gap;\n    }\n    // If it still overflows (narrow viewport), center below\n    if (left < 16) {\n      left = Math.max(16, (viewportW - popoverW) / 2);\n      top = targetRect.bottom + gap;\n    }\n    // Clamp vertically\n    if (top + 400 > viewportH - 80) { // 80 for toolbar\n      top = Math.max(16, viewportH - 480);\n    }\n    if (top < 16) top = 16;\n\n    popover.style.left = left + \"px\";\n    popover.style.top = top + \"px\";\n  }\n\n  function escapeAttr(str) {\n    return String(str || \"\").replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\");\n  }\n\n  function showMediaBrowser(popover, annotation, currentValue, element, imgEl) {\n    var mainBody = popover.querySelector(\"#emdash-img-main\");\n    if (mainBody) mainBody.style.display = \"none\";\n\n    // Remove existing browser if any\n    var existing = popover.querySelector(\".emdash-img-browser\");\n    if (existing) existing.remove();\n\n    var browser = document.createElement(\"div\");\n    browser.className = \"emdash-img-browser\";\n\n    browser.innerHTML = '<div class=\"emdash-img-browser-header\">' +\n      '<span class=\"emdash-img-browser-title\">Media Library</span>' +\n      '<button class=\"emdash-img-browser-back\">Back</button>' +\n      '</div>' +\n      '<div class=\"emdash-img-loading\">Loading\\u2026</div>';\n\n    popover.appendChild(browser);\n\n    browser.querySelector(\".emdash-img-browser-back\").addEventListener(\"click\", function() {\n      browser.remove();\n      if (mainBody) mainBody.style.display = \"\";\n    });\n\n    // Fetch media\n    ecFetch(\"/_emdash/api/media?mimeType=image/&limit=30\", { credentials: \"same-origin\" })\n    .then(function(r) { return r.json(); })\n    .then(function(data) {\n      var items = data.items || [];\n      var loadingEl = browser.querySelector(\".emdash-img-loading\");\n      if (loadingEl) loadingEl.remove();\n\n      if (items.length === 0) {\n        var empty = document.createElement(\"div\");\n        empty.className = \"emdash-img-loading\";\n        empty.textContent = \"No images found\";\n        browser.appendChild(empty);\n        return;\n      }\n\n      var grid = document.createElement(\"div\");\n      grid.className = \"emdash-img-grid\";\n\n      items.forEach(function(item) {\n        var thumb = document.createElement(\"div\");\n        thumb.className = \"emdash-img-grid-item\";\n        if (currentValue && currentValue.id === item.id) {\n          thumb.classList.add(\"emdash-img-grid-item--selected\");\n        }\n        var thumbUrl = item.url || item.previewUrl || (\"/_emdash/api/media/file/\" + item.storageKey);\n        thumb.innerHTML = '<img src=\"' + escapeAttr(thumbUrl) + '\" alt=\"' + escapeAttr(item.alt || item.filename || \"\") + '\" loading=\"lazy\" />';\n\n        thumb.addEventListener(\"click\", function() {\n          selectMediaItem(item, annotation, element, imgEl);\n        });\n\n        grid.appendChild(thumb);\n      });\n\n      browser.appendChild(grid);\n    })\n    .catch(function(err) {\n      var loadingEl = browser.querySelector(\".emdash-img-loading\");\n      if (loadingEl) loadingEl.textContent = \"Failed to load media\";\n      console.error(\"Media fetch error:\", err);\n    });\n  }\n\n  function selectMediaItem(item, annotation, element, imgEl) {\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    var isLocal = !item.provider || item.provider === \"local\";\n    var itemUrl = item.url || item.previewUrl || (\"/_emdash/api/media/file/\" + item.storageKey);\n\n    var newValue = {\n      id: item.id,\n      provider: item.provider || \"local\",\n      src: isLocal ? itemUrl : undefined,\n      previewUrl: isLocal ? undefined : itemUrl,\n      alt: item.alt || \"\",\n      width: item.width,\n      height: item.height,\n      meta: item.meta\n    };\n\n    // Clean undefined fields\n    Object.keys(newValue).forEach(function(k) {\n      if (newValue[k] === undefined) delete newValue[k];\n    });\n\n    saveField(collection, id, field, newValue).then(function() {\n      // Update the image in the DOM\n      if (imgEl) {\n        imgEl.src = itemUrl;\n        imgEl.alt = item.alt || \"\";\n        imgEl.style.display = \"\";\n      }\n      closeImagePopover();\n    });\n  }\n\n  function handleImageUpload(file, popover, annotation, element, imgEl) {\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    // Show uploading state\n    var mainBody = popover.querySelector(\"#emdash-img-main\");\n    var browserEl = popover.querySelector(\".emdash-img-browser\");\n    if (browserEl) browserEl.remove();\n    if (mainBody) {\n      mainBody.innerHTML = '<div class=\"emdash-img-uploading\">' +\n        '<span>Uploading ' + escapeAttr(file.name) + '\\u2026</span>' +\n        '</div>';\n      mainBody.style.display = \"\";\n    }\n\n    // Detect dimensions before upload\n    var dimPromise = new Promise(function(resolve) {\n      if (!file.type.startsWith(\"image/\")) return resolve({});\n      var img = new Image();\n      img.onload = function() {\n        resolve({ width: img.naturalWidth, height: img.naturalHeight });\n        URL.revokeObjectURL(img.src);\n      };\n      img.onerror = function() {\n        resolve({});\n        URL.revokeObjectURL(img.src);\n      };\n      img.src = URL.createObjectURL(file);\n    });\n\n    dimPromise.then(function(dims) {\n      // Generate a thumbnail for large images to avoid OOM in server-side\n      // blurhash generation on memory-constrained runtimes (Workers).\n      // Thumbnail fits within a 64x64 box (scale by max dimension) so that\n      // extreme aspect ratios don't explode into a huge canvas client-side.\n      var thumbPromise;\n      if (dims.width && dims.height && dims.width * dims.height * 4 > 32 * 1024 * 1024) {\n        thumbPromise = new Promise(function(resolve) {\n          try {\n            var maxDim = Math.max(dims.width, dims.height);\n            var scale = Math.min(1, 64 / maxDim);\n            var thumbW = Math.max(1, Math.round(dims.width * scale));\n            var thumbH = Math.max(1, Math.round(dims.height * scale));\n            var canvas = document.createElement(\"canvas\");\n            canvas.width = thumbW;\n            canvas.height = thumbH;\n            var ctx = canvas.getContext(\"2d\");\n            if (ctx) {\n              var img = new Image();\n              img.onload = function() {\n                try {\n                  ctx.drawImage(img, 0, 0, thumbW, thumbH);\n                  canvas.toBlob(function(blob) {\n                    URL.revokeObjectURL(img.src);\n                    resolve(blob);\n                  }, \"image/png\");\n                } catch (e) {\n                  URL.revokeObjectURL(img.src);\n                  resolve(null);\n                }\n              };\n              img.onerror = function() {\n                URL.revokeObjectURL(img.src);\n                resolve(null);\n              };\n              img.src = URL.createObjectURL(file);\n            } else {\n              resolve(null);\n            }\n          } catch (e) {\n            resolve(null);\n          }\n        });\n      } else {\n        thumbPromise = Promise.resolve(null);\n      }\n\n      return thumbPromise.then(function(thumbnail) {\n        var formData = new FormData();\n        formData.append(\"file\", file);\n        if (dims.width) formData.append(\"width\", String(dims.width));\n        if (dims.height) formData.append(\"height\", String(dims.height));\n        if (thumbnail) formData.append(\"thumbnail\", thumbnail, \"thumb.png\");\n\n        return ecFetch(\"/_emdash/api/media\", {\n          method: \"POST\",\n          credentials: \"same-origin\",\n          body: formData\n        });\n      });\n    })\n    .then(function(r) { return r.json(); })\n    .then(function(data) {\n      if (!data.item) throw new Error(\"Upload failed\");\n      var item = data.item;\n      selectMediaItem(item, annotation, element, imgEl);\n    })\n    .catch(function(err) {\n      console.error(\"Upload error:\", err);\n      setSaveState(\"error\");\n      closeImagePopover();\n    });\n  }\n\n  // Click handler for edit mode\n  if (isEditMode) {\n    document.addEventListener(\"click\", function(e) {\n      var target = e.target;\n\n      // Don't intercept clicks on elements currently being edited\n      if (target.hasAttribute && target.hasAttribute(\"data-emdash-editing\")) return;\n\n      // Walk up to find annotated element\n      while (target && target !== document.body) {\n        if (target.hasAttribute && target.hasAttribute(\"data-emdash-editing\")) return;\n\n        var ref = target.getAttribute && target.getAttribute(\"data-emdash-ref\");\n        if (ref) {\n          try {\n            var annotation = JSON.parse(ref);\n\n            // Entry-level annotation (no field) — keep walking for a field-level ancestor\n            if (!annotation.field) {\n              target = target.parentElement;\n              continue;\n            }\n\n            function dispatchInline(kind) {\n              closeImagePopover();\n              // Portable Text is edited in-page by InlinePortableTextEditor — do not open admin\n              if (kind === \"portableText\") {\n                return;\n              }\n              e.preventDefault();\n              e.stopPropagation();\n              if (kind === \"string\" || kind === \"text\") {\n                startTextEdit(target, annotation);\n              } else if (kind === \"image\") {\n                startImageEdit(target, annotation);\n              } else {\n                openAdmin(annotation);\n              }\n            }\n\n            if (manifestCache) {\n              dispatchInline(getFieldKind(manifestCache, annotation.collection, annotation.field));\n            } else {\n              fetchManifest().then(function(manifest) {\n                dispatchInline(getFieldKind(manifest, annotation.collection, annotation.field));\n              });\n            }\n          } catch (err) {\n            console.error(\"Failed to parse emdash ref:\", err);\n          }\n          return;\n        }\n        target = target.parentElement;\n      }\n    }, true);\n  }\n\n  updateStatus();\n})();\n</script>\n`;\n}\n","/**\n * EmDash Request Context Middleware\n *\n * Sets up AsyncLocalStorage-based request context for query functions.\n * Skips ALS entirely for logged-out users with no CMS signals (fast path).\n *\n * Handles:\n * - Preview tokens: _preview query param with signed HMAC token\n * - Edit mode: emdash-edit-mode cookie (for visual editing)\n * - Toolbar injection: floating pill for authenticated editors\n */\n\nimport { defineMiddleware } from \"astro:middleware\";\n\nimport { resolveSecretsCached } from \"#config/secrets.js\";\n\nimport { verifyPreviewToken, parseContentId } from \"../../preview/tokens.js\";\nimport { getRequestContext, runWithContext } from \"../../request-context.js\";\nimport { renderToolbar } from \"../../visual-editing/toolbar.js\";\n\n/**\n * Inject toolbar HTML into a response if it's an HTML page.\n * Returns the original response if not HTML.\n */\nasync function injectToolbar(response: Response, toolbarHtml: string): Promise<Response> {\n\tconst contentType = response.headers.get(\"content-type\");\n\tif (!contentType?.includes(\"text/html\")) return response;\n\n\tconst html = await response.text();\n\tif (!html.includes(\"</body>\")) return new Response(html, response);\n\n\tconst injected = html.replace(\"</body>\", `${toolbarHtml}</body>`);\n\treturn new Response(injected, {\n\t\tstatus: response.status,\n\t\theaders: response.headers,\n\t});\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { cookies, url } = context;\n\n\t// Skip /_emdash routes (admin has its own UI, no rendering context needed)\n\tif (url.pathname.startsWith(\"/_emdash\")) {\n\t\treturn next();\n\t}\n\n\t// Check for authenticated editor (role >= 30)\n\tconst { user } = context.locals;\n\tconst isEditor = !!user && user.role >= 30;\n\n\t// Playground mode: the playground middleware (from @emdash-cms/cloudflare) stashes\n\t// the per-session DO database on locals.__playgroundDb. We set it via ALS here\n\t// (same module instance as the loader) so getDb() picks it up correctly.\n\t//\n\t// `dbIsIsolated: true` tells schema-derived caches (manifest, taxonomy defs,\n\t// byline/term existence probes) to bypass module-scope memoization — each\n\t// playground session is its own database with its own schema, so a cached\n\t// value from another session would be wrong.\n\tconst playgroundDb = context.locals.__playgroundDb;\n\tif (playgroundDb) {\n\t\t// Check if playground user has toggled edit mode on\n\t\tconst hasEditCookie = cookies.get(\"emdash-edit-mode\")?.value === \"true\";\n\t\treturn runWithContext({ editMode: hasEditCookie, db: playgroundDb, dbIsIsolated: true }, () =>\n\t\t\tnext(),\n\t\t);\n\t}\n\n\t// Fast path: check for CMS signals before doing any work\n\tconst hasEditCookie = cookies.get(\"emdash-edit-mode\")?.value === \"true\";\n\tconst hasPreviewToken = url.searchParams.has(\"_preview\");\n\n\t// No CMS signals and not an editor → skip everything (zero overhead)\n\tif (!hasEditCookie && !hasPreviewToken && !isEditor) {\n\t\treturn next();\n\t}\n\n\t// Determine edit mode: cookie AND authenticated editor\n\tconst editMode = hasEditCookie && isEditor;\n\n\t// Read locale from Astro's i18n routing\n\t// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Astro context includes currentLocale when i18n is configured\n\tconst locale = (context as { currentLocale?: string }).currentLocale;\n\n\t// Verify preview token if present.\n\t// The preview secret is resolved via `resolveSecretsCached`: env wins,\n\t// otherwise a DB-stored value is read (or generated on first need).\n\t// `emdash.db` is set by the runtime middleware which runs first; the\n\t// only path where it's missing is a runtime-init failure.\n\tlet preview: { collection: string; id: string } | undefined;\n\tif (hasPreviewToken) {\n\t\tconst db = context.locals.emdash?.db;\n\t\tif (db) {\n\t\t\tconst { previewSecret } = await resolveSecretsCached(db);\n\t\t\tconst result = await verifyPreviewToken({ url, secret: previewSecret });\n\t\t\tif (result.valid) {\n\t\t\t\tconst { collection, id } = parseContentId(result.payload.cid);\n\t\t\t\tpreview = { collection, id };\n\t\t\t}\n\t\t} else {\n\t\t\tconsole.warn(\n\t\t\t\t\"[emdash] Preview token present but EmDash runtime not initialized; preview disabled.\",\n\t\t\t);\n\t\t}\n\t}\n\n\t// If we have CMS signals, wrap in ALS context\n\tconst needsContext = hasEditCookie || hasPreviewToken;\n\n\tif (needsContext) {\n\t\t// Merge with any outer ALS context (e.g. the per-request D1 session db\n\t\t// set by the runtime middleware). `storage.run()` replaces the store\n\t\t// wholesale, so without the spread the outer `db` would be lost and\n\t\t// loaders would fall back to the singleton non-session dialect.\n\t\tconst parent = getRequestContext();\n\t\treturn runWithContext({ ...parent, editMode, preview, locale }, async () => {\n\t\t\tlet response = await next();\n\n\t\t\t// Preview responses must not be cached -- draft content could leak past token expiry.\n\t\t\t// Clone the response before modifying headers — the original may be immutable.\n\t\t\tif (preview) {\n\t\t\t\tresponse = new Response(response.body, response);\n\t\t\t\tresponse.headers.set(\"Cache-Control\", \"private, no-store\");\n\t\t\t}\n\n\t\t\t// Inject toolbar for authenticated editors\n\t\t\tif (isEditor) {\n\t\t\t\tconst toolbarHtml = renderToolbar({\n\t\t\t\t\teditMode,\n\t\t\t\t\tisPreview: !!preview,\n\t\t\t\t});\n\t\t\t\treturn injectToolbar(response, toolbarHtml);\n\t\t\t}\n\n\t\t\treturn response;\n\t\t});\n\t}\n\n\t// Editor without CMS signals — no ALS needed, but inject toolbar\n\tif (isEditor) {\n\t\tconst response = await next();\n\t\tconst toolbarHtml = renderToolbar({\n\t\t\teditMode: false,\n\t\t\tisPreview: false,\n\t\t});\n\t\treturn injectToolbar(response, toolbarHtml);\n\t}\n\n\treturn next();\n});\n\nexport default onRequest;\n"],"mappings":";;;;;;;;AAaA,SAAgB,cAAc,QAA+B;CAC5D,MAAM,EAAE,UAAU,cAAc;AAEhC,QAAO;;2CAEmC,SAAS,kBAAkB,UAAU;;;;;;;uDAOzB,WAAW,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACDjF,eAAe,cAAc,UAAoB,aAAwC;AAExF,KAAI,CADgB,SAAS,QAAQ,IAAI,eAAe,EACtC,SAAS,YAAY,CAAE,QAAO;CAEhD,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,KAAI,CAAC,KAAK,SAAS,UAAU,CAAE,QAAO,IAAI,SAAS,MAAM,SAAS;CAElE,MAAM,WAAW,KAAK,QAAQ,WAAW,GAAG,YAAY,SAAS;AACjE,QAAO,IAAI,SAAS,UAAU;EAC7B,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB,CAAC;;AAGH,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,SAAS,QAAQ;AAGzB,KAAI,IAAI,SAAS,WAAW,WAAW,CACtC,QAAO,MAAM;CAId,MAAM,EAAE,SAAS,QAAQ;CACzB,MAAM,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ;CAUxC,MAAM,eAAe,QAAQ,OAAO;AACpC,KAAI,aAGH,QAAO,eAAe;EAAE,UADF,QAAQ,IAAI,mBAAmB,EAAE,UAAU;EAChB,IAAI;EAAc,cAAc;EAAM,QACtF,MAAM,CACN;CAIF,MAAM,gBAAgB,QAAQ,IAAI,mBAAmB,EAAE,UAAU;CACjE,MAAM,kBAAkB,IAAI,aAAa,IAAI,WAAW;AAGxD,KAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,SAC1C,QAAO,MAAM;CAId,MAAM,WAAW,iBAAiB;CAIlC,MAAM,SAAU,QAAuC;CAOvD,IAAI;AACJ,KAAI,iBAAiB;EACpB,MAAM,KAAK,QAAQ,OAAO,QAAQ;AAClC,MAAI,IAAI;GACP,MAAM,EAAE,kBAAkB,MAAM,qBAAqB,GAAG;GACxD,MAAM,SAAS,MAAM,mBAAmB;IAAE;IAAK,QAAQ;IAAe,CAAC;AACvE,OAAI,OAAO,OAAO;IACjB,MAAM,EAAE,YAAY,OAAO,eAAe,OAAO,QAAQ,IAAI;AAC7D,cAAU;KAAE;KAAY;KAAI;;QAG7B,SAAQ,KACP,uFACA;;AAOH,KAFqB,iBAAiB,gBAQrC,QAAO,eAAe;EAAE,GADT,mBAAmB;EACC;EAAU;EAAS;EAAQ,EAAE,YAAY;EAC3E,IAAI,WAAW,MAAM,MAAM;AAI3B,MAAI,SAAS;AACZ,cAAW,IAAI,SAAS,SAAS,MAAM,SAAS;AAChD,YAAS,QAAQ,IAAI,iBAAiB,oBAAoB;;AAI3D,MAAI,UAAU;GACb,MAAM,cAAc,cAAc;IACjC;IACA,WAAW,CAAC,CAAC;IACb,CAAC;AACF,UAAO,cAAc,UAAU,YAAY;;AAG5C,SAAO;GACN;AAIH,KAAI,SAMH,QAAO,cALU,MAAM,MAAM,EACT,cAAc;EACjC,UAAU;EACV,WAAW;EACX,CAAC,CACyC;AAG5C,QAAO,MAAM;EACZ"}
+{"version":3,"file":"request-context.mjs","names":[],"sources":["../../../src/visual-editing/toolbar.ts","../../../src/astro/middleware/request-context.ts"],"sourcesContent":["/**\n * EmDash Visual Editing Toolbar\n *\n * A floating pill injected via middleware for authenticated editors.\n * Renders as a plain HTML string with inline styles and a <script> tag.\n * No dependencies — works on any page with a </body> tag.\n */\n\ninterface ToolbarConfig {\n\teditMode: boolean;\n\tisPreview: boolean;\n}\n\nexport function renderToolbar(config: ToolbarConfig): string {\n\tconst { editMode, isPreview } = config;\n\n\treturn `\n<!-- EmDash Visual Editing Toolbar -->\n<div id=\"emdash-toolbar\" data-edit-mode=\"${editMode}\" data-preview=\"${isPreview}\">\n  <div class=\"emdash-tb-inner\">\n    <span class=\"emdash-tb-logo\">EmDash</span>\n\n    <div class=\"emdash-tb-divider\"></div>\n\n    <label class=\"emdash-tb-toggle\" title=\"Toggle edit mode\">\n      <input type=\"checkbox\" id=\"emdash-edit-toggle\" ${editMode ? \"checked\" : \"\"} />\n      <span class=\"emdash-tb-toggle-track\">\n        <span class=\"emdash-tb-toggle-thumb\"></span>\n      </span>\n      <span class=\"emdash-tb-toggle-label\">Edit</span>\n    </label>\n\n    <span class=\"emdash-tb-status\" id=\"emdash-tb-status\"></span>\n\n    <span class=\"emdash-tb-save-status\" id=\"emdash-tb-save-status\"></span>\n\n    <a class=\"emdash-tb-admin\" id=\"emdash-tb-admin\" href=\"#\" target=\"emdash-admin\" style=\"display:none\" title=\"Open in admin\">\n      <svg width=\"14\" height=\"14\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6\"/><polyline points=\"15 3 21 3 21 9\"/><line x1=\"10\" y1=\"14\" x2=\"21\" y2=\"3\"/></svg>\n    </a>\n\n    <button class=\"emdash-tb-publish\" id=\"emdash-tb-publish\" style=\"display:none\">Publish</button>\n  </div>\n</div>\n\n<style>\n  #emdash-toolbar {\n    position: fixed;\n    bottom: 16px;\n    left: 50%;\n    transform: translateX(-50%);\n    z-index: 999999;\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, sans-serif;\n    font-size: 13px;\n    line-height: 1;\n    -webkit-font-smoothing: antialiased;\n  }\n\n  .emdash-tb-inner {\n    display: flex;\n    align-items: center;\n    gap: 10px;\n    padding: 8px 16px;\n    background: #1a1a1a;\n    color: #e0e0e0;\n    border-radius: 999px;\n    box-shadow: 0 4px 24px rgba(0,0,0,0.3), 0 0 0 1px rgba(255,255,255,0.08);\n    white-space: nowrap;\n    user-select: none;\n  }\n\n  .emdash-tb-logo {\n    font-weight: 600;\n    font-size: 12px;\n    letter-spacing: 0.02em;\n    color: #fff;\n    opacity: 0.7;\n  }\n\n  .emdash-tb-divider {\n    width: 1px;\n    height: 16px;\n    background: rgba(255,255,255,0.15);\n  }\n\n  /* Toggle switch */\n  .emdash-tb-toggle {\n    display: flex;\n    align-items: center;\n    gap: 6px;\n    cursor: pointer;\n  }\n\n  .emdash-tb-toggle input {\n    position: absolute;\n    opacity: 0;\n    width: 0;\n    height: 0;\n  }\n\n  .emdash-tb-toggle-track {\n    position: relative;\n    width: 32px;\n    height: 18px;\n    background: #444;\n    border-radius: 9px;\n    transition: background 0.2s;\n  }\n\n  .emdash-tb-toggle input:checked + .emdash-tb-toggle-track {\n    background: #3b82f6;\n  }\n\n  .emdash-tb-toggle-thumb {\n    position: absolute;\n    top: 2px;\n    left: 2px;\n    width: 14px;\n    height: 14px;\n    background: #fff;\n    border-radius: 50%;\n    transition: transform 0.2s;\n  }\n\n  .emdash-tb-toggle input:checked + .emdash-tb-toggle-track .emdash-tb-toggle-thumb {\n    transform: translateX(14px);\n  }\n\n  .emdash-tb-toggle-label {\n    font-size: 12px;\n    color: #aaa;\n  }\n\n  .emdash-tb-toggle input:checked ~ .emdash-tb-toggle-label {\n    color: #fff;\n  }\n\n  /* Status area — flex for multiple badges */\n  .emdash-tb-status {\n    display: inline-flex;\n    gap: 6px;\n    align-items: center;\n  }\n\n  /* Badges */\n  .emdash-tb-badge {\n    display: inline-flex;\n    align-items: center;\n    padding: 3px 8px;\n    border-radius: 999px;\n    font-size: 11px;\n    font-weight: 600;\n    letter-spacing: 0.02em;\n    text-transform: uppercase;\n  }\n\n  .emdash-tb-badge--preview {\n    background: rgba(139,92,246,0.2);\n    color: #a78bfa;\n  }\n\n  .emdash-tb-badge--draft {\n    background: rgba(245,158,11,0.2);\n    color: #fbbf24;\n  }\n\n  .emdash-tb-badge--published {\n    background: rgba(34,197,94,0.2);\n    color: #4ade80;\n  }\n\n  .emdash-tb-badge--pending {\n    background: rgba(59,130,246,0.2);\n    color: #60a5fa;\n  }\n\n  .emdash-tb-badge--unsaved {\n    background: rgba(245,158,11,0.2);\n    color: #fbbf24;\n  }\n\n  .emdash-tb-badge--saving {\n    background: rgba(148,163,184,0.2);\n    color: #94a3b8;\n  }\n\n  .emdash-tb-badge--saved {\n    background: rgba(34,197,94,0.2);\n    color: #4ade80;\n    transition: opacity 0.3s;\n  }\n\n  .emdash-tb-badge--error {\n    background: rgba(239,68,68,0.2);\n    color: #f87171;\n  }\n\n  /* Admin link */\n  .emdash-tb-admin {\n    display: inline-flex;\n    align-items: center;\n    justify-content: center;\n    color: #888;\n    text-decoration: none;\n    padding: 2px;\n    border-radius: 4px;\n    transition: color 0.15s;\n  }\n\n  .emdash-tb-admin:hover {\n    color: #fff;\n  }\n\n  /* Publish button */\n  .emdash-tb-publish {\n    padding: 4px 12px;\n    background: #3b82f6;\n    color: #fff;\n    border: none;\n    border-radius: 999px;\n    font-size: 12px;\n    font-weight: 600;\n    cursor: pointer;\n    transition: background 0.15s;\n    font-family: inherit;\n  }\n\n  .emdash-tb-publish:hover {\n    background: #2563eb;\n  }\n\n  .emdash-tb-publish:disabled {\n    opacity: 0.5;\n    cursor: not-allowed;\n  }\n\n  /* Edit mode: editable hover styles — uses :has() to check toolbar state */\n  body:has(#emdash-toolbar[data-edit-mode=\"true\"]) [data-emdash-ref] {\n    transition: box-shadow 0.15s, background-color 0.15s;\n  }\n\n  body:has(#emdash-toolbar[data-edit-mode=\"true\"]) [data-emdash-ref]:hover {\n    box-shadow: 0 0 0 2px rgba(59,130,246,0.5);\n    border-radius: 4px;\n    background-color: rgba(59,130,246,0.04);\n    cursor: text;\n  }\n\n  /* Active editing state — override hover pencil cursor */\n  [data-emdash-editing] {\n    box-shadow: 0 0 0 2px #3b82f6 !important;\n    border-radius: 4px !important;\n    background-color: rgba(59,130,246,0.04) !important;\n    cursor: text !important;\n  }\n\n  /* Suppress browser focus ring on contenteditable and tiptap editor */\n  [data-emdash-editing]:focus,\n  [data-emdash-ref] .tiptap:focus,\n  [data-emdash-ref] .ProseMirror:focus {\n    outline: none !important;\n  }\n\n  /* Image editor popover */\n  .emdash-img-popover {\n    position: fixed;\n    z-index: 1000000;\n    background: #1a1a1a;\n    border-radius: 12px;\n    box-shadow: 0 8px 32px rgba(0,0,0,0.4), 0 0 0 1px rgba(255,255,255,0.08);\n    color: #e0e0e0;\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, sans-serif;\n    font-size: 13px;\n    width: 320px;\n    overflow: hidden;\n    animation: emdash-img-fadein 0.15s ease-out;\n  }\n\n  @keyframes emdash-img-fadein {\n    from { opacity: 0; transform: translateY(4px); }\n    to { opacity: 1; transform: translateY(0); }\n  }\n\n  .emdash-img-popover-header {\n    display: flex;\n    align-items: center;\n    justify-content: space-between;\n    padding: 10px 12px;\n    border-bottom: 1px solid rgba(255,255,255,0.08);\n  }\n\n  .emdash-img-popover-title {\n    font-weight: 600;\n    font-size: 12px;\n    text-transform: uppercase;\n    letter-spacing: 0.04em;\n    color: #999;\n  }\n\n  .emdash-img-popover-close {\n    background: none;\n    border: none;\n    color: #666;\n    cursor: pointer;\n    padding: 2px;\n    line-height: 1;\n    font-size: 16px;\n    border-radius: 4px;\n    transition: color 0.15s;\n  }\n\n  .emdash-img-popover-close:hover {\n    color: #fff;\n  }\n\n  .emdash-img-popover-body {\n    padding: 12px;\n    display: flex;\n    flex-direction: column;\n    gap: 10px;\n  }\n\n  .emdash-img-preview {\n    width: 100%;\n    max-height: 160px;\n    object-fit: contain;\n    border-radius: 6px;\n    background: #111;\n  }\n\n  .emdash-img-empty {\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    height: 80px;\n    border: 2px dashed rgba(255,255,255,0.15);\n    border-radius: 6px;\n    color: #666;\n    font-size: 12px;\n  }\n\n  .emdash-img-field {\n    display: flex;\n    flex-direction: column;\n    gap: 4px;\n  }\n\n  .emdash-img-field label {\n    font-size: 11px;\n    font-weight: 600;\n    color: #888;\n    text-transform: uppercase;\n    letter-spacing: 0.04em;\n  }\n\n  .emdash-img-field input[type=\"text\"] {\n    background: #111;\n    border: 1px solid rgba(255,255,255,0.12);\n    border-radius: 6px;\n    color: #e0e0e0;\n    padding: 6px 8px;\n    font-size: 13px;\n    font-family: inherit;\n    outline: none;\n    transition: border-color 0.15s;\n  }\n\n  .emdash-img-field input[type=\"text\"]:focus {\n    border-color: #3b82f6;\n  }\n\n  .emdash-img-actions {\n    display: flex;\n    gap: 6px;\n  }\n\n  .emdash-img-btn {\n    flex: 1;\n    padding: 6px 10px;\n    border: 1px solid rgba(255,255,255,0.12);\n    border-radius: 6px;\n    background: #222;\n    color: #e0e0e0;\n    font-size: 12px;\n    font-family: inherit;\n    cursor: pointer;\n    transition: background 0.15s, border-color 0.15s;\n    text-align: center;\n    white-space: nowrap;\n  }\n\n  .emdash-img-btn:hover {\n    background: #333;\n    border-color: rgba(255,255,255,0.2);\n  }\n\n  .emdash-img-btn--primary {\n    background: #3b82f6;\n    border-color: #3b82f6;\n    color: #fff;\n  }\n\n  .emdash-img-btn--primary:hover {\n    background: #2563eb;\n    border-color: #2563eb;\n  }\n\n  .emdash-img-btn--danger {\n    color: #f87171;\n    border-color: rgba(248,113,113,0.3);\n  }\n\n  .emdash-img-btn--danger:hover {\n    background: rgba(248,113,113,0.1);\n    border-color: rgba(248,113,113,0.5);\n  }\n\n  /* Media browser within the popover */\n  .emdash-img-browser {\n    border-top: 1px solid rgba(255,255,255,0.08);\n    padding: 12px;\n  }\n\n  .emdash-img-browser-header {\n    display: flex;\n    align-items: center;\n    justify-content: space-between;\n    margin-bottom: 8px;\n  }\n\n  .emdash-img-browser-title {\n    font-size: 12px;\n    font-weight: 600;\n    color: #999;\n  }\n\n  .emdash-img-browser-back {\n    background: none;\n    border: none;\n    color: #3b82f6;\n    cursor: pointer;\n    font-size: 12px;\n    font-family: inherit;\n    padding: 2px 4px;\n  }\n\n  .emdash-img-browser-back:hover {\n    text-decoration: underline;\n  }\n\n  .emdash-img-grid {\n    display: grid;\n    grid-template-columns: repeat(3, 1fr);\n    gap: 6px;\n    max-height: 240px;\n    overflow-y: auto;\n  }\n\n  .emdash-img-grid-item {\n    aspect-ratio: 1;\n    border-radius: 4px;\n    overflow: hidden;\n    cursor: pointer;\n    border: 2px solid transparent;\n    transition: border-color 0.15s;\n    background: #111;\n  }\n\n  .emdash-img-grid-item:hover {\n    border-color: rgba(59,130,246,0.5);\n  }\n\n  .emdash-img-grid-item--selected {\n    border-color: #3b82f6;\n  }\n\n  .emdash-img-grid-item img {\n    width: 100%;\n    height: 100%;\n    object-fit: cover;\n  }\n\n  .emdash-img-loading {\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    height: 80px;\n    color: #666;\n    font-size: 12px;\n  }\n\n  .emdash-img-drop {\n    border: 2px dashed #3b82f6;\n    background: rgba(59,130,246,0.05);\n  }\n\n  .emdash-img-uploading {\n    display: flex;\n    align-items: center;\n    gap: 8px;\n    padding: 8px 0;\n    color: #999;\n    font-size: 12px;\n  }\n\n  .emdash-img-popover-backdrop {\n    position: fixed;\n    inset: 0;\n    z-index: 999999;\n  }\n</style>\n\n<script>\n(function() {\n  var toolbar = document.getElementById(\"emdash-toolbar\");\n  var toggle = document.getElementById(\"emdash-edit-toggle\");\n  var statusEl = document.getElementById(\"emdash-tb-status\");\n  var saveStatusEl = document.getElementById(\"emdash-tb-save-status\");\n  var publishBtn = document.getElementById(\"emdash-tb-publish\");\n  if (!toolbar || !toggle || !statusEl || !publishBtn || !saveStatusEl) return;\n\n  var isEditMode = toolbar.getAttribute(\"data-edit-mode\") === \"true\";\n\n  // CSRF-protected fetch — adds X-EmDash-Request header to all API calls\n  function ecFetch(url, init) {\n    init = init || {};\n    init.headers = Object.assign({ \"X-EmDash-Request\": \"1\" }, init.headers || {});\n    return fetch(url, init);\n  }\n\n  // --- Save status tracking ---\n  var saveState = \"idle\"; // idle | unsaved | saving | saved | error\n  var saveHideTimer = null;\n  var pendingSavePromise = null;\n\n  function setSaveState(state) {\n    saveState = state;\n    clearTimeout(saveHideTimer);\n\n    switch (state) {\n      case \"unsaved\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--unsaved\">Unsaved</span>';\n        break;\n      case \"saving\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--saving\">Saving\\u2026</span>';\n        break;\n      case \"saved\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--saved\">Saved</span>';\n        saveHideTimer = setTimeout(function() {\n          saveStatusEl.innerHTML = \"\";\n          saveState = \"idle\";\n        }, 2000);\n        break;\n      case \"error\":\n        saveStatusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--error\">Save failed</span>';\n        saveHideTimer = setTimeout(function() {\n          saveStatusEl.innerHTML = \"\";\n          saveState = \"idle\";\n        }, 3000);\n        break;\n      default:\n        saveStatusEl.innerHTML = \"\";\n    }\n  }\n\n  // Listen for save events from inline editors (e.g. PT editor)\n  document.addEventListener(\"emdash:save\", function(e) {\n    var detail = e.detail || {};\n    if (detail.state) {\n      setSaveState(detail.state);\n    }\n  });\n\n  document.addEventListener(\"emdash:content-changed\", function(e) {\n    var detail = e.detail || {};\n    if (detail.collection && detail.id) {\n      showUnpublishedChanges(detail.collection, detail.id);\n    }\n  });\n\n  // --- Entry status ---\n  var entryRef = null;\n\n  function updateStatus() {\n    if (!isEditMode) {\n      statusEl.innerHTML = \"\";\n      publishBtn.style.display = \"none\";\n      return;\n    }\n\n    var first = document.querySelector(\"[data-emdash-ref]\");\n    if (!first) {\n      statusEl.innerHTML = \"\";\n      publishBtn.style.display = \"none\";\n      return;\n    }\n\n    try {\n      var ref = JSON.parse(first.getAttribute(\"data-emdash-ref\"));\n      entryRef = ref;\n      if (!ref.status) return;\n\n      // Show admin link\n      var adminLink = document.getElementById(\"emdash-tb-admin\");\n      if (adminLink) {\n        adminLink.href = \"/_emdash/admin/content/\" + encodeURIComponent(ref.collection) + \"/\" + encodeURIComponent(ref.id);\n        adminLink.style.display = \"\";\n      }\n\n      if (ref.status === \"draft\") {\n        statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--draft\">Draft</span>';\n        publishBtn.style.display = \"\";\n        publishBtn.onclick = function() { publish(ref.collection, ref.id); };\n      } else if (ref.status === \"published\" && ref.hasDraft) {\n        statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--pending\">Unpublished changes</span>';\n        publishBtn.style.display = \"\";\n        publishBtn.onclick = function() { publish(ref.collection, ref.id); };\n      } else if (ref.status === \"published\") {\n        statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--published\">Published</span>';\n        publishBtn.style.display = \"none\";\n      }\n    } catch (e) {\n      // ignore parse errors\n    }\n  }\n\n  // Publish action\n  function publish(collection, id) {\n    if (pendingSavePromise) {\n      pendingSavePromise.then(function() { publish(collection, id); });\n      return;\n    }\n\n    publishBtn.disabled = true;\n    publishBtn.textContent = \"Publishing\\u2026\";\n\n    ecFetch(\"/_emdash/api/content/\" + encodeURIComponent(collection) + \"/\" + encodeURIComponent(id) + \"/publish\", {\n      method: \"POST\",\n      credentials: \"same-origin\",\n    })\n    .then(function(res) {\n      if (res.ok) {\n        if (document.startViewTransition) {\n          document.startViewTransition(function() { location.reload(); });\n        } else {\n          location.reload();\n        }\n      } else {\n        publishBtn.disabled = false;\n        publishBtn.textContent = \"Publish\";\n        console.error(\"Publish failed:\", res.status);\n      }\n    })\n    .catch(function(err) {\n      publishBtn.disabled = false;\n      publishBtn.textContent = \"Publish\";\n      console.error(\"Publish failed:\", err);\n    });\n  }\n\n  // Edit mode toggle\n  toggle.addEventListener(\"change\", function() {\n    if (toggle.checked) {\n      document.cookie = \"emdash-edit-mode=true;path=/;samesite=lax\";\n    } else {\n      document.cookie = \"emdash-edit-mode=;path=/;expires=Thu, 01 Jan 1970 00:00:00 GMT\";\n    }\n\n    if (document.startViewTransition) {\n      document.startViewTransition(function() { location.replace(location.href); });\n    } else {\n      location.replace(location.href);\n    }\n  });\n\n  // --- Inline editing ---\n\n  // Cached manifest (fetched once on first edit click)\n  var manifestCache = null;\n  var manifestPromise = null;\n\n  function fetchManifest() {\n    if (manifestCache) return Promise.resolve(manifestCache);\n    if (manifestPromise) return manifestPromise;\n    manifestPromise = ecFetch(\"/_emdash/api/manifest\", { credentials: \"same-origin\" })\n      .then(function(r) { return r.json(); })\n      .then(function(m) {\n        // The manifest endpoint wraps the payload in a { data } envelope (ApiResponse shape).\n        // Unwrap it so getFieldKind can read manifest.collections directly.\n        manifestCache = m && m.data ? m.data : m;\n        return manifestCache;\n      });\n    return manifestPromise;\n  }\n\n  function getFieldKind(manifest, collection, field) {\n    var col = manifest.collections && manifest.collections[collection];\n    if (!col || !col.fields) return null;\n    var f = col.fields[field];\n    return f ? f.kind : null;\n  }\n\n  // Load manifest early so the first click can resolve field kinds without racing the event.\n  if (isEditMode) {\n    fetchManifest();\n  }\n\n  // Save a single field value\n  function saveField(collection, id, field, value) {\n    setSaveState(\"saving\");\n    return ecFetch(\"/_emdash/api/content/\" + encodeURIComponent(collection) + \"/\" + encodeURIComponent(id), {\n      method: \"PUT\",\n      credentials: \"same-origin\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ data: { [field]: value } }),\n    })\n    .then(function(res) {\n      if (res.ok) {\n        setSaveState(\"saved\");\n        // A save creates/updates a draft — show unpublished changes\n        showUnpublishedChanges(collection, id);\n      } else {\n        setSaveState(\"error\");\n        console.error(\"Save failed:\", res.status);\n      }\n    })\n    .catch(function(err) {\n      setSaveState(\"error\");\n      console.error(\"Save failed:\", err);\n    });\n  }\n\n  function showUnpublishedChanges(collection, id) {\n    statusEl.innerHTML = '<span class=\"emdash-tb-badge emdash-tb-badge--pending\">Unpublished changes</span>';\n    publishBtn.style.display = \"\";\n    publishBtn.disabled = false;\n    publishBtn.textContent = \"Publish\";\n    publishBtn.onclick = function() { publish(collection, id); };\n  }\n\n  // Plain text inline editing (contenteditable)\n  var currentlyEditing = null;\n\n  function startTextEdit(element, annotation) {\n    if (currentlyEditing === element) return;\n    if (currentlyEditing) endCurrentEdit();\n\n    currentlyEditing = element;\n    var originalText = element.textContent || \"\";\n\n    element.setAttribute(\"data-emdash-editing\", \"\");\n    element.contentEditable = \"plaintext-only\";\n    element.focus();\n\n    // Select all text\n    var range = document.createRange();\n    range.selectNodeContents(element);\n    var sel = window.getSelection();\n    sel.removeAllRanges();\n    sel.addRange(range);\n\n    // Track dirty state via input events\n    function handleInput() {\n      var current = (element.textContent || \"\").trim();\n      if (current !== originalText.trim()) {\n        setSaveState(\"unsaved\");\n      } else {\n        setSaveState(\"idle\");\n      }\n    }\n\n    function handleBlur() {\n      element.removeEventListener(\"blur\", handleBlur);\n      element.removeEventListener(\"keydown\", handleKeydown);\n      element.removeEventListener(\"input\", handleInput);\n      element.contentEditable = \"false\";\n      element.removeAttribute(\"data-emdash-editing\");\n      currentlyEditing = null;\n\n      var newValue = (element.textContent || \"\").trim();\n      if (newValue !== originalText.trim()) {\n        pendingSavePromise = saveField(annotation.collection, annotation.id, annotation.field, newValue).then(function() {\n          pendingSavePromise = null;\n        }, function() {\n          pendingSavePromise = null;\n        });\n      } else {\n        setSaveState(\"idle\");\n      }\n    }\n\n    function handleKeydown(e) {\n      if (e.key === \"Enter\" && !e.shiftKey) {\n        e.preventDefault();\n        element.blur();\n      }\n      if (e.key === \"Escape\") {\n        element.textContent = originalText;\n        setSaveState(\"idle\");\n        element.blur();\n      }\n    }\n\n    element.addEventListener(\"input\", handleInput);\n    element.addEventListener(\"blur\", handleBlur);\n    element.addEventListener(\"keydown\", handleKeydown);\n  }\n\n  function endCurrentEdit() {\n    if (currentlyEditing) {\n      currentlyEditing.blur();\n    }\n  }\n\n  // Fallback: open admin\n  function openAdmin(annotation) {\n    var url = \"/_emdash/admin/content/\" + encodeURIComponent(annotation.collection) + \"/\" + encodeURIComponent(annotation.id);\n    if (annotation.field) {\n      url += \"?field=\" + encodeURIComponent(annotation.field);\n    }\n    window.open(url, \"emdash-admin\");\n  }\n\n  // --- Inline image editing ---\n  var activeImagePopover = null;\n\n  function closeImagePopover() {\n    if (activeImagePopover) {\n      activeImagePopover.backdrop.remove();\n      activeImagePopover.popover.remove();\n      if (activeImagePopover.escapeHandler) {\n        document.removeEventListener(\"keydown\", activeImagePopover.escapeHandler);\n      }\n      activeImagePopover = null;\n    }\n  }\n\n  function startImageEdit(element, annotation) {\n    closeImagePopover();\n\n    // Find the current image value by fetching the entry\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    // Find img element inside the annotated container (or the element itself if it's an img)\n    var imgEl = element.tagName === \"IMG\" ? element : element.querySelector(\"img\");\n\n    // Fetch current field value from the content API\n    ecFetch(\"/_emdash/api/content/\" + encodeURIComponent(collection) + \"/\" + encodeURIComponent(id), {\n      credentials: \"same-origin\"\n    })\n    .then(function(r) { return r.json(); })\n    .then(function(entry) {\n      var currentValue = entry.data && entry.data[field];\n      showImagePopover(element, imgEl, annotation, currentValue);\n    })\n    .catch(function() {\n      // If fetch fails, still show popover with what we can infer from DOM\n      showImagePopover(element, imgEl, annotation, null);\n    });\n  }\n\n  function showImagePopover(element, imgEl, annotation, currentValue) {\n    closeImagePopover();\n\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    // Position near the element\n    var rect = element.getBoundingClientRect();\n    var viewportH = window.innerHeight;\n    var viewportW = window.innerWidth;\n\n    // Create backdrop for click-outside-to-close\n    var backdrop = document.createElement(\"div\");\n    backdrop.className = \"emdash-img-popover-backdrop\";\n    backdrop.addEventListener(\"click\", function(e) {\n      if (e.target === backdrop) closeImagePopover();\n    });\n\n    // Create popover\n    var popover = document.createElement(\"div\");\n    popover.className = \"emdash-img-popover\";\n\n    var currentSrc = currentValue ? (currentValue.previewUrl || currentValue.src) : (imgEl ? imgEl.src : null);\n    var currentAlt = currentValue ? (currentValue.alt || \"\") : (imgEl ? (imgEl.alt || \"\") : \"\");\n\n    // Build popover HTML\n    var html = '';\n    html += '<div class=\"emdash-img-popover-header\">';\n    html += '  <span class=\"emdash-img-popover-title\">Image</span>';\n    html += '  <button class=\"emdash-img-popover-close\" data-action=\"close\">&times;</button>';\n    html += '</div>';\n    html += '<div class=\"emdash-img-popover-body\" id=\"emdash-img-main\">';\n\n    if (currentSrc) {\n      html += '<img class=\"emdash-img-preview\" src=\"' + escapeAttr(currentSrc) + '\" alt=\"\" />';\n    } else {\n      html += '<div class=\"emdash-img-empty\">No image selected</div>';\n    }\n\n    html += '<div class=\"emdash-img-field\">';\n    html += '  <label for=\"emdash-img-alt\">Alt text</label>';\n    html += '  <input type=\"text\" id=\"emdash-img-alt\" value=\"' + escapeAttr(currentAlt) + '\" placeholder=\"Describe the image\" />';\n    html += '</div>';\n\n    html += '<div class=\"emdash-img-actions\">';\n    html += '  <button class=\"emdash-img-btn emdash-img-btn--primary\" data-action=\"browse\">Replace</button>';\n    html += '  <label class=\"emdash-img-btn\" style=\"cursor:pointer\">';\n    html += '    Upload';\n    html += '    <input type=\"file\" accept=\"image/*\" id=\"emdash-img-upload\" style=\"display:none\" />';\n    html += '  </label>';\n    if (currentSrc) {\n      html += '  <button class=\"emdash-img-btn emdash-img-btn--danger\" data-action=\"remove\">Remove</button>';\n    }\n    html += '</div>';\n    html += '</div>';\n\n    popover.innerHTML = html;\n\n    backdrop.appendChild(popover);\n    document.body.appendChild(backdrop);\n\n    // Position the popover\n    positionPopover(popover, rect, viewportW, viewportH);\n\n    // Escape key handler\n    function handleEscape(e) {\n      if (e.key === \"Escape\") {\n        closeImagePopover();\n        document.removeEventListener(\"keydown\", handleEscape);\n      }\n    }\n    document.addEventListener(\"keydown\", handleEscape);\n\n    activeImagePopover = {\n      backdrop: backdrop,\n      popover: popover,\n      annotation: annotation,\n      currentValue: currentValue,\n      element: element,\n      imgEl: imgEl,\n      escapeHandler: handleEscape\n    };\n\n    // Event handlers\n    popover.querySelector('[data-action=\"close\"]').addEventListener(\"click\", closeImagePopover);\n\n    popover.querySelector('[data-action=\"browse\"]').addEventListener(\"click\", function() {\n      showMediaBrowser(popover, annotation, currentValue, element, imgEl);\n    });\n\n    var uploadInput = popover.querySelector(\"#emdash-img-upload\");\n    uploadInput.addEventListener(\"change\", function(e) {\n      var file = e.target.files && e.target.files[0];\n      if (file) handleImageUpload(file, popover, annotation, element, imgEl);\n    });\n\n    var removeBtn = popover.querySelector('[data-action=\"remove\"]');\n    if (removeBtn) {\n      removeBtn.addEventListener(\"click\", function() {\n        saveField(collection, id, field, null).then(function() {\n          if (imgEl) {\n            imgEl.style.display = \"none\";\n          }\n          closeImagePopover();\n        });\n      });\n    }\n\n    // Save alt text on change (debounced)\n    var altInput = popover.querySelector(\"#emdash-img-alt\");\n    var altTimer = null;\n    altInput.addEventListener(\"input\", function() {\n      clearTimeout(altTimer);\n      altTimer = setTimeout(function() {\n        var newAlt = altInput.value;\n        if (currentValue) {\n          var updated = Object.assign({}, currentValue, { alt: newAlt });\n          saveField(collection, id, field, updated);\n          if (imgEl) imgEl.alt = newAlt;\n        }\n      }, 500);\n    });\n\n    // Handle drag and drop on the popover body\n    var body = popover.querySelector(\".emdash-img-popover-body\");\n    body.addEventListener(\"dragover\", function(e) {\n      e.preventDefault();\n      body.classList.add(\"emdash-img-drop\");\n    });\n    body.addEventListener(\"dragleave\", function() {\n      body.classList.remove(\"emdash-img-drop\");\n    });\n    body.addEventListener(\"drop\", function(e) {\n      e.preventDefault();\n      body.classList.remove(\"emdash-img-drop\");\n      var file = e.dataTransfer && e.dataTransfer.files && e.dataTransfer.files[0];\n      if (file && file.type.startsWith(\"image/\")) {\n        handleImageUpload(file, popover, annotation, element, imgEl);\n      }\n    });\n  }\n\n  function positionPopover(popover, targetRect, viewportW, viewportH) {\n    var popoverW = 320;\n    var gap = 8;\n\n    // Try to place to the right of the element\n    var left = targetRect.right + gap;\n    var top = targetRect.top;\n\n    // If it overflows right, place to the left\n    if (left + popoverW > viewportW - 16) {\n      left = targetRect.left - popoverW - gap;\n    }\n    // If it still overflows (narrow viewport), center below\n    if (left < 16) {\n      left = Math.max(16, (viewportW - popoverW) / 2);\n      top = targetRect.bottom + gap;\n    }\n    // Clamp vertically\n    if (top + 400 > viewportH - 80) { // 80 for toolbar\n      top = Math.max(16, viewportH - 480);\n    }\n    if (top < 16) top = 16;\n\n    popover.style.left = left + \"px\";\n    popover.style.top = top + \"px\";\n  }\n\n  function escapeAttr(str) {\n    return String(str || \"\").replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\");\n  }\n\n  function showMediaBrowser(popover, annotation, currentValue, element, imgEl) {\n    var mainBody = popover.querySelector(\"#emdash-img-main\");\n    if (mainBody) mainBody.style.display = \"none\";\n\n    // Remove existing browser if any\n    var existing = popover.querySelector(\".emdash-img-browser\");\n    if (existing) existing.remove();\n\n    var browser = document.createElement(\"div\");\n    browser.className = \"emdash-img-browser\";\n\n    browser.innerHTML = '<div class=\"emdash-img-browser-header\">' +\n      '<span class=\"emdash-img-browser-title\">Media Library</span>' +\n      '<button class=\"emdash-img-browser-back\">Back</button>' +\n      '</div>' +\n      '<div class=\"emdash-img-loading\">Loading\\u2026</div>';\n\n    popover.appendChild(browser);\n\n    browser.querySelector(\".emdash-img-browser-back\").addEventListener(\"click\", function() {\n      browser.remove();\n      if (mainBody) mainBody.style.display = \"\";\n    });\n\n    // Fetch media\n    ecFetch(\"/_emdash/api/media?mimeType=image/&limit=30\", { credentials: \"same-origin\" })\n    .then(function(r) { return r.json(); })\n    .then(function(data) {\n      var items = data.items || [];\n      var loadingEl = browser.querySelector(\".emdash-img-loading\");\n      if (loadingEl) loadingEl.remove();\n\n      if (items.length === 0) {\n        var empty = document.createElement(\"div\");\n        empty.className = \"emdash-img-loading\";\n        empty.textContent = \"No images found\";\n        browser.appendChild(empty);\n        return;\n      }\n\n      var grid = document.createElement(\"div\");\n      grid.className = \"emdash-img-grid\";\n\n      items.forEach(function(item) {\n        var thumb = document.createElement(\"div\");\n        thumb.className = \"emdash-img-grid-item\";\n        if (currentValue && currentValue.id === item.id) {\n          thumb.classList.add(\"emdash-img-grid-item--selected\");\n        }\n        var thumbUrl = item.url || item.previewUrl || (\"/_emdash/api/media/file/\" + item.storageKey);\n        thumb.innerHTML = '<img src=\"' + escapeAttr(thumbUrl) + '\" alt=\"' + escapeAttr(item.alt || item.filename || \"\") + '\" loading=\"lazy\" />';\n\n        thumb.addEventListener(\"click\", function() {\n          selectMediaItem(item, annotation, element, imgEl);\n        });\n\n        grid.appendChild(thumb);\n      });\n\n      browser.appendChild(grid);\n    })\n    .catch(function(err) {\n      var loadingEl = browser.querySelector(\".emdash-img-loading\");\n      if (loadingEl) loadingEl.textContent = \"Failed to load media\";\n      console.error(\"Media fetch error:\", err);\n    });\n  }\n\n  function selectMediaItem(item, annotation, element, imgEl) {\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    var isLocal = !item.provider || item.provider === \"local\";\n    var itemUrl = item.url || item.previewUrl || (\"/_emdash/api/media/file/\" + item.storageKey);\n\n    var newValue = {\n      id: item.id,\n      provider: item.provider || \"local\",\n      src: isLocal ? itemUrl : undefined,\n      previewUrl: isLocal ? undefined : itemUrl,\n      alt: item.alt || \"\",\n      width: item.width,\n      height: item.height,\n      meta: item.meta\n    };\n\n    // Clean undefined fields\n    Object.keys(newValue).forEach(function(k) {\n      if (newValue[k] === undefined) delete newValue[k];\n    });\n\n    saveField(collection, id, field, newValue).then(function() {\n      // Update the image in the DOM\n      if (imgEl) {\n        imgEl.src = itemUrl;\n        imgEl.alt = item.alt || \"\";\n        imgEl.style.display = \"\";\n      }\n      closeImagePopover();\n    });\n  }\n\n  function handleImageUpload(file, popover, annotation, element, imgEl) {\n    var collection = annotation.collection;\n    var id = annotation.id;\n    var field = annotation.field;\n\n    // Show uploading state\n    var mainBody = popover.querySelector(\"#emdash-img-main\");\n    var browserEl = popover.querySelector(\".emdash-img-browser\");\n    if (browserEl) browserEl.remove();\n    if (mainBody) {\n      mainBody.innerHTML = '<div class=\"emdash-img-uploading\">' +\n        '<span>Uploading ' + escapeAttr(file.name) + '\\u2026</span>' +\n        '</div>';\n      mainBody.style.display = \"\";\n    }\n\n    // Detect dimensions before upload\n    var dimPromise = new Promise(function(resolve) {\n      if (!file.type.startsWith(\"image/\")) return resolve({});\n      var img = new Image();\n      img.onload = function() {\n        resolve({ width: img.naturalWidth, height: img.naturalHeight });\n        URL.revokeObjectURL(img.src);\n      };\n      img.onerror = function() {\n        resolve({});\n        URL.revokeObjectURL(img.src);\n      };\n      img.src = URL.createObjectURL(file);\n    });\n\n    dimPromise.then(function(dims) {\n      // Generate a thumbnail for large images to avoid OOM in server-side\n      // blurhash generation on memory-constrained runtimes (Workers).\n      // Thumbnail fits within a 64x64 box (scale by max dimension) so that\n      // extreme aspect ratios don't explode into a huge canvas client-side.\n      var thumbPromise;\n      if (dims.width && dims.height && dims.width * dims.height * 4 > 32 * 1024 * 1024) {\n        thumbPromise = new Promise(function(resolve) {\n          try {\n            var maxDim = Math.max(dims.width, dims.height);\n            var scale = Math.min(1, 64 / maxDim);\n            var thumbW = Math.max(1, Math.round(dims.width * scale));\n            var thumbH = Math.max(1, Math.round(dims.height * scale));\n            var canvas = document.createElement(\"canvas\");\n            canvas.width = thumbW;\n            canvas.height = thumbH;\n            var ctx = canvas.getContext(\"2d\");\n            if (ctx) {\n              var img = new Image();\n              img.onload = function() {\n                try {\n                  ctx.drawImage(img, 0, 0, thumbW, thumbH);\n                  canvas.toBlob(function(blob) {\n                    URL.revokeObjectURL(img.src);\n                    resolve(blob);\n                  }, \"image/png\");\n                } catch (e) {\n                  URL.revokeObjectURL(img.src);\n                  resolve(null);\n                }\n              };\n              img.onerror = function() {\n                URL.revokeObjectURL(img.src);\n                resolve(null);\n              };\n              img.src = URL.createObjectURL(file);\n            } else {\n              resolve(null);\n            }\n          } catch (e) {\n            resolve(null);\n          }\n        });\n      } else {\n        thumbPromise = Promise.resolve(null);\n      }\n\n      return thumbPromise.then(function(thumbnail) {\n        var formData = new FormData();\n        formData.append(\"file\", file);\n        if (dims.width) formData.append(\"width\", String(dims.width));\n        if (dims.height) formData.append(\"height\", String(dims.height));\n        if (thumbnail) formData.append(\"thumbnail\", thumbnail, \"thumb.png\");\n\n        return ecFetch(\"/_emdash/api/media\", {\n          method: \"POST\",\n          credentials: \"same-origin\",\n          body: formData\n        });\n      });\n    })\n    .then(function(r) { return r.json(); })\n    .then(function(data) {\n      if (!data.item) throw new Error(\"Upload failed\");\n      var item = data.item;\n      selectMediaItem(item, annotation, element, imgEl);\n    })\n    .catch(function(err) {\n      console.error(\"Upload error:\", err);\n      setSaveState(\"error\");\n      closeImagePopover();\n    });\n  }\n\n  // Click handler for edit mode\n  if (isEditMode) {\n    document.addEventListener(\"click\", function(e) {\n      var target = e.target;\n\n      // Don't intercept clicks on elements currently being edited\n      if (target.hasAttribute && target.hasAttribute(\"data-emdash-editing\")) return;\n\n      // Walk up to find annotated element\n      while (target && target !== document.body) {\n        if (target.hasAttribute && target.hasAttribute(\"data-emdash-editing\")) return;\n\n        var ref = target.getAttribute && target.getAttribute(\"data-emdash-ref\");\n        if (ref) {\n          try {\n            var annotation = JSON.parse(ref);\n\n            // Entry-level annotation (no field) — keep walking for a field-level ancestor\n            if (!annotation.field) {\n              target = target.parentElement;\n              continue;\n            }\n\n            function dispatchInline(kind) {\n              closeImagePopover();\n              // Portable Text is edited in-page by InlinePortableTextEditor — do not open admin\n              if (kind === \"portableText\") {\n                return;\n              }\n              e.preventDefault();\n              e.stopPropagation();\n              if (kind === \"string\" || kind === \"text\") {\n                startTextEdit(target, annotation);\n              } else if (kind === \"image\") {\n                startImageEdit(target, annotation);\n              } else {\n                openAdmin(annotation);\n              }\n            }\n\n            if (manifestCache) {\n              dispatchInline(getFieldKind(manifestCache, annotation.collection, annotation.field));\n            } else {\n              fetchManifest().then(function(manifest) {\n                dispatchInline(getFieldKind(manifest, annotation.collection, annotation.field));\n              });\n            }\n          } catch (err) {\n            console.error(\"Failed to parse emdash ref:\", err);\n          }\n          return;\n        }\n        target = target.parentElement;\n      }\n    }, true);\n  }\n\n  updateStatus();\n})();\n</script>\n`;\n}\n","/**\n * EmDash Request Context Middleware\n *\n * Sets up AsyncLocalStorage-based request context for query functions.\n * Skips ALS entirely for logged-out users with no CMS signals (fast path).\n *\n * Handles:\n * - Preview tokens: _preview query param with signed HMAC token\n * - Edit mode: emdash-edit-mode cookie (for visual editing)\n * - Toolbar injection: floating pill for authenticated editors\n */\n\nimport { defineMiddleware } from \"astro:middleware\";\n\nimport { resolveSecretsCached } from \"#config/secrets.js\";\n\nimport { verifyPreviewToken, parseContentId } from \"../../preview/tokens.js\";\nimport { getRequestContext, runWithContext } from \"../../request-context.js\";\nimport { renderToolbar } from \"../../visual-editing/toolbar.js\";\n\n/**\n * Inject toolbar HTML into a response if it's an HTML page.\n * Returns the original response if not HTML.\n */\nasync function injectToolbar(response: Response, toolbarHtml: string): Promise<Response> {\n\tconst contentType = response.headers.get(\"content-type\");\n\tif (!contentType?.includes(\"text/html\")) return response;\n\n\tconst html = await response.text();\n\tif (!html.includes(\"</body>\")) return new Response(html, response);\n\n\tconst injected = html.replace(\"</body>\", `${toolbarHtml}</body>`);\n\treturn new Response(injected, {\n\t\tstatus: response.status,\n\t\theaders: response.headers,\n\t});\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { cookies, url } = context;\n\n\t// Skip /_emdash routes (admin has its own UI, no rendering context needed)\n\tif (url.pathname.startsWith(\"/_emdash\")) {\n\t\treturn next();\n\t}\n\n\t// Check for authenticated editor (role >= 30)\n\tconst { user } = context.locals;\n\tconst isEditor = !!user && user.role >= 30;\n\n\t// Playground mode: the playground middleware (from @emdash-cms/cloudflare) stashes\n\t// the per-session DO database on locals.__playgroundDb. We set it via ALS here\n\t// (same module instance as the loader) so getDb() picks it up correctly.\n\t//\n\t// `dbIsIsolated: true` tells schema-derived caches (manifest, taxonomy defs,\n\t// byline/term existence probes) to bypass module-scope memoization — each\n\t// playground session is its own database with its own schema, so a cached\n\t// value from another session would be wrong.\n\tconst playgroundDb = context.locals.__playgroundDb;\n\tif (playgroundDb) {\n\t\t// Check if playground user has toggled edit mode on\n\t\tconst hasEditCookie = cookies.get(\"emdash-edit-mode\")?.value === \"true\";\n\t\treturn runWithContext({ editMode: hasEditCookie, db: playgroundDb, dbIsIsolated: true }, () =>\n\t\t\tnext(),\n\t\t);\n\t}\n\n\t// Fast path: check for CMS signals before doing any work\n\tconst hasEditCookie = cookies.get(\"emdash-edit-mode\")?.value === \"true\";\n\tconst hasPreviewToken = url.searchParams.has(\"_preview\");\n\n\t// No CMS signals and not an editor → skip everything (zero overhead)\n\tif (!hasEditCookie && !hasPreviewToken && !isEditor) {\n\t\treturn next();\n\t}\n\n\t// Determine edit mode: cookie AND authenticated editor\n\tconst editMode = hasEditCookie && isEditor;\n\n\t// Read locale from Astro's i18n routing\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Astro context includes currentLocale when i18n is configured\n\tconst locale = (context as { currentLocale?: string }).currentLocale;\n\n\t// Verify preview token if present.\n\t// The preview secret is resolved via `resolveSecretsCached`: env wins,\n\t// otherwise a DB-stored value is read (or generated on first need).\n\t// `emdash.db` is set by the runtime middleware which runs first; the\n\t// only path where it's missing is a runtime-init failure.\n\tlet preview: { collection: string; id: string } | undefined;\n\tif (hasPreviewToken) {\n\t\tconst db = context.locals.emdash?.db;\n\t\tif (db) {\n\t\t\tconst { previewSecret } = await resolveSecretsCached(db);\n\t\t\tconst result = await verifyPreviewToken({ url, secret: previewSecret });\n\t\t\tif (result.valid) {\n\t\t\t\tconst { collection, id } = parseContentId(result.payload.cid);\n\t\t\t\tpreview = { collection, id };\n\t\t\t}\n\t\t} else {\n\t\t\tconsole.warn(\n\t\t\t\t\"[emdash] Preview token present but EmDash runtime not initialized; preview disabled.\",\n\t\t\t);\n\t\t}\n\t}\n\n\t// If we have CMS signals, wrap in ALS context\n\tconst needsContext = hasEditCookie || hasPreviewToken;\n\n\tif (needsContext) {\n\t\t// Merge with any outer ALS context (e.g. the per-request D1 session db\n\t\t// set by the runtime middleware). `storage.run()` replaces the store\n\t\t// wholesale, so without the spread the outer `db` would be lost and\n\t\t// loaders would fall back to the singleton non-session dialect.\n\t\tconst parent = getRequestContext();\n\t\treturn runWithContext({ ...parent, editMode, preview, locale }, async () => {\n\t\t\tlet response = await next();\n\n\t\t\t// Preview responses must not be cached -- draft content could leak past token expiry.\n\t\t\t// Clone the response before modifying headers — the original may be immutable.\n\t\t\tif (preview) {\n\t\t\t\tresponse = new Response(response.body, response);\n\t\t\t\tresponse.headers.set(\"Cache-Control\", \"private, no-store\");\n\t\t\t}\n\n\t\t\t// Inject toolbar for authenticated editors\n\t\t\tif (isEditor) {\n\t\t\t\tconst toolbarHtml = renderToolbar({\n\t\t\t\t\teditMode,\n\t\t\t\t\tisPreview: !!preview,\n\t\t\t\t});\n\t\t\t\treturn injectToolbar(response, toolbarHtml);\n\t\t\t}\n\n\t\t\treturn response;\n\t\t});\n\t}\n\n\t// Editor without CMS signals — no ALS needed, but inject toolbar\n\tif (isEditor) {\n\t\tconst response = await next();\n\t\tconst toolbarHtml = renderToolbar({\n\t\t\teditMode: false,\n\t\t\tisPreview: false,\n\t\t});\n\t\treturn injectToolbar(response, toolbarHtml);\n\t}\n\n\treturn next();\n});\n\nexport default onRequest;\n"],"mappings":";;;;;;;;AAaA,SAAgB,cAAc,QAA+B;CAC5D,MAAM,EAAE,UAAU,cAAc;AAEhC,QAAO;;2CAEmC,SAAS,kBAAkB,UAAU;;;;;;;uDAOzB,WAAW,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACDjF,eAAe,cAAc,UAAoB,aAAwC;AAExF,KAAI,CADgB,SAAS,QAAQ,IAAI,eAAe,EACtC,SAAS,YAAY,CAAE,QAAO;CAEhD,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,KAAI,CAAC,KAAK,SAAS,UAAU,CAAE,QAAO,IAAI,SAAS,MAAM,SAAS;CAElE,MAAM,WAAW,KAAK,QAAQ,WAAW,GAAG,YAAY,SAAS;AACjE,QAAO,IAAI,SAAS,UAAU;EAC7B,QAAQ,SAAS;EACjB,SAAS,SAAS;EAClB,CAAC;;AAGH,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,SAAS,QAAQ;AAGzB,KAAI,IAAI,SAAS,WAAW,WAAW,CACtC,QAAO,MAAM;CAId,MAAM,EAAE,SAAS,QAAQ;CACzB,MAAM,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ;CAUxC,MAAM,eAAe,QAAQ,OAAO;AACpC,KAAI,aAGH,QAAO,eAAe;EAAE,UADF,QAAQ,IAAI,mBAAmB,EAAE,UAAU;EAChB,IAAI;EAAc,cAAc;EAAM,QACtF,MAAM,CACN;CAIF,MAAM,gBAAgB,QAAQ,IAAI,mBAAmB,EAAE,UAAU;CACjE,MAAM,kBAAkB,IAAI,aAAa,IAAI,WAAW;AAGxD,KAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,SAC1C,QAAO,MAAM;CAId,MAAM,WAAW,iBAAiB;CAIlC,MAAM,SAAU,QAAuC;CAOvD,IAAI;AACJ,KAAI,iBAAiB;EACpB,MAAM,KAAK,QAAQ,OAAO,QAAQ;AAClC,MAAI,IAAI;GACP,MAAM,EAAE,kBAAkB,MAAM,qBAAqB,GAAG;GACxD,MAAM,SAAS,MAAM,mBAAmB;IAAE;IAAK,QAAQ;IAAe,CAAC;AACvE,OAAI,OAAO,OAAO;IACjB,MAAM,EAAE,YAAY,OAAO,eAAe,OAAO,QAAQ,IAAI;AAC7D,cAAU;KAAE;KAAY;KAAI;;QAG7B,SAAQ,KACP,uFACA;;AAOH,KAFqB,iBAAiB,gBAQrC,QAAO,eAAe;EAAE,GADT,mBAAmB;EACC;EAAU;EAAS;EAAQ,EAAE,YAAY;EAC3E,IAAI,WAAW,MAAM,MAAM;AAI3B,MAAI,SAAS;AACZ,cAAW,IAAI,SAAS,SAAS,MAAM,SAAS;AAChD,YAAS,QAAQ,IAAI,iBAAiB,oBAAoB;;AAI3D,MAAI,UAAU;GACb,MAAM,cAAc,cAAc;IACjC;IACA,WAAW,CAAC,CAAC;IACb,CAAC;AACF,UAAO,cAAc,UAAU,YAAY;;AAG5C,SAAO;GACN;AAIH,KAAI,SAMH,QAAO,cALU,MAAM,MAAM,EACT,cAAc;EACjC,UAAU;EACV,WAAW;EACX,CAAC,CACyC;AAG5C,QAAO,MAAM;EACZ"}

package/dist/astro/middleware/setup.mjs

@@ -1,4 +1,4 @@
-import { t as getAuthMode } from "../../mode-DPRPvJYm.mjs";
+import { t as getAuthMode } from "../../mode-CaaiebZI.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/setup.ts

package/dist/astro/middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/astro/middleware.ts"],"mappings":";;;;;;AAwQA;;;cAAa,SAAA,EA4UX,KAAA,CA5UoB,iBAAA"}
+{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/astro/middleware.ts"],"mappings":";;;;;;AAkRA;;;cAAa,SAAA,EA6UX,KAAA,CA7UoB,iBAAA"}