emdash 0.20.0 → 0.22.0

package/dist/astro/routes/api/search/suggest.mjs

@@ -1,14 +1,15 @@
 import "../../../../dialect-helpers-DRI5pyY3.mjs";
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import "../../../../fts-manager-1RgHmopc.mjs";
-import "../../../../loader-ZN1ll-d-.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
-import { i as parseQuery, t as isParseError } from "../../../../parse-CrGndy1A.mjs";
-import { N as searchSuggestQuery } from "../../../../redirects-CCbCqCCd.mjs";
-import "../../../../byline-fields-8TMtkBnH.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import "../../../../fts-manager-DtiWqwNJ.mjs";
+import "../../../../loader-C8Z48Uof.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../parse-qrHlnzTy.mjs";
+import { N as searchSuggestQuery } from "../../../../redirects-DUvXgzCX.mjs";
+import "../../../../byline-fields-53i9Et0x.mjs";
+import "../../../../status-CB2basWJ.mjs";
 import "../../../../api/schemas/index.mjs";
-import { a as getSuggestions } from "../../../../search-B3SGZw91.mjs";
+import { a as getSuggestions } from "../../../../search-D9FkoM-k.mjs";
 
 //#region src/astro/routes/api/search/suggest.ts
 const prerender = false;

package/dist/astro/routes/api/search/suggest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"suggest.mjs","names":[],"sources":["../../../../../src/astro/routes/api/search/suggest.ts"],"sourcesContent":["/**\n * Search suggestions endpoint - Autocomplete\n *\n * GET /_emdash/api/search/suggest?q=hel&limit=5\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { searchSuggestQuery } from \"#api/schemas.js\";\nimport { getSuggestions } from \"#search/index.js\";\n\nexport const prerender = false;\n\n/**\n * Get search suggestions for autocomplete\n *\n * Query parameters:\n * - q: Partial search query (required)\n * - collections: Comma-separated list of collection slugs (optional)\n * - limit: Maximum suggestions (optional, defaults to 5)\n */\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash not configured\", 500);\n\t}\n\n\tconst query = parseQuery(url, searchSuggestQuery);\n\tif (isParseError(query)) return query;\n\n\tconst collections = query.collections\n\t\t? query.collections.split(\",\").map((c: string) => c.trim())\n\t\t: undefined;\n\n\ttry {\n\t\t// Verify FTS indexes are healthy on first use. See search/index.ts.\n\t\tawait emdash.ensureSearchHealthy?.();\n\n\t\tconst suggestions = await getSuggestions(emdash.db, query.q, {\n\t\t\tcollections,\n\t\t\tlocale: query.locale,\n\t\t\tlimit: query.limit,\n\t\t});\n\n\t\treturn apiSuccess({ items: suggestions });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get suggestions\", \"SUGGESTION_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,YAAY;;;;;;;;;AAUzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,yBAAyB,IAAI;CAGhE,MAAM,QAAQ,WAAW,KAAK,mBAAmB;AACjD,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,cAAc,MAAM,cACvB,MAAM,YAAY,MAAM,IAAI,CAAC,KAAK,MAAc,EAAE,MAAM,CAAC,GACzD;AAEH,KAAI;AAEH,QAAM,OAAO,uBAAuB;AAQpC,SAAO,WAAW,EAAE,OANA,MAAM,eAAe,OAAO,IAAI,MAAM,GAAG;GAC5D;GACA,QAAQ,MAAM;GACd,OAAO,MAAM;GACb,CAAC,EAEsC,CAAC;UACjC,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,mBAAmB"}
+{"version":3,"file":"suggest.mjs","names":[],"sources":["../../../../../src/astro/routes/api/search/suggest.ts"],"sourcesContent":["/**\n * Search suggestions endpoint - Autocomplete\n *\n * GET /_emdash/api/search/suggest?q=hel&limit=5\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { searchSuggestQuery } from \"#api/schemas.js\";\nimport { getSuggestions } from \"#search/index.js\";\n\nexport const prerender = false;\n\n/**\n * Get search suggestions for autocomplete\n *\n * Query parameters:\n * - q: Partial search query (required)\n * - collections: Comma-separated list of collection slugs (optional)\n * - limit: Maximum suggestions (optional, defaults to 5)\n */\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash not configured\", 500);\n\t}\n\n\tconst query = parseQuery(url, searchSuggestQuery);\n\tif (isParseError(query)) return query;\n\n\tconst collections = query.collections\n\t\t? query.collections.split(\",\").map((c: string) => c.trim())\n\t\t: undefined;\n\n\ttry {\n\t\t// Verify FTS indexes are healthy on first use. See search/index.ts.\n\t\tawait emdash.ensureSearchHealthy?.();\n\n\t\tconst suggestions = await getSuggestions(emdash.db, query.q, {\n\t\t\tcollections,\n\t\t\tlocale: query.locale,\n\t\t\tlimit: query.limit,\n\t\t});\n\n\t\treturn apiSuccess({ items: suggestions });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get suggestions\", \"SUGGESTION_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAaA,MAAa,YAAY;;;;;;;;;AAUzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,yBAAyB,IAAI;CAGhE,MAAM,QAAQ,WAAW,KAAK,mBAAmB;AACjD,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,cAAc,MAAM,cACvB,MAAM,YAAY,MAAM,IAAI,CAAC,KAAK,MAAc,EAAE,MAAM,CAAC,GACzD;AAEH,KAAI;AAEH,QAAM,OAAO,uBAAuB;AAQpC,SAAO,WAAW,EAAE,OANA,MAAM,eAAe,OAAO,IAAI,MAAM,GAAG;GAC5D;GACA,QAAQ,MAAM;GACd,OAAO,MAAM;GACb,CAAC,EAEsC,CAAC;UACjC,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,mBAAmB"}

package/dist/astro/routes/api/sections/_slug_.mjs

@@ -1,14 +1,15 @@
 import "../../../../dialect-helpers-DRI5pyY3.mjs";
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import "../../../../loader-ZN1ll-d-.mjs";
-import { a as handleSectionUpdate, n as handleSectionDelete, r as handleSectionGet } from "../../../../sections-D_lVzwRZ.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CrGndy1A.mjs";
-import { B as updateSectionBody } from "../../../../redirects-CCbCqCCd.mjs";
-import "../../../../byline-fields-8TMtkBnH.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import "../../../../loader-C8Z48Uof.mjs";
+import { a as handleSectionUpdate, n as handleSectionDelete, r as handleSectionGet } from "../../../../sections-DWYZo6HK.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-qrHlnzTy.mjs";
+import { B as updateSectionBody } from "../../../../redirects-DUvXgzCX.mjs";
+import "../../../../byline-fields-53i9Et0x.mjs";
+import "../../../../status-CB2basWJ.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../authorize-DsMSVSaY.mjs";
+import { n as requirePerm } from "../../../../authorize-C0EYoUeV.mjs";
 
 //#region src/astro/routes/api/sections/[slug].ts
 const prerender = false;

package/dist/astro/routes/api/sections/_slug_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_slug_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/sections/[slug].ts"],"sourcesContent":["/**\n * Section by slug endpoints\n *\n * GET    /_emdash/api/sections/:slug - Get section\n * PUT    /_emdash/api/sections/:slug - Update section\n * DELETE /_emdash/api/sections/:slug - Delete section\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleSectionDelete,\n\thandleSectionGet,\n\thandleSectionUpdate,\n} from \"#api/handlers/sections.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { updateSectionBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\tconst { slug } = params;\n\n\tconst denied = requirePerm(user, \"sections:read\");\n\tif (denied) return denied;\n\n\tif (!slug) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"slug is required\", 400);\n\t}\n\n\ttry {\n\t\tconst result = await handleSectionGet(db, slug);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch section\", \"SECTION_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\tconst { slug } = params;\n\n\tconst denied = requirePerm(user, \"sections:manage\");\n\tif (denied) return denied;\n\n\tif (!slug) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"slug is required\", 400);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, updateSectionBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSectionUpdate(db, slug, body);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update section\", \"SECTION_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\tconst { slug } = params;\n\n\tconst denied = requirePerm(user, \"sections:manage\");\n\tif (denied) return denied;\n\n\tif (!slug) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"slug is required\", 400);\n\t}\n\n\ttry {\n\t\tconst result = await handleSectionDelete(db, slug);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete section\", \"SECTION_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAoBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAClB,MAAM,EAAE,SAAS;CAEjB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,KACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;AAEH,SAAO,aADQ,MAAM,iBAAiB,IAAI,KAAK,CACpB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,oBAAoB;;;AAI3E,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAClB,MAAM,EAAE,SAAS;CAEjB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,KACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,oBAAoB,IAAI,MAAM,KAAK,CAC7B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;AAI/E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAClB,MAAM,EAAE,SAAS;CAEjB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,KACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;AAEH,SAAO,aADQ,MAAM,oBAAoB,IAAI,KAAK,CACvB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}
+{"version":3,"file":"_slug_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/sections/[slug].ts"],"sourcesContent":["/**\n * Section by slug endpoints\n *\n * GET    /_emdash/api/sections/:slug - Get section\n * PUT    /_emdash/api/sections/:slug - Update section\n * DELETE /_emdash/api/sections/:slug - Delete section\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleSectionDelete,\n\thandleSectionGet,\n\thandleSectionUpdate,\n} from \"#api/handlers/sections.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { updateSectionBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\tconst { slug } = params;\n\n\tconst denied = requirePerm(user, \"sections:read\");\n\tif (denied) return denied;\n\n\tif (!slug) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"slug is required\", 400);\n\t}\n\n\ttry {\n\t\tconst result = await handleSectionGet(db, slug);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch section\", \"SECTION_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\tconst { slug } = params;\n\n\tconst denied = requirePerm(user, \"sections:manage\");\n\tif (denied) return denied;\n\n\tif (!slug) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"slug is required\", 400);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, updateSectionBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSectionUpdate(db, slug, body);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update section\", \"SECTION_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\tconst { slug } = params;\n\n\tconst denied = requirePerm(user, \"sections:manage\");\n\tif (denied) return denied;\n\n\tif (!slug) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"slug is required\", 400);\n\t}\n\n\ttry {\n\t\tconst result = await handleSectionDelete(db, slug);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete section\", \"SECTION_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAoBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAClB,MAAM,EAAE,SAAS;CAEjB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,KACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;AAEH,SAAO,aADQ,MAAM,iBAAiB,IAAI,KAAK,CACpB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,oBAAoB;;;AAI3E,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAClB,MAAM,EAAE,SAAS;CAEjB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,KACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,oBAAoB,IAAI,MAAM,KAAK,CAC7B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;AAI/E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAClB,MAAM,EAAE,SAAS;CAEjB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,KACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;AAEH,SAAO,aADQ,MAAM,oBAAoB,IAAI,KAAK,CACvB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}

package/dist/astro/routes/api/sections/index.mjs

@@ -1,14 +1,15 @@
 import "../../../../dialect-helpers-DRI5pyY3.mjs";
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import "../../../../loader-ZN1ll-d-.mjs";
-import { i as handleSectionList, t as handleSectionCreate } from "../../../../sections-D_lVzwRZ.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../error-RwM4dD35.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-CrGndy1A.mjs";
-import { I as createSectionBody, z as sectionsListQuery } from "../../../../redirects-CCbCqCCd.mjs";
-import "../../../../byline-fields-8TMtkBnH.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import "../../../../loader-C8Z48Uof.mjs";
+import { i as handleSectionList, t as handleSectionCreate } from "../../../../sections-DWYZo6HK.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../error-BQ1pxs0L.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-qrHlnzTy.mjs";
+import { I as createSectionBody, z as sectionsListQuery } from "../../../../redirects-DUvXgzCX.mjs";
+import "../../../../byline-fields-53i9Et0x.mjs";
+import "../../../../status-CB2basWJ.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../authorize-DsMSVSaY.mjs";
+import { n as requirePerm } from "../../../../authorize-C0EYoUeV.mjs";
 
 //#region src/astro/routes/api/sections/index.ts
 const prerender = false;

package/dist/astro/routes/api/sections/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/sections/index.ts"],"sourcesContent":["/**\n * Sections list and create endpoints\n *\n * GET  /_emdash/api/sections - List all sections (with filters)\n * POST /_emdash/api/sections - Create section\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleSectionCreate, handleSectionList } from \"#api/handlers/sections.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createSectionBody, sectionsListQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\n\tconst denied = requirePerm(user, \"sections:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst query = parseQuery(url, sectionsListQuery);\n\t\tif (isParseError(query)) return query;\n\n\t\tconst result = await handleSectionList(db, query);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch sections\", \"SECTION_LIST_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\n\tconst denied = requirePerm(user, \"sections:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createSectionBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSectionCreate(db, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create section\", \"SECTION_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAElB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,QAAQ,WAAW,KAAK,kBAAkB;AAChD,MAAI,aAAa,MAAM,CAAE,QAAO;AAGhC,SAAO,aADQ,MAAM,kBAAkB,IAAI,MAAM,CACtB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,qBAAqB;;;AAI7E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAElB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,oBAAoB,IAAI,KAAK,EACtB,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/sections/index.ts"],"sourcesContent":["/**\n * Sections list and create endpoints\n *\n * GET  /_emdash/api/sections - List all sections (with filters)\n * POST /_emdash/api/sections - Create section\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleSectionCreate, handleSectionList } from \"#api/handlers/sections.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createSectionBody, sectionsListQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\n\tconst denied = requirePerm(user, \"sections:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst query = parseQuery(url, sectionsListQuery);\n\t\tif (isParseError(query)) return query;\n\n\t\tconst result = await handleSectionList(db, query);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch sections\", \"SECTION_LIST_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst db = emdash.db;\n\n\tconst denied = requirePerm(user, \"sections:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createSectionBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSectionCreate(db, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create section\", \"SECTION_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAElB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,QAAQ,WAAW,KAAK,kBAAkB;AAChD,MAAI,aAAa,MAAM,CAAE,QAAO;AAGhC,SAAO,aADQ,MAAM,kBAAkB,IAAI,MAAM,CACtB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,qBAAqB;;;AAI7E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,KAAK,OAAO;CAElB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,oBAAoB,IAAI,KAAK,EACtB,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}

package/dist/astro/routes/api/settings/email.mjs

@@ -1,9 +1,9 @@
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import { t as OptionsRepository } from "../../../../options-BPCVnesz.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CrGndy1A.mjs";
-import { n as requirePerm } from "../../../../authorize-DsMSVSaY.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import { t as OptionsRepository } from "../../../../options-DTTML-Tx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-qrHlnzTy.mjs";
+import { n as requirePerm } from "../../../../authorize-C0EYoUeV.mjs";
 import { z } from "zod";
 import { escapeHtml } from "@emdash-cms/auth";
 

package/dist/astro/routes/api/settings.mjs

@@ -1,18 +1,21 @@
 import "../../../dialect-helpers-DRI5pyY3.mjs";
-import "../../../base64-CqR-7kqF.mjs";
-import "../../../types-BXSUSAjt.mjs";
-import "../../../media-JOf3pNkw.mjs";
-import "../../../options-BPCVnesz.mjs";
-import "../../../request-cache-D32LpnmI.mjs";
-import "../../../loader-ZN1ll-d-.mjs";
-import "../../../settings-DfxiWY_s.mjs";
-import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-Cv47v9u8.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-RwM4dD35.mjs";
-import { n as parseBody, t as isParseError } from "../../../parse-CrGndy1A.mjs";
-import { P as settingsUpdateBody } from "../../../redirects-CCbCqCCd.mjs";
-import "../../../byline-fields-8TMtkBnH.mjs";
+import "../../../after-B1IIdH3Y.mjs";
+import "../../../object-cache-SEb2IM4Z.mjs";
+import "../../../base64-CmWvODNW.mjs";
+import "../../../types-DXOIbece.mjs";
+import "../../../media-Bw0sA6rb.mjs";
+import "../../../options-DTTML-Tx.mjs";
+import "../../../request-cache-KCNHp_RJ.mjs";
+import "../../../loader-C8Z48Uof.mjs";
+import "../../../settings-yaxu9mU-.mjs";
+import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-DUrVDN0c.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-BQ1pxs0L.mjs";
+import { n as parseBody, t as isParseError } from "../../../parse-qrHlnzTy.mjs";
+import { P as settingsUpdateBody } from "../../../redirects-DUvXgzCX.mjs";
+import "../../../byline-fields-53i9Et0x.mjs";
+import "../../../status-CB2basWJ.mjs";
 import "../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../authorize-DsMSVSaY.mjs";
+import { n as requirePerm } from "../../../authorize-C0EYoUeV.mjs";
 
 //#region src/astro/routes/api/settings.ts
 const prerender = false;

package/dist/astro/routes/api/settings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings.mjs","names":[],"sources":["../../../../src/astro/routes/api/settings.ts"],"sourcesContent":["/**\n * Site Settings API endpoint\n *\n * GET  /_emdash/api/settings - Get all site settings\n * POST /_emdash/api/settings - Update site settings\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleSettingsGet, handleSettingsUpdate } from \"#api/handlers/settings.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { settingsUpdateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n/**\n * GET /_emdash/api/settings\n *\n * Returns all site settings as a JSON object.\n * Unset values are undefined. Media references include resolved URLs.\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst result = await handleSettingsGet(emdash.db, emdash.storage);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get settings\", \"SETTINGS_READ_ERROR\");\n\t}\n};\n\n/**\n * POST /_emdash/api/settings\n *\n * Updates site settings. Accepts a partial settings object.\n * Merges with existing settings and returns the updated settings.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, settingsUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSettingsUpdate(emdash.db, emdash.storage, body);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update settings\", \"SETTINGS_UPDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;;;;;;;AAQzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI;AAEH,SAAO,aADQ,MAAM,kBAAkB,OAAO,IAAI,OAAO,QAAQ,CACtC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,sBAAsB;;;;;;;;;AAU5E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,OAAO,SAAS,KAAK,CAC/C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}
+{"version":3,"file":"settings.mjs","names":[],"sources":["../../../../src/astro/routes/api/settings.ts"],"sourcesContent":["/**\n * Site Settings API endpoint\n *\n * GET  /_emdash/api/settings - Get all site settings\n * POST /_emdash/api/settings - Update site settings\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleSettingsGet, handleSettingsUpdate } from \"#api/handlers/settings.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { settingsUpdateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n/**\n * GET /_emdash/api/settings\n *\n * Returns all site settings as a JSON object.\n * Unset values are undefined. Media references include resolved URLs.\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst result = await handleSettingsGet(emdash.db, emdash.storage);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get settings\", \"SETTINGS_READ_ERROR\");\n\t}\n};\n\n/**\n * POST /_emdash/api/settings\n *\n * Updates site settings. Accepts a partial settings object.\n * Merges with existing settings and returns the updated settings.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, settingsUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSettingsUpdate(emdash.db, emdash.storage, body);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update settings\", \"SETTINGS_UPDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;;;;;;;AAQzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI;AAEH,SAAO,aADQ,MAAM,kBAAkB,OAAO,IAAI,OAAO,QAAQ,CACtC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,sBAAsB;;;;;;;;;AAU5E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,OAAO,SAAS,KAAK,CAC/C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}

package/dist/astro/routes/api/setup/admin-verify.mjs

@@ -1,16 +1,17 @@
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import { t as OptionsRepository } from "../../../../options-BPCVnesz.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CrGndy1A.mjs";
-import "../../../../redirects-CCbCqCCd.mjs";
-import { l as setupAdminVerifyBody } from "../../../../byline-fields-8TMtkBnH.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import { t as OptionsRepository } from "../../../../options-DTTML-Tx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-qrHlnzTy.mjs";
+import "../../../../redirects-DUvXgzCX.mjs";
+import { l as setupAdminVerifyBody } from "../../../../byline-fields-53i9Et0x.mjs";
+import "../../../../status-CB2basWJ.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../public-url-BFVC2OTJ.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../allowed-origins-B1u7Qnvg.mjs";
-import { n as createChallengeStore } from "../../../../challenge-store-DXX3rfdI.mjs";
-import { t as getPasskeyConfig } from "../../../../passkey-config-C3QgnQnU.mjs";
-import { t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-C9aFzb94.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-8lFyQ8ZF.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../allowed-origins-DjlhyfNN.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-C6E_kWTs.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-BJTbcnI5.mjs";
+import { t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-DFWG-J5c.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { Role, secureCompare } from "@emdash-cms/auth";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/setup/admin-verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin-verify.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin-verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/admin/verify\n *\n * Complete admin creation by verifying the passkey registration\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { Role, secureCompare } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupAdminVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { SETUP_NONCE_COOKIE } from \"#auth/setup-nonce.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ cookies, request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Check if setup is already complete\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\treturn apiError(\"SETUP_COMPLETE\", \"Setup already complete\", 400);\n\t\t}\n\n\t\t// Check if any users exist\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst userCount = await adapter.countUsers();\n\n\t\tif (userCount > 0) {\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// Get setup state\n\t\tconst setupState = await options.get<{\n\t\t\tstep?: string;\n\t\t\temail?: string;\n\t\t\tname?: string | null;\n\t\t\tnonce?: string;\n\t\t}>(\"emdash:setup_state\");\n\n\t\tif (!setupState || setupState.step !== \"admin\") {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Verify the session nonce. The cookie was minted by POST /setup/admin\n\t\t// and stored alongside setup_state; presenting a matching cookie is\n\t\t// proof that this verify call comes from the same browser that\n\t\t// started the admin step. Constant-time compare to avoid leaking the\n\t\t// stored value through timing.\n\t\tconst cookieNonce = cookies.get(SETUP_NONCE_COOKIE)?.value;\n\t\tif (!setupState.nonce || !cookieNonce || !secureCompare(cookieNonce, setupState.nonce)) {\n\t\t\treturn apiError(\n\t\t\t\t\"INVALID_STATE\",\n\t\t\t\t\"Setup session expired or tampered with. Please restart the admin step.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\tif (!setupState.email) {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupAdminVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Create the admin user\n\t\tconst user = await adapter.createUser({\n\t\t\temail: setupState.email,\n\t\t\tname: setupState.name ?? null,\n\t\t\trole: Role.ADMIN,\n\t\t\temailVerified: false, // No email verification for first user\n\t\t});\n\n\t\t// Register the passkey\n\t\tawait registerPasskey(adapter, user.id, verified, \"Setup passkey\");\n\n\t\t// Mark setup as complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Clean up setup state and the session nonce cookie\n\t\tawait options.delete(\"emdash:setup_state\");\n\t\tcookies.delete(SETUP_NONCE_COOKIE, { path: \"/_emdash/\" });\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to verify admin setup\", \"SETUP_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAgBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,SAAS,aAAa;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAEhE,MAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;EAIjE,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAG9C,MAFkB,MAAM,QAAQ,YAAY,GAE5B,EACf,QAAO,SAAS,gBAAgB,6BAA6B,IAAI;EAIlE,MAAM,aAAa,MAAM,QAAQ,IAK9B,qBAAqB;AAExB,MAAI,CAAC,cAAc,WAAW,SAAS,QACtC,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAQpF,MAAM,cAAc,QAAQ,IAAI,mBAAmB,EAAE;AACrD,MAAI,CAAC,WAAW,SAAS,CAAC,eAAe,CAAC,cAAc,aAAa,WAAW,MAAM,CACrF,QAAO,SACN,iBACA,0EACA,IACA;AAGF,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAIpF,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,WAAY,MAAM,QAAQ,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAEtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,MAAM,OAAO,MAAM,QAAQ,WAAW;GACrC,OAAO,WAAW;GAClB,MAAM,WAAW,QAAQ;GACzB,MAAM,KAAK;GACX,eAAe;GACf,CAAC;AAGF,QAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,gBAAgB;AAGlE,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,QAAM,QAAQ,OAAO,qBAAqB;AAC1C,UAAQ,OAAO,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzD,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}
+{"version":3,"file":"admin-verify.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin-verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/admin/verify\n *\n * Complete admin creation by verifying the passkey registration\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { Role, secureCompare } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupAdminVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { SETUP_NONCE_COOKIE } from \"#auth/setup-nonce.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ cookies, request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Check if setup is already complete\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\treturn apiError(\"SETUP_COMPLETE\", \"Setup already complete\", 400);\n\t\t}\n\n\t\t// Check if any users exist\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst userCount = await adapter.countUsers();\n\n\t\tif (userCount > 0) {\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// Get setup state\n\t\tconst setupState = await options.get<{\n\t\t\tstep?: string;\n\t\t\temail?: string;\n\t\t\tname?: string | null;\n\t\t\tnonce?: string;\n\t\t}>(\"emdash:setup_state\");\n\n\t\tif (!setupState || setupState.step !== \"admin\") {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Verify the session nonce. The cookie was minted by POST /setup/admin\n\t\t// and stored alongside setup_state; presenting a matching cookie is\n\t\t// proof that this verify call comes from the same browser that\n\t\t// started the admin step. Constant-time compare to avoid leaking the\n\t\t// stored value through timing.\n\t\tconst cookieNonce = cookies.get(SETUP_NONCE_COOKIE)?.value;\n\t\tif (!setupState.nonce || !cookieNonce || !secureCompare(cookieNonce, setupState.nonce)) {\n\t\t\treturn apiError(\n\t\t\t\t\"INVALID_STATE\",\n\t\t\t\t\"Setup session expired or tampered with. Please restart the admin step.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\tif (!setupState.email) {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupAdminVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Create the admin user\n\t\tconst user = await adapter.createUser({\n\t\t\temail: setupState.email,\n\t\t\tname: setupState.name ?? null,\n\t\t\trole: Role.ADMIN,\n\t\t\temailVerified: false, // No email verification for first user\n\t\t});\n\n\t\t// Register the passkey\n\t\tawait registerPasskey(adapter, user.id, verified, \"Setup passkey\");\n\n\t\t// Mark setup as complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Clean up setup state and the session nonce cookie\n\t\tawait options.delete(\"emdash:setup_state\");\n\t\tcookies.delete(SETUP_NONCE_COOKIE, { path: \"/_emdash/\" });\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to verify admin setup\", \"SETUP_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAgBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,SAAS,aAAa;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAEhE,MAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;EAIjE,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAG9C,MAFkB,MAAM,QAAQ,YAAY,GAE5B,EACf,QAAO,SAAS,gBAAgB,6BAA6B,IAAI;EAIlE,MAAM,aAAa,MAAM,QAAQ,IAK9B,qBAAqB;AAExB,MAAI,CAAC,cAAc,WAAW,SAAS,QACtC,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAQpF,MAAM,cAAc,QAAQ,IAAI,mBAAmB,EAAE;AACrD,MAAI,CAAC,WAAW,SAAS,CAAC,eAAe,CAAC,cAAc,aAAa,WAAW,MAAM,CACrF,QAAO,SACN,iBACA,0EACA,IACA;AAGF,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAIpF,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,WAAY,MAAM,QAAQ,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAEtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,MAAM,OAAO,MAAM,QAAQ,WAAW;GACrC,OAAO,WAAW;GAClB,MAAM,WAAW,QAAQ;GACzB,MAAM,KAAK;GACX,eAAe;GACf,CAAC;AAGF,QAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,gBAAgB;AAGlE,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,QAAM,QAAQ,OAAO,qBAAqB;AAC1C,UAAQ,OAAO,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzD,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}

package/dist/astro/routes/api/setup/admin.mjs

@@ -1,15 +1,16 @@
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import { t as OptionsRepository } from "../../../../options-BPCVnesz.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CrGndy1A.mjs";
-import "../../../../redirects-CCbCqCCd.mjs";
-import { c as setupAdminBody } from "../../../../byline-fields-8TMtkBnH.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import { t as OptionsRepository } from "../../../../options-DTTML-Tx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-qrHlnzTy.mjs";
+import "../../../../redirects-DUvXgzCX.mjs";
+import { c as setupAdminBody } from "../../../../byline-fields-53i9Et0x.mjs";
+import "../../../../status-CB2basWJ.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../public-url-BFVC2OTJ.mjs";
-import { n as createChallengeStore } from "../../../../challenge-store-DXX3rfdI.mjs";
-import { t as getPasskeyConfig } from "../../../../passkey-config-C3QgnQnU.mjs";
-import { n as SETUP_NONCE_MAX_AGE_SECONDS, t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-C9aFzb94.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-8lFyQ8ZF.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-C6E_kWTs.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-BJTbcnI5.mjs";
+import { n as SETUP_NONCE_MAX_AGE_SECONDS, t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-DFWG-J5c.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateToken } from "@emdash-cms/auth";
 import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/setup/admin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/admin\n *\n * Step 3 of setup: Start admin creation by returning passkey registration options\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateToken } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupAdminBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { SETUP_NONCE_COOKIE, SETUP_NONCE_MAX_AGE_SECONDS } from \"#auth/setup-nonce.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ cookies, request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Check if setup is already complete\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\treturn apiError(\"SETUP_COMPLETE\", \"Setup already complete\", 400);\n\t\t}\n\n\t\t// Check if any users exist\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst userCount = await adapter.countUsers();\n\n\t\tif (userCount > 0) {\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupAdminBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Preserve title/tagline from step 1 by reading existing setup state\n\t\t// before we overwrite it below.\n\t\tconst existingState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\n\t\t// Mint a fresh session nonce. This binds the follow-up\n\t\t// /setup/admin/verify call to the same browser that made this\n\t\t// request, so an unauthenticated attacker on another host cannot\n\t\t// substitute their own email into the setup state during the\n\t\t// setup window. Rotates on every call so a legitimate retry\n\t\t// always gets a working session.\n\t\tconst nonce = generateToken();\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\t// Create a temporary user object for registration options\n\t\t// (not persisted until passkey is verified)\n\t\tconst tempUser = {\n\t\t\tid: `setup-${Date.now()}`, // Temporary ID\n\t\t\temail: body.email.toLowerCase(),\n\t\t\tname: body.name || null,\n\t\t};\n\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\ttempUser,\n\t\t\t[], // No existing credentials\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Store the nonce alongside the rest of the setup state, preserving\n\t\t// title/tagline from step 1. The verify endpoint will constant-time\n\t\t// compare the nonce with the incoming cookie.\n\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t...existingState,\n\t\t\tstep: \"admin\",\n\t\t\temail: body.email.toLowerCase(),\n\t\t\tname: body.name || null,\n\t\t\ttempUserId: tempUser.id,\n\t\t\tnonce,\n\t\t});\n\n\t\t// HttpOnly + SameSite=Strict + path-scoped. The cookie must not be\n\t\t// accessible to JS (nothing in the admin UI needs to read it) and\n\t\t// must not be sent on cross-site navigations. The /_emdash/ path\n\t\t// scope keeps it away from user-authored frontend code.\n\t\t//\n\t\t// Derive `secure` from the public origin, not the internal request\n\t\t// URL. Behind a TLS-terminating reverse proxy the internal hop is\n\t\t// often `http:` while the browser-facing origin is `https:` —\n\t\t// using `url.protocol` there would drop the Secure flag on a\n\t\t// sensitive cookie over the public HTTPS connection.\n\t\tconst publicOrigin = new URL(siteUrl);\n\t\tcookies.set(SETUP_NONCE_COOKIE, nonce, {\n\t\t\tpath: \"/_emdash/\",\n\t\t\thttpOnly: true,\n\t\t\tsameSite: \"strict\",\n\t\t\tsecure: publicOrigin.protocol === \"https:\",\n\t\t\tmaxAge: SETUP_NONCE_MAX_AGE_SECONDS,\n\t\t});\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: registrationOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create admin\", \"SETUP_ADMIN_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,SAAS,aAAa;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAEhE,MAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAOjE,MAFkB,MADF,oBAAoB,OAAO,GAAG,CACd,YAAY,GAE5B,EACf,QAAO,SAAS,gBAAgB,6BAA6B,IAAI;EAIlE,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,gBAAgB,MAAM,QAAQ,IAA6B,qBAAqB;EAQtF,MAAM,QAAQ,eAAe;EAG7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,WAAY,MAAM,QAAQ,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EACpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,QAAQ;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAItD,MAAM,WAAW;GAChB,IAAI,SAAS,KAAK,KAAK;GACvB,OAAO,KAAK,MAAM,aAAa;GAC/B,MAAM,KAAK,QAAQ;GACnB;EAED,MAAM,sBAAsB,MAAM,4BACjC,eACA,UACA,EAAE,EACF,eACA;AAKD,QAAM,QAAQ,IAAI,sBAAsB;GACvC,GAAG;GACH,MAAM;GACN,OAAO,KAAK,MAAM,aAAa;GAC/B,MAAM,KAAK,QAAQ;GACnB,YAAY,SAAS;GACrB;GACA,CAAC;EAYF,MAAM,eAAe,IAAI,IAAI,QAAQ;AACrC,UAAQ,IAAI,oBAAoB,OAAO;GACtC,MAAM;GACN,UAAU;GACV,UAAU;GACV,QAAQ,aAAa,aAAa;GAClC,QAAQ;GACR,CAAC;AAEF,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,oBAAoB"}
+{"version":3,"file":"admin.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/admin\n *\n * Step 3 of setup: Start admin creation by returning passkey registration options\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateToken } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupAdminBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { SETUP_NONCE_COOKIE, SETUP_NONCE_MAX_AGE_SECONDS } from \"#auth/setup-nonce.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ cookies, request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Check if setup is already complete\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\treturn apiError(\"SETUP_COMPLETE\", \"Setup already complete\", 400);\n\t\t}\n\n\t\t// Check if any users exist\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst userCount = await adapter.countUsers();\n\n\t\tif (userCount > 0) {\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupAdminBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Preserve title/tagline from step 1 by reading existing setup state\n\t\t// before we overwrite it below.\n\t\tconst existingState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\n\t\t// Mint a fresh session nonce. This binds the follow-up\n\t\t// /setup/admin/verify call to the same browser that made this\n\t\t// request, so an unauthenticated attacker on another host cannot\n\t\t// substitute their own email into the setup state during the\n\t\t// setup window. Rotates on every call so a legitimate retry\n\t\t// always gets a working session.\n\t\tconst nonce = generateToken();\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\t// Create a temporary user object for registration options\n\t\t// (not persisted until passkey is verified)\n\t\tconst tempUser = {\n\t\t\tid: `setup-${Date.now()}`, // Temporary ID\n\t\t\temail: body.email.toLowerCase(),\n\t\t\tname: body.name || null,\n\t\t};\n\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\ttempUser,\n\t\t\t[], // No existing credentials\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Store the nonce alongside the rest of the setup state, preserving\n\t\t// title/tagline from step 1. The verify endpoint will constant-time\n\t\t// compare the nonce with the incoming cookie.\n\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t...existingState,\n\t\t\tstep: \"admin\",\n\t\t\temail: body.email.toLowerCase(),\n\t\t\tname: body.name || null,\n\t\t\ttempUserId: tempUser.id,\n\t\t\tnonce,\n\t\t});\n\n\t\t// HttpOnly + SameSite=Strict + path-scoped. The cookie must not be\n\t\t// accessible to JS (nothing in the admin UI needs to read it) and\n\t\t// must not be sent on cross-site navigations. The /_emdash/ path\n\t\t// scope keeps it away from user-authored frontend code.\n\t\t//\n\t\t// Derive `secure` from the public origin, not the internal request\n\t\t// URL. Behind a TLS-terminating reverse proxy the internal hop is\n\t\t// often `http:` while the browser-facing origin is `https:` —\n\t\t// using `url.protocol` there would drop the Secure flag on a\n\t\t// sensitive cookie over the public HTTPS connection.\n\t\tconst publicOrigin = new URL(siteUrl);\n\t\tcookies.set(SETUP_NONCE_COOKIE, nonce, {\n\t\t\tpath: \"/_emdash/\",\n\t\t\thttpOnly: true,\n\t\t\tsameSite: \"strict\",\n\t\t\tsecure: publicOrigin.protocol === \"https:\",\n\t\t\tmaxAge: SETUP_NONCE_MAX_AGE_SECONDS,\n\t\t});\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: registrationOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create admin\", \"SETUP_ADMIN_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,SAAS,aAAa;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAEhE,MAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAOjE,MAFkB,MADF,oBAAoB,OAAO,GAAG,CACd,YAAY,GAE5B,EACf,QAAO,SAAS,gBAAgB,6BAA6B,IAAI;EAIlE,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,gBAAgB,MAAM,QAAQ,IAA6B,qBAAqB;EAQtF,MAAM,QAAQ,eAAe;EAG7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,WAAY,MAAM,QAAQ,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EACpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,QAAQ;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAItD,MAAM,WAAW;GAChB,IAAI,SAAS,KAAK,KAAK;GACvB,OAAO,KAAK,MAAM,aAAa;GAC/B,MAAM,KAAK,QAAQ;GACnB;EAED,MAAM,sBAAsB,MAAM,4BACjC,eACA,UACA,EAAE,EACF,eACA;AAKD,QAAM,QAAQ,IAAI,sBAAsB;GACvC,GAAG;GACH,MAAM;GACN,OAAO,KAAK,MAAM,aAAa;GAC/B,MAAM,KAAK,QAAQ;GACnB,YAAY,SAAS;GACrB;GACA,CAAC;EAYF,MAAM,eAAe,IAAI,IAAI,QAAQ;AACrC,UAAQ,IAAI,oBAAoB,OAAO;GACtC,MAAM;GACN,UAAU;GACV,UAAU;GACV,QAAQ,aAAa,aAAa;GAClC,QAAQ;GACR,CAAC;AAEF,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,oBAAoB"}

package/dist/astro/routes/api/setup/dev-bypass.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-bypass.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"mappings":";;;cAmBa,SAAA;AAAA,cAmLA,GAAA,EAAK,QAAA;AAAA,cACL,IAAA,EAAM,QAAA"}
+{"version":3,"file":"dev-bypass.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"mappings":";;;cAmBa,SAAA;AAAA,cAuLA,GAAA,EAAK,QAAA;AAAA,cACL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/setup/dev-bypass.mjs

@@ -1,30 +1,32 @@
-import { i as runMigrations } from "../../../../runner--4wMWwKM.mjs";
+import { i as runMigrations } from "../../../../runner-DYYnW530.mjs";
 import "../../../../dialect-helpers-DRI5pyY3.mjs";
-import "../../../../content-BIlVx-RX.mjs";
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import "../../../../media-JOf3pNkw.mjs";
-import "../../../../taxonomy-CdllE4oq.mjs";
-import { t as OptionsRepository } from "../../../../options-BPCVnesz.mjs";
-import "../../../../redirect-CRWIt8Zj.mjs";
-import "../../../../request-cache-D32LpnmI.mjs";
-import "../../../../byline-registry-CWP7I71B.mjs";
-import "../../../../byline-DUx48sJp.mjs";
-import "../../../../fts-manager-1RgHmopc.mjs";
-import "../../../../registry-brYh-rAT.mjs";
-import "../../../../loader-ZN1ll-d-.mjs";
-import "../../../../settings-DfxiWY_s.mjs";
-import "../../../../ssrf-BsVGIE0Z.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
-import "../../../../ssrf-BvgVcfNQ.mjs";
-import { t as validateSeed } from "../../../../validate-Bz4vqcX1.mjs";
-import { t as applySeed } from "../../../../apply-Dr7snAMT.mjs";
-import { t as loadSeed } from "../../../../load-BBetCvLC.mjs";
-import { n as getPublicOrigin } from "../../../../public-url-BFVC2OTJ.mjs";
-import "../../../../api-tokens-Oq39ba-Z.mjs";
-import { t as handleApiTokenCreate } from "../../../../api-tokens-DPfhPu5V.mjs";
-import { t as escapeHtml } from "../../../../escape-Ds07EEyu.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-B_q19j4v.mjs";
+import "../../../../after-B1IIdH3Y.mjs";
+import "../../../../object-cache-SEb2IM4Z.mjs";
+import "../../../../content-2PTDNnoh.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import "../../../../media-Bw0sA6rb.mjs";
+import "../../../../taxonomy-B2HQuVf5.mjs";
+import { t as OptionsRepository } from "../../../../options-DTTML-Tx.mjs";
+import "../../../../redirect-Bifv_yHv.mjs";
+import "../../../../request-cache-KCNHp_RJ.mjs";
+import "../../../../byline-registry-BOjqDOim.mjs";
+import "../../../../byline-CC0WS4Gu.mjs";
+import "../../../../fts-manager-DtiWqwNJ.mjs";
+import "../../../../registry-CjK96fHD.mjs";
+import "../../../../loader-C8Z48Uof.mjs";
+import "../../../../settings-yaxu9mU-.mjs";
+import "../../../../ssrf-B0VeRLrp.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
+import "../../../../ssrf-Cz1e2QPn.mjs";
+import { t as validateSeed } from "../../../../validate-Bwl64sxv.mjs";
+import { t as applySeed } from "../../../../apply-wDqQoxX4.mjs";
+import { t as loadSeed } from "../../../../load-Dtoo7KcJ.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-8lFyQ8ZF.mjs";
+import "../../../../api-tokens-BVH-H8Z9.mjs";
+import { n as handleApiTokenCreate, t as deleteApiTokensByName } from "../../../../api-tokens-ViYKeIp9.mjs";
+import { t as escapeHtml } from "../../../../escape-BtbJWyaW.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-B4wuX2A5.mjs";
 import { ulid } from "ulidx";
 
 //#region src/astro/routes/api/setup/dev-bypass.ts
@@ -86,6 +88,7 @@ async function handleDevBypass(context) {
 		if (session) session.set("user", { id: user.id });
 		let token;
 		if (url.searchParams.has("token")) {
+			await deleteApiTokensByName(emdash.db, user.id, "dev-bypass-token");
 			const result = await handleApiTokenCreate(emdash.db, user.id, {
 				name: "dev-bypass-token",
 				scopes: [

package/dist/astro/routes/api/setup/dev-bypass.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/dev-bypass\n * GET  /_emdash/api/setup/dev-bypass\n *\n * Development-only endpoint to bypass the setup wizard.\n * Runs migrations, creates a dev admin user, and marks setup complete.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with setup info\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { handleApiTokenCreate } from \"#api/handlers/api-tokens.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { runMigrations } from \"#db/migrations/runner.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\nconst DEV_SITE_TITLE = \"EmDash Dev Site\";\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Run migrations\n\t\tconst migrations = await runMigrations(emdash.db);\n\t\tconsole.log(\"[setup-dev-bypass] Migrations applied:\", migrations.applied);\n\n\t\t// Apply seed (user seed or built-in default)\n\t\tconst seed = await loadSeed();\n\t\tconst validation = validateSeed(seed);\n\t\tif (validation.valid) {\n\t\t\tconst seedResult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent: true,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t\tconsole.log(\n\t\t\t\t`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`,\n\t\t\t);\n\t\t}\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\t\tlet userCreated = false;\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tuserCreated = true;\n\t\t\tconsole.log(\"[setup-dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Set site title if not already set\n\t\tconst existingTitle = await options.get(\"emdash:site_title\");\n\t\tif (!existingTitle) {\n\t\t\tawait options.set(\"emdash:site_title\", DEV_SITE_TITLE);\n\t\t}\n\n\t\t// Store canonical site URL (used by magic-link/recovery emails)\n\t\tawait options.set(\"emdash:site_url\", getPublicOrigin(url, emdash?.config));\n\n\t\t// Mark setup complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Optionally create a PAT token (?token=1) for headless/CLI testing.\n\t\tlet token: string | undefined;\n\t\tif (url.searchParams.has(\"token\")) {\n\t\t\tconst result = await handleApiTokenCreate(emdash.db, user.id, {\n\t\t\t\tname: \"dev-bypass-token\",\n\t\t\t\tscopes: [\n\t\t\t\t\t\"content:read\",\n\t\t\t\t\t\"content:write\",\n\t\t\t\t\t\"media:read\",\n\t\t\t\t\t\"media:write\",\n\t\t\t\t\t\"schema:read\",\n\t\t\t\t\t\"schema:write\",\n\t\t\t\t\t\"admin\",\n\t\t\t\t],\n\t\t\t});\n\t\t\tif (result.success) {\n\t\t\t\ttoken = result.data.token;\n\t\t\t}\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev setup complete\",\n\t\t\tmigrations: migrations.applied,\n\t\t\tuserCreated,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t\t...(token ? { token } : {}),\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAgBzB,MAAM,aAAa;AAEnB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AAEvB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,aAAa,MAAM,cAAc,OAAO,GAAG;AACjD,UAAQ,IAAI,0CAA0C,WAAW,QAAQ;EAGzE,MAAM,OAAO,MAAM,UAAU;AAE7B,MADmB,aAAa,KAAK,CACtB,OAAO;GACrB,MAAM,aAAa,MAAM,UAAU,OAAO,IAAI,MAAM;IACnD,gBAAgB;IAChB,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;AACF,WAAQ,IACP,oCAAoC,WAAW,YAAY,QAAQ,gBAAgB,WAAW,OAAO,QAAQ,SAC7G;;EAGF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAGhD,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;EACJ,IAAI,cAAc;AAElB,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,iBAAc;AACd,WAAQ,IAAI,8CAA8C,KAAK,MAAM;QAErE,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAKF,MAAI,CADkB,MAAM,QAAQ,IAAI,oBAAoB,CAE3D,OAAM,QAAQ,IAAI,qBAAqB,eAAe;AAIvD,QAAM,QAAQ,IAAI,mBAAmB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AAG1E,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,IAAI;AACJ,MAAI,IAAI,aAAa,IAAI,QAAQ,EAAE;GAClC,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,KAAK,IAAI;IAC7D,MAAM;IACN,QAAQ;KACP;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACD,CAAC;AACF,OAAI,OAAO,QACV,SAAQ,OAAO,KAAK;;EAKtB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,YAAY,WAAW;GACvB;GACA,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;GAC1B,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,qBAAqB,mBAAmB;;;AAKpE,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}
+{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/dev-bypass\n * GET  /_emdash/api/setup/dev-bypass\n *\n * Development-only endpoint to bypass the setup wizard.\n * Runs migrations, creates a dev admin user, and marks setup complete.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with setup info\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { deleteApiTokensByName, handleApiTokenCreate } from \"#api/handlers/api-tokens.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { runMigrations } from \"#db/migrations/runner.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\nconst DEV_SITE_TITLE = \"EmDash Dev Site\";\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Run migrations\n\t\tconst migrations = await runMigrations(emdash.db);\n\t\tconsole.log(\"[setup-dev-bypass] Migrations applied:\", migrations.applied);\n\n\t\t// Apply seed (user seed or built-in default)\n\t\tconst seed = await loadSeed();\n\t\tconst validation = validateSeed(seed);\n\t\tif (validation.valid) {\n\t\t\tconst seedResult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent: true,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t\tconsole.log(\n\t\t\t\t`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`,\n\t\t\t);\n\t\t}\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\t\tlet userCreated = false;\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tuserCreated = true;\n\t\t\tconsole.log(\"[setup-dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Set site title if not already set\n\t\tconst existingTitle = await options.get(\"emdash:site_title\");\n\t\tif (!existingTitle) {\n\t\t\tawait options.set(\"emdash:site_title\", DEV_SITE_TITLE);\n\t\t}\n\n\t\t// Store canonical site URL (used by magic-link/recovery emails)\n\t\tawait options.set(\"emdash:site_url\", getPublicOrigin(url, emdash?.config));\n\n\t\t// Mark setup complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Optionally create a PAT token (?token=1) for headless/CLI testing.\n\t\tlet token: string | undefined;\n\t\tif (url.searchParams.has(\"token\")) {\n\t\t\t// Idempotent by name: a prior reset can leave a stale dev-bypass-token,\n\t\t\t// and the raw token is only available at creation, so drop any existing\n\t\t\t// one and mint a fresh, usable PAT rather than accumulating duplicates.\n\t\t\tawait deleteApiTokensByName(emdash.db, user.id, \"dev-bypass-token\");\n\t\t\tconst result = await handleApiTokenCreate(emdash.db, user.id, {\n\t\t\t\tname: \"dev-bypass-token\",\n\t\t\t\tscopes: [\n\t\t\t\t\t\"content:read\",\n\t\t\t\t\t\"content:write\",\n\t\t\t\t\t\"media:read\",\n\t\t\t\t\t\"media:write\",\n\t\t\t\t\t\"schema:read\",\n\t\t\t\t\t\"schema:write\",\n\t\t\t\t\t\"admin\",\n\t\t\t\t],\n\t\t\t});\n\t\t\tif (result.success) {\n\t\t\t\ttoken = result.data.token;\n\t\t\t}\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev setup complete\",\n\t\t\tmigrations: migrations.applied,\n\t\t\tuserCreated,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t\t...(token ? { token } : {}),\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAgBzB,MAAM,aAAa;AAEnB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AAEvB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,aAAa,MAAM,cAAc,OAAO,GAAG;AACjD,UAAQ,IAAI,0CAA0C,WAAW,QAAQ;EAGzE,MAAM,OAAO,MAAM,UAAU;AAE7B,MADmB,aAAa,KAAK,CACtB,OAAO;GACrB,MAAM,aAAa,MAAM,UAAU,OAAO,IAAI,MAAM;IACnD,gBAAgB;IAChB,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;AACF,WAAQ,IACP,oCAAoC,WAAW,YAAY,QAAQ,gBAAgB,WAAW,OAAO,QAAQ,SAC7G;;EAGF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAGhD,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;EACJ,IAAI,cAAc;AAElB,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,iBAAc;AACd,WAAQ,IAAI,8CAA8C,KAAK,MAAM;QAErE,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAKF,MAAI,CADkB,MAAM,QAAQ,IAAI,oBAAoB,CAE3D,OAAM,QAAQ,IAAI,qBAAqB,eAAe;AAIvD,QAAM,QAAQ,IAAI,mBAAmB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AAG1E,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,IAAI;AACJ,MAAI,IAAI,aAAa,IAAI,QAAQ,EAAE;AAIlC,SAAM,sBAAsB,OAAO,IAAI,KAAK,IAAI,mBAAmB;GACnE,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,KAAK,IAAI;IAC7D,MAAM;IACN,QAAQ;KACP;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACD,CAAC;AACF,OAAI,OAAO,QACV,SAAQ,OAAO,KAAK;;EAKtB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,YAAY,WAAW;GACvB;GACA,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;GAC1B,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,qBAAqB,mBAAmB;;;AAKpE,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}

package/dist/astro/routes/api/setup/dev-reset.mjs

@@ -1,7 +1,7 @@
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import { t as OptionsRepository } from "../../../../options-BPCVnesz.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import { t as OptionsRepository } from "../../../../options-DTTML-Tx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
 
 //#region src/astro/routes/api/setup/dev-reset.ts
 const prerender = false;

package/dist/astro/routes/api/setup/index.mjs

@@ -1,31 +1,34 @@
-import { i as runMigrations } from "../../../../runner--4wMWwKM.mjs";
+import { i as runMigrations } from "../../../../runner-DYYnW530.mjs";
 import "../../../../dialect-helpers-DRI5pyY3.mjs";
-import "../../../../content-BIlVx-RX.mjs";
-import "../../../../base64-CqR-7kqF.mjs";
-import "../../../../types-BXSUSAjt.mjs";
-import "../../../../media-JOf3pNkw.mjs";
-import "../../../../taxonomy-CdllE4oq.mjs";
-import { t as OptionsRepository } from "../../../../options-BPCVnesz.mjs";
-import "../../../../redirect-CRWIt8Zj.mjs";
-import "../../../../request-cache-D32LpnmI.mjs";
-import "../../../../byline-registry-CWP7I71B.mjs";
-import "../../../../byline-DUx48sJp.mjs";
-import "../../../../fts-manager-1RgHmopc.mjs";
-import "../../../../registry-brYh-rAT.mjs";
-import "../../../../loader-ZN1ll-d-.mjs";
-import "../../../../settings-DfxiWY_s.mjs";
-import "../../../../ssrf-BsVGIE0Z.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-RwM4dD35.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CrGndy1A.mjs";
-import "../../../../redirects-CCbCqCCd.mjs";
-import { d as setupBody } from "../../../../byline-fields-8TMtkBnH.mjs";
+import "../../../../after-B1IIdH3Y.mjs";
+import "../../../../object-cache-SEb2IM4Z.mjs";
+import "../../../../content-2PTDNnoh.mjs";
+import "../../../../base64-CmWvODNW.mjs";
+import "../../../../types-DXOIbece.mjs";
+import "../../../../media-Bw0sA6rb.mjs";
+import "../../../../taxonomy-B2HQuVf5.mjs";
+import { t as OptionsRepository } from "../../../../options-DTTML-Tx.mjs";
+import "../../../../redirect-Bifv_yHv.mjs";
+import "../../../../request-cache-KCNHp_RJ.mjs";
+import "../../../../byline-registry-BOjqDOim.mjs";
+import "../../../../byline-CC0WS4Gu.mjs";
+import "../../../../fts-manager-DtiWqwNJ.mjs";
+import "../../../../registry-CjK96fHD.mjs";
+import "../../../../loader-C8Z48Uof.mjs";
+import "../../../../settings-yaxu9mU-.mjs";
+import "../../../../ssrf-B0VeRLrp.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BQ1pxs0L.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-qrHlnzTy.mjs";
+import "../../../../redirects-DUvXgzCX.mjs";
+import { d as setupBody } from "../../../../byline-fields-53i9Et0x.mjs";
+import "../../../../status-CB2basWJ.mjs";
 import "../../../../api/schemas/index.mjs";
-import "../../../../ssrf-BvgVcfNQ.mjs";
-import { t as validateSeed } from "../../../../validate-Bz4vqcX1.mjs";
-import { t as applySeed } from "../../../../apply-Dr7snAMT.mjs";
-import { t as loadSeed } from "../../../../load-BBetCvLC.mjs";
-import { n as getPublicOrigin } from "../../../../public-url-BFVC2OTJ.mjs";
-import { t as getAuthMode } from "../../../../mode-CO2vQHfq.mjs";
+import "../../../../ssrf-Cz1e2QPn.mjs";
+import { t as validateSeed } from "../../../../validate-Bwl64sxv.mjs";
+import { t as applySeed } from "../../../../apply-wDqQoxX4.mjs";
+import { t as loadSeed } from "../../../../load-Dtoo7KcJ.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-8lFyQ8ZF.mjs";
+import { t as getAuthMode } from "../../../../mode-CFh8Dw8G.mjs";
 
 //#region src/astro/routes/api/setup/index.ts
 const prerender = false;

package/dist/astro/routes/api/setup/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup\n *\n * Executes the setup wizard - applies seed file and marks setup complete\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupBody } from \"#api/schemas.js\";\nimport { getAuthMode } from \"#auth/mode.js\";\nimport { runMigrations } from \"#db/migrations/runner.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\nexport const POST: APIRoute = async ({ request, url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Guard: reject if setup has already been completed.\n\t\t// The options table may not exist on first-ever setup (pre-migration),\n\t\t// so a query failure means setup hasn't run yet — allow it to proceed.\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\t\treturn apiError(\"ALREADY_CONFIGURED\", \"Setup has already been completed\", 409);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Options table doesn't exist yet — first-ever setup, allow it\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// 1. Run core migrations\n\t\ttry {\n\t\t\tawait runMigrations(emdash.db);\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to run database migrations\", \"MIGRATION_ERROR\");\n\t\t}\n\n\t\t// 2. Load seed file (user seed or built-in default)\n\t\tconst seed = await loadSeed();\n\n\t\t// 3. Override seed settings with form values\n\t\tseed.settings = {\n\t\t\t...seed.settings,\n\t\t\ttitle: body.title,\n\t\t\ttagline: body.tagline,\n\t\t};\n\n\t\t// 4. Apply seed\n\t\tconst validation = validateSeed(seed);\n\t\tif (!validation.valid) {\n\t\t\treturn apiError(\"INVALID_SEED\", `Invalid seed file: ${validation.errors.join(\", \")}`, 400);\n\t\t}\n\n\t\tlet result;\n\t\ttry {\n\t\t\tresult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent: body.includeContent,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to apply seed\", \"SEED_ERROR\");\n\t\t}\n\n\t\t// 5. Store setup state\n\t\t// In external auth mode, mark setup complete immediately (first user to login becomes admin)\n\t\t// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)\n\t\tconst authMode = getAuthMode(emdash.config);\n\t\tconst useExternalAuth = authMode.type === \"external\";\n\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t\t// Store the canonical site URL from the setup request.\n\t\t\t// Write-once at the DB level so concurrent setup POSTs can't both\n\t\t\t// observe an empty value and race to write. A spoofed Host header\n\t\t\t// on a later call during the wizard window must not be able to\n\t\t\t// replace the first value.\n\t\t\tconst siteUrl = getPublicOrigin(url, emdash.config);\n\t\t\tawait options.setIfAbsent(\"emdash:site_url\", siteUrl);\n\n\t\t\tif (useExternalAuth) {\n\t\t\t\t// External auth mode: mark setup complete now\n\t\t\t\t// First user to log in via external provider will become admin\n\t\t\t\tawait options.set(\"emdash:setup_complete\", true);\n\t\t\t\tawait options.set(\"emdash:site_title\", body.title);\n\t\t\t\tif (body.tagline) {\n\t\t\t\t\tawait options.set(\"emdash:site_tagline\", body.tagline);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Passkey/provider mode: store state for next step (admin creation)\n\t\t\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t\t\tstep: \"site_complete\",\n\t\t\t\t\ttitle: body.title,\n\t\t\t\t\ttagline: body.tagline,\n\t\t\t\t});\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconsole.error(\"Failed to save setup state:\", error);\n\t\t\t// Non-fatal - continue anyway\n\t\t}\n\n\t\t// 6. Return success with result\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\t// In external auth mode, setup is complete - redirect to admin\n\t\t\tsetupComplete: useExternalAuth,\n\t\t\tresult,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Setup failed\", \"SETUP_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,KAAK,aAAa;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAIH,MAAI;GAEH,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAEhE,OAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,sBAAsB,oCAAoC,IAAI;UAExE;EAKR,MAAM,OAAO,MAAM,UAAU,SAAS,UAAU;AAChD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,MAAI;AACH,SAAM,cAAc,OAAO,GAAG;WACtB,OAAO;AACf,UAAO,YAAY,OAAO,qCAAqC,kBAAkB;;EAIlF,MAAM,OAAO,MAAM,UAAU;AAG7B,OAAK,WAAW;GACf,GAAG,KAAK;GACR,OAAO,KAAK;GACZ,SAAS,KAAK;GACd;EAGD,MAAM,aAAa,aAAa,KAAK;AACrC,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,gBAAgB,sBAAsB,WAAW,OAAO,KAAK,KAAK,IAAI,IAAI;EAG3F,IAAI;AACJ,MAAI;AACH,YAAS,MAAM,UAAU,OAAO,IAAI,MAAM;IACzC,gBAAgB,KAAK;IACrB,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;WACM,OAAO;AACf,UAAO,YAAY,OAAO,wBAAwB,aAAa;;EAOhE,MAAM,kBADW,YAAY,OAAO,OAAO,CACV,SAAS;AAE1C,MAAI;GACH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;GAOhD,MAAM,UAAU,gBAAgB,KAAK,OAAO,OAAO;AACnD,SAAM,QAAQ,YAAY,mBAAmB,QAAQ;AAErD,OAAI,iBAAiB;AAGpB,UAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,UAAM,QAAQ,IAAI,qBAAqB,KAAK,MAAM;AAClD,QAAI,KAAK,QACR,OAAM,QAAQ,IAAI,uBAAuB,KAAK,QAAQ;SAIvD,OAAM,QAAQ,IAAI,sBAAsB;IACvC,MAAM;IACN,OAAO,KAAK;IACZ,SAAS,KAAK;IACd,CAAC;WAEK,OAAO;AACf,WAAQ,MAAM,+BAA+B,MAAM;;AAKpD,SAAO,WAAW;GACjB,SAAS;GAET,eAAe;GACf;GACA,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gBAAgB,cAAc"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup\n *\n * Executes the setup wizard - applies seed file and marks setup complete\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupBody } from \"#api/schemas.js\";\nimport { getAuthMode } from \"#auth/mode.js\";\nimport { runMigrations } from \"#db/migrations/runner.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\nexport const POST: APIRoute = async ({ request, url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Guard: reject if setup has already been completed.\n\t\t// The options table may not exist on first-ever setup (pre-migration),\n\t\t// so a query failure means setup hasn't run yet — allow it to proceed.\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\t\treturn apiError(\"ALREADY_CONFIGURED\", \"Setup has already been completed\", 409);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Options table doesn't exist yet — first-ever setup, allow it\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// 1. Run core migrations\n\t\ttry {\n\t\t\tawait runMigrations(emdash.db);\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to run database migrations\", \"MIGRATION_ERROR\");\n\t\t}\n\n\t\t// 2. Load seed file (user seed or built-in default)\n\t\tconst seed = await loadSeed();\n\n\t\t// 3. Override seed settings with form values\n\t\tseed.settings = {\n\t\t\t...seed.settings,\n\t\t\ttitle: body.title,\n\t\t\ttagline: body.tagline,\n\t\t};\n\n\t\t// 4. Apply seed\n\t\tconst validation = validateSeed(seed);\n\t\tif (!validation.valid) {\n\t\t\treturn apiError(\"INVALID_SEED\", `Invalid seed file: ${validation.errors.join(\", \")}`, 400);\n\t\t}\n\n\t\tlet result;\n\t\ttry {\n\t\t\tresult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent: body.includeContent,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to apply seed\", \"SEED_ERROR\");\n\t\t}\n\n\t\t// 5. Store setup state\n\t\t// In external auth mode, mark setup complete immediately (first user to login becomes admin)\n\t\t// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)\n\t\tconst authMode = getAuthMode(emdash.config);\n\t\tconst useExternalAuth = authMode.type === \"external\";\n\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t\t// Store the canonical site URL from the setup request.\n\t\t\t// Write-once at the DB level so concurrent setup POSTs can't both\n\t\t\t// observe an empty value and race to write. A spoofed Host header\n\t\t\t// on a later call during the wizard window must not be able to\n\t\t\t// replace the first value.\n\t\t\tconst siteUrl = getPublicOrigin(url, emdash.config);\n\t\t\tawait options.setIfAbsent(\"emdash:site_url\", siteUrl);\n\n\t\t\tif (useExternalAuth) {\n\t\t\t\t// External auth mode: mark setup complete now\n\t\t\t\t// First user to log in via external provider will become admin\n\t\t\t\tawait options.set(\"emdash:setup_complete\", true);\n\t\t\t\tawait options.set(\"emdash:site_title\", body.title);\n\t\t\t\tif (body.tagline) {\n\t\t\t\t\tawait options.set(\"emdash:site_tagline\", body.tagline);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Passkey/provider mode: store state for next step (admin creation)\n\t\t\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t\t\tstep: \"site_complete\",\n\t\t\t\t\ttitle: body.title,\n\t\t\t\t\ttagline: body.tagline,\n\t\t\t\t});\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconsole.error(\"Failed to save setup state:\", error);\n\t\t\t// Non-fatal - continue anyway\n\t\t}\n\n\t\t// 6. Return success with result\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\t// In external auth mode, setup is complete - redirect to admin\n\t\t\tsetupComplete: useExternalAuth,\n\t\t\tresult,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Setup failed\", \"SETUP_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,KAAK,aAAa;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAIH,MAAI;GAEH,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAEhE,OAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,sBAAsB,oCAAoC,IAAI;UAExE;EAKR,MAAM,OAAO,MAAM,UAAU,SAAS,UAAU;AAChD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,MAAI;AACH,SAAM,cAAc,OAAO,GAAG;WACtB,OAAO;AACf,UAAO,YAAY,OAAO,qCAAqC,kBAAkB;;EAIlF,MAAM,OAAO,MAAM,UAAU;AAG7B,OAAK,WAAW;GACf,GAAG,KAAK;GACR,OAAO,KAAK;GACZ,SAAS,KAAK;GACd;EAGD,MAAM,aAAa,aAAa,KAAK;AACrC,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,gBAAgB,sBAAsB,WAAW,OAAO,KAAK,KAAK,IAAI,IAAI;EAG3F,IAAI;AACJ,MAAI;AACH,YAAS,MAAM,UAAU,OAAO,IAAI,MAAM;IACzC,gBAAgB,KAAK;IACrB,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;WACM,OAAO;AACf,UAAO,YAAY,OAAO,wBAAwB,aAAa;;EAOhE,MAAM,kBADW,YAAY,OAAO,OAAO,CACV,SAAS;AAE1C,MAAI;GACH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;GAOhD,MAAM,UAAU,gBAAgB,KAAK,OAAO,OAAO;AACnD,SAAM,QAAQ,YAAY,mBAAmB,QAAQ;AAErD,OAAI,iBAAiB;AAGpB,UAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,UAAM,QAAQ,IAAI,qBAAqB,KAAK,MAAM;AAClD,QAAI,KAAK,QACR,OAAM,QAAQ,IAAI,uBAAuB,KAAK,QAAQ;SAIvD,OAAM,QAAQ,IAAI,sBAAsB;IACvC,MAAM;IACN,OAAO,KAAK;IACZ,SAAS,KAAK;IACd,CAAC;WAEK,OAAO;AACf,WAAQ,MAAM,+BAA+B,MAAM;;AAKpD,SAAO,WAAW;GACjB,SAAS;GAET,eAAe;GACf;GACA,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gBAAgB,cAAc"}