npm - emdash - Versions diffs - 0.29.0 → 0.30.0 - Mend

emdash 0.29.0 → 0.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (839) hide show

package/src/astro/public-plugin-api-routes.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import type { RouteMeta } from "../plugins/routes.js";
 import type { HandlerResponse } from "./types.js";
 export type PublicPluginApiRouteHandler = (
@@ -8,7 +9,7 @@ export type PublicPluginApiRouteHandler = (
 ) => Promise<HandlerResponse>;
 interface PublicPluginApiRouteRuntime {
-	getPluginRouteMeta(pluginId: string, path: string): { public: boolean } | null;
+	getPluginRouteMeta(pluginId: string, path: string): RouteMeta | null;
 	handlePluginApiRoute(
 		pluginId: string,
 		method: string,

package/src/astro/routes/PluginRegistry.tsx CHANGED Viewed

@@ -6,7 +6,7 @@
  * together with the admin app and available via React context.
  */
-import { AdminApp } from "@emdash-cms/admin";
+import { AdminApp, type AdminBranding } from "@emdash-cms/admin";
 import type { Messages } from "@lingui/core";
 // @ts-ignore - virtual module generated by integration
 import { pluginAdmins } from "virtual:emdash/admin-registry";
@@ -16,13 +16,16 @@ import { authProviders } from "virtual:emdash/auth-providers";
 interface AdminWrapperProps {
 	locale: string;
 	messages: Messages;
+	/** Configured admin white-label branding (logo, site name), read server-side from `admin.astro`. */
+	adminBranding?: AdminBranding;
 }
-export default function AdminWrapper({ locale, messages }: AdminWrapperProps) {
+export default function AdminWrapper({ locale, messages, adminBranding }: AdminWrapperProps) {
 	return (
 		<AdminApp
 			pluginAdmins={pluginAdmins}
 			authProviders={authProviders}
+			adminBranding={adminBranding}
 			locale={locale}
 			messages={messages}
 		/>

package/src/astro/routes/admin.astro CHANGED Viewed

@@ -17,6 +17,7 @@ import { Font } from "astro:assets";
 export const prerender = false;
 import { resolveLocale, loadMessages, getLocaleDir } from "@emdash-cms/admin/locales";
+import { getSiteSettingsWithDb } from "#settings/index.js";
 const resolvedLocale = resolveLocale(Astro.request);
 const resolvedDir = getLocaleDir(resolvedLocale);
@@ -33,17 +34,59 @@ const pageTitle = adminConfig?.siteName ? `${adminConfig.siteName} Admin` : "EmD
 // via cookie/Accept-Language). API routes already send `private, no-store`
 // (API_CACHE_HEADERS); this closes the same gap for the admin HTML.
 Astro.response.headers.set("Cache-Control", "private, no-store");
+// Favicon precedence: an explicit build-time `admin.favicon` is admin-specific
+// and always wins — in that case the settings read is skipped entirely.
+// Otherwise fall back to the Site Icon configured in Settings → General, so
+// the admin shell is branded like the public site (WordPress-style Site Icon,
+// which also brands wp-admin), and finally the bundled EmDash mark below.
+const emdash = Astro.locals.emdash;
+let siteFavicon: string | undefined;
+let siteFaviconType: string | undefined;
+if (!adminConfig?.favicon && emdash?.db) {
+	try {
+		const settings = await getSiteSettingsWithDb(emdash.db, emdash.storage ?? null);
+		siteFavicon = settings.favicon?.url ?? undefined;
+		siteFaviconType = settings.favicon?.contentType ?? undefined;
+	} catch {
+		// Settings unavailable (e.g. pre-setup) — fall back to the config/default.
+	}
+}
+const favicon = adminConfig?.favicon ?? siteFavicon;
+// The media-file URL has no extension, so browsers need the MIME type —
+// Chromium ignores SVG favicons without type="image/svg+xml". Only set for
+// Site Icons; build-time `admin.favicon` strings keep their current behavior.
+const faviconType = adminConfig?.favicon ? undefined : siteFaviconType;
 ---
 <!doctype html>
-<html lang={resolvedLocale} dir={resolvedDir}>
+<html lang={resolvedLocale} dir={resolvedDir} data-theme="classic">
 	<head>
 		<meta charset="UTF-8" />
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+		<script is:inline>
+			(() => {
+				let preference = "system";
+				try {
+					const storedPreference = localStorage.getItem("emdash-theme");
+					if (storedPreference === "light" || storedPreference === "dark") {
+						preference = storedPreference;
+					}
+				} catch {
+					// Storage can be unavailable in privacy-restricted contexts. Use the system theme.
+				}
+				const prefersDark = window.matchMedia("(prefers-color-scheme: dark)").matches;
+				const mode =
+					preference === "dark" || (preference === "system" && prefersDark) ? "dark" : "light";
+				document.documentElement.setAttribute("data-mode", mode);
+			})();
+		</script>
 		<link rel="stylesheet" href={adminStylesUrl} />
 		<Font cssVariable="--font-emdash" />
-		{adminConfig?.favicon ? (
-			<link rel="icon" href={adminConfig.favicon} />
+		{favicon ? (
+			<link rel="icon" href={favicon} type={faviconType} />
 		) : (
 			<link
 				rel="icon"
@@ -61,8 +104,7 @@ Astro.response.headers.set("Cache-Control", "private, no-store");
 						align-items: center;
 						justify-content: center;
 						min-height: 100vh;
-						color-scheme: light dark;
-						background: light-dark(hsl(0 0% 100%), hsl(222.2 84% 4.9%));
+						background: var(--color-kumo-elevated);
 					}
 					#emdash-boot-loader .loader-inner {
 						text-align: center;
@@ -71,15 +113,8 @@ Astro.response.headers.set("Cache-Control", "private, no-store");
 						width: 24px;
 						height: 24px;
 						margin: 0 auto;
-						border: 2.5px solid
-							light-dark(
-								hsl(215.4 16.3% 46.9% / 0.3),
-								hsl(215 20.2% 65.1% / 0.3)
-							);
-						border-top-color: light-dark(
-							hsl(215.4 16.3% 46.9%),
-							hsl(215 20.2% 65.1%)
-						);
+						border: 2.5px solid var(--color-kumo-line);
+						border-top-color: var(--text-color-kumo-subtle);
 						border-radius: 50%;
 						animation: emdash-spin 0.8s linear infinite;
 					}
@@ -92,7 +127,7 @@ Astro.response.headers.set("Cache-Control", "private, no-store");
 							sans-serif
 						);
 						font-size: 0.875rem;
-						color: light-dark(hsl(215.4 16.3% 46.9%), hsl(215 20.2% 65.1%));
+						color: var(--text-color-kumo-subtle);
 					}
 					@keyframes emdash-spin {
 						to {
@@ -105,7 +140,12 @@ Astro.response.headers.set("Cache-Control", "private, no-store");
 					<p>{adminConfig?.siteName ? `Loading ${adminConfig.siteName}...` : "Loading EmDash..."}</p>
 				</div>
 			</div>
-			<AdminWrapper client:only="react" locale={resolvedLocale} messages={messages} />
+			<AdminWrapper
+				client:only="react"
+				locale={resolvedLocale}
+				messages={messages}
+				adminBranding={{ logo: adminConfig?.logo, siteName: adminConfig?.siteName }}
+			/>
 		</div>
 	</body>
 </html>

package/src/astro/routes/api/admin/api-tokens/index.ts CHANGED Viewed

@@ -12,13 +12,13 @@ import { z } from "zod";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
 import { handleApiTokenCreate, handleApiTokenList } from "#api/handlers/api-tokens.js";
 import { isParseError, parseBody } from "#api/parse.js";
-import { VALID_SCOPES } from "#auth/api-tokens.js";
+import { isValidScope } from "#auth/api-tokens.js";
 export const prerender = false;
 const createTokenSchema = z.object({
 	name: z.string().min(1).max(100),
-	scopes: z.array(z.enum(VALID_SCOPES)).min(1),
+	scopes: z.array(z.string().refine(isValidScope)).min(1),
 	expiresAt: z.string().datetime().optional(),
 });

package/src/astro/routes/api/admin/bylines/[id]/translations.ts CHANGED Viewed

@@ -15,7 +15,7 @@
 import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
-import { handleError, requireDb, unwrapResult } from "#api/error.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleBylineCreate, handleBylineTranslations } from "#api/handlers/bylines.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { bylineTranslationCreateBody } from "#api/schemas.js";
@@ -65,10 +65,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		const repo = new BylineRepository(emdash.db);
 		const source = await repo.findById(id);
 		if (!source) {
-			return new Response(
-				JSON.stringify({ error: { code: "NOT_FOUND", message: "Byline not found" } }),
-				{ status: 404, headers: { "Content-Type": "application/json" } },
-			);
+			return apiError("NOT_FOUND", "Byline not found", 404);
 		}
 		const result = await handleBylineCreate(emdash.db, {

package/src/astro/routes/api/admin/plugins/[id]/index.ts CHANGED Viewed

@@ -34,6 +34,12 @@ export const GET: APIRoute = async ({ params, locals }) => {
 		id,
 		emdash.config.marketplace,
 	);
+	if (result.success) {
+		const tools = await emdash.getPluginMcpTools(id);
+		result.data.item.mcpTools = tools.map(
+			({ inputSchema: _, outputSchema: __, pluginId: ___, ...tool }) => tool,
+		);
+	}
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/[id]/mcp.ts ADDED Viewed

@@ -0,0 +1,42 @@
+import type { APIRoute } from "astro";
+import { z } from "zod";
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess } from "#api/error.js";
+import { parseBody } from "#api/parse.js";
+import { PluginStateRepository } from "#plugins/state.js";
+export const prerender = false;
+const bodySchema = z.object({ enabled: z.boolean() });
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+	if (!params.id) return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+	const parsed = await parseBody(request, bodySchema);
+	if (parsed instanceof Response) return parsed;
+	const tools = await emdash.getPluginMcpTools(params.id);
+	if (parsed.enabled && tools.length === 0) {
+		return apiError("NO_MCP_TOOLS", "Plugin does not declare MCP tools", 400);
+	}
+	const stateRepo = new PluginStateRepository(emdash.db);
+	const existing = await stateRepo.get(params.id);
+	const configuredVersion =
+		emdash.configuredPlugins.find((plugin) => plugin.id === params.id)?.version ??
+		emdash.sandboxedPluginEntries.find((plugin) => plugin.id === params.id)?.version;
+	const version = existing?.version ?? configuredVersion;
+	if (!version) return apiError("NOT_FOUND", "Plugin not found", 404);
+	const consent = parsed.enabled ? emdash.serializePluginMcpConsent(tools, params.id) : null;
+	const item = await stateRepo.upsert(params.id, version, existing?.status ?? "active", {
+		mcpToolsEnabled: parsed.enabled,
+		mcpToolsConsent: consent,
+	});
+	return apiSuccess({
+		enabled: item.mcpToolsEnabled,
+		tools: tools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool),
+	});
+};

package/src/astro/routes/api/admin/plugins/[id]/settings.ts ADDED Viewed

@@ -0,0 +1,80 @@
+/**
+ * Plugin settings endpoint (auto-generated settings UI)
+ *
+ * GET /_emdash/api/admin/plugins/:id/settings - Get schema + current values (secrets masked)
+ * PUT /_emdash/api/admin/plugins/:id/settings - Update values
+ */
+import type { APIRoute } from "astro";
+import { z } from "zod";
+import { requirePerm } from "#api/authorize.js";
+import { apiError } from "#api/error.js";
+import {
+	getPluginSettingsSchema,
+	handlePluginSettingsGet,
+	handlePluginSettingsUpdate,
+} from "#api/handlers/plugin-settings.js";
+import { unwrapResult } from "#api/index.js";
+import { isParseError, parseBody } from "#api/parse.js";
+export const prerender = false;
+const updateBody = z.object({
+	values: z.record(z.string(), z.unknown()),
+});
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+	}
+	const schema =
+		getPluginSettingsSchema(emdash.configuredPlugins, emdash.sandboxedPluginEntries, id) ??
+		emdash.getRuntimePluginSettingsSchema(id);
+	if (schema === null) {
+		return apiError("NOT_FOUND", `Plugin not found: ${id}`, 404);
+	}
+	const result = await handlePluginSettingsGet(emdash.db, id, schema);
+	return unwrapResult(result);
+};
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+	}
+	const schema =
+		getPluginSettingsSchema(emdash.configuredPlugins, emdash.sandboxedPluginEntries, id) ??
+		emdash.getRuntimePluginSettingsSchema(id);
+	if (schema === null) {
+		return apiError("NOT_FOUND", `Plugin not found: ${id}`, 404);
+	}
+	const body = await parseBody(request, updateBody);
+	if (isParseError(body)) return body;
+	const result = await handlePluginSettingsUpdate(emdash.db, id, schema, body.values);
+	return unwrapResult(result);
+};

package/src/astro/routes/api/admin/plugins/[id]/update.ts CHANGED Viewed

@@ -18,6 +18,7 @@ const updateBodySchema = z.object({
 	version: z.string().min(1).optional(),
 	confirmCapabilityChanges: z.boolean().optional(),
 	confirmRouteVisibilityChanges: z.boolean().optional(),
+	confirmMcpTools: z.boolean().optional(),
 });
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -48,6 +49,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			version: body.version,
 			confirmCapabilityChanges: body.confirmCapabilityChanges,
 			confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+			confirmMcpTools: body.confirmMcpTools,
 			sandboxBypassed: emdash.isSandboxBypassed(),
 		},
 	);

package/src/astro/routes/api/admin/plugins/index.ts CHANGED Viewed

@@ -27,7 +27,16 @@ export const GET: APIRoute = async ({ locals }) => {
 		emdash.configuredPlugins,
 		emdash.sandboxedPluginEntries,
 		emdash.config.marketplace,
+		(pluginId) => emdash.getRuntimePluginSettingsSchema(pluginId),
 	);
+	if (result.success) {
+		const tools = await emdash.getPluginMcpTools();
+		for (const item of result.data.items) {
+			item.mcpTools = tools
+				.filter((tool) => tool.pluginId === item.id)
+				.map(({ inputSchema: _, outputSchema: __, pluginId: ___, ...tool }) => tool);
+		}
+	}
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/marketplace/[id]/install.ts CHANGED Viewed

@@ -16,6 +16,7 @@ export const prerender = false;
 const installBodySchema = z.object({
 	version: z.string().min(1).optional(),
+	confirmMcpTools: z.boolean().optional(),
 });
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -54,6 +55,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 				configuredPluginIds,
 				siteOrigin,
 				sandboxBypassed: emdash.isSandboxBypassed(),
+				confirmMcpTools: body.confirmMcpTools,
 			},
 		);

package/src/astro/routes/api/admin/plugins/registry/[id]/update.ts CHANGED Viewed

@@ -36,6 +36,7 @@ const updateBodySchema = z.object({
 	 * version newly exposes a public (unauthenticated) route.
 	 */
 	confirmRouteVisibilityChanges: z.boolean().optional(),
+	confirmMcpTools: z.boolean().optional(),
 });
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -67,6 +68,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 				version: body.version,
 				confirmCapabilityChanges: body.confirmCapabilityChanges,
 				confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+				confirmMcpTools: body.confirmMcpTools,
 				hostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),
 			},
 		);

package/src/astro/routes/api/admin/plugins/registry/install.ts CHANGED Viewed

@@ -57,6 +57,7 @@ const installBodySchema = z.object({
 	 * dialog and the install POST.
 	 */
 	acknowledgedDeclaredAccess: z.unknown().optional(),
+	acknowledgedMcpTools: z.unknown().optional(),
 });
 export const POST: APIRoute = async ({ request, locals }) => {
@@ -93,6 +94,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 				slug: body.slug,
 				version: body.version,
 				acknowledgedDeclaredAccess: body.acknowledgedDeclaredAccess,
+				acknowledgedMcpTools: body.acknowledgedMcpTools,
 			},
 			{
 				configuredPluginIds: reservedPluginIds,

package/src/astro/routes/api/admin/plugins/updates.ts CHANGED Viewed

@@ -15,7 +15,7 @@
 import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
-import { apiError } from "#api/error.js";
+import { apiError, apiSuccess } from "#api/error.js";
 import { handleMarketplaceUpdateCheck, handleRegistryUpdateCheck } from "#api/index.js";
 export const prerender = false;
@@ -59,7 +59,5 @@ export const GET: APIRoute = async ({ locals }) => {
 	if (marketplace?.success) items.push(...marketplace.data.items);
 	if (registry?.success) items.push(...registry.data.items);
-	// Match the rest of the admin API envelope (`{ data: ... }`) so the
-	// admin client's `parseApiResponse` unwraps `body.data`.
-	return Response.json({ data: { items } });
+	return apiSuccess({ items });
 };

package/src/astro/routes/api/auth/mode.ts CHANGED Viewed

@@ -11,6 +11,7 @@
 import type { APIRoute } from "astro";
+import { apiSuccess } from "#api/error.js";
 import { getAuthMode } from "#auth/mode.js";
 export const prerender = false;
@@ -40,18 +41,9 @@ export const GET: APIRoute = async ({ locals }) => {
 		label: p.label,
 	}));
-	return Response.json(
-		{
-			data: {
-				authMode: authMode.type === "external" ? authMode.providerType : "passkey",
-				signupEnabled,
-				providers,
-			},
-		},
-		{
-			headers: {
-				"Cache-Control": "private, no-store",
-			},
-		},
-	);
+	return apiSuccess({
+		authMode: authMode.type === "external" ? authMode.providerType : "passkey",
+		signupEnabled,
+		providers,
+	});
 };

package/src/astro/routes/api/auth/oauth/[provider]/callback.ts CHANGED Viewed

@@ -115,10 +115,17 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 	}
 	try {
-		// Get OAuth providers from environment
-		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- locals.runtime is injected by the Cloudflare adapter at runtime; not declared on App.Locals since the adapter is optional
-		const runtimeLocals = locals as unknown as { runtime?: { env?: Record<string, unknown> } };
-		const env = runtimeLocals.runtime?.env ?? import.meta.env;
+		// Get OAuth providers from environment. Astro 6 removed
+		// `Astro.locals.runtime.env` (accessing it throws rather than
+		// returning undefined, so optional-chaining doesn't help) -- read
+		// Cloudflare bindings via the emdash virtual module instead, which
+		// re-exports `cloudflare:workers`' `env` under that adapter and
+		// falls back to `import.meta.env` on Node (#1736).
+		// @ts-ignore - virtual module, generated by the Astro integration
+		const { env: cfEnv } = (await import("virtual:emdash/env")) as {
+			env?: Record<string, unknown>;
+		};
+		const env = cfEnv ?? import.meta.env;
 		const providers = getOAuthConfig(env);
 		if (!providers[provider]) {
@@ -216,6 +223,16 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 				case "signup_not_allowed":
 					message = "Self-signup is not allowed for your email. Please contact an administrator.";
 					break;
+				case "invite_invalid":
+					message = "This invite link is invalid or has expired. Please ask for a new one.";
+					break;
+				case "invite_email_mismatch":
+					message = "This invite was sent to a different email address than your account.";
+					break;
+				case "invite_email_unverified":
+					message =
+						"Your account's email is not verified by the provider. Please verify it and try again.";
+					break;
 				case "user_not_found":
 					message = "Your account was not found. It may have been deleted.";
 					break;

package/src/astro/routes/api/auth/oauth/[provider].ts CHANGED Viewed

@@ -17,6 +17,9 @@ type ProviderName = "github" | "google";
 const VALID_PROVIDERS = new Set<string>(["github", "google"]);
+/** Invite tokens are base64url; clamp shape and length before persisting to state. */
+const INVITE_TOKEN_REGEX = /^[A-Za-z0-9_-]{1,256}$/;
 function isValidProvider(provider: string): provider is ProviderName {
 	return VALID_PROVIDERS.has(provider);
 }
@@ -93,11 +96,17 @@ export const GET: APIRoute = async ({ params, request, locals, redirect }) => {
 	try {
 		const url = new URL(request.url);
-		// Get OAuth providers from environment
-		// Access via locals.runtime for Cloudflare, or import.meta.env for Node
-		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- locals.runtime is injected by the Cloudflare adapter at runtime; not declared on App.Locals since the adapter is optional
-		const runtimeLocals = locals as unknown as { runtime?: { env?: Record<string, unknown> } };
-		const env = runtimeLocals.runtime?.env ?? import.meta.env;
+		// Get OAuth providers from environment. Astro 6 removed
+		// `Astro.locals.runtime.env` (accessing it throws rather than
+		// returning undefined, so optional-chaining doesn't help) -- read
+		// Cloudflare bindings via the emdash virtual module instead, which
+		// re-exports `cloudflare:workers`' `env` under that adapter and
+		// falls back to `import.meta.env` on Node (#1736).
+		// @ts-ignore - virtual module, generated by the Astro integration
+		const { env: cfEnv } = (await import("virtual:emdash/env")) as {
+			env?: Record<string, unknown>;
+		};
+		const env = cfEnv ?? import.meta.env;
 		const providers = getOAuthConfig(env);
 		if (!providers[provider]) {
@@ -113,7 +122,16 @@ export const GET: APIRoute = async ({ params, request, locals, redirect }) => {
 		const stateStore = createOAuthStateStore(emdash.db);
-		const { url: authUrl } = await createAuthorizationUrl(config, provider, stateStore);
+		// When the flow starts from an invite link, carry the invite token so the
+		// callback can complete the invite for a matching, verified email. Validate
+		// its shape/length first: this endpoint is unauthenticated, so we avoid
+		// persisting arbitrary or oversized values into the short-lived state store.
+		const rawInvite = url.searchParams.get("invite");
+		const inviteToken = rawInvite && INVITE_TOKEN_REGEX.test(rawInvite) ? rawInvite : undefined;
+		const { url: authUrl } = await createAuthorizationUrl(config, provider, stateStore, {
+			inviteToken,
+		});
 		return redirect(authUrl);
 	} catch (error) {

package/src/astro/routes/api/content/[collection]/[id]/compare.ts CHANGED Viewed

@@ -13,15 +13,14 @@ export const prerender = false;
 export const GET: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
+	if (!emdash?.handleContentCompare) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
 	const denied = requirePerm(user, "content:read_drafts");
 	if (denied) return denied;
 	const collection = params.collection!;
 	const id = params.id!;
-	if (!emdash?.handleContentCompare) {
-		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
-	}
 	const result = await emdash.handleContentCompare(collection, id);
 	return unwrapResult(result);

package/src/astro/routes/api/content/[collection]/[id]/duplicate.ts CHANGED Viewed

@@ -16,12 +16,11 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 	const collection = params.collection!;
 	const id = params.id!;
-	const denied = requirePerm(user, "content:create");
-	if (denied) return denied;
 	if (!emdash?.handleContentDuplicate || !emdash?.handleContentGet) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	const denied = requirePerm(user, "content:create");
+	if (denied) return denied;
 	// Fetch item to check ownership — duplicating requires read access to the source
 	const existing = await emdash.handleContentGet(collection, id);

package/src/astro/routes/api/content/[collection]/[id]/permanent.ts CHANGED Viewed

@@ -16,12 +16,11 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 	const collection = params.collection!;
 	const id = params.id!;
-	const denied = requirePerm(user, "content:delete_permanent");
-	if (denied) return denied;
 	if (!emdash?.handleContentPermanentDelete) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	const denied = requirePerm(user, "content:delete_permanent");
+	if (denied) return denied;
 	const result = await emdash.handleContentPermanentDelete(collection, id);

package/src/astro/routes/api/content/[collection]/[id]/preview-url.ts CHANGED Viewed

@@ -33,15 +33,14 @@ const DURATION_PATTERN = /^(\d+)([smhdw])$/;
 export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
 	const denied = requirePerm(user, "content:read_drafts");
 	if (denied) return denied;
 	const collection = params.collection!;
 	const id = params.id!;
-	if (!emdash?.db) {
-		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
-	}
 	// Resolve the preview secret. Env override wins; otherwise a stable
 	// site-specific value is read from (or generated into) the options table.
 	// The resolver always returns a usable secret, so this path can no