emdash 0.29.0 → 0.30.0

package/dist/astro/routes/PluginRegistry.d.mts

@@ -1,3 +1,4 @@
+import { AdminBranding } from "@emdash-cms/admin";
 import * as react from "react";
 import { Messages } from "@lingui/core";
 
@@ -5,10 +6,13 @@ import { Messages } from "@lingui/core";
 interface AdminWrapperProps {
   locale: string;
   messages: Messages;
+  /** Configured admin white-label branding (logo, site name), read server-side from `admin.astro`. */
+  adminBranding?: AdminBranding;
 }
 declare function AdminWrapper({
   locale,
-  messages
+  messages,
+  adminBranding
 }: AdminWrapperProps): react.JSX.Element;
 //#endregion
 export { AdminWrapper as default };

package/dist/astro/routes/PluginRegistry.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"PluginRegistry.d.mts","names":[],"sources":["../../../src/astro/routes/PluginRegistry.tsx"],"mappings":";;;;UAeU,iBAAA;EACT,MAAA;EACA,QAAA,EAAU,QAAA;AAAA;AAAA,iBAGa,YAAA,CAAA;EAAe,MAAA;EAAQ;AAAA,GAAY,iBAAA,GAAiB,KAAA,CAAA,GAAA,CAAA,OAAA"}
+{"version":3,"file":"PluginRegistry.d.mts","names":[],"sources":["../../../src/astro/routes/PluginRegistry.tsx"],"mappings":";;;;;UAeU,iBAAA;EACT,MAAA;EACA,QAAA,EAAU,QAAA;EAEV;EAAA,aAAA,GAAgB,aAAA;AAAA;AAAA,iBAGO,YAAA,CAAA;EAAe,MAAA;EAAQ,QAAA;EAAU;AAAA,GAAiB,iBAAA,GAAiB,KAAA,CAAA,GAAA,CAAA,OAAA"}

package/dist/astro/routes/PluginRegistry.mjs

@@ -11,10 +11,11 @@ import { jsx } from "react/jsx-runtime";
 * to AdminApp via props. This ensures plugin components are bundled
 * together with the admin app and available via React context.
 */
-function AdminWrapper({ locale, messages }) {
+function AdminWrapper({ locale, messages, adminBranding }) {
 	return /* @__PURE__ */ jsx(AdminApp, {
 		pluginAdmins,
 		authProviders,
+		adminBranding,
 		locale,
 		messages
 	});

package/dist/astro/routes/PluginRegistry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"PluginRegistry.mjs","names":[],"sources":["../../../src/astro/routes/PluginRegistry.tsx"],"sourcesContent":["/**\n * Admin Wrapper\n *\n * Imports plugin admin modules from the virtual module and passes them\n * to AdminApp via props. This ensures plugin components are bundled\n * together with the admin app and available via React context.\n */\n\nimport { AdminApp } from \"@emdash-cms/admin\";\nimport type { Messages } from \"@lingui/core\";\n// @ts-ignore - virtual module generated by integration\nimport { pluginAdmins } from \"virtual:emdash/admin-registry\";\n// @ts-ignore - virtual module generated by integration\nimport { authProviders } from \"virtual:emdash/auth-providers\";\n\ninterface AdminWrapperProps {\n\tlocale: string;\n\tmessages: Messages;\n}\n\nexport default function AdminWrapper({ locale, messages }: AdminWrapperProps) {\n\treturn (\n\t\t<AdminApp\n\t\t\tpluginAdmins={pluginAdmins}\n\t\t\tauthProviders={authProviders}\n\t\t\tlocale={locale}\n\t\t\tmessages={messages}\n\t\t/>\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,SAAwB,aAAa,EAAE,QAAQ,YAA+B;AAC7E,QACC,oBAAC;EACc;EACC;EACP;EACE;GACT"}
+{"version":3,"file":"PluginRegistry.mjs","names":[],"sources":["../../../src/astro/routes/PluginRegistry.tsx"],"sourcesContent":["/**\n * Admin Wrapper\n *\n * Imports plugin admin modules from the virtual module and passes them\n * to AdminApp via props. This ensures plugin components are bundled\n * together with the admin app and available via React context.\n */\n\nimport { AdminApp, type AdminBranding } from \"@emdash-cms/admin\";\nimport type { Messages } from \"@lingui/core\";\n// @ts-ignore - virtual module generated by integration\nimport { pluginAdmins } from \"virtual:emdash/admin-registry\";\n// @ts-ignore - virtual module generated by integration\nimport { authProviders } from \"virtual:emdash/auth-providers\";\n\ninterface AdminWrapperProps {\n\tlocale: string;\n\tmessages: Messages;\n\t/** Configured admin white-label branding (logo, site name), read server-side from `admin.astro`. */\n\tadminBranding?: AdminBranding;\n}\n\nexport default function AdminWrapper({ locale, messages, adminBranding }: AdminWrapperProps) {\n\treturn (\n\t\t<AdminApp\n\t\t\tpluginAdmins={pluginAdmins}\n\t\t\tauthProviders={authProviders}\n\t\t\tadminBranding={adminBranding}\n\t\t\tlocale={locale}\n\t\t\tmessages={messages}\n\t\t/>\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;AAsBA,SAAwB,aAAa,EAAE,QAAQ,UAAU,iBAAoC;AAC5F,QACC,oBAAC;EACc;EACC;EACA;EACP;EACE;GACT"}

package/dist/astro/routes/api/admin/allowed-domains/_domain_.mjs

@@ -1,13 +1,14 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { S as allowedDomainUpdateBody } from "../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import "../../../../../media-kIV1IxFf.mjs";
+import { S as allowedDomainUpdateBody } from "../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { Role, roleFromLevel } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/admin/allowed-domains/[domain].ts
 const prerender = false;

package/dist/astro/routes/api/admin/allowed-domains/_domain_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_domain_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/allowed-domains/[domain].ts"],"sourcesContent":["/**\n * PATCH/DELETE /_emdash/api/admin/allowed-domains/[domain]\n *\n * Admin endpoints for managing a specific allowed domain.\n * PATCH - Update domain settings (enabled, defaultRole)\n * DELETE - Remove an allowed domain\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { Role, roleFromLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { allowedDomainUpdateBody } from \"#api/schemas.js\";\n\n/**\n * PATCH - Update domain settings\n */\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { domain } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!domain) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Domain is required\", 400);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, allowedDomainUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Check if domain exists\n\t\tconst existing = await adapter.getAllowedDomain(domain);\n\t\tif (!existing) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Domain not found\", 404);\n\t\t}\n\n\t\t// Role is already validated as RoleLevel by Zod schema\n\t\tconst defaultRole = body.defaultRole;\n\n\t\t// Update domain\n\t\tconst enabled = body.enabled ?? existing.enabled;\n\t\tawait adapter.updateAllowedDomain(domain, enabled, defaultRole);\n\n\t\t// Fetch updated domain\n\t\tconst updated = await adapter.getAllowedDomain(domain);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tdomain: updated\n\t\t\t\t? {\n\t\t\t\t\t\tdomain: updated.domain,\n\t\t\t\t\t\tdefaultRole: updated.defaultRole,\n\t\t\t\t\t\troleName: roleFromLevel(updated.defaultRole),\n\t\t\t\t\t\tenabled: updated.enabled,\n\t\t\t\t\t\tcreatedAt: updated.createdAt.toISOString(),\n\t\t\t\t\t}\n\t\t\t\t: null,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update allowed domain\", \"DOMAIN_UPDATE_ERROR\");\n\t}\n};\n\n/**\n * DELETE - Remove an allowed domain\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { domain } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!domain) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Domain is required\", 400);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\t// Check if domain exists (optional - delete is idempotent)\n\t\tconst existing = await adapter.getAllowedDomain(domain);\n\t\tif (!existing) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Domain not found\", 404);\n\t\t}\n\n\t\tawait adapter.deleteAllowedDomain(domain);\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete allowed domain\", \"DOMAIN_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;AAUA,MAAa,YAAY;;;;AAYzB,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,sBAAsB,IAAI;AAG/D,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,wBAAwB;AAC9D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,WAAW,MAAM,QAAQ,iBAAiB,OAAO;AACvD,MAAI,CAAC,SACJ,QAAO,SAAS,aAAa,oBAAoB,IAAI;EAItD,MAAM,cAAc,KAAK;EAGzB,MAAM,UAAU,KAAK,WAAW,SAAS;AACzC,QAAM,QAAQ,oBAAoB,QAAQ,SAAS,YAAY;EAG/D,MAAM,UAAU,MAAM,QAAQ,iBAAiB,OAAO;AAEtD,SAAO,WAAW;GACjB,SAAS;GACT,QAAQ,UACL;IACA,QAAQ,QAAQ;IAChB,aAAa,QAAQ;IACrB,UAAU,cAAc,QAAQ,YAAY;IAC5C,SAAS,QAAQ;IACjB,WAAW,QAAQ,UAAU,aAAa;IAC1C,GACA;GACH,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,sBAAsB;;;;;;AAOrF,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,sBAAsB,IAAI;AAG/D,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;AAGH,MAAI,CADa,MAAM,QAAQ,iBAAiB,OAAO,CAEtD,QAAO,SAAS,aAAa,oBAAoB,IAAI;AAGtD,QAAM,QAAQ,oBAAoB,OAAO;AAEzC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,sBAAsB"}
+{"version":3,"file":"_domain_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/allowed-domains/[domain].ts"],"sourcesContent":["/**\n * PATCH/DELETE /_emdash/api/admin/allowed-domains/[domain]\n *\n * Admin endpoints for managing a specific allowed domain.\n * PATCH - Update domain settings (enabled, defaultRole)\n * DELETE - Remove an allowed domain\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { Role, roleFromLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { allowedDomainUpdateBody } from \"#api/schemas.js\";\n\n/**\n * PATCH - Update domain settings\n */\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { domain } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!domain) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Domain is required\", 400);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, allowedDomainUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Check if domain exists\n\t\tconst existing = await adapter.getAllowedDomain(domain);\n\t\tif (!existing) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Domain not found\", 404);\n\t\t}\n\n\t\t// Role is already validated as RoleLevel by Zod schema\n\t\tconst defaultRole = body.defaultRole;\n\n\t\t// Update domain\n\t\tconst enabled = body.enabled ?? existing.enabled;\n\t\tawait adapter.updateAllowedDomain(domain, enabled, defaultRole);\n\n\t\t// Fetch updated domain\n\t\tconst updated = await adapter.getAllowedDomain(domain);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tdomain: updated\n\t\t\t\t? {\n\t\t\t\t\t\tdomain: updated.domain,\n\t\t\t\t\t\tdefaultRole: updated.defaultRole,\n\t\t\t\t\t\troleName: roleFromLevel(updated.defaultRole),\n\t\t\t\t\t\tenabled: updated.enabled,\n\t\t\t\t\t\tcreatedAt: updated.createdAt.toISOString(),\n\t\t\t\t\t}\n\t\t\t\t: null,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update allowed domain\", \"DOMAIN_UPDATE_ERROR\");\n\t}\n};\n\n/**\n * DELETE - Remove an allowed domain\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { domain } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!domain) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Domain is required\", 400);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\t// Check if domain exists (optional - delete is idempotent)\n\t\tconst existing = await adapter.getAllowedDomain(domain);\n\t\tif (!existing) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Domain not found\", 404);\n\t\t}\n\n\t\tawait adapter.deleteAllowedDomain(domain);\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete allowed domain\", \"DOMAIN_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,YAAY;;;;AAYzB,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,sBAAsB,IAAI;AAG/D,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,wBAAwB;AAC9D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,WAAW,MAAM,QAAQ,iBAAiB,OAAO;AACvD,MAAI,CAAC,SACJ,QAAO,SAAS,aAAa,oBAAoB,IAAI;EAItD,MAAM,cAAc,KAAK;EAGzB,MAAM,UAAU,KAAK,WAAW,SAAS;AACzC,QAAM,QAAQ,oBAAoB,QAAQ,SAAS,YAAY;EAG/D,MAAM,UAAU,MAAM,QAAQ,iBAAiB,OAAO;AAEtD,SAAO,WAAW;GACjB,SAAS;GACT,QAAQ,UACL;IACA,QAAQ,QAAQ;IAChB,aAAa,QAAQ;IACrB,UAAU,cAAc,QAAQ,YAAY;IAC5C,SAAS,QAAQ;IACjB,WAAW,QAAQ,UAAU,aAAa;IAC1C,GACA;GACH,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,sBAAsB;;;;;;AAOrF,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,sBAAsB,IAAI;AAG/D,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;AAGH,MAAI,CADa,MAAM,QAAQ,iBAAiB,OAAO,CAEtD,QAAO,SAAS,aAAa,oBAAoB,IAAI;AAGtD,QAAM,QAAQ,oBAAoB,OAAO;AAEzC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,sBAAsB"}

package/dist/astro/routes/api/admin/allowed-domains/index.mjs

@@ -1,13 +1,14 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { x as allowedDomainCreateBody } from "../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import "../../../../../media-kIV1IxFf.mjs";
+import { x as allowedDomainCreateBody } from "../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { Role, roleFromLevel } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/admin/allowed-domains/index.ts
 const prerender = false;

package/dist/astro/routes/api/admin/allowed-domains/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/allowed-domains/index.ts"],"sourcesContent":["/**\n * GET/POST /_emdash/api/admin/allowed-domains\n *\n * Admin endpoints for managing allowed signup domains.\n * GET - List all allowed domains\n * POST - Add a new allowed domain\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { Role, roleFromLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { allowedDomainCreateBody } from \"#api/schemas.js\";\n\nconst DOMAIN_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9-]*(\\.[a-zA-Z0-9-]+)+$/;\n\n/**\n * GET - List all allowed domains\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst domains = await adapter.getAllowedDomains();\n\n\t\treturn apiSuccess({\n\t\t\tdomains: domains.map((d) => ({\n\t\t\t\tdomain: d.domain,\n\t\t\t\tdefaultRole: d.defaultRole,\n\t\t\t\troleName: roleFromLevel(d.defaultRole),\n\t\t\t\tenabled: d.enabled,\n\t\t\t\tcreatedAt: d.createdAt.toISOString(),\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list allowed domains\", \"DOMAIN_LIST_ERROR\");\n\t}\n};\n\n/**\n * POST - Add a new allowed domain\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, allowedDomainCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Role is already validated as RoleLevel by Zod schema\n\t\tconst defaultRole = body.defaultRole;\n\n\t\t// Validate domain format (no protocol, just domain)\n\t\tconst cleanDomain = body.domain.toLowerCase().trim();\n\t\tif (!DOMAIN_REGEX.test(cleanDomain)) {\n\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid domain format\", 400);\n\t\t}\n\n\t\t// Check if domain already exists\n\t\tconst existing = await adapter.getAllowedDomain(cleanDomain);\n\t\tif (existing) {\n\t\t\treturn apiError(\"CONFLICT\", \"Domain already exists\", 409);\n\t\t}\n\n\t\tconst domain = await adapter.createAllowedDomain(cleanDomain, defaultRole);\n\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tsuccess: true,\n\t\t\t\tdomain: {\n\t\t\t\t\tdomain: domain.domain,\n\t\t\t\t\tdefaultRole: domain.defaultRole,\n\t\t\t\t\troleName: roleFromLevel(domain.defaultRole),\n\t\t\t\t\tenabled: domain.enabled,\n\t\t\t\t\tcreatedAt: domain.createdAt.toISOString(),\n\t\t\t\t},\n\t\t\t},\n\t\t\t201,\n\t\t);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create allowed domain\", \"DOMAIN_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;AAUA,MAAa,YAAY;AASzB,MAAM,eAAe;;;;AAKrB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;AAGH,SAAO,WAAW,EACjB,UAHe,MAAM,QAAQ,mBAAmB,EAG/B,KAAK,OAAO;GAC5B,QAAQ,EAAE;GACV,aAAa,EAAE;GACf,UAAU,cAAc,EAAE,YAAY;GACtC,SAAS,EAAE;GACX,WAAW,EAAE,UAAU,aAAa;GACpC,EAAE,EACH,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,oBAAoB;;;;;;AAOlF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,wBAAwB;AAC9D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,cAAc,KAAK;EAGzB,MAAM,cAAc,KAAK,OAAO,aAAa,CAAC,MAAM;AACpD,MAAI,CAAC,aAAa,KAAK,YAAY,CAClC,QAAO,SAAS,oBAAoB,yBAAyB,IAAI;AAKlE,MADiB,MAAM,QAAQ,iBAAiB,YAAY,CAE3D,QAAO,SAAS,YAAY,yBAAyB,IAAI;EAG1D,MAAM,SAAS,MAAM,QAAQ,oBAAoB,aAAa,YAAY;AAE1E,SAAO,WACN;GACC,SAAS;GACT,QAAQ;IACP,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,cAAc,OAAO,YAAY;IAC3C,SAAS,OAAO;IAChB,WAAW,OAAO,UAAU,aAAa;IACzC;GACD,EACD,IACA;UACO,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,sBAAsB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/allowed-domains/index.ts"],"sourcesContent":["/**\n * GET/POST /_emdash/api/admin/allowed-domains\n *\n * Admin endpoints for managing allowed signup domains.\n * GET - List all allowed domains\n * POST - Add a new allowed domain\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { Role, roleFromLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { allowedDomainCreateBody } from \"#api/schemas.js\";\n\nconst DOMAIN_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9-]*(\\.[a-zA-Z0-9-]+)+$/;\n\n/**\n * GET - List all allowed domains\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst domains = await adapter.getAllowedDomains();\n\n\t\treturn apiSuccess({\n\t\t\tdomains: domains.map((d) => ({\n\t\t\t\tdomain: d.domain,\n\t\t\t\tdefaultRole: d.defaultRole,\n\t\t\t\troleName: roleFromLevel(d.defaultRole),\n\t\t\t\tenabled: d.enabled,\n\t\t\t\tcreatedAt: d.createdAt.toISOString(),\n\t\t\t})),\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list allowed domains\", \"DOMAIN_LIST_ERROR\");\n\t}\n};\n\n/**\n * POST - Add a new allowed domain\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, allowedDomainCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Role is already validated as RoleLevel by Zod schema\n\t\tconst defaultRole = body.defaultRole;\n\n\t\t// Validate domain format (no protocol, just domain)\n\t\tconst cleanDomain = body.domain.toLowerCase().trim();\n\t\tif (!DOMAIN_REGEX.test(cleanDomain)) {\n\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid domain format\", 400);\n\t\t}\n\n\t\t// Check if domain already exists\n\t\tconst existing = await adapter.getAllowedDomain(cleanDomain);\n\t\tif (existing) {\n\t\t\treturn apiError(\"CONFLICT\", \"Domain already exists\", 409);\n\t\t}\n\n\t\tconst domain = await adapter.createAllowedDomain(cleanDomain, defaultRole);\n\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tsuccess: true,\n\t\t\t\tdomain: {\n\t\t\t\t\tdomain: domain.domain,\n\t\t\t\t\tdefaultRole: domain.defaultRole,\n\t\t\t\t\troleName: roleFromLevel(domain.defaultRole),\n\t\t\t\t\tenabled: domain.enabled,\n\t\t\t\t\tcreatedAt: domain.createdAt.toISOString(),\n\t\t\t\t},\n\t\t\t},\n\t\t\t201,\n\t\t);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create allowed domain\", \"DOMAIN_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,YAAY;AASzB,MAAM,eAAe;;;;AAKrB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;AAGH,SAAO,WAAW,EACjB,UAHe,MAAM,QAAQ,mBAAmB,EAG/B,KAAK,OAAO;GAC5B,QAAQ,EAAE;GACV,aAAa,EAAE;GACf,UAAU,cAAc,EAAE,YAAY;GACtC,SAAS,EAAE;GACX,WAAW,EAAE,UAAU,aAAa;GACpC,EAAE,EACH,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,oBAAoB;;;;;;AAOlF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,wBAAwB;AAC9D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,cAAc,KAAK;EAGzB,MAAM,cAAc,KAAK,OAAO,aAAa,CAAC,MAAM;AACpD,MAAI,CAAC,aAAa,KAAK,YAAY,CAClC,QAAO,SAAS,oBAAoB,yBAAyB,IAAI;AAKlE,MADiB,MAAM,QAAQ,iBAAiB,YAAY,CAE3D,QAAO,SAAS,YAAY,yBAAyB,IAAI;EAG1D,MAAM,SAAS,MAAM,QAAQ,oBAAoB,aAAa,YAAY;AAE1E,SAAO,WACN;GACC,SAAS;GACT,QAAQ;IACP,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,cAAc,OAAO,YAAY;IAC3C,SAAS,OAAO;IAChB,WAAW,OAAO,UAAU,aAAa;IACzC;GACD,EACD,IACA;UACO,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,sBAAsB"}

package/dist/astro/routes/api/admin/api-tokens/_id_.mjs

@@ -1,8 +1,8 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import "../../../../../api-tokens-Dk2GrJMY.mjs";
-import { i as handleApiTokenRevoke } from "../../../../../api-tokens-UYBkl17d.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import "../../../../../api-tokens-Cvmixds7.mjs";
+import { i as handleApiTokenRevoke } from "../../../../../api-tokens-uPt8UDpx.mjs";
 import { Role } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/admin/api-tokens/[id].ts

package/dist/astro/routes/api/admin/api-tokens/index.mjs

@@ -1,9 +1,9 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { n as VALID_SCOPES } from "../../../../../api-tokens-Dk2GrJMY.mjs";
-import { n as handleApiTokenCreate, r as handleApiTokenList } from "../../../../../api-tokens-UYBkl17d.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import { o as isValidScope } from "../../../../../api-tokens-Cvmixds7.mjs";
+import { n as handleApiTokenCreate, r as handleApiTokenList } from "../../../../../api-tokens-uPt8UDpx.mjs";
 import { z } from "zod";
 import { Role } from "@emdash-cms/auth";
 
@@ -17,7 +17,7 @@ import { Role } from "@emdash-cms/auth";
 const prerender = false;
 const createTokenSchema = z.object({
 	name: z.string().min(1).max(100),
-	scopes: z.array(z.enum(VALID_SCOPES)).min(1),
+	scopes: z.array(z.string().refine(isValidScope)).min(1),
 	expiresAt: z.string().datetime().optional()
 });
 /**

package/dist/astro/routes/api/admin/api-tokens/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/api-tokens/index.ts"],"sourcesContent":["/**\n * API token management endpoints\n *\n * GET  /_emdash/api/admin/api-tokens — List tokens for current user\n * POST /_emdash/api/admin/api-tokens — Create a new token\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleApiTokenCreate, handleApiTokenList } from \"#api/handlers/api-tokens.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { VALID_SCOPES } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\nconst createTokenSchema = z.object({\n\tname: z.string().min(1).max(100),\n\tscopes: z.array(z.enum(VALID_SCOPES)).min(1),\n\texpiresAt: z.string().datetime().optional(),\n});\n\n/**\n * List API tokens for the current user.\n * Admins can list all tokens (future: add ?userId= filter).\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst result = await handleApiTokenList(emdash.db, user.id);\n\treturn unwrapResult(result);\n};\n\n/**\n * Create a new API token.\n * Returns the raw token once — it cannot be retrieved again.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, createTokenSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleApiTokenCreate(emdash.db, user.id, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create API token\", \"TOKEN_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAClC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;CAChC,QAAQ,EAAE,MAAM,EAAE,KAAK,aAAa,CAAC,CAAC,IAAI,EAAE;CAC5C,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;CAC3C,CAAC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;AAI/D,QAAO,aADQ,MAAM,mBAAmB,OAAO,IAAI,KAAK,GAAG,CAChC;;;;;;AAO5B,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;AAG/D,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,KAAK,IAAI,KAAK,EACvC,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,qBAAqB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/api-tokens/index.ts"],"sourcesContent":["/**\n * API token management endpoints\n *\n * GET  /_emdash/api/admin/api-tokens — List tokens for current user\n * POST /_emdash/api/admin/api-tokens — Create a new token\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleApiTokenCreate, handleApiTokenList } from \"#api/handlers/api-tokens.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { isValidScope } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\nconst createTokenSchema = z.object({\n\tname: z.string().min(1).max(100),\n\tscopes: z.array(z.string().refine(isValidScope)).min(1),\n\texpiresAt: z.string().datetime().optional(),\n});\n\n/**\n * List API tokens for the current user.\n * Admins can list all tokens (future: add ?userId= filter).\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst result = await handleApiTokenList(emdash.db, user.id);\n\treturn unwrapResult(result);\n};\n\n/**\n * Create a new API token.\n * Returns the raw token once — it cannot be retrieved again.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, createTokenSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleApiTokenCreate(emdash.db, user.id, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create API token\", \"TOKEN_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAClC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;CAChC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,aAAa,CAAC,CAAC,IAAI,EAAE;CACvD,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;CAC3C,CAAC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;AAI/D,QAAO,aADQ,MAAM,mBAAmB,OAAO,IAAI,KAAK,GAAG,CAChC;;;;;;AAO5B,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;AAG/D,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,KAAK,IAAI,KAAK,EACvC,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,qBAAqB"}

package/dist/astro/routes/api/admin/byline-fields/_slug_/usage.mjs

@@ -1,9 +1,9 @@
-import "../../../../../../base64-C74Msx8h.mjs";
-import "../../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../../base64-B-PsqheR.mjs";
+import "../../../../../../types-D1iJ3DpO.mjs";
 import "../../../../../../byline-registry-BCuOp4UF.mjs";
-import { a as unwrapResult, i as requireDb, t as apiError } from "../../../../../../error-CfJMLSkd.mjs";
-import { n as requirePerm } from "../../../../../../authorize-BmCwQCib.mjs";
-import { s as handleBylineFieldUsage } from "../../../../../../byline-fields-DO6bAYK8.mjs";
+import { a as unwrapResult, i as requireDb, t as apiError } from "../../../../../../error-CEGF6UZb.mjs";
+import { r as requirePerm } from "../../../../../../authorize-WxsiePzy.mjs";
+import { s as handleBylineFieldUsage } from "../../../../../../byline-fields-CdU_LTF1.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/[slug]/usage.ts
 const prerender = false;

package/dist/astro/routes/api/admin/byline-fields/_slug_.mjs

@@ -1,14 +1,15 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
 import "../../../../../byline-registry-BCuOp4UF.mjs";
-import { a as unwrapResult, i as requireDb, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import "../../../../../redirects-CeD7K7EX.mjs";
-import { h as bylineFieldUpdateBody } from "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import { a as unwrapResult, i as requireDb, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import "../../../../../media-kIV1IxFf.mjs";
+import "../../../../../redirects-BBq3n2Rj.mjs";
+import { h as bylineFieldUpdateBody } from "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
-import { n as handleBylineFieldDelete, o as handleBylineFieldUpdate, r as handleBylineFieldGet } from "../../../../../byline-fields-DO6bAYK8.mjs";
+import { r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
+import { n as handleBylineFieldDelete, o as handleBylineFieldUpdate, r as handleBylineFieldGet } from "../../../../../byline-fields-CdU_LTF1.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/[slug].ts
 const prerender = false;

package/dist/astro/routes/api/admin/byline-fields/_slug_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_slug_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/byline-fields/[slug].ts"],"sourcesContent":["/**\n * Byline custom-field schema management — single field CRUD.\n *\n * - GET    /_emdash/api/admin/byline-fields/{slug}    read one definition\n * - PATCH  /_emdash/api/admin/byline-fields/{slug}    update label / required /\n *                                                     translatable / validation /\n *                                                     sort order\n * - DELETE /_emdash/api/admin/byline-fields/{slug}    drop the definition and all\n *                                                     stored values (FK CASCADE +\n *                                                     app-level cleanup; see\n *                                                     `BylineSchemaRegistry.deleteField`)\n *\n * Thin wrappers around the handler layer; status mapping happens in\n * `unwrapResult`. `slug` and `type` are immutable post-create — see\n * `bylineFieldUpdateBody`. Flipping `translatable` while value rows\n * exist surfaces as a 409 `TRANSLATABLE_LOCKED`.\n *\n * Phase 4 of Discussion #1174.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, requireDb, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleBylineFieldDelete,\n\thandleBylineFieldGet,\n\thandleBylineFieldUpdate,\n} from \"#api/handlers/byline-fields.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineFieldUpdateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n// GET requires `schema:read` (Editor+); see sibling `index.ts` GET\n// for rationale.\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:read\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst slug = params.slug;\n\tif (!slug) return apiError(\"MISSING_PARAM\", \"Field slug is required\", 400);\n\n\tconst result = await handleBylineFieldGet(emdash.db, slug);\n\treturn unwrapResult(result);\n};\n\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst slug = params.slug;\n\tif (!slug) return apiError(\"MISSING_PARAM\", \"Field slug is required\", 400);\n\n\tconst body = await parseBody(request, bylineFieldUpdateBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineFieldUpdate(emdash.db, slug, {\n\t\tlabel: body.label,\n\t\trequired: body.required,\n\t\ttranslatable: body.translatable,\n\t\t// `null` clears the stored validation; `undefined` leaves it as-is.\n\t\t// The zod schema makes `validation` itself optional, so an absent\n\t\t// key reaches the handler as `undefined`.\n\t\tvalidation: body.validation,\n\t\tsortOrder: body.sortOrder,\n\t});\n\treturn unwrapResult(result);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst slug = params.slug;\n\tif (!slug) return apiError(\"MISSING_PARAM\", \"Field slug is required\", 400);\n\n\tconst result = await handleBylineFieldDelete(emdash.db, slug);\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;AAgCA,MAAa,YAAY;AAIzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,cAAc;AAC/C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,KAAM,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAG1E,QAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,KAAK,CAC/B;;AAG5B,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,KAAM,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;CAE1E,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,KAAI,aAAa,KAAK,CAAE,QAAO;AAY/B,QAAO,aAVQ,MAAM,wBAAwB,OAAO,IAAI,MAAM;EAC7D,OAAO,KAAK;EACZ,UAAU,KAAK;EACf,cAAc,KAAK;EAInB,YAAY,KAAK;EACjB,WAAW,KAAK;EAChB,CAAC,CACyB;;AAG5B,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,KAAM,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAG1E,QAAO,aADQ,MAAM,wBAAwB,OAAO,IAAI,KAAK,CAClC"}
+{"version":3,"file":"_slug_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/byline-fields/[slug].ts"],"sourcesContent":["/**\n * Byline custom-field schema management — single field CRUD.\n *\n * - GET    /_emdash/api/admin/byline-fields/{slug}    read one definition\n * - PATCH  /_emdash/api/admin/byline-fields/{slug}    update label / required /\n *                                                     translatable / validation /\n *                                                     sort order\n * - DELETE /_emdash/api/admin/byline-fields/{slug}    drop the definition and all\n *                                                     stored values (FK CASCADE +\n *                                                     app-level cleanup; see\n *                                                     `BylineSchemaRegistry.deleteField`)\n *\n * Thin wrappers around the handler layer; status mapping happens in\n * `unwrapResult`. `slug` and `type` are immutable post-create — see\n * `bylineFieldUpdateBody`. Flipping `translatable` while value rows\n * exist surfaces as a 409 `TRANSLATABLE_LOCKED`.\n *\n * Phase 4 of Discussion #1174.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, requireDb, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleBylineFieldDelete,\n\thandleBylineFieldGet,\n\thandleBylineFieldUpdate,\n} from \"#api/handlers/byline-fields.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineFieldUpdateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n// GET requires `schema:read` (Editor+); see sibling `index.ts` GET\n// for rationale.\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:read\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst slug = params.slug;\n\tif (!slug) return apiError(\"MISSING_PARAM\", \"Field slug is required\", 400);\n\n\tconst result = await handleBylineFieldGet(emdash.db, slug);\n\treturn unwrapResult(result);\n};\n\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst slug = params.slug;\n\tif (!slug) return apiError(\"MISSING_PARAM\", \"Field slug is required\", 400);\n\n\tconst body = await parseBody(request, bylineFieldUpdateBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineFieldUpdate(emdash.db, slug, {\n\t\tlabel: body.label,\n\t\trequired: body.required,\n\t\ttranslatable: body.translatable,\n\t\t// `null` clears the stored validation; `undefined` leaves it as-is.\n\t\t// The zod schema makes `validation` itself optional, so an absent\n\t\t// key reaches the handler as `undefined`.\n\t\tvalidation: body.validation,\n\t\tsortOrder: body.sortOrder,\n\t});\n\treturn unwrapResult(result);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst slug = params.slug;\n\tif (!slug) return apiError(\"MISSING_PARAM\", \"Field slug is required\", 400);\n\n\tconst result = await handleBylineFieldDelete(emdash.db, slug);\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;AAgCA,MAAa,YAAY;AAIzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,cAAc;AAC/C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,KAAM,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAG1E,QAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,KAAK,CAC/B;;AAG5B,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,KAAM,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;CAE1E,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,KAAI,aAAa,KAAK,CAAE,QAAO;AAY/B,QAAO,aAVQ,MAAM,wBAAwB,OAAO,IAAI,MAAM;EAC7D,OAAO,KAAK;EACZ,UAAU,KAAK;EACf,cAAc,KAAK;EAInB,YAAY,KAAK;EACjB,WAAW,KAAK;EAChB,CAAC,CACyB;;AAG5B,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,KAAM,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAG1E,QAAO,aADQ,MAAM,wBAAwB,OAAO,IAAI,KAAK,CAClC"}

package/dist/astro/routes/api/admin/byline-fields/index.mjs

@@ -1,14 +1,15 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
 import "../../../../../byline-registry-BCuOp4UF.mjs";
-import { a as unwrapResult, i as requireDb } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import "../../../../../redirects-CeD7K7EX.mjs";
-import { d as bylineFieldCreateBody } from "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import { a as unwrapResult, i as requireDb } from "../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import "../../../../../media-kIV1IxFf.mjs";
+import "../../../../../redirects-BBq3n2Rj.mjs";
+import { d as bylineFieldCreateBody } from "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
-import { i as handleBylineFieldList, t as handleBylineFieldCreate } from "../../../../../byline-fields-DO6bAYK8.mjs";
+import { r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
+import { i as handleBylineFieldList, t as handleBylineFieldCreate } from "../../../../../byline-fields-CdU_LTF1.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/index.ts
 const prerender = false;

package/dist/astro/routes/api/admin/byline-fields/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/byline-fields/index.ts"],"sourcesContent":["/**\n * Byline custom-field schema management — list + create.\n *\n * - GET  /_emdash/api/admin/byline-fields           list every registered field\n * - POST /_emdash/api/admin/byline-fields           create a new field definition\n *\n * Thin wrappers around `handleBylineFieldList` / `handleBylineFieldCreate`\n * in `api/handlers/byline-fields.ts`. Both endpoints require\n * `schema:manage`. Reserved-slug + identifier validation runs at the\n * zod layer in `bylineFieldCreateBody`; the registry repeats the check\n * for defence-in-depth. Domain errors surface as typed `ErrorCode`s and\n * are mapped to HTTP statuses by `unwrapResult` → `mapErrorStatus`.\n *\n * Phase 4 of Discussion #1174.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineFieldCreate, handleBylineFieldList } from \"#api/handlers/byline-fields.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineFieldCreateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n// GET requires `schema:read` (Editor+), not `schema:manage` — Phase 6\n// of #1174 surfaced the split: editors need to read field definitions\n// to render custom-field inputs in the byline edit form, while only\n// admins manage the registry. The Phase 4 review-round constraint\n// \"every endpoint returns 403 for a user without schema:manage\" is\n// superseded for the read endpoints; mutations remain admin-only.\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:read\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst result = await handleBylineFieldList(emdash.db);\n\treturn unwrapResult(result);\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst body = await parseBody(request, bylineFieldCreateBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineFieldCreate(emdash.db, {\n\t\tslug: body.slug,\n\t\tlabel: body.label,\n\t\ttype: body.type,\n\t\trequired: body.required,\n\t\ttranslatable: body.translatable,\n\t\tvalidation: body.validation ?? null,\n\t\tsortOrder: body.sortOrder,\n\t});\n\treturn unwrapResult(result, 201);\n};\n"],"mappings":";;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAQzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,cAAc;AAC/C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;AAGlB,QAAO,aADQ,MAAM,sBAAsB,OAAO,GAAG,CAC1B;;AAG5B,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,KAAI,aAAa,KAAK,CAAE,QAAO;AAW/B,QAAO,aATQ,MAAM,wBAAwB,OAAO,IAAI;EACvD,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,YAAY,KAAK,cAAc;EAC/B,WAAW,KAAK;EAChB,CAAC,EAC0B,IAAI"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/byline-fields/index.ts"],"sourcesContent":["/**\n * Byline custom-field schema management — list + create.\n *\n * - GET  /_emdash/api/admin/byline-fields           list every registered field\n * - POST /_emdash/api/admin/byline-fields           create a new field definition\n *\n * Thin wrappers around `handleBylineFieldList` / `handleBylineFieldCreate`\n * in `api/handlers/byline-fields.ts`. Both endpoints require\n * `schema:manage`. Reserved-slug + identifier validation runs at the\n * zod layer in `bylineFieldCreateBody`; the registry repeats the check\n * for defence-in-depth. Domain errors surface as typed `ErrorCode`s and\n * are mapped to HTTP statuses by `unwrapResult` → `mapErrorStatus`.\n *\n * Phase 4 of Discussion #1174.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineFieldCreate, handleBylineFieldList } from \"#api/handlers/byline-fields.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineFieldCreateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n// GET requires `schema:read` (Editor+), not `schema:manage` — Phase 6\n// of #1174 surfaced the split: editors need to read field definitions\n// to render custom-field inputs in the byline edit form, while only\n// admins manage the registry. The Phase 4 review-round constraint\n// \"every endpoint returns 403 for a user without schema:manage\" is\n// superseded for the read endpoints; mutations remain admin-only.\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:read\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst result = await handleBylineFieldList(emdash.db);\n\treturn unwrapResult(result);\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst body = await parseBody(request, bylineFieldCreateBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineFieldCreate(emdash.db, {\n\t\tslug: body.slug,\n\t\tlabel: body.label,\n\t\ttype: body.type,\n\t\trequired: body.required,\n\t\ttranslatable: body.translatable,\n\t\tvalidation: body.validation ?? null,\n\t\tsortOrder: body.sortOrder,\n\t});\n\treturn unwrapResult(result, 201);\n};\n"],"mappings":";;;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAQzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,cAAc;AAC/C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;AAGlB,QAAO,aADQ,MAAM,sBAAsB,OAAO,GAAG,CAC1B;;AAG5B,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,KAAI,aAAa,KAAK,CAAE,QAAO;AAW/B,QAAO,aATQ,MAAM,wBAAwB,OAAO,IAAI;EACvD,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,YAAY,KAAK,cAAc;EAC/B,WAAW,KAAK;EAChB,CAAC,EAC0B,IAAI"}

package/dist/astro/routes/api/admin/byline-fields/reorder.mjs

@@ -1,14 +1,15 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
 import "../../../../../byline-registry-BCuOp4UF.mjs";
-import { a as unwrapResult, i as requireDb } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import "../../../../../redirects-CeD7K7EX.mjs";
-import { m as bylineFieldReorderBody } from "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import { a as unwrapResult, i as requireDb } from "../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import "../../../../../media-kIV1IxFf.mjs";
+import "../../../../../redirects-BBq3n2Rj.mjs";
+import { m as bylineFieldReorderBody } from "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
-import { a as handleBylineFieldReorder } from "../../../../../byline-fields-DO6bAYK8.mjs";
+import { r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
+import { a as handleBylineFieldReorder } from "../../../../../byline-fields-CdU_LTF1.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/reorder.ts
 const prerender = false;

package/dist/astro/routes/api/admin/byline-fields/reorder.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"reorder.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/byline-fields/reorder.ts"],"sourcesContent":["/**\n * Byline field reorder.\n *\n * POST /_emdash/api/admin/byline-fields/reorder\n *\n * Body: `{ slugs: string[] }` — the exact set of currently registered\n * slugs in the desired order. The registry rejects any drift\n * (`REORDER_MISMATCH` → 400). Empty `[]` against an empty registered\n * set is a no-op by registry contract; the zod schema permits it.\n *\n * Thin wrapper around `handleBylineFieldReorder`.\n *\n * Phase 4 of Discussion #1174.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineFieldReorder } from \"#api/handlers/byline-fields.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineFieldReorderBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst body = await parseBody(request, bylineFieldReorderBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineFieldReorder(emdash.db, body.slugs);\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;AAuBA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,MAAM,UAAU,SAAS,uBAAuB;AAC7D,KAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,QAAO,aADQ,MAAM,yBAAyB,OAAO,IAAI,KAAK,MAAM,CACzC"}
+{"version":3,"file":"reorder.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/byline-fields/reorder.ts"],"sourcesContent":["/**\n * Byline field reorder.\n *\n * POST /_emdash/api/admin/byline-fields/reorder\n *\n * Body: `{ slugs: string[] }` — the exact set of currently registered\n * slugs in the desired order. The registry rejects any drift\n * (`REORDER_MISMATCH` → 400). Empty `[]` against an empty registered\n * set is a no-op by registry contract; the zod schema permits it.\n *\n * Thin wrapper around `handleBylineFieldReorder`.\n *\n * Phase 4 of Discussion #1174.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineFieldReorder } from \"#api/handlers/byline-fields.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineFieldReorderBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst body = await parseBody(request, bylineFieldReorderBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineFieldReorder(emdash.db, body.slugs);\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;AAuBA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,MAAM,UAAU,SAAS,uBAAuB;AAC7D,KAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,QAAO,aADQ,MAAM,yBAAyB,OAAO,IAAI,KAAK,MAAM,CACzC"}

package/dist/astro/routes/api/admin/bylines/_id_/index.mjs

@@ -1,23 +1,24 @@
-import "../../../../../../dialect-helpers-Cue7QQOR.mjs";
+import "../../../../../../dialect-helpers-HxEQGl_1.mjs";
 import "../../../../../../after-B1IIdH3Y.mjs";
 import "../../../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../../../base64-C74Msx8h.mjs";
-import "../../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../../base64-B-PsqheR.mjs";
+import "../../../../../../types-D1iJ3DpO.mjs";
 import "../../../../../../request-cache-BSUptuJR.mjs";
 import "../../../../../../byline-registry-BCuOp4UF.mjs";
-import "../../../../../../field-defs-cache-BVrNCgSj.mjs";
-import { t as BylineRepository } from "../../../../../../byline-BWb5H-65.mjs";
+import "../../../../../../field-defs-cache-DvmlgP-D.mjs";
+import { t as BylineRepository } from "../../../../../../byline-XEjchwzZ.mjs";
 import "../../../../../../resolve-Cd9dzclN.mjs";
-import "../../../../../../loader-Rb8QlGZp.mjs";
-import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-GLksnn-B.mjs";
-import { kn as bylineUpdateBody } from "../../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../../loader-Be3ouI5L.mjs";
+import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-C_-6klII.mjs";
+import "../../../../../../media-kIV1IxFf.mjs";
+import { fn as bylineUpdateBody } from "../../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../../relations-5_avdrN_.mjs";
+import "../../../../../../status-COfycGIU.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { a as invalidateBylineCache } from "../../../../../../bylines-CHojDMpj.mjs";
-import { n as requirePerm } from "../../../../../../authorize-BmCwQCib.mjs";
-import { i as handleBylineUpdate } from "../../../../../../bylines-BGuKFaBy.mjs";
+import { a as invalidateBylineCache } from "../../../../../../bylines-czseViYo.mjs";
+import { r as requirePerm } from "../../../../../../authorize-WxsiePzy.mjs";
+import { i as handleBylineUpdate } from "../../../../../../bylines-BJbT4gKS.mjs";
 
 //#region src/astro/routes/api/admin/bylines/[id]/index.ts
 const prerender = false;

package/dist/astro/routes/api/admin/bylines/_id_/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/bylines/[id]/index.ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineUpdate } from \"#api/handlers/bylines.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineUpdateBody } from \"#api/schemas.js\";\nimport { invalidateBylineCache } from \"#bylines/index.js\";\nimport { BylineRepository } from \"#db/repositories/byline.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"bylines:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst repo = new BylineRepository(emdash.db);\n\t\tconst byline = await repo.findById(params.id!);\n\t\tif (!byline) return apiError(\"NOT_FOUND\", \"Byline not found\", 404);\n\t\treturn apiSuccess(byline);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get byline\", \"BYLINE_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"bylines:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst body = await parseBody(request, bylineUpdateBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineUpdate(emdash.db, params.id!, {\n\t\tslug: body.slug,\n\t\tdisplayName: body.displayName,\n\t\tbio: body.bio ?? null,\n\t\tavatarMediaId: body.avatarMediaId ?? null,\n\t\twebsiteUrl: body.websiteUrl ?? null,\n\t\tuserId: body.userId ?? null,\n\t\tisGuest: body.isGuest,\n\t\t// Forward `customFields` only when present so the repo treats an\n\t\t// omitted key as \"leave existing values untouched\". An empty\n\t\t// object also no-ops by repo convention — see\n\t\t// `BylineRepository.update`. Validation (unknown slug, type\n\t\t// mismatch, select-choice) happens inside the repo and surfaces\n\t\t// as `EmDashValidationError`, which the handler maps to a 400\n\t\t// `VALIDATION_ERROR` for `unwrapResult` / `mapErrorStatus`.\n\t\tcustomFields: body.customFields,\n\t});\n\n\tif (result.success) invalidateBylineCache();\n\treturn unwrapResult(result);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"bylines:manage\");\n\tif (denied) return denied;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst repo = new BylineRepository(emdash.db);\n\t\tconst deleted = await repo.delete(params.id!);\n\t\tif (!deleted) return apiError(\"NOT_FOUND\", \"Byline not found\", 404);\n\t\tinvalidateBylineCache();\n\t\treturn apiSuccess({ deleted: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete byline\", \"BYLINE_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,SAAS,MADF,IAAI,iBAAiB,OAAO,GAAG,CAClB,SAAS,OAAO,GAAI;AAC9C,MAAI,CAAC,OAAQ,QAAO,SAAS,aAAa,oBAAoB,IAAI;AAClE,SAAO,WAAW,OAAO;UACjB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,mBAAmB;;;AAIvE,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,MAAM,mBAAmB,OAAO,IAAI,OAAO,IAAK;EAC9D,MAAM,KAAK;EACX,aAAa,KAAK;EAClB,KAAK,KAAK,OAAO;EACjB,eAAe,KAAK,iBAAiB;EACrC,YAAY,KAAK,cAAc;EAC/B,QAAQ,KAAK,UAAU;EACvB,SAAS,KAAK;EAQd,cAAc,KAAK;EACnB,CAAC;AAEF,KAAI,OAAO,QAAS,wCAAuB;AAC3C,QAAO,aAAa,OAAO;;AAG5B,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAGH,MAAI,CADY,MADH,IAAI,iBAAiB,OAAO,GAAG,CACjB,OAAO,OAAO,GAAI,CAC/B,QAAO,SAAS,aAAa,oBAAoB,IAAI;AACnE,yCAAuB;AACvB,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,sBAAsB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/bylines/[id]/index.ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineUpdate } from \"#api/handlers/bylines.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineUpdateBody } from \"#api/schemas.js\";\nimport { invalidateBylineCache } from \"#bylines/index.js\";\nimport { BylineRepository } from \"#db/repositories/byline.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"bylines:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst repo = new BylineRepository(emdash.db);\n\t\tconst byline = await repo.findById(params.id!);\n\t\tif (!byline) return apiError(\"NOT_FOUND\", \"Byline not found\", 404);\n\t\treturn apiSuccess(byline);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get byline\", \"BYLINE_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"bylines:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst body = await parseBody(request, bylineUpdateBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineUpdate(emdash.db, params.id!, {\n\t\tslug: body.slug,\n\t\tdisplayName: body.displayName,\n\t\tbio: body.bio ?? null,\n\t\tavatarMediaId: body.avatarMediaId ?? null,\n\t\twebsiteUrl: body.websiteUrl ?? null,\n\t\tuserId: body.userId ?? null,\n\t\tisGuest: body.isGuest,\n\t\t// Forward `customFields` only when present so the repo treats an\n\t\t// omitted key as \"leave existing values untouched\". An empty\n\t\t// object also no-ops by repo convention — see\n\t\t// `BylineRepository.update`. Validation (unknown slug, type\n\t\t// mismatch, select-choice) happens inside the repo and surfaces\n\t\t// as `EmDashValidationError`, which the handler maps to a 400\n\t\t// `VALIDATION_ERROR` for `unwrapResult` / `mapErrorStatus`.\n\t\tcustomFields: body.customFields,\n\t});\n\n\tif (result.success) invalidateBylineCache();\n\treturn unwrapResult(result);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"bylines:manage\");\n\tif (denied) return denied;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst repo = new BylineRepository(emdash.db);\n\t\tconst deleted = await repo.delete(params.id!);\n\t\tif (!deleted) return apiError(\"NOT_FOUND\", \"Byline not found\", 404);\n\t\tinvalidateBylineCache();\n\t\treturn apiSuccess({ deleted: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete byline\", \"BYLINE_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,SAAS,MADF,IAAI,iBAAiB,OAAO,GAAG,CAClB,SAAS,OAAO,GAAI;AAC9C,MAAI,CAAC,OAAQ,QAAO,SAAS,aAAa,oBAAoB,IAAI;AAClE,SAAO,WAAW,OAAO;UACjB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,mBAAmB;;;AAIvE,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,MAAM,mBAAmB,OAAO,IAAI,OAAO,IAAK;EAC9D,MAAM,KAAK;EACX,aAAa,KAAK;EAClB,KAAK,KAAK,OAAO;EACjB,eAAe,KAAK,iBAAiB;EACrC,YAAY,KAAK,cAAc;EAC/B,QAAQ,KAAK,UAAU;EACvB,SAAS,KAAK;EAQd,cAAc,KAAK;EACnB,CAAC;AAEF,KAAI,OAAO,QAAS,wCAAuB;AAC3C,QAAO,aAAa,OAAO;;AAG5B,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAGH,MAAI,CADY,MADH,IAAI,iBAAiB,OAAO,GAAG,CACjB,OAAO,OAAO,GAAI,CAC/B,QAAO,SAAS,aAAa,oBAAoB,IAAI;AACnE,yCAAuB;AACvB,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,sBAAsB"}

package/dist/astro/routes/api/admin/bylines/_id_/translations.mjs

@@ -1,23 +1,24 @@
-import "../../../../../../dialect-helpers-Cue7QQOR.mjs";
+import "../../../../../../dialect-helpers-HxEQGl_1.mjs";
 import "../../../../../../after-B1IIdH3Y.mjs";
 import "../../../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../../../base64-C74Msx8h.mjs";
-import "../../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../../base64-B-PsqheR.mjs";
+import "../../../../../../types-D1iJ3DpO.mjs";
 import "../../../../../../request-cache-BSUptuJR.mjs";
 import "../../../../../../byline-registry-BCuOp4UF.mjs";
-import "../../../../../../field-defs-cache-BVrNCgSj.mjs";
-import { t as BylineRepository } from "../../../../../../byline-BWb5H-65.mjs";
+import "../../../../../../field-defs-cache-DvmlgP-D.mjs";
+import { t as BylineRepository } from "../../../../../../byline-XEjchwzZ.mjs";
 import "../../../../../../resolve-Cd9dzclN.mjs";
-import "../../../../../../loader-Rb8QlGZp.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-GLksnn-B.mjs";
-import { Dn as bylineTranslationCreateBody } from "../../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../../loader-Be3ouI5L.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-C_-6klII.mjs";
+import "../../../../../../media-kIV1IxFf.mjs";
+import { un as bylineTranslationCreateBody } from "../../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../../relations-5_avdrN_.mjs";
+import "../../../../../../status-COfycGIU.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { a as invalidateBylineCache } from "../../../../../../bylines-CHojDMpj.mjs";
-import { n as requirePerm } from "../../../../../../authorize-BmCwQCib.mjs";
-import { n as handleBylineCreate, r as handleBylineTranslations } from "../../../../../../bylines-BGuKFaBy.mjs";
+import { a as invalidateBylineCache } from "../../../../../../bylines-czseViYo.mjs";
+import { r as requirePerm } from "../../../../../../authorize-WxsiePzy.mjs";
+import { n as handleBylineCreate, r as handleBylineTranslations } from "../../../../../../bylines-BJbT4gKS.mjs";
 
 //#region src/astro/routes/api/admin/bylines/[id]/translations.ts
 const prerender = false;
@@ -45,13 +46,7 @@ const POST = async ({ params, request, locals }) => {
 		const body = await parseBody(request, bylineTranslationCreateBody);
 		if (isParseError(body)) return body;
 		const source = await new BylineRepository(emdash.db).findById(id);
-		if (!source) return new Response(JSON.stringify({ error: {
-			code: "NOT_FOUND",
-			message: "Byline not found"
-		} }), {
-			status: 404,
-			headers: { "Content-Type": "application/json" }
-		});
+		if (!source) return apiError("NOT_FOUND", "Byline not found", 404);
 		const result = await handleBylineCreate(emdash.db, {
 			slug: body.slug ?? source.slug,
 			displayName: body.displayName ?? source.displayName,

package/dist/astro/routes/api/admin/bylines/_id_/translations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/bylines/[id]/translations.ts"],"sourcesContent":["/**\n * Byline translation endpoints\n *\n * GET  /_emdash/api/admin/bylines/:id/translations  — list every translation\n *                                                     of a byline (siblings\n *                                                     in the same\n *                                                     translation_group)\n * POST /_emdash/api/admin/bylines/:id/translations  — create a new locale\n *                                                     variant joining the\n *                                                     source's\n *                                                     translation_group\n *                                                     (body: { locale, ... })\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineCreate, handleBylineTranslations } from \"#api/handlers/bylines.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineTranslationCreateBody } from \"#api/schemas.js\";\nimport { invalidateBylineCache } from \"#bylines/index.js\";\nimport { BylineRepository } from \"#db/repositories/byline.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst id = params.id!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"bylines:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst result = await handleBylineTranslations(emdash.db, id);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch byline translations\", \"BYLINE_TRANSLATIONS_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst id = params.id!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"bylines:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, bylineTranslationCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Look up the source byline so we can:\n\t\t//  (a) emit a clean 404 when it doesn't exist (route layer);\n\t\t//  (b) fall back to its slug + display_name + avatar/website when\n\t\t//      the body omits them. Editors creating a translation often\n\t\t//      want to keep the slug stable and only enter the localized\n\t\t//      bio/displayName — defaulting saves clicks.\n\t\tconst repo = new BylineRepository(emdash.db);\n\t\tconst source = await repo.findById(id);\n\t\tif (!source) {\n\t\t\treturn new Response(\n\t\t\t\tJSON.stringify({ error: { code: \"NOT_FOUND\", message: \"Byline not found\" } }),\n\t\t\t\t{ status: 404, headers: { \"Content-Type\": \"application/json\" } },\n\t\t\t);\n\t\t}\n\n\t\tconst result = await handleBylineCreate(emdash.db, {\n\t\t\tslug: body.slug ?? source.slug,\n\t\t\tdisplayName: body.displayName ?? source.displayName,\n\t\t\tbio: body.bio ?? null,\n\t\t\tavatarMediaId: body.avatarMediaId ?? source.avatarMediaId,\n\t\t\twebsiteUrl: body.websiteUrl ?? source.websiteUrl,\n\t\t\t// Translations don't inherit the source's user_id or guest flag —\n\t\t\t// the partial unique on (user_id, locale) means a single user can\n\t\t\t// own one byline per locale, but the editor must opt into linking\n\t\t\t// the new row by editing it after creation.\n\t\t\tuserId: null,\n\t\t\tisGuest: source.isGuest,\n\t\t\tlocale: body.locale,\n\t\t\ttranslationOf: id,\n\t\t});\n\n\t\tif (result.success) invalidateBylineCache();\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to create byline translation\",\n\t\t\t\"BYLINE_TRANSLATION_CREATE_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,KAAK,OAAO;CAElB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI;AAEH,SAAO,aADQ,MAAM,yBAAyB,OAAO,IAAI,GAAG,CACjC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,uCAAuC,4BAA4B;;;AAI/F,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,KAAK,OAAO;CAElB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,4BAA4B;AAClE,MAAI,aAAa,KAAK,CAAE,QAAO;EAS/B,MAAM,SAAS,MADF,IAAI,iBAAiB,OAAO,GAAG,CAClB,SAAS,GAAG;AACtC,MAAI,CAAC,OACJ,QAAO,IAAI,SACV,KAAK,UAAU,EAAE,OAAO;GAAE,MAAM;GAAa,SAAS;GAAoB,EAAE,CAAC,EAC7E;GAAE,QAAQ;GAAK,SAAS,EAAE,gBAAgB,oBAAoB;GAAE,CAChE;EAGF,MAAM,SAAS,MAAM,mBAAmB,OAAO,IAAI;GAClD,MAAM,KAAK,QAAQ,OAAO;GAC1B,aAAa,KAAK,eAAe,OAAO;GACxC,KAAK,KAAK,OAAO;GACjB,eAAe,KAAK,iBAAiB,OAAO;GAC5C,YAAY,KAAK,cAAc,OAAO;GAKtC,QAAQ;GACR,SAAS,OAAO;GAChB,QAAQ,KAAK;GACb,eAAe;GACf,CAAC;AAEF,MAAI,OAAO,QAAS,wCAAuB;AAC3C,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YACN,OACA,uCACA,kCACA"}
+{"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/bylines/[id]/translations.ts"],"sourcesContent":["/**\n * Byline translation endpoints\n *\n * GET  /_emdash/api/admin/bylines/:id/translations  — list every translation\n *                                                     of a byline (siblings\n *                                                     in the same\n *                                                     translation_group)\n * POST /_emdash/api/admin/bylines/:id/translations  — create a new locale\n *                                                     variant joining the\n *                                                     source's\n *                                                     translation_group\n *                                                     (body: { locale, ... })\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineCreate, handleBylineTranslations } from \"#api/handlers/bylines.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineTranslationCreateBody } from \"#api/schemas.js\";\nimport { invalidateBylineCache } from \"#bylines/index.js\";\nimport { BylineRepository } from \"#db/repositories/byline.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst id = params.id!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"bylines:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst result = await handleBylineTranslations(emdash.db, id);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch byline translations\", \"BYLINE_TRANSLATIONS_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst id = params.id!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"bylines:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, bylineTranslationCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Look up the source byline so we can:\n\t\t//  (a) emit a clean 404 when it doesn't exist (route layer);\n\t\t//  (b) fall back to its slug + display_name + avatar/website when\n\t\t//      the body omits them. Editors creating a translation often\n\t\t//      want to keep the slug stable and only enter the localized\n\t\t//      bio/displayName — defaulting saves clicks.\n\t\tconst repo = new BylineRepository(emdash.db);\n\t\tconst source = await repo.findById(id);\n\t\tif (!source) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Byline not found\", 404);\n\t\t}\n\n\t\tconst result = await handleBylineCreate(emdash.db, {\n\t\t\tslug: body.slug ?? source.slug,\n\t\t\tdisplayName: body.displayName ?? source.displayName,\n\t\t\tbio: body.bio ?? null,\n\t\t\tavatarMediaId: body.avatarMediaId ?? source.avatarMediaId,\n\t\t\twebsiteUrl: body.websiteUrl ?? source.websiteUrl,\n\t\t\t// Translations don't inherit the source's user_id or guest flag —\n\t\t\t// the partial unique on (user_id, locale) means a single user can\n\t\t\t// own one byline per locale, but the editor must opt into linking\n\t\t\t// the new row by editing it after creation.\n\t\t\tuserId: null,\n\t\t\tisGuest: source.isGuest,\n\t\t\tlocale: body.locale,\n\t\t\ttranslationOf: id,\n\t\t});\n\n\t\tif (result.success) invalidateBylineCache();\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to create byline translation\",\n\t\t\t\"BYLINE_TRANSLATION_CREATE_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,KAAK,OAAO;CAElB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI;AAEH,SAAO,aADQ,MAAM,yBAAyB,OAAO,IAAI,GAAG,CACjC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,uCAAuC,4BAA4B;;;AAI/F,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,KAAK,OAAO;CAElB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,4BAA4B;AAClE,MAAI,aAAa,KAAK,CAAE,QAAO;EAS/B,MAAM,SAAS,MADF,IAAI,iBAAiB,OAAO,GAAG,CAClB,SAAS,GAAG;AACtC,MAAI,CAAC,OACJ,QAAO,SAAS,aAAa,oBAAoB,IAAI;EAGtD,MAAM,SAAS,MAAM,mBAAmB,OAAO,IAAI;GAClD,MAAM,KAAK,QAAQ,OAAO;GAC1B,aAAa,KAAK,eAAe,OAAO;GACxC,KAAK,KAAK,OAAO;GACjB,eAAe,KAAK,iBAAiB,OAAO;GAC5C,YAAY,KAAK,cAAc,OAAO;GAKtC,QAAQ;GACR,SAAS,OAAO;GAChB,QAAQ,KAAK;GACb,eAAe;GACf,CAAC;AAEF,MAAI,OAAO,QAAS,wCAAuB;AAC3C,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YACN,OACA,uCACA,kCACA"}

package/dist/astro/routes/api/admin/bylines/index.mjs

@@ -1,24 +1,25 @@
-import "../../../../../dialect-helpers-Cue7QQOR.mjs";
+import "../../../../../dialect-helpers-HxEQGl_1.mjs";
 import { n as getI18nConfig } from "../../../../../config-CVssduLe.mjs";
 import "../../../../../after-B1IIdH3Y.mjs";
 import "../../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
 import "../../../../../request-cache-BSUptuJR.mjs";
 import "../../../../../byline-registry-BCuOp4UF.mjs";
-import "../../../../../field-defs-cache-BVrNCgSj.mjs";
-import { t as BylineRepository } from "../../../../../byline-BWb5H-65.mjs";
+import "../../../../../field-defs-cache-DvmlgP-D.mjs";
+import { t as BylineRepository } from "../../../../../byline-XEjchwzZ.mjs";
 import "../../../../../resolve-Cd9dzclN.mjs";
-import "../../../../../loader-Rb8QlGZp.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { An as bylinesListQuery, Cn as bylineCreateBody } from "../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../loader-Be3ouI5L.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import "../../../../../media-kIV1IxFf.mjs";
+import { on as bylineCreateBody, pn as bylinesListQuery } from "../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { a as invalidateBylineCache } from "../../../../../bylines-CHojDMpj.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
-import { n as handleBylineCreate } from "../../../../../bylines-BGuKFaBy.mjs";
+import { a as invalidateBylineCache } from "../../../../../bylines-czseViYo.mjs";
+import { r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
+import { n as handleBylineCreate } from "../../../../../bylines-BJbT4gKS.mjs";
 
 //#region src/astro/routes/api/admin/bylines/index.ts
 const prerender = false;