emdash 0.29.0 → 0.30.0

package/dist/astro/routes/api/media/_id_/confirm.mjs

@@ -1,13 +1,14 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
 import { t as enrichImageMetadata } from "../../../../../enrich-CFJJgxs_.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { Kt as mediaConfirmBody } from "../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import { i as mediaConfirmBody } from "../../../../../media-kIV1IxFf.mjs";
+import "../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm, t as requireOwnerPerm } from "../../../../../authorize-BmCwQCib.mjs";
+import { n as requireOwnerPerm, r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
 import { MediaRepository } from "emdash";
 
 //#region src/astro/routes/api/media/[id]/confirm.ts

package/dist/astro/routes/api/media/_id_/confirm.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"confirm.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/[id]/confirm.ts"],"sourcesContent":["/**\n * Confirm media upload endpoint\n *\n * POST /_emdash/api/media/{id}/confirm\n *\n * Confirms that the client has successfully uploaded the file to storage.\n * Marks the media record as ready and optionally updates metadata.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { MediaRepository } from \"emdash\";\n\nimport { requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { mediaConfirmBody } from \"#api/schemas.js\";\nimport { enrichImageMetadata } from \"#media/enrich.js\";\nimport type { MediaItem } from \"#types\";\n\nexport const prerender = false;\n\n/**\n * Max raw bytes to buffer for server-side LQIP generation at confirm time. The\n * signed-URL upload flow exists so large files bypass server buffering — re-reading\n * the whole object into a Worker's 128 MB heap to compute a blurhash would OOM\n * on the very uploads that flow was designed for. LQIP is progressive\n * enhancement: large images simply ship without a server-generated placeholder.\n */\nconst MAX_PLACEHOLDER_DOWNLOAD_BYTES = 8 * 1024 * 1024;\n\n/**\n * Add URL to media item (relative URL for portability)\n */\nfunction addUrlToMedia(item: MediaItem): MediaItem & { url: string } {\n\treturn {\n\t\t...item,\n\t\turl: `/_emdash/api/media/file/${item.storageKey}`,\n\t};\n}\n\n/**\n * Confirm upload completion\n */\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID is required\", 400);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseOptionalBody(request, mediaConfirmBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Get the media item first to check status\n\t\tconst existing = await repo.findById(id);\n\t\tif (!existing) {\n\t\t\treturn apiError(\"NOT_FOUND\", `Media item not found: ${id}`, 404);\n\t\t}\n\n\t\tif (existing.status !== \"pending\") {\n\t\t\treturn apiError(\"INVALID_STATE\", `Media item is not pending: ${existing.status}`, 400);\n\t\t}\n\n\t\t// Only the uploader or a user with media:edit_any can confirm/fail a pending upload\n\t\tconst ownerDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\texisting.authorId ?? \"\",\n\t\t\t\"media:edit_own\",\n\t\t\t\"media:edit_any\",\n\t\t);\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\t// Optionally verify the file exists in storage\n\t\tif (emdash.storage) {\n\t\t\tconst exists = await emdash.storage.exists(existing.storageKey);\n\t\t\tif (!exists) {\n\t\t\t\t// Mark as failed\n\t\t\t\tawait repo.markFailed(id);\n\t\t\t\treturn apiError(\"FILE_NOT_FOUND\", \"File was not uploaded to storage\", 400);\n\t\t\t}\n\t\t}\n\n\t\t// For images, read the just-uploaded bytes back from storage once to\n\t\t// generate LQIP placeholders (and server-side dimensions as a fallback).\n\t\t// The signed-URL flow uploads directly to storage, so this confirm is the\n\t\t// only point at which the server sees the bytes. Best-effort: a decode\n\t\t// failure must not block the upload from being marked ready. We also cap\n\t\t// the download size — buffering a large original into a Worker heap to\n\t\t// compute a 32px blurhash would OOM on the uploads the signed-URL path\n\t\t// exists to support, so oversized files skip the server-side placeholder.\n\t\tlet blurhash: string | undefined;\n\t\tlet dominantColor: string | undefined;\n\t\tlet width = body.width;\n\t\tlet height = body.height;\n\t\tif (emdash.storage && existing.mimeType.startsWith(\"image/\")) {\n\t\t\tconst knownSize = body.size ?? existing.size ?? undefined;\n\t\t\tconst tooLarge = knownSize != null && knownSize > MAX_PLACEHOLDER_DOWNLOAD_BYTES;\n\t\t\tif (!tooLarge) {\n\t\t\t\ttry {\n\t\t\t\t\tconst { body: stream } = await emdash.storage.download(existing.storageKey);\n\t\t\t\t\tconst bytes = new Uint8Array(await new Response(stream).arrayBuffer());\n\t\t\t\t\t// Defense-in-depth for the unknown-size case: even though we\n\t\t\t\t\t// already buffered it, refuse the decode so we don't also pay\n\t\t\t\t\t// the (larger) RGBA allocation.\n\t\t\t\t\tif (bytes.byteLength > MAX_PLACEHOLDER_DOWNLOAD_BYTES) {\n\t\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\t`[media] confirm skipping placeholder: object ${existing.storageKey} is ${bytes.byteLength} bytes (> ${MAX_PLACEHOLDER_DOWNLOAD_BYTES})`,\n\t\t\t\t\t\t);\n\t\t\t\t\t} else {\n\t\t\t\t\t\tconst enriched = await enrichImageMetadata(bytes, existing.mimeType, {\n\t\t\t\t\t\t\tknownDimensions:\n\t\t\t\t\t\t\t\tbody.width != null && body.height != null\n\t\t\t\t\t\t\t\t\t? { width: body.width, height: body.height }\n\t\t\t\t\t\t\t\t\t: undefined,\n\t\t\t\t\t\t});\n\t\t\t\t\t\tblurhash = enriched.blurhash;\n\t\t\t\t\t\tdominantColor = enriched.dominantColor;\n\t\t\t\t\t\twidth = width ?? enriched.width;\n\t\t\t\t\t\theight = height ?? enriched.height;\n\t\t\t\t\t}\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconsole.error(\"[media] confirm placeholder generation failed:\", error);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[media] confirm skipping placeholder: object ${existing.storageKey} reported size ${knownSize} bytes (> ${MAX_PLACEHOLDER_DOWNLOAD_BYTES})`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Confirm the upload\n\t\tconst item = await repo.confirmUpload(id, {\n\t\t\tsize: body.size,\n\t\t\twidth,\n\t\t\theight,\n\t\t\tblurhash,\n\t\t\tdominantColor,\n\t\t});\n\n\t\tif (!item) {\n\t\t\treturn apiError(\"CONFIRM_FAILED\", \"Failed to confirm upload\", 500);\n\t\t}\n\n\t\t// Add URL to the response (relative URL for portability)\n\t\tconst itemWithUrl = addUrlToMedia(item);\n\n\t\treturn apiSuccess({ item: itemWithUrl });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to confirm upload\", \"CONFIRM_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAmBA,MAAa,YAAY;;;;;;;;AASzB,MAAM,iCAAiC,IAAI,OAAO;;;;AAKlD,SAAS,cAAc,MAA8C;AACpE,QAAO;EACN,GAAG;EACH,KAAK,2BAA2B,KAAK;EACrC;;;;;AAMF,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAEf,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,wBAAwB,IAAI;AAGhE,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,kBAAkB,SAAS,kBAAkB,EAAE,CAAC;AACnE,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;EAG3C,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SACJ,QAAO,SAAS,aAAa,yBAAyB,MAAM,IAAI;AAGjE,MAAI,SAAS,WAAW,UACvB,QAAO,SAAS,iBAAiB,8BAA8B,SAAS,UAAU,IAAI;EAIvF,MAAM,cAAc,iBACnB,MACA,SAAS,YAAY,IACrB,kBACA,iBACA;AACD,MAAI,YAAa,QAAO;AAGxB,MAAI,OAAO,SAEV;OAAI,CADW,MAAM,OAAO,QAAQ,OAAO,SAAS,WAAW,EAClD;AAEZ,UAAM,KAAK,WAAW,GAAG;AACzB,WAAO,SAAS,kBAAkB,oCAAoC,IAAI;;;EAY5E,IAAI;EACJ,IAAI;EACJ,IAAI,QAAQ,KAAK;EACjB,IAAI,SAAS,KAAK;AAClB,MAAI,OAAO,WAAW,SAAS,SAAS,WAAW,SAAS,EAAE;GAC7D,MAAM,YAAY,KAAK,QAAQ,SAAS,QAAQ;AAEhD,OAAI,EADa,aAAa,QAAQ,YAAY,gCAEjD,KAAI;IACH,MAAM,EAAE,MAAM,WAAW,MAAM,OAAO,QAAQ,SAAS,SAAS,WAAW;IAC3E,MAAM,QAAQ,IAAI,WAAW,MAAM,IAAI,SAAS,OAAO,CAAC,aAAa,CAAC;AAItE,QAAI,MAAM,aAAa,+BACtB,SAAQ,KACP,gDAAgD,SAAS,WAAW,MAAM,MAAM,WAAW,YAAY,+BAA+B,GACtI;SACK;KACN,MAAM,WAAW,MAAM,oBAAoB,OAAO,SAAS,UAAU,EACpE,iBACC,KAAK,SAAS,QAAQ,KAAK,UAAU,OAClC;MAAE,OAAO,KAAK;MAAO,QAAQ,KAAK;MAAQ,GAC1C,QACJ,CAAC;AACF,gBAAW,SAAS;AACpB,qBAAgB,SAAS;AACzB,aAAQ,SAAS,SAAS;AAC1B,cAAS,UAAU,SAAS;;YAErB,OAAO;AACf,YAAQ,MAAM,kDAAkD,MAAM;;OAGvE,SAAQ,KACP,gDAAgD,SAAS,WAAW,iBAAiB,UAAU,YAAY,+BAA+B,GAC1I;;EAKH,MAAM,OAAO,MAAM,KAAK,cAAc,IAAI;GACzC,MAAM,KAAK;GACX;GACA;GACA;GACA;GACA,CAAC;AAEF,MAAI,CAAC,KACJ,QAAO,SAAS,kBAAkB,4BAA4B,IAAI;AAMnE,SAAO,WAAW,EAAE,MAFA,cAAc,KAAK,EAEA,CAAC;UAChC,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,gBAAgB"}
+{"version":3,"file":"confirm.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/[id]/confirm.ts"],"sourcesContent":["/**\n * Confirm media upload endpoint\n *\n * POST /_emdash/api/media/{id}/confirm\n *\n * Confirms that the client has successfully uploaded the file to storage.\n * Marks the media record as ready and optionally updates metadata.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { MediaRepository } from \"emdash\";\n\nimport { requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { mediaConfirmBody } from \"#api/schemas.js\";\nimport { enrichImageMetadata } from \"#media/enrich.js\";\nimport type { MediaItem } from \"#types\";\n\nexport const prerender = false;\n\n/**\n * Max raw bytes to buffer for server-side LQIP generation at confirm time. The\n * signed-URL upload flow exists so large files bypass server buffering — re-reading\n * the whole object into a Worker's 128 MB heap to compute a blurhash would OOM\n * on the very uploads that flow was designed for. LQIP is progressive\n * enhancement: large images simply ship without a server-generated placeholder.\n */\nconst MAX_PLACEHOLDER_DOWNLOAD_BYTES = 8 * 1024 * 1024;\n\n/**\n * Add URL to media item (relative URL for portability)\n */\nfunction addUrlToMedia(item: MediaItem): MediaItem & { url: string } {\n\treturn {\n\t\t...item,\n\t\turl: `/_emdash/api/media/file/${item.storageKey}`,\n\t};\n}\n\n/**\n * Confirm upload completion\n */\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID is required\", 400);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseOptionalBody(request, mediaConfirmBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Get the media item first to check status\n\t\tconst existing = await repo.findById(id);\n\t\tif (!existing) {\n\t\t\treturn apiError(\"NOT_FOUND\", `Media item not found: ${id}`, 404);\n\t\t}\n\n\t\tif (existing.status !== \"pending\") {\n\t\t\treturn apiError(\"INVALID_STATE\", `Media item is not pending: ${existing.status}`, 400);\n\t\t}\n\n\t\t// Only the uploader or a user with media:edit_any can confirm/fail a pending upload\n\t\tconst ownerDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\texisting.authorId ?? \"\",\n\t\t\t\"media:edit_own\",\n\t\t\t\"media:edit_any\",\n\t\t);\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\t// Optionally verify the file exists in storage\n\t\tif (emdash.storage) {\n\t\t\tconst exists = await emdash.storage.exists(existing.storageKey);\n\t\t\tif (!exists) {\n\t\t\t\t// Mark as failed\n\t\t\t\tawait repo.markFailed(id);\n\t\t\t\treturn apiError(\"FILE_NOT_FOUND\", \"File was not uploaded to storage\", 400);\n\t\t\t}\n\t\t}\n\n\t\t// For images, read the just-uploaded bytes back from storage once to\n\t\t// generate LQIP placeholders (and server-side dimensions as a fallback).\n\t\t// The signed-URL flow uploads directly to storage, so this confirm is the\n\t\t// only point at which the server sees the bytes. Best-effort: a decode\n\t\t// failure must not block the upload from being marked ready. We also cap\n\t\t// the download size — buffering a large original into a Worker heap to\n\t\t// compute a 32px blurhash would OOM on the uploads the signed-URL path\n\t\t// exists to support, so oversized files skip the server-side placeholder.\n\t\tlet blurhash: string | undefined;\n\t\tlet dominantColor: string | undefined;\n\t\tlet width = body.width;\n\t\tlet height = body.height;\n\t\tif (emdash.storage && existing.mimeType.startsWith(\"image/\")) {\n\t\t\tconst knownSize = body.size ?? existing.size ?? undefined;\n\t\t\tconst tooLarge = knownSize != null && knownSize > MAX_PLACEHOLDER_DOWNLOAD_BYTES;\n\t\t\tif (!tooLarge) {\n\t\t\t\ttry {\n\t\t\t\t\tconst { body: stream } = await emdash.storage.download(existing.storageKey);\n\t\t\t\t\tconst bytes = new Uint8Array(await new Response(stream).arrayBuffer());\n\t\t\t\t\t// Defense-in-depth for the unknown-size case: even though we\n\t\t\t\t\t// already buffered it, refuse the decode so we don't also pay\n\t\t\t\t\t// the (larger) RGBA allocation.\n\t\t\t\t\tif (bytes.byteLength > MAX_PLACEHOLDER_DOWNLOAD_BYTES) {\n\t\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\t`[media] confirm skipping placeholder: object ${existing.storageKey} is ${bytes.byteLength} bytes (> ${MAX_PLACEHOLDER_DOWNLOAD_BYTES})`,\n\t\t\t\t\t\t);\n\t\t\t\t\t} else {\n\t\t\t\t\t\tconst enriched = await enrichImageMetadata(bytes, existing.mimeType, {\n\t\t\t\t\t\t\tknownDimensions:\n\t\t\t\t\t\t\t\tbody.width != null && body.height != null\n\t\t\t\t\t\t\t\t\t? { width: body.width, height: body.height }\n\t\t\t\t\t\t\t\t\t: undefined,\n\t\t\t\t\t\t});\n\t\t\t\t\t\tblurhash = enriched.blurhash;\n\t\t\t\t\t\tdominantColor = enriched.dominantColor;\n\t\t\t\t\t\twidth = width ?? enriched.width;\n\t\t\t\t\t\theight = height ?? enriched.height;\n\t\t\t\t\t}\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconsole.error(\"[media] confirm placeholder generation failed:\", error);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`[media] confirm skipping placeholder: object ${existing.storageKey} reported size ${knownSize} bytes (> ${MAX_PLACEHOLDER_DOWNLOAD_BYTES})`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Confirm the upload\n\t\tconst item = await repo.confirmUpload(id, {\n\t\t\tsize: body.size,\n\t\t\twidth,\n\t\t\theight,\n\t\t\tblurhash,\n\t\t\tdominantColor,\n\t\t});\n\n\t\tif (!item) {\n\t\t\treturn apiError(\"CONFIRM_FAILED\", \"Failed to confirm upload\", 500);\n\t\t}\n\n\t\t// Add URL to the response (relative URL for portability)\n\t\tconst itemWithUrl = addUrlToMedia(item);\n\n\t\treturn apiSuccess({ item: itemWithUrl });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to confirm upload\", \"CONFIRM_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAa,YAAY;;;;;;;;AASzB,MAAM,iCAAiC,IAAI,OAAO;;;;AAKlD,SAAS,cAAc,MAA8C;AACpE,QAAO;EACN,GAAG;EACH,KAAK,2BAA2B,KAAK;EACrC;;;;;AAMF,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAEf,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,wBAAwB,IAAI;AAGhE,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,kBAAkB,SAAS,kBAAkB,EAAE,CAAC;AACnE,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;EAG3C,MAAM,WAAW,MAAM,KAAK,SAAS,GAAG;AACxC,MAAI,CAAC,SACJ,QAAO,SAAS,aAAa,yBAAyB,MAAM,IAAI;AAGjE,MAAI,SAAS,WAAW,UACvB,QAAO,SAAS,iBAAiB,8BAA8B,SAAS,UAAU,IAAI;EAIvF,MAAM,cAAc,iBACnB,MACA,SAAS,YAAY,IACrB,kBACA,iBACA;AACD,MAAI,YAAa,QAAO;AAGxB,MAAI,OAAO,SAEV;OAAI,CADW,MAAM,OAAO,QAAQ,OAAO,SAAS,WAAW,EAClD;AAEZ,UAAM,KAAK,WAAW,GAAG;AACzB,WAAO,SAAS,kBAAkB,oCAAoC,IAAI;;;EAY5E,IAAI;EACJ,IAAI;EACJ,IAAI,QAAQ,KAAK;EACjB,IAAI,SAAS,KAAK;AAClB,MAAI,OAAO,WAAW,SAAS,SAAS,WAAW,SAAS,EAAE;GAC7D,MAAM,YAAY,KAAK,QAAQ,SAAS,QAAQ;AAEhD,OAAI,EADa,aAAa,QAAQ,YAAY,gCAEjD,KAAI;IACH,MAAM,EAAE,MAAM,WAAW,MAAM,OAAO,QAAQ,SAAS,SAAS,WAAW;IAC3E,MAAM,QAAQ,IAAI,WAAW,MAAM,IAAI,SAAS,OAAO,CAAC,aAAa,CAAC;AAItE,QAAI,MAAM,aAAa,+BACtB,SAAQ,KACP,gDAAgD,SAAS,WAAW,MAAM,MAAM,WAAW,YAAY,+BAA+B,GACtI;SACK;KACN,MAAM,WAAW,MAAM,oBAAoB,OAAO,SAAS,UAAU,EACpE,iBACC,KAAK,SAAS,QAAQ,KAAK,UAAU,OAClC;MAAE,OAAO,KAAK;MAAO,QAAQ,KAAK;MAAQ,GAC1C,QACJ,CAAC;AACF,gBAAW,SAAS;AACpB,qBAAgB,SAAS;AACzB,aAAQ,SAAS,SAAS;AAC1B,cAAS,UAAU,SAAS;;YAErB,OAAO;AACf,YAAQ,MAAM,kDAAkD,MAAM;;OAGvE,SAAQ,KACP,gDAAgD,SAAS,WAAW,iBAAiB,UAAU,YAAY,+BAA+B,GAC1I;;EAKH,MAAM,OAAO,MAAM,KAAK,cAAc,IAAI;GACzC,MAAM,KAAK;GACX;GACA;GACA;GACA;GACA,CAAC;AAEF,MAAI,CAAC,KACJ,QAAO,SAAS,kBAAkB,4BAA4B,IAAI;AAMnE,SAAO,WAAW,EAAE,MAFA,cAAc,KAAK,EAEA,CAAC;UAChC,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,gBAAgB"}

package/dist/astro/routes/api/media/_id_/usage.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/media/[id]/usage.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=usage.d.mts.map

package/dist/astro/routes/api/media/_id_/usage.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/media/[id]/usage.ts"],"mappings":";;;cASa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/media/_id_/usage.mjs

@@ -0,0 +1,37 @@
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import "../../../../../media-BjhhENaJ.mjs";
+import "../../../../../content-refresh-D4khvC0R.mjs";
+import { t as handleMediaUsageDetails } from "../../../../../media-usage-CljdO1mc.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import { S as mediaUsageDetailsQuery } from "../../../../../media-kIV1IxFf.mjs";
+import "../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
+import "../../../../../api/schemas/index.mjs";
+import "../../../../../api-tokens-Cvmixds7.mjs";
+import { r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
+import { t as requireScope } from "../../../../../scopes-Bl4IwHA-.mjs";
+
+//#region src/astro/routes/api/media/[id]/usage.ts
+const prerender = false;
+const GET = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const mediaDenied = requirePerm(user, "media:read");
+	if (mediaDenied) return mediaDenied;
+	const contentDenied = requirePerm(user, "content:read_drafts");
+	if (contentDenied) return contentDenied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+	const { id } = params;
+	if (!id) return apiError("INVALID_REQUEST", "Media ID required", 400);
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const query = parseQuery(new URL(request.url), mediaUsageDetailsQuery);
+	if (isParseError(query)) return query;
+	return unwrapResult(await handleMediaUsageDetails(emdash.db, id, query));
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=usage.mjs.map

package/dist/astro/routes/api/media/_id_/usage.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/[id]/usage.ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaUsageDetails } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { mediaUsageDetailsQuery } from \"#api/schemas.js\";\nimport { requireScope } from \"#auth/scopes.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst mediaDenied = requirePerm(user, \"media:read\");\n\tif (mediaDenied) return mediaDenied;\n\tconst contentDenied = requirePerm(user, \"content:read_drafts\");\n\tif (contentDenied) return contentDenied;\n\tconst scopeDenied = requireScope(locals, \"admin\");\n\tif (scopeDenied) return scopeDenied;\n\n\tconst { id } = params;\n\tif (!id) return apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst query = parseQuery(new URL(request.url), mediaUsageDetailsQuery);\n\tif (isParseError(query)) return query;\n\n\treturn unwrapResult(await handleMediaUsageDetails(emdash.db, id, query));\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,cAAc,YAAY,MAAM,aAAa;AACnD,KAAI,YAAa,QAAO;CACxB,MAAM,gBAAgB,YAAY,MAAM,sBAAsB;AAC9D,KAAI,cAAe,QAAO;CAC1B,MAAM,cAAc,aAAa,QAAQ,QAAQ;AACjD,KAAI,YAAa,QAAO;CAExB,MAAM,EAAE,OAAO;AACf,KAAI,CAAC,GAAI,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AACrE,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,uBAAuB;AACtE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,IAAI,MAAM,CAAC"}

package/dist/astro/routes/api/media/_id_.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/media/[id].ts"],"mappings":";;;cAea,SAAA;;;;cAKA,GAAA,EAAK,QAAA;AAwBlB;;;;;AAAA,cAAa,GAAA,EAAK,QAAA;;;;;;cAkDL,MAAA,EAAQ,QAAA"}
+{"version":3,"file":"_id_.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/media/[id].ts"],"mappings":";;;cAgBa,SAAA;;;;cAKA,GAAA,EAAK,QAAA;AAkClB;;;;;AAAA,cAAa,GAAA,EAAK,QAAA;;;;;;cAkDL,MAAA,EAAQ,QAAA"}

package/dist/astro/routes/api/media/_id_.mjs

@@ -1,26 +1,42 @@
-import "../../../../base64-C74Msx8h.mjs";
-import "../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-GLksnn-B.mjs";
-import { en as mediaUpdateBody } from "../../../../redirects-CeD7K7EX.mjs";
-import "../../../../relations-BmBmX4Eb.mjs";
-import "../../../../status-D3Gy1Zc6.mjs";
+import "../../../../base64-B-PsqheR.mjs";
+import "../../../../types-D1iJ3DpO.mjs";
+import "../../../../media-BjhhENaJ.mjs";
+import "../../../../content-refresh-D4khvC0R.mjs";
+import { r as handleMediaUsageSummaries } from "../../../../media-usage-CljdO1mc.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEGF6UZb.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-C_-6klII.mjs";
+import { _ as mediaUpdateBody, s as mediaGetQuery } from "../../../../media-kIV1IxFf.mjs";
+import "../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../relations-5_avdrN_.mjs";
+import "../../../../status-COfycGIU.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as requirePerm, t as requireOwnerPerm } from "../../../../authorize-BmCwQCib.mjs";
+import { n as requireOwnerPerm, r as requirePerm, t as canReadMediaUsageCount } from "../../../../authorize-WxsiePzy.mjs";
 
 //#region src/astro/routes/api/media/[id].ts
 const prerender = false;
 /**
 * Get media item
 */
-const GET = async ({ params, locals }) => {
+const GET = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { id } = params;
 	const readDenied = requirePerm(user, "media:read");
 	if (readDenied) return readDenied;
 	if (!id) return apiError("INVALID_REQUEST", "Media ID required", 400);
 	if (!emdash?.handleMediaGet) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
-	return unwrapResult(await emdash.handleMediaGet(id));
+	const query = parseQuery(new URL(request.url), mediaGetQuery);
+	if (isParseError(query)) return query;
+	const result = await emdash.handleMediaGet(id);
+	if (!result.success || query.includeUsage !== "1") return unwrapResult(result);
+	const includeCount = canReadMediaUsageCount(user, locals.tokenScopes);
+	const usageResult = await handleMediaUsageSummaries(emdash.db, [id], { includeCount });
+	if (!usageResult.success) return unwrapResult(usageResult);
+	const usage = usageResult.data[id];
+	if (!usage) return apiError("MEDIA_USAGE_READ_ERROR", "Failed to read media usage", 500);
+	return apiSuccess({ item: {
+		...result.data.item,
+		usage
+	} });
 };
 /**
 * Update media metadata

package/dist/astro/routes/api/media/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/[id].ts"],"sourcesContent":["/**\n * Single media item endpoint\n *\n * GET /_emdash/api/media/:id - Get media item\n * PUT /_emdash/api/media/:id - Update media metadata\n * DELETE /_emdash/api/media/:id - Delete media item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { mediaUpdateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n/**\n * Get media item\n */\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tconst readDenied = requirePerm(user, \"media:read\");\n\tif (readDenied) return readDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst result = await emdash.handleMediaGet(id);\n\treturn unwrapResult(result);\n};\n\n/**\n * Update media metadata\n *\n * Authors can edit their own media; editors+ can edit any.\n */\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst editDenied = requirePerm(user, \"media:edit_own\");\n\tif (editDenied) return editDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaUpdate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can edit own, editors+ can edit any\n\t\tconst ownerDenied = requireOwnerPerm(user, media.authorId, \"media:edit_own\", \"media:edit_any\");\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\tconst body = await parseBody(request, mediaUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await emdash.handleMediaUpdate(id, {\n\t\t\talt: body.alt,\n\t\t\tcaption: body.caption,\n\t\t\twidth: body.width,\n\t\t\theight: body.height,\n\t\t});\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update media\", \"MEDIA_UPDATE_ERROR\");\n\t}\n};\n\n/**\n * Delete media item\n *\n * Authors can delete their own media; editors+ can delete any.\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst deleteDenied = requirePerm(user, \"media:delete_own\");\n\tif (deleteDenied) return deleteDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaDelete) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check and storage key\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can delete own, editors+ can delete any\n\t\tconst ownerDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\tmedia.authorId,\n\t\t\t\"media:delete_own\",\n\t\t\t\"media:delete_any\",\n\t\t);\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\t// Delete file from storage via the storage adapter\n\t\tif (emdash.storage) {\n\t\t\ttry {\n\t\t\t\tawait emdash.storage.delete(media.storageKey);\n\t\t\t} catch {\n\t\t\t\t// Best-effort — continue with database deletion\n\t\t\t}\n\t\t}\n\n\t\t// Delete from database — site-settings cache invalidation happens\n\t\t// in `EmDashRuntime.handleMediaDelete` so MCP/plugin paths inherit it.\n\t\tconst result = await emdash.handleMediaDelete(id);\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete media\", \"MEDIA_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;AAeA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAEf,MAAM,aAAa,YAAY,MAAM,aAAa;AAClD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,eACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,QAAO,aADQ,MAAM,OAAO,eAAe,GAAG,CACnB;;;;;;;AAQ5B,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,aAAa,YAAY,MAAM,iBAAiB;AACtD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBAAiB,MAAM,MAAM,UAAU,kBAAkB,iBAAiB;AAC9F,MAAI,YAAa,QAAO;EAExB,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,MAAI,aAAa,KAAK,CAAE,QAAO;AAS/B,SAAO,aAPQ,MAAM,OAAO,kBAAkB,IAAI;GACjD,KAAK,KAAK;GACV,SAAS,KAAK;GACd,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,CAAC,CAEyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB;;;;;;;;AAS3E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,eAAe,YAAY,MAAM,mBAAmB;AAC1D,KAAI,aAAc,QAAO;AAEzB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBACnB,MACA,MAAM,UACN,oBACA,mBACA;AACD,MAAI,YAAa,QAAO;AAGxB,MAAI,OAAO,QACV,KAAI;AACH,SAAM,OAAO,QAAQ,OAAO,MAAM,WAAW;UACtC;AAST,SAAO,aAFQ,MAAM,OAAO,kBAAkB,GAAG,CAEtB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/[id].ts"],"sourcesContent":["/**\n * Single media item endpoint\n *\n * GET /_emdash/api/media/:id - Get media item\n * PUT /_emdash/api/media/:id - Update media metadata\n * DELETE /_emdash/api/media/:id - Delete media item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { canReadMediaUsageCount, requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaUsageSummaries } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { mediaGetQuery, mediaUpdateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n/**\n * Get media item\n */\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tconst readDenied = requirePerm(user, \"media:read\");\n\tif (readDenied) return readDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst query = parseQuery(new URL(request.url), mediaGetQuery);\n\tif (isParseError(query)) return query;\n\n\tconst result = await emdash.handleMediaGet(id);\n\tif (!result.success || query.includeUsage !== \"1\") return unwrapResult(result);\n\n\tconst includeCount = canReadMediaUsageCount(user, locals.tokenScopes);\n\tconst usageResult = await handleMediaUsageSummaries(emdash.db, [id], { includeCount });\n\tif (!usageResult.success) return unwrapResult(usageResult);\n\tconst usage = usageResult.data[id];\n\tif (!usage) return apiError(\"MEDIA_USAGE_READ_ERROR\", \"Failed to read media usage\", 500);\n\n\treturn apiSuccess({ item: { ...result.data.item, usage } });\n};\n\n/**\n * Update media metadata\n *\n * Authors can edit their own media; editors+ can edit any.\n */\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst editDenied = requirePerm(user, \"media:edit_own\");\n\tif (editDenied) return editDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaUpdate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can edit own, editors+ can edit any\n\t\tconst ownerDenied = requireOwnerPerm(user, media.authorId, \"media:edit_own\", \"media:edit_any\");\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\tconst body = await parseBody(request, mediaUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await emdash.handleMediaUpdate(id, {\n\t\t\talt: body.alt,\n\t\t\tcaption: body.caption,\n\t\t\twidth: body.width,\n\t\t\theight: body.height,\n\t\t});\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update media\", \"MEDIA_UPDATE_ERROR\");\n\t}\n};\n\n/**\n * Delete media item\n *\n * Authors can delete their own media; editors+ can delete any.\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst deleteDenied = requirePerm(user, \"media:delete_own\");\n\tif (deleteDenied) return deleteDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaDelete) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check and storage key\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can delete own, editors+ can delete any\n\t\tconst ownerDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\tmedia.authorId,\n\t\t\t\"media:delete_own\",\n\t\t\t\"media:delete_any\",\n\t\t);\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\t// Delete file from storage via the storage adapter\n\t\tif (emdash.storage) {\n\t\t\ttry {\n\t\t\t\tawait emdash.storage.delete(media.storageKey);\n\t\t\t} catch {\n\t\t\t\t// Best-effort — continue with database deletion\n\t\t\t}\n\t\t}\n\n\t\t// Delete from database — site-settings cache invalidation happens\n\t\t// in `EmDashRuntime.handleMediaDelete` so MCP/plugin paths inherit it.\n\t\tconst result = await emdash.handleMediaDelete(id);\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete media\", \"MEDIA_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAEf,MAAM,aAAa,YAAY,MAAM,aAAa;AAClD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,eACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,cAAc;AAC7D,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,SAAS,MAAM,OAAO,eAAe,GAAG;AAC9C,KAAI,CAAC,OAAO,WAAW,MAAM,iBAAiB,IAAK,QAAO,aAAa,OAAO;CAE9E,MAAM,eAAe,uBAAuB,MAAM,OAAO,YAAY;CACrE,MAAM,cAAc,MAAM,0BAA0B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;AACtF,KAAI,CAAC,YAAY,QAAS,QAAO,aAAa,YAAY;CAC1D,MAAM,QAAQ,YAAY,KAAK;AAC/B,KAAI,CAAC,MAAO,QAAO,SAAS,0BAA0B,8BAA8B,IAAI;AAExF,QAAO,WAAW,EAAE,MAAM;EAAE,GAAG,OAAO,KAAK;EAAM;EAAO,EAAE,CAAC;;;;;;;AAQ5D,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,aAAa,YAAY,MAAM,iBAAiB;AACtD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBAAiB,MAAM,MAAM,UAAU,kBAAkB,iBAAiB;AAC9F,MAAI,YAAa,QAAO;EAExB,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,MAAI,aAAa,KAAK,CAAE,QAAO;AAS/B,SAAO,aAPQ,MAAM,OAAO,kBAAkB,IAAI;GACjD,KAAK,KAAK;GACV,SAAS,KAAK;GACd,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,CAAC,CAEyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB;;;;;;;;AAS3E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,eAAe,YAAY,MAAM,mBAAmB;AAC1D,KAAI,aAAc,QAAO;AAEzB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBACnB,MACA,MAAM,UACN,oBACA,mBACA;AACD,MAAI,YAAa,QAAO;AAGxB,MAAI,OAAO,QACV,KAAI;AACH,SAAM,OAAO,QAAQ,OAAO,MAAM,WAAW;UACtC;AAST,SAAO,aAFQ,MAAM,OAAO,kBAAkB,GAAG,CAEtB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB"}

package/dist/astro/routes/api/media/file/_...key_.mjs

@@ -1,6 +1,6 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import { r as handleError, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
 
 //#region src/astro/routes/api/media/file/[...key].ts
 const prerender = false;
@@ -25,6 +25,7 @@ const GET = async ({ params, locals }) => {
 	const { key } = params;
 	const { emdash } = locals;
 	if (!key) return apiError("NOT_FOUND", "File not found", 404);
+	if (key.startsWith("backups/")) return apiError("NOT_FOUND", "File not found", 404);
 	if (!emdash?.storage) return apiError("NOT_CONFIGURED", "Storage not configured", 500);
 	try {
 		const result = await emdash.storage.download(key);

package/dist/astro/routes/api/media/file/_...key_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst result = await emdash.storage.download(key);\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": \"public, max-age=31536000, immutable\",\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t};\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tif (SAFE_INLINE_TYPES.has(result.contentType)) {\n\t\t\theaders[\"Content-Disposition\"] = \"inline\";\n\t\t} else {\n\t\t\theaders[\"Content-Disposition\"] = \"attachment\";\n\t\t}\n\n\t\treturn new Response(result.body, { status: 200, headers });\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;AAUA,MAAa,YAAY;;;;;AAMzB,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAGjE,KAAI;EACH,MAAM,SAAS,MAAM,OAAO,QAAQ,SAAS,IAAI;EAEjD,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB;GACjB,0BAA0B;GAG1B,2BACC;GACD;AAED,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;AAKhD,MAAI,kBAAkB,IAAI,OAAO,YAAY,CAC5C,SAAQ,yBAAyB;MAEjC,SAAQ,yBAAyB;AAGlC,SAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;UAClD,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB"}
+{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\t// Backup archives share the storage bucket but hold the site's full\n\t// content export — they must never be reachable through the public,\n\t// unauthenticated media route. Admins download them via the\n\t// authenticated backups API.\n\tif (key.startsWith(\"backups/\")) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst result = await emdash.storage.download(key);\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": \"public, max-age=31536000, immutable\",\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t};\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tif (SAFE_INLINE_TYPES.has(result.contentType)) {\n\t\t\theaders[\"Content-Disposition\"] = \"inline\";\n\t\t} else {\n\t\t\theaders[\"Content-Disposition\"] = \"attachment\";\n\t\t}\n\n\t\treturn new Response(result.body, { status: 200, headers });\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;AAUA,MAAa,YAAY;;;;;AAMzB,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAOpD,KAAI,IAAI,WAAW,WAAW,CAC7B,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAGjE,KAAI;EACH,MAAM,SAAS,MAAM,OAAO,QAAQ,SAAS,IAAI;EAEjD,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB;GACjB,0BAA0B;GAG1B,2BACC;GACD;AAED,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;AAKhD,MAAI,kBAAkB,IAAI,OAAO,YAAY,CAC5C,SAAQ,yBAAyB;MAEjC,SAAQ,yBAAyB;AAGlC,SAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;UAClD,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB"}

package/dist/astro/routes/api/media/providers/_providerId_/_itemId_.mjs

@@ -1,7 +1,7 @@
-import "../../../../../../base64-C74Msx8h.mjs";
-import "../../../../../../types-Ch8pFMEm.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CfJMLSkd.mjs";
-import { n as requirePerm } from "../../../../../../authorize-BmCwQCib.mjs";
+import "../../../../../../base64-B-PsqheR.mjs";
+import "../../../../../../types-D1iJ3DpO.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEGF6UZb.mjs";
+import { r as requirePerm } from "../../../../../../authorize-WxsiePzy.mjs";
 
 //#region src/astro/routes/api/media/providers/[providerId]/[itemId].ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/_providerId_/index.mjs

@@ -1,7 +1,7 @@
-import "../../../../../../base64-C74Msx8h.mjs";
-import "../../../../../../types-Ch8pFMEm.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CfJMLSkd.mjs";
-import { n as requirePerm } from "../../../../../../authorize-BmCwQCib.mjs";
+import "../../../../../../base64-B-PsqheR.mjs";
+import "../../../../../../types-D1iJ3DpO.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEGF6UZb.mjs";
+import { r as requirePerm } from "../../../../../../authorize-WxsiePzy.mjs";
 
 //#region src/astro/routes/api/media/providers/[providerId]/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/index.mjs

@@ -1,7 +1,7 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-CEGF6UZb.mjs";
+import { r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
 
 //#region src/astro/routes/api/media/providers/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/upload-url.mjs

@@ -1,14 +1,15 @@
-import "../../../../base64-C74Msx8h.mjs";
-import "../../../../types-Ch8pFMEm.mjs";
+import "../../../../base64-B-PsqheR.mjs";
+import "../../../../types-D1iJ3DpO.mjs";
 import { n as normalizeMime, t as matchesMimeAllowlist } from "../../../../mime-DfIVjNkr.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-GLksnn-B.mjs";
-import { Wt as DEFAULT_MAX_UPLOAD_SIZE, tn as mediaUploadUrlBody } from "../../../../redirects-CeD7K7EX.mjs";
-import "../../../../relations-BmBmX4Eb.mjs";
-import "../../../../status-D3Gy1Zc6.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEGF6UZb.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C_-6klII.mjs";
+import { n as DEFAULT_MAX_UPLOAD_SIZE, v as mediaUploadUrlBody } from "../../../../media-kIV1IxFf.mjs";
+import "../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../relations-5_avdrN_.mjs";
+import "../../../../status-COfycGIU.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../authorize-BmCwQCib.mjs";
-import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../../media-allowlist-Dc05vKtt.mjs";
+import { r as requirePerm } from "../../../../authorize-WxsiePzy.mjs";
+import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../../media-allowlist-jUppPWFy.mjs";
 import { ulid } from "ulidx";
 import * as path from "node:path";
 import { MediaRepository } from "emdash";

package/dist/astro/routes/api/media/upload-url.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"upload-url.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/upload-url.ts"],"sourcesContent":["/**\n * Media upload URL endpoint\n *\n * POST /_emdash/api/media/upload-url\n *\n * Returns a signed URL for direct upload to storage.\n * Creates a pending media record that must be confirmed after upload.\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { MediaRepository } from \"emdash\";\nimport { ulid } from \"ulidx\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from \"#api/schemas.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\n\nexport const prerender = false;\n\ninterface UploadUrlResponse {\n\tuploadUrl: string;\n\tmethod: \"PUT\";\n\theaders: Record<string, string>;\n\tmediaId: string;\n\tstorageKey: string;\n\texpiresAt: string;\n}\n\n/** Response when content already exists (deduplication) */\ninterface ExistingMediaResponse {\n\texisting: true;\n\tmediaId: string;\n\tstorageKey: string;\n\turl: string;\n}\n\n/**\n * Get a signed upload URL for direct-to-storage upload\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\n\t\t\t\"NO_STORAGE\",\n\t\t\t\"Storage not configured. Signed URL uploads require S3-compatible storage.\",\n\t\t\t501,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst maxSize = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(maxSize) || maxSize <= 0) {\n\t\t\treturn apiError(\n\t\t\t\t\"CONFIGURATION_ERROR\",\n\t\t\t\t\"Invalid maxUploadSize configuration. Expected a positive finite number.\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t\tconst body = await parseBody(request, mediaUploadUrlBody(maxSize));\n\t\tif (isParseError(body)) return body;\n\n\t\t// Validate content type (field-aware widening)\n\t\tconst fieldAllowlist = body.fieldId\n\t\t\t? await resolveFieldAllowlist(emdash.db, body.fieldId)\n\t\t\t: null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(body.contentType, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Check for existing content with same hash (deduplication)\n\t\tif (body.contentHash) {\n\t\t\tconst existing = await repo.findByContentHash(body.contentHash);\n\t\t\tif (existing) {\n\t\t\t\tconst response: ExistingMediaResponse = {\n\t\t\t\t\texisting: true,\n\t\t\t\t\tmediaId: existing.id,\n\t\t\t\t\tstorageKey: existing.storageKey,\n\t\t\t\t\turl: `/_emdash/api/media/file/${existing.storageKey}`,\n\t\t\t\t};\n\t\t\t\treturn apiSuccess(response);\n\t\t\t}\n\t\t}\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(body.filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\t// Create pending media record with content hash\n\t\tconst mediaItem = await repo.createPending({\n\t\t\tfilename: body.filename,\n\t\t\tmimeType: normalizeMime(body.contentType),\n\t\t\tsize: body.size,\n\t\t\tstorageKey,\n\t\t\tcontentHash: body.contentHash,\n\t\t\tauthorId: user?.id,\n\t\t});\n\n\t\t// Get signed upload URL from storage\n\t\tconst signedUrl = await emdash.storage.getSignedUploadUrl({\n\t\t\tkey: storageKey,\n\t\t\tcontentType: body.contentType,\n\t\t\tsize: body.size,\n\t\t\texpiresIn: 3600, // 1 hour\n\t\t});\n\n\t\tconst response: UploadUrlResponse = {\n\t\t\tuploadUrl: signedUrl.url,\n\t\t\tmethod: signedUrl.method,\n\t\t\theaders: signedUrl.headers,\n\t\t\tmediaId: mediaItem.id,\n\t\t\tstorageKey,\n\t\t\texpiresAt: signedUrl.expiresAt,\n\t\t};\n\n\t\treturn apiSuccess(response);\n\t} catch (error) {\n\t\t// Check if storage doesn't support signed URLs (e.g., local storage)\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t\"code\" in error &&\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowing error to check custom code property after \"code\" in error guard\n\t\t\t(error as { code: string }).code === \"NOT_SUPPORTED\"\n\t\t) {\n\t\t\treturn apiError(\n\t\t\t\t\"NOT_SUPPORTED\",\n\t\t\t\t\"Storage does not support signed upload URLs. Use direct upload.\",\n\t\t\t\t501,\n\t\t\t);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to generate upload URL\", \"UPLOAD_URL_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;;;;AAsBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,QACZ,QAAO,SACN,cACA,6EACA,IACA;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,UAAU,OAAO,OAAO,iBAAiB;AAC/C,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC3C,QAAO,SACN,uBACA,2EACA,IACA;EAEF,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB,QAAQ,CAAC;AAClE,MAAI,aAAa,KAAK,CAAE,QAAO;EAM/B,MAAM,aAHiB,KAAK,UACzB,MAAM,sBAAsB,OAAO,IAAI,KAAK,QAAQ,GACpD,SACiC,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,aAAa,UAAU,CACrD,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;EAG9D,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAG3C,MAAI,KAAK,aAAa;GACrB,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,YAAY;AAC/D,OAAI,SAOH,QAAO,WANiC;IACvC,UAAU;IACV,SAAS,SAAS;IAClB,YAAY,SAAS;IACrB,KAAK,2BAA2B,SAAS;IACzC,CAC0B;;EAO7B,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,KAAK,SAAS,IAAI;EAI3C,MAAM,YAAY,MAAM,KAAK,cAAc;GAC1C,UAAU,KAAK;GACf,UAAU,cAAc,KAAK,YAAY;GACzC,MAAM,KAAK;GACX;GACA,aAAa,KAAK;GAClB,UAAU,MAAM;GAChB,CAAC;EAGF,MAAM,YAAY,MAAM,OAAO,QAAQ,mBAAmB;GACzD,KAAK;GACL,aAAa,KAAK;GAClB,MAAM,KAAK;GACX,WAAW;GACX,CAAC;AAWF,SAAO,WAT6B;GACnC,WAAW,UAAU;GACrB,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,UAAU;GACnB;GACA,WAAW,UAAU;GACrB,CAE0B;UACnB,OAAO;AAEf,MACC,iBAAiB,SACjB,UAAU,SAET,MAA2B,SAAS,gBAErC,QAAO,SACN,iBACA,mEACA,IACA;AAGF,SAAO,YAAY,OAAO,iCAAiC,mBAAmB"}
+{"version":3,"file":"upload-url.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/upload-url.ts"],"sourcesContent":["/**\n * Media upload URL endpoint\n *\n * POST /_emdash/api/media/upload-url\n *\n * Returns a signed URL for direct upload to storage.\n * Creates a pending media record that must be confirmed after upload.\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { MediaRepository } from \"emdash\";\nimport { ulid } from \"ulidx\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from \"#api/schemas.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\n\nexport const prerender = false;\n\ninterface UploadUrlResponse {\n\tuploadUrl: string;\n\tmethod: \"PUT\";\n\theaders: Record<string, string>;\n\tmediaId: string;\n\tstorageKey: string;\n\texpiresAt: string;\n}\n\n/** Response when content already exists (deduplication) */\ninterface ExistingMediaResponse {\n\texisting: true;\n\tmediaId: string;\n\tstorageKey: string;\n\turl: string;\n}\n\n/**\n * Get a signed upload URL for direct-to-storage upload\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\n\t\t\t\"NO_STORAGE\",\n\t\t\t\"Storage not configured. Signed URL uploads require S3-compatible storage.\",\n\t\t\t501,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst maxSize = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(maxSize) || maxSize <= 0) {\n\t\t\treturn apiError(\n\t\t\t\t\"CONFIGURATION_ERROR\",\n\t\t\t\t\"Invalid maxUploadSize configuration. Expected a positive finite number.\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t\tconst body = await parseBody(request, mediaUploadUrlBody(maxSize));\n\t\tif (isParseError(body)) return body;\n\n\t\t// Validate content type (field-aware widening)\n\t\tconst fieldAllowlist = body.fieldId\n\t\t\t? await resolveFieldAllowlist(emdash.db, body.fieldId)\n\t\t\t: null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(body.contentType, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Check for existing content with same hash (deduplication)\n\t\tif (body.contentHash) {\n\t\t\tconst existing = await repo.findByContentHash(body.contentHash);\n\t\t\tif (existing) {\n\t\t\t\tconst response: ExistingMediaResponse = {\n\t\t\t\t\texisting: true,\n\t\t\t\t\tmediaId: existing.id,\n\t\t\t\t\tstorageKey: existing.storageKey,\n\t\t\t\t\turl: `/_emdash/api/media/file/${existing.storageKey}`,\n\t\t\t\t};\n\t\t\t\treturn apiSuccess(response);\n\t\t\t}\n\t\t}\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(body.filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\t// Create pending media record with content hash\n\t\tconst mediaItem = await repo.createPending({\n\t\t\tfilename: body.filename,\n\t\t\tmimeType: normalizeMime(body.contentType),\n\t\t\tsize: body.size,\n\t\t\tstorageKey,\n\t\t\tcontentHash: body.contentHash,\n\t\t\tauthorId: user?.id,\n\t\t});\n\n\t\t// Get signed upload URL from storage\n\t\tconst signedUrl = await emdash.storage.getSignedUploadUrl({\n\t\t\tkey: storageKey,\n\t\t\tcontentType: body.contentType,\n\t\t\tsize: body.size,\n\t\t\texpiresIn: 3600, // 1 hour\n\t\t});\n\n\t\tconst response: UploadUrlResponse = {\n\t\t\tuploadUrl: signedUrl.url,\n\t\t\tmethod: signedUrl.method,\n\t\t\theaders: signedUrl.headers,\n\t\t\tmediaId: mediaItem.id,\n\t\t\tstorageKey,\n\t\t\texpiresAt: signedUrl.expiresAt,\n\t\t};\n\n\t\treturn apiSuccess(response);\n\t} catch (error) {\n\t\t// Check if storage doesn't support signed URLs (e.g., local storage)\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t\"code\" in error &&\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowing error to check custom code property after \"code\" in error guard\n\t\t\t(error as { code: string }).code === \"NOT_SUPPORTED\"\n\t\t) {\n\t\t\treturn apiError(\n\t\t\t\t\"NOT_SUPPORTED\",\n\t\t\t\t\"Storage does not support signed upload URLs. Use direct upload.\",\n\t\t\t\t501,\n\t\t\t);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to generate upload URL\", \"UPLOAD_URL_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;;;;AAsBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,QACZ,QAAO,SACN,cACA,6EACA,IACA;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,UAAU,OAAO,OAAO,iBAAiB;AAC/C,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC3C,QAAO,SACN,uBACA,2EACA,IACA;EAEF,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB,QAAQ,CAAC;AAClE,MAAI,aAAa,KAAK,CAAE,QAAO;EAM/B,MAAM,aAHiB,KAAK,UACzB,MAAM,sBAAsB,OAAO,IAAI,KAAK,QAAQ,GACpD,SACiC,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,aAAa,UAAU,CACrD,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;EAG9D,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAG3C,MAAI,KAAK,aAAa;GACrB,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,YAAY;AAC/D,OAAI,SAOH,QAAO,WANiC;IACvC,UAAU;IACV,SAAS,SAAS;IAClB,YAAY,SAAS;IACrB,KAAK,2BAA2B,SAAS;IACzC,CAC0B;;EAO7B,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,KAAK,SAAS,IAAI;EAI3C,MAAM,YAAY,MAAM,KAAK,cAAc;GAC1C,UAAU,KAAK;GACf,UAAU,cAAc,KAAK,YAAY;GACzC,MAAM,KAAK;GACX;GACA,aAAa,KAAK;GAClB,UAAU,MAAM;GAChB,CAAC;EAGF,MAAM,YAAY,MAAM,OAAO,QAAQ,mBAAmB;GACzD,KAAK;GACL,aAAa,KAAK;GAClB,MAAM,KAAK;GACX,WAAW;GACX,CAAC;AAWF,SAAO,WAT6B;GACnC,WAAW,UAAU;GACrB,QAAQ,UAAU;GAClB,SAAS,UAAU;GACnB,SAAS,UAAU;GACnB;GACA,WAAW,UAAU;GACrB,CAE0B;UACnB,OAAO;AAEf,MACC,iBAAiB,SACjB,UAAU,SAET,MAA2B,SAAS,gBAErC,QAAO,SACN,iBACA,mEACA,IACA;AAGF,SAAO,YAAY,OAAO,iCAAiC,mBAAmB"}

package/dist/astro/routes/api/media.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"media.d.mts","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"mappings":";;;cAwBa,SAAA;AAgBb;;;AAAA,cAAa,GAAA,EAAK,QAAA;;AAoClB;;;;cAAa,IAAA,EAAM,QAAA"}
+{"version":3,"file":"media.d.mts","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"mappings":";;;cAyBa,SAAA;AAgBb;;;AAAA,cAAa,GAAA,EAAK,QAAA;;AAsDlB;;;;cAAa,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/media.mjs

@@ -1,17 +1,20 @@
-import "../../../base64-C74Msx8h.mjs";
-import "../../../types-Ch8pFMEm.mjs";
-import { t as MediaRepository } from "../../../media-D2ZFowpn.mjs";
+import "../../../base64-B-PsqheR.mjs";
+import "../../../types-D1iJ3DpO.mjs";
+import { t as MediaRepository } from "../../../media-BjhhENaJ.mjs";
 import { n as normalizeMime, t as matchesMimeAllowlist } from "../../../mime-DfIVjNkr.mjs";
 import { t as enrichImageMetadata } from "../../../enrich-CFJJgxs_.mjs";
 import { t as computeContentHash } from "../../../hash-DFFrkivP.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, t as isParseError } from "../../../parse-GLksnn-B.mjs";
-import { Gt as formatFileSize, Wt as DEFAULT_MAX_UPLOAD_SIZE, Xt as mediaListQuery } from "../../../redirects-CeD7K7EX.mjs";
-import "../../../relations-BmBmX4Eb.mjs";
-import "../../../status-D3Gy1Zc6.mjs";
+import "../../../content-refresh-D4khvC0R.mjs";
+import { r as handleMediaUsageSummaries } from "../../../media-usage-CljdO1mc.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../error-CEGF6UZb.mjs";
+import { i as parseQuery, t as isParseError } from "../../../parse-C_-6klII.mjs";
+import { l as mediaListQuery, n as DEFAULT_MAX_UPLOAD_SIZE, r as formatFileSize } from "../../../media-kIV1IxFf.mjs";
+import "../../../redirects-BBq3n2Rj.mjs";
+import "../../../relations-5_avdrN_.mjs";
+import "../../../status-COfycGIU.mjs";
 import "../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../authorize-BmCwQCib.mjs";
-import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../media-allowlist-Dc05vKtt.mjs";
+import { r as requirePerm, t as canReadMediaUsageCount } from "../../../authorize-WxsiePzy.mjs";
+import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../media-allowlist-jUppPWFy.mjs";
 import { ulid } from "ulidx";
 import * as path from "node:path";
 
@@ -50,8 +53,25 @@ const GET = async ({ request, locals }) => {
 		q: query.q
 	});
 	if (!result.success) return unwrapResult(result);
+	const itemsWithUrl = result.data.items.map((item) => addUrlToMedia(item));
+	if (query.includeUsage !== "1") return apiSuccess({
+		items: itemsWithUrl,
+		nextCursor: result.data.nextCursor
+	});
+	const includeCount = canReadMediaUsageCount(user, locals.tokenScopes);
+	const usageResult = await handleMediaUsageSummaries(emdash.db, itemsWithUrl.map((item) => item.id), { includeCount });
+	if (!usageResult.success) return unwrapResult(usageResult);
+	const itemsWithUsage = [];
+	for (const item of itemsWithUrl) {
+		const usage = usageResult.data[item.id];
+		if (!usage) return apiError("MEDIA_USAGE_READ_ERROR", "Failed to read media usage", 500);
+		itemsWithUsage.push({
+			...item,
+			usage
+		});
+	}
 	return apiSuccess({
-		items: result.data.items.map((item) => addUrlToMedia(item)),
+		items: itemsWithUsage,
 		nextCursor: result.data.nextCursor
 	});
 };

package/dist/astro/routes/api/media.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"media.mjs","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"sourcesContent":["/**\n * Media list and upload endpoint\n *\n * GET /_emdash/api/media - List all media\n * POST /_emdash/api/media - Upload new media (via configured storage adapter)\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, formatFileSize, mediaListQuery } from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { enrichImageMetadata } from \"#media/enrich.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\nimport { computeContentHash } from \"#utils/hash.js\";\n\nimport type { MediaItem } from \"../../types.js\";\n\nexport const prerender = false;\n\n/**\n * Add URL to media items\n * Uses relative URLs to ensure portability across deployments\n */\nfunction addUrlToMedia(item: MediaItem): MediaItem & { url: string } {\n\treturn {\n\t\t...item,\n\t\turl: `/_emdash/api/media/file/${item.storageKey}`,\n\t};\n}\n\n/**\n * List media items\n */\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst query = parseQuery(url, mediaListQuery);\n\tif (isParseError(query)) return query;\n\n\tconst result = await emdash.handleMediaList({\n\t\tcursor: query.cursor,\n\t\tlimit: query.limit,\n\t\tmimeType: query.mimeType,\n\t\tq: query.q,\n\t});\n\n\tif (!result.success) {\n\t\treturn unwrapResult(result);\n\t}\n\n\t// Add URL to each media item (relative URLs for portability)\n\tconst itemsWithUrl = result.data.items.map((item) => addUrlToMedia(item));\n\n\treturn apiSuccess({ items: itemsWithUrl, nextCursor: result.data.nextCursor });\n};\n\n/**\n * Upload media file\n *\n * Uses the configured storage adapter to store the file.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaCreate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NO_STORAGE\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst rawMax = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(rawMax) || rawMax <= 0) {\n\t\t\treturn apiError(\"CONFIGURATION_ERROR\", \"Invalid maxUploadSize configuration\", 500);\n\t\t}\n\t\tconst maxUploadSize = rawMax;\n\n\t\t// Best-effort size check before buffering the full multipart body\n\t\tconst contentLength = request.headers.get(\"Content-Length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxUploadSize) {\n\t\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Upload too large\", 413);\n\t\t}\n\n\t\tconst formData = await request.formData();\n\t\tconst fileEntry = formData.get(\"file\");\n\t\tconst file = fileEntry instanceof File ? fileEntry : null;\n\n\t\tif (!file) {\n\t\t\treturn apiError(\"NO_FILE\", \"No file provided\", 400);\n\t\t}\n\n\t\t// Validate file type — widen the allowlist when a field-specific list is configured\n\t\tconst fieldIdEntry = formData.get(\"fieldId\");\n\t\tconst fieldId =\n\t\t\ttypeof fieldIdEntry === \"string\" && fieldIdEntry.length > 0 ? fieldIdEntry : null;\n\n\t\tconst fieldAllowlist = fieldId ? await resolveFieldAllowlist(emdash.db, fieldId) : null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(file.type, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\t// Check file size before buffering\n\t\tif (file.size > maxUploadSize) {\n\t\t\treturn apiError(\n\t\t\t\t\"PAYLOAD_TOO_LARGE\",\n\t\t\t\t`File exceeds maximum size of ${formatFileSize(maxUploadSize)}`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\n\t\t// Get file content and compute hash\n\t\tconst buffer = new Uint8Array(await file.arrayBuffer());\n\t\tconst contentHash = await computeContentHash(buffer);\n\n\t\t// Check for existing media with same content hash (deduplication)\n\t\tconst repo = new MediaRepository(emdash.db);\n\t\tconst existing = await repo.findByContentHash(contentHash);\n\t\tif (existing) {\n\t\t\t// Same content already exists - return existing item\n\t\t\tconst itemWithUrl = addUrlToMedia(existing);\n\t\t\treturn apiSuccess({ item: itemWithUrl, deduplicated: true });\n\t\t}\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(file.name) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\t// Upload to storage using the configured adapter\n\t\tawait emdash.storage.upload({\n\t\t\tkey: storageKey,\n\t\t\tbody: buffer,\n\t\t\tcontentType: file.type,\n\t\t});\n\n\t\t// Get image dimensions from form data (sent by client)\n\t\tconst widthEntry = formData.get(\"width\");\n\t\tconst widthStr = typeof widthEntry === \"string\" ? widthEntry : null;\n\t\tconst heightEntry = formData.get(\"height\");\n\t\tconst heightStr = typeof heightEntry === \"string\" ? heightEntry : null;\n\t\tconst width = widthStr ? parseInt(widthStr, 10) : undefined;\n\t\tconst height = heightStr ? parseInt(heightStr, 10) : undefined;\n\n\t\t// Derive dimensions + LQIP placeholders via the shared helper.\n\t\t// If the client sent a downscaled thumbnail, decode that for the blurhash\n\t\t// (avoids OOM on large originals on memory-constrained runtimes).\n\t\tconst thumbnailEntry = formData.get(\"thumbnail\");\n\t\tconst thumbnail = thumbnailEntry instanceof File ? thumbnailEntry : null;\n\t\tconst enriched = await enrichImageMetadata(buffer, file.type, {\n\t\t\tknownDimensions: width != null && height != null ? { width, height } : undefined,\n\t\t\tplaceholder: thumbnail\n\t\t\t\t? { bytes: new Uint8Array(await thumbnail.arrayBuffer()), contentType: thumbnail.type }\n\t\t\t\t: undefined,\n\t\t});\n\n\t\t// Create media record\n\t\tconst result = await emdash.handleMediaCreate({\n\t\t\tfilename: file.name,\n\t\t\tmimeType: normalizeMime(file.type),\n\t\t\tsize: file.size,\n\t\t\t// Client dimensions win over server header dimensions: the browser's\n\t\t\t// naturalWidth/Height apply EXIF orientation, while image-size reports\n\t\t\t// raw (pre-orientation) header dims — swapped for 90°/270° JPEGs.\n\t\t\twidth: width ?? enriched.width,\n\t\t\theight: height ?? enriched.height,\n\t\t\tstorageKey,\n\t\t\tcontentHash,\n\t\t\tblurhash: enriched.blurhash,\n\t\t\tdominantColor: enriched.dominantColor,\n\t\t\tauthorId: user?.id,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\t// Clean up the uploaded file on failure\n\t\t\ttry {\n\t\t\t\tawait emdash.storage.delete(storageKey);\n\t\t\t} catch {\n\t\t\t\t// Ignore cleanup errors\n\t\t\t}\n\t\t\treturn unwrapResult(result);\n\t\t}\n\n\t\t// Add URL to the response (relative URL for portability)\n\t\tconst itemWithUrl = addUrlToMedia(result.data.item);\n\n\t\treturn apiSuccess({ item: itemWithUrl }, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Upload failed\", \"UPLOAD_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,YAAY;;;;;AAMzB,SAAS,cAAc,MAA8C;AACpE,QAAO;EACN,GAAG;EACH,KAAK,2BAA2B,KAAK;EACrC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,gBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,QAAQ,WADF,IAAI,IAAI,QAAQ,IAAI,EACF,eAAe;AAC7C,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,SAAS,MAAM,OAAO,gBAAgB;EAC3C,QAAQ,MAAM;EACd,OAAO,MAAM;EACb,UAAU,MAAM;EAChB,GAAG,MAAM;EACT,CAAC;AAEF,KAAI,CAAC,OAAO,QACX,QAAO,aAAa,OAAO;AAM5B,QAAO,WAAW;EAAE,OAFC,OAAO,KAAK,MAAM,KAAK,SAAS,cAAc,KAAK,CAAC;EAEhC,YAAY,OAAO,KAAK;EAAY,CAAC;;;;;;;AAQ/E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,kBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,cAAc,0BAA0B,IAAI;AAG7D,KAAI;EACH,MAAM,SAAS,OAAO,OAAO,iBAAiB;AAC9C,MAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACzC,QAAO,SAAS,uBAAuB,uCAAuC,IAAI;EAEnF,MAAM,gBAAgB;EAGtB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,oBAAoB,IAAI;EAG9D,MAAM,WAAW,MAAM,QAAQ,UAAU;EACzC,MAAM,YAAY,SAAS,IAAI,OAAO;EACtC,MAAM,OAAO,qBAAqB,OAAO,YAAY;AAErD,MAAI,CAAC,KACJ,QAAO,SAAS,WAAW,oBAAoB,IAAI;EAIpD,MAAM,eAAe,SAAS,IAAI,UAAU;EAC5C,MAAM,UACL,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,eAAe;EAG9E,MAAM,aADiB,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,GAAG,SAC/C,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,MAAM,UAAU,CAC9C,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;AAI9D,MAAI,KAAK,OAAO,cACf,QAAO,SACN,qBACA,gCAAgC,eAAe,cAAc,IAC7D,IACA;EAIF,MAAM,SAAS,IAAI,WAAW,MAAM,KAAK,aAAa,CAAC;EACvD,MAAM,cAAc,MAAM,mBAAmB,OAAO;EAIpD,MAAM,WAAW,MADJ,IAAI,gBAAgB,OAAO,GAAG,CACf,kBAAkB,YAAY;AAC1D,MAAI,SAGH,QAAO,WAAW;GAAE,MADA,cAAc,SAAS;GACJ,cAAc;GAAM,CAAC;EAM7D,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,KAAK,KAAK,IAAI;AAIvC,QAAM,OAAO,QAAQ,OAAO;GAC3B,KAAK;GACL,MAAM;GACN,aAAa,KAAK;GAClB,CAAC;EAGF,MAAM,aAAa,SAAS,IAAI,QAAQ;EACxC,MAAM,WAAW,OAAO,eAAe,WAAW,aAAa;EAC/D,MAAM,cAAc,SAAS,IAAI,SAAS;EAC1C,MAAM,YAAY,OAAO,gBAAgB,WAAW,cAAc;EAClE,MAAM,QAAQ,WAAW,SAAS,UAAU,GAAG,GAAG;EAClD,MAAM,SAAS,YAAY,SAAS,WAAW,GAAG,GAAG;EAKrD,MAAM,iBAAiB,SAAS,IAAI,YAAY;EAChD,MAAM,YAAY,0BAA0B,OAAO,iBAAiB;EACpE,MAAM,WAAW,MAAM,oBAAoB,QAAQ,KAAK,MAAM;GAC7D,iBAAiB,SAAS,QAAQ,UAAU,OAAO;IAAE;IAAO;IAAQ,GAAG;GACvE,aAAa,YACV;IAAE,OAAO,IAAI,WAAW,MAAM,UAAU,aAAa,CAAC;IAAE,aAAa,UAAU;IAAM,GACrF;GACH,CAAC;EAGF,MAAM,SAAS,MAAM,OAAO,kBAAkB;GAC7C,UAAU,KAAK;GACf,UAAU,cAAc,KAAK,KAAK;GAClC,MAAM,KAAK;GAIX,OAAO,SAAS,SAAS;GACzB,QAAQ,UAAU,SAAS;GAC3B;GACA;GACA,UAAU,SAAS;GACnB,eAAe,SAAS;GACxB,UAAU,MAAM;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,SAAS;AAEpB,OAAI;AACH,UAAM,OAAO,QAAQ,OAAO,WAAW;WAChC;AAGR,UAAO,aAAa,OAAO;;AAM5B,SAAO,WAAW,EAAE,MAFA,cAAc,OAAO,KAAK,KAAK,EAEZ,EAAE,IAAI;UACrC,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}
+{"version":3,"file":"media.mjs","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"sourcesContent":["/**\n * Media list and upload endpoint\n *\n * GET /_emdash/api/media - List all media\n * POST /_emdash/api/media - Upload new media (via configured storage adapter)\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { canReadMediaUsageCount, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { handleMediaUsageSummaries } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, formatFileSize, mediaListQuery } from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { enrichImageMetadata } from \"#media/enrich.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\nimport { computeContentHash } from \"#utils/hash.js\";\n\nimport type { MediaItem } from \"../../types.js\";\n\nexport const prerender = false;\n\n/**\n * Add URL to media items\n * Uses relative URLs to ensure portability across deployments\n */\nfunction addUrlToMedia(item: MediaItem): MediaItem & { url: string } {\n\treturn {\n\t\t...item,\n\t\turl: `/_emdash/api/media/file/${item.storageKey}`,\n\t};\n}\n\n/**\n * List media items\n */\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst query = parseQuery(url, mediaListQuery);\n\tif (isParseError(query)) return query;\n\n\tconst result = await emdash.handleMediaList({\n\t\tcursor: query.cursor,\n\t\tlimit: query.limit,\n\t\tmimeType: query.mimeType,\n\t\tq: query.q,\n\t});\n\n\tif (!result.success) {\n\t\treturn unwrapResult(result);\n\t}\n\n\t// Add URL to each media item (relative URLs for portability)\n\tconst itemsWithUrl = result.data.items.map((item) => addUrlToMedia(item));\n\tif (query.includeUsage !== \"1\") {\n\t\treturn apiSuccess({ items: itemsWithUrl, nextCursor: result.data.nextCursor });\n\t}\n\n\tconst includeCount = canReadMediaUsageCount(user, locals.tokenScopes);\n\tconst usageResult = await handleMediaUsageSummaries(\n\t\temdash.db,\n\t\titemsWithUrl.map((item) => item.id),\n\t\t{ includeCount },\n\t);\n\tif (!usageResult.success) return unwrapResult(usageResult);\n\n\tconst itemsWithUsage = [];\n\tfor (const item of itemsWithUrl) {\n\t\tconst usage = usageResult.data[item.id];\n\t\tif (!usage) return apiError(\"MEDIA_USAGE_READ_ERROR\", \"Failed to read media usage\", 500);\n\t\titemsWithUsage.push({ ...item, usage });\n\t}\n\n\treturn apiSuccess({ items: itemsWithUsage, nextCursor: result.data.nextCursor });\n};\n\n/**\n * Upload media file\n *\n * Uses the configured storage adapter to store the file.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaCreate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NO_STORAGE\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst rawMax = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(rawMax) || rawMax <= 0) {\n\t\t\treturn apiError(\"CONFIGURATION_ERROR\", \"Invalid maxUploadSize configuration\", 500);\n\t\t}\n\t\tconst maxUploadSize = rawMax;\n\n\t\t// Best-effort size check before buffering the full multipart body\n\t\tconst contentLength = request.headers.get(\"Content-Length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxUploadSize) {\n\t\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Upload too large\", 413);\n\t\t}\n\n\t\tconst formData = await request.formData();\n\t\tconst fileEntry = formData.get(\"file\");\n\t\tconst file = fileEntry instanceof File ? fileEntry : null;\n\n\t\tif (!file) {\n\t\t\treturn apiError(\"NO_FILE\", \"No file provided\", 400);\n\t\t}\n\n\t\t// Validate file type — widen the allowlist when a field-specific list is configured\n\t\tconst fieldIdEntry = formData.get(\"fieldId\");\n\t\tconst fieldId =\n\t\t\ttypeof fieldIdEntry === \"string\" && fieldIdEntry.length > 0 ? fieldIdEntry : null;\n\n\t\tconst fieldAllowlist = fieldId ? await resolveFieldAllowlist(emdash.db, fieldId) : null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(file.type, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\t// Check file size before buffering\n\t\tif (file.size > maxUploadSize) {\n\t\t\treturn apiError(\n\t\t\t\t\"PAYLOAD_TOO_LARGE\",\n\t\t\t\t`File exceeds maximum size of ${formatFileSize(maxUploadSize)}`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\n\t\t// Get file content and compute hash\n\t\tconst buffer = new Uint8Array(await file.arrayBuffer());\n\t\tconst contentHash = await computeContentHash(buffer);\n\n\t\t// Check for existing media with same content hash (deduplication)\n\t\tconst repo = new MediaRepository(emdash.db);\n\t\tconst existing = await repo.findByContentHash(contentHash);\n\t\tif (existing) {\n\t\t\t// Same content already exists - return existing item\n\t\t\tconst itemWithUrl = addUrlToMedia(existing);\n\t\t\treturn apiSuccess({ item: itemWithUrl, deduplicated: true });\n\t\t}\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(file.name) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\t// Upload to storage using the configured adapter\n\t\tawait emdash.storage.upload({\n\t\t\tkey: storageKey,\n\t\t\tbody: buffer,\n\t\t\tcontentType: file.type,\n\t\t});\n\n\t\t// Get image dimensions from form data (sent by client)\n\t\tconst widthEntry = formData.get(\"width\");\n\t\tconst widthStr = typeof widthEntry === \"string\" ? widthEntry : null;\n\t\tconst heightEntry = formData.get(\"height\");\n\t\tconst heightStr = typeof heightEntry === \"string\" ? heightEntry : null;\n\t\tconst width = widthStr ? parseInt(widthStr, 10) : undefined;\n\t\tconst height = heightStr ? parseInt(heightStr, 10) : undefined;\n\n\t\t// Derive dimensions + LQIP placeholders via the shared helper.\n\t\t// If the client sent a downscaled thumbnail, decode that for the blurhash\n\t\t// (avoids OOM on large originals on memory-constrained runtimes).\n\t\tconst thumbnailEntry = formData.get(\"thumbnail\");\n\t\tconst thumbnail = thumbnailEntry instanceof File ? thumbnailEntry : null;\n\t\tconst enriched = await enrichImageMetadata(buffer, file.type, {\n\t\t\tknownDimensions: width != null && height != null ? { width, height } : undefined,\n\t\t\tplaceholder: thumbnail\n\t\t\t\t? { bytes: new Uint8Array(await thumbnail.arrayBuffer()), contentType: thumbnail.type }\n\t\t\t\t: undefined,\n\t\t});\n\n\t\t// Create media record\n\t\tconst result = await emdash.handleMediaCreate({\n\t\t\tfilename: file.name,\n\t\t\tmimeType: normalizeMime(file.type),\n\t\t\tsize: file.size,\n\t\t\t// Client dimensions win over server header dimensions: the browser's\n\t\t\t// naturalWidth/Height apply EXIF orientation, while image-size reports\n\t\t\t// raw (pre-orientation) header dims — swapped for 90°/270° JPEGs.\n\t\t\twidth: width ?? enriched.width,\n\t\t\theight: height ?? enriched.height,\n\t\t\tstorageKey,\n\t\t\tcontentHash,\n\t\t\tblurhash: enriched.blurhash,\n\t\t\tdominantColor: enriched.dominantColor,\n\t\t\tauthorId: user?.id,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\t// Clean up the uploaded file on failure\n\t\t\ttry {\n\t\t\t\tawait emdash.storage.delete(storageKey);\n\t\t\t} catch {\n\t\t\t\t// Ignore cleanup errors\n\t\t\t}\n\t\t\treturn unwrapResult(result);\n\t\t}\n\n\t\t// Add URL to the response (relative URL for portability)\n\t\tconst itemWithUrl = addUrlToMedia(result.data.item);\n\n\t\treturn apiSuccess({ item: itemWithUrl }, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Upload failed\", \"UPLOAD_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY;;;;;AAMzB,SAAS,cAAc,MAA8C;AACpE,QAAO;EACN,GAAG;EACH,KAAK,2BAA2B,KAAK;EACrC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,gBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,QAAQ,WADF,IAAI,IAAI,QAAQ,IAAI,EACF,eAAe;AAC7C,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,SAAS,MAAM,OAAO,gBAAgB;EAC3C,QAAQ,MAAM;EACd,OAAO,MAAM;EACb,UAAU,MAAM;EAChB,GAAG,MAAM;EACT,CAAC;AAEF,KAAI,CAAC,OAAO,QACX,QAAO,aAAa,OAAO;CAI5B,MAAM,eAAe,OAAO,KAAK,MAAM,KAAK,SAAS,cAAc,KAAK,CAAC;AACzE,KAAI,MAAM,iBAAiB,IAC1B,QAAO,WAAW;EAAE,OAAO;EAAc,YAAY,OAAO,KAAK;EAAY,CAAC;CAG/E,MAAM,eAAe,uBAAuB,MAAM,OAAO,YAAY;CACrE,MAAM,cAAc,MAAM,0BACzB,OAAO,IACP,aAAa,KAAK,SAAS,KAAK,GAAG,EACnC,EAAE,cAAc,CAChB;AACD,KAAI,CAAC,YAAY,QAAS,QAAO,aAAa,YAAY;CAE1D,MAAM,iBAAiB,EAAE;AACzB,MAAK,MAAM,QAAQ,cAAc;EAChC,MAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,MAAI,CAAC,MAAO,QAAO,SAAS,0BAA0B,8BAA8B,IAAI;AACxF,iBAAe,KAAK;GAAE,GAAG;GAAM;GAAO,CAAC;;AAGxC,QAAO,WAAW;EAAE,OAAO;EAAgB,YAAY,OAAO,KAAK;EAAY,CAAC;;;;;;;AAQjF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,kBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,cAAc,0BAA0B,IAAI;AAG7D,KAAI;EACH,MAAM,SAAS,OAAO,OAAO,iBAAiB;AAC9C,MAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACzC,QAAO,SAAS,uBAAuB,uCAAuC,IAAI;EAEnF,MAAM,gBAAgB;EAGtB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,oBAAoB,IAAI;EAG9D,MAAM,WAAW,MAAM,QAAQ,UAAU;EACzC,MAAM,YAAY,SAAS,IAAI,OAAO;EACtC,MAAM,OAAO,qBAAqB,OAAO,YAAY;AAErD,MAAI,CAAC,KACJ,QAAO,SAAS,WAAW,oBAAoB,IAAI;EAIpD,MAAM,eAAe,SAAS,IAAI,UAAU;EAC5C,MAAM,UACL,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,eAAe;EAG9E,MAAM,aADiB,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,GAAG,SAC/C,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,MAAM,UAAU,CAC9C,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;AAI9D,MAAI,KAAK,OAAO,cACf,QAAO,SACN,qBACA,gCAAgC,eAAe,cAAc,IAC7D,IACA;EAIF,MAAM,SAAS,IAAI,WAAW,MAAM,KAAK,aAAa,CAAC;EACvD,MAAM,cAAc,MAAM,mBAAmB,OAAO;EAIpD,MAAM,WAAW,MADJ,IAAI,gBAAgB,OAAO,GAAG,CACf,kBAAkB,YAAY;AAC1D,MAAI,SAGH,QAAO,WAAW;GAAE,MADA,cAAc,SAAS;GACJ,cAAc;GAAM,CAAC;EAM7D,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,KAAK,KAAK,IAAI;AAIvC,QAAM,OAAO,QAAQ,OAAO;GAC3B,KAAK;GACL,MAAM;GACN,aAAa,KAAK;GAClB,CAAC;EAGF,MAAM,aAAa,SAAS,IAAI,QAAQ;EACxC,MAAM,WAAW,OAAO,eAAe,WAAW,aAAa;EAC/D,MAAM,cAAc,SAAS,IAAI,SAAS;EAC1C,MAAM,YAAY,OAAO,gBAAgB,WAAW,cAAc;EAClE,MAAM,QAAQ,WAAW,SAAS,UAAU,GAAG,GAAG;EAClD,MAAM,SAAS,YAAY,SAAS,WAAW,GAAG,GAAG;EAKrD,MAAM,iBAAiB,SAAS,IAAI,YAAY;EAChD,MAAM,YAAY,0BAA0B,OAAO,iBAAiB;EACpE,MAAM,WAAW,MAAM,oBAAoB,QAAQ,KAAK,MAAM;GAC7D,iBAAiB,SAAS,QAAQ,UAAU,OAAO;IAAE;IAAO;IAAQ,GAAG;GACvE,aAAa,YACV;IAAE,OAAO,IAAI,WAAW,MAAM,UAAU,aAAa,CAAC;IAAE,aAAa,UAAU;IAAM,GACrF;GACH,CAAC;EAGF,MAAM,SAAS,MAAM,OAAO,kBAAkB;GAC7C,UAAU,KAAK;GACf,UAAU,cAAc,KAAK,KAAK;GAClC,MAAM,KAAK;GAIX,OAAO,SAAS,SAAS;GACzB,QAAQ,UAAU,SAAS;GAC3B;GACA;GACA,UAAU,SAAS;GACnB,eAAe,SAAS;GACxB,UAAU,MAAM;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,SAAS;AAEpB,OAAI;AACH,UAAM,OAAO,QAAQ,OAAO,WAAW;WAChC;AAGR,UAAO,aAAa,OAAO;;AAM5B,SAAO,WAAW,EAAE,MAFA,cAAc,OAAO,KAAK,KAAK,EAEZ,EAAE,IAAI;UACrC,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}

package/dist/astro/routes/api/menus/_name_/items/_id_.mjs

@@ -1,15 +1,16 @@
 import "../../../../../../after-B1IIdH3Y.mjs";
 import "../../../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../../../base64-C74Msx8h.mjs";
-import "../../../../../../types-Ch8pFMEm.mjs";
-import { a as handleMenuItemDelete, s as handleMenuItemUpdate } from "../../../../../../menus-BpfevlJD.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../parse-GLksnn-B.mjs";
-import { lt as updateMenuItemBody, zn as localeFilterQuery } from "../../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../../base64-B-PsqheR.mjs";
+import "../../../../../../types-D1iJ3DpO.mjs";
+import { a as handleMenuItemDelete, s as handleMenuItemUpdate } from "../../../../../../menus-CZyG6rvx.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-CEGF6UZb.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../parse-C_-6klII.mjs";
+import { z as localeFilterQuery } from "../../../../../../media-kIV1IxFf.mjs";
+import { lt as updateMenuItemBody } from "../../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../../relations-5_avdrN_.mjs";
+import "../../../../../../status-COfycGIU.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../../authorize-BmCwQCib.mjs";
+import { r as requirePerm } from "../../../../../../authorize-WxsiePzy.mjs";
 
 //#region src/astro/routes/api/menus/[name]/items/[id].ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_/items/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/menus/[name]/items/[id].ts"],"sourcesContent":["/**\n * Single menu item endpoint\n *\n * PUT    /_emdash/api/menus/:name/items/:id[?locale=xx]\n * DELETE /_emdash/api/menus/:name/items/:id[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemDelete, handleMenuItemUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuItemBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemUpdate(emdash.db, name, itemId, body, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu item\", \"MENU_ITEM_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst result = await handleMenuItemDelete(emdash.db, name, itemId, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu item\", \"MENU_ITEM_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;AAK/B,SAAO,aAHQ,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,MAAM,EACxE,QAAQ,QAAQ,QAChB,CAAC,CACyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB;;;AAInF,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACtE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;AAIH,SAAO,aAHQ,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,EAClE,QAAQ,QAAQ,QAChB,CAAC,CACyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/menus/[name]/items/[id].ts"],"sourcesContent":["/**\n * Single menu item endpoint\n *\n * PUT    /_emdash/api/menus/:name/items/:id[?locale=xx]\n * DELETE /_emdash/api/menus/:name/items/:id[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemDelete, handleMenuItemUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuItemBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemUpdate(emdash.db, name, itemId, body, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu item\", \"MENU_ITEM_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst result = await handleMenuItemDelete(emdash.db, name, itemId, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu item\", \"MENU_ITEM_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;AAK/B,SAAO,aAHQ,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,MAAM,EACxE,QAAQ,QAAQ,QAChB,CAAC,CACyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB;;;AAInF,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACtE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;AAIH,SAAO,aAHQ,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,EAClE,QAAQ,QAAQ,QAChB,CAAC,CACyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}

package/dist/astro/routes/api/menus/_name_/items.mjs

@@ -1,15 +1,16 @@
 import "../../../../../after-B1IIdH3Y.mjs";
 import "../../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { i as handleMenuItemCreate } from "../../../../../menus-BpfevlJD.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { et as createMenuItemBody, zn as localeFilterQuery } from "../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-D1iJ3DpO.mjs";
+import { i as handleMenuItemCreate } from "../../../../../menus-CZyG6rvx.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../../error-CEGF6UZb.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-C_-6klII.mjs";
+import { z as localeFilterQuery } from "../../../../../media-kIV1IxFf.mjs";
+import { et as createMenuItemBody } from "../../../../../redirects-BBq3n2Rj.mjs";
+import "../../../../../relations-5_avdrN_.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
+import { r as requirePerm } from "../../../../../authorize-WxsiePzy.mjs";
 
 //#region src/astro/routes/api/menus/[name]/items.ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_/items.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"items.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/items.ts"],"sourcesContent":["/**\n * Menu items create endpoint\n *\n * POST /_emdash/api/menus/:name/items[?locale=xx] - Create a new menu item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemCreate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuItemBody, localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemCreate(emdash.db, name, body, { locale: localeQ.locale });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu item\", \"MENU_ITEM_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,MAAM,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC,EAChE,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}
+{"version":3,"file":"items.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/items.ts"],"sourcesContent":["/**\n * Menu items create endpoint\n *\n * POST /_emdash/api/menus/:name/items[?locale=xx] - Create a new menu item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemCreate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuItemBody, localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemCreate(emdash.db, name, body, { locale: localeQ.locale });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu item\", \"MENU_ITEM_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,qBAAqB,OAAO,IAAI,MAAM,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC,EAChE,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}