emdash 0.31.1 → 0.33.0

package/dist/astro/routes/api/admin/users/index.mjs

@@ -1,11 +1,11 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { i as parseQuery, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import { D as usersListQuery } from "../../../../../redirects-D457qwt0.mjs";
-import "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import { D as usersListQuery } from "../../../../../redirects-G8wAhWAf.mjs";
+import "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { Role } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";

package/dist/astro/routes/api/auth/dev-bypass.mjs

@@ -1,10 +1,11 @@
-import { a as runMigrations } from "../../../../runner-BdeLEgad.mjs";
-import "../../../../dialect-helpers-BtOwo2us.mjs";
+import { a as runMigrations } from "../../../../runner-BFTrkYhu.mjs";
+import "../../../../dialect-helpers-BSbfaO3F.mjs";
+import "../../../../config-DyF3OKg_.mjs";
 import "../../../../base64-B-PsqheR.mjs";
-import "../../../../types-CrRUFdej.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DJ98TRbQ.mjs";
-import { t as escapeHtml } from "../../../../escape-CFedIB1C.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-Botom7X6.mjs";
+import "../../../../types-Cd8iuS1J.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-oh_9i6bR.mjs";
+import { t as escapeHtml } from "../../../../escape-CXps5F_v.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-Egf2R9yP.mjs";
 import { ulid } from "ulidx";
 
 //#region src/astro/routes/api/auth/dev-bypass.ts

package/dist/astro/routes/api/auth/dev-bypass.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/dev-bypass\n * GET  /_emdash/api/auth/dev-bypass\n *\n * Development-only endpoint to bypass passkey authentication.\n * Creates or uses a test admin user and establishes a session.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/auth/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with user info\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/auth/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { runMigrations } from \"#db/migrations/runner.js\";\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Ensure migrations are run\n\t\tawait runMigrations(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tconsole.log(\"[dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev session created\",\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass setup failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,YAAY;AASzB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AAGtB,MAAM,aAAa;AAEnB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,QAAM,cAAc,OAAO,GAAG;EAG9B,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;AAEJ,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,WAAQ,IAAI,wCAAwC,KAAK,MAAM;QAE/D,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAIF,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,mBAAmB;;;AAK1E,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}
+{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/dev-bypass\n * GET  /_emdash/api/auth/dev-bypass\n *\n * Development-only endpoint to bypass passkey authentication.\n * Creates or uses a test admin user and establishes a session.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/auth/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with user info\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/auth/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { runMigrations } from \"#db/migrations/runner.js\";\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Ensure migrations are run\n\t\tawait runMigrations(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tconsole.log(\"[dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev session created\",\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass setup failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;;AAmBA,MAAa,YAAY;AASzB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AAGtB,MAAM,aAAa;AAEnB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,QAAM,cAAc,OAAO,GAAG;EAG9B,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;AAEJ,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,WAAQ,IAAI,wCAAwC,KAAK,MAAM;QAE/D,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAIF,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,mBAAmB;;;AAK1E,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}

package/dist/astro/routes/api/auth/invite/accept.mjs

@@ -1,6 +1,6 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
 import { InviteError, roleFromLevel, validateInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/invite/complete.mjs

@@ -1,17 +1,17 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { k as inviteCompleteBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { k as inviteCompleteBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-DSGTnJFw.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CCEi9bPI.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-BFzgFRog.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-C-SKpc0-.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Ox9oOlgp.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CG1pACtS.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-D9VNKELo.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-D-zrzMJI.mjs";
 import { InviteError, completeInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/auth/invite/index.mjs

@@ -1,14 +1,14 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { A as inviteCreateBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { A as inviteCreateBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-NGJT6NTU.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-I-lJ5kma.mjs";
 import { InviteError, Role, createInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
@@ -24,7 +24,7 @@ const POST = async ({ request, locals }) => {
 		if (isParseError(body)) return body;
 		const role = body.role ?? Role.AUTHOR;
 		const siteName = await new OptionsRepository(emdash.db).get("emdash:site_title") || "EmDash";
-		const baseUrl = await getSiteBaseUrl(emdash.db, request);
+		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
 		const emailSend = emdash.email?.isAvailable() ? (message) => emdash.email.send(message, "system") : void 0;
 		const result = await createInvite({
 			baseUrl,

package/dist/astro/routes/api/auth/invite/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite\n *\n * Create an invite for a new user. Admin only.\n *\n * When an email provider is configured (via the plugin email pipeline),\n * the invite email is sent automatically.\n * When no provider is configured, returns the invite URL for the admin\n * to share manually (copy-link fallback).\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createInvite, InviteError, Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { inviteCreateBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Default to AUTHOR role if not specified (Zod validates the level)\n\t\tconst role = body.role ?? Role.AUTHOR;\n\n\t\t// Get site config for invite email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use stored site URL to prevent Host header spoofing in invite emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request);\n\n\t\t// Build email sender from the plugin pipeline (if available)\n\t\tconst emailSend = emdash.email?.isAvailable()\n\t\t\t? (message: { to: string; subject: string; text: string; html?: string }) =>\n\t\t\t\t\temdash.email!.send(message, \"system\")\n\t\t\t: undefined;\n\n\t\tconst result = await createInvite(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: emailSend,\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email,\n\t\t\trole,\n\t\t\tuser.id,\n\t\t);\n\n\t\tif (emailSend) {\n\t\t\t// Email was sent\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: `Invite sent to ${body.email}`,\n\t\t\t});\n\t\t}\n\n\t\t// No email provider — return the invite URL for manual sharing\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"Invite created. No email provider configured — share the link manually.\",\n\t\t\t\tinviteUrl: result.url,\n\t\t\t},\n\t\t\t200,\n\t\t);\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tuser_exists: 409,\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 400,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to create invite\", \"INVITE_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAaA,MAAa,YAAY;AAWzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,KAAK,QAAQ,KAAK;EAI/B,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EAGrE,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,QAAQ;EAGxD,MAAM,YAAY,OAAO,OAAO,aAAa,IACzC,YACD,OAAO,MAAO,KAAK,SAAS,SAAS,GACrC;EAEH,MAAM,SAAS,MAAM,aACpB;GACC;GACA;GACA,OAAO;GACP,EACD,SACA,KAAK,OACL,MACA,KAAK,GACL;AAED,MAAI,UAEH,QAAO,WAAW;GACjB,SAAS;GACT,SAAS,kBAAkB,KAAK;GAChC,CAAC;AAIH,SAAO,WACN;GACC,SAAS;GACT,SAAS;GACT,WAAW,OAAO;GAClB,EACD,IACA;UACO,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,aAAa;GACb,eAAe;GACf,eAAe;GACf,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,2BAA2B,sBAAsB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite\n *\n * Create an invite for a new user. Admin only.\n *\n * When an email provider is configured (via the plugin email pipeline),\n * the invite email is sent automatically.\n * When no provider is configured, returns the invite URL for the admin\n * to share manually (copy-link fallback).\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createInvite, InviteError, Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { inviteCreateBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Default to AUTHOR role if not specified (Zod validates the level)\n\t\tconst role = body.role ?? Role.AUTHOR;\n\n\t\t// Get site config for invite email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in invite emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\n\t\t// Build email sender from the plugin pipeline (if available)\n\t\tconst emailSend = emdash.email?.isAvailable()\n\t\t\t? (message: { to: string; subject: string; text: string; html?: string }) =>\n\t\t\t\t\temdash.email!.send(message, \"system\")\n\t\t\t: undefined;\n\n\t\tconst result = await createInvite(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: emailSend,\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email,\n\t\t\trole,\n\t\t\tuser.id,\n\t\t);\n\n\t\tif (emailSend) {\n\t\t\t// Email was sent\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: `Invite sent to ${body.email}`,\n\t\t\t});\n\t\t}\n\n\t\t// No email provider — return the invite URL for manual sharing\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"Invite created. No email provider configured — share the link manually.\",\n\t\t\t\tinviteUrl: result.url,\n\t\t\t},\n\t\t\t200,\n\t\t);\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tuser_exists: 409,\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 400,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to create invite\", \"INVITE_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAaA,MAAa,YAAY;AAWzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,KAAK,QAAQ,KAAK;EAI/B,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EAGrE,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EAGvE,MAAM,YAAY,OAAO,OAAO,aAAa,IACzC,YACD,OAAO,MAAO,KAAK,SAAS,SAAS,GACrC;EAEH,MAAM,SAAS,MAAM,aACpB;GACC;GACA;GACA,OAAO;GACP,EACD,SACA,KAAK,OACL,MACA,KAAK,GACL;AAED,MAAI,UAEH,QAAO,WAAW;GACjB,SAAS;GACT,SAAS,kBAAkB,KAAK;GAChC,CAAC;AAIH,SAAO,WACN;GACC,SAAS;GACT,SAAS;GACT,WAAW,OAAO;GAClB,EACD,IACA;UACO,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,aAAa;GACb,eAAe;GACf,eAAe;GACf,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,2BAA2B,sBAAsB"}

package/dist/astro/routes/api/auth/invite/register-options.mjs

@@ -1,16 +1,16 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { j as inviteRegisterOptionsBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { j as inviteRegisterOptionsBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-DSGTnJFw.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-BFzgFRog.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-C-SKpc0-.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Ox9oOlgp.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-D9VNKELo.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-D-zrzMJI.mjs";
 import { ulid } from "ulidx";
 import { InviteError, validateInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";

package/dist/astro/routes/api/auth/logout.mjs

@@ -1,7 +1,7 @@
 import "../../../../base64-B-PsqheR.mjs";
-import "../../../../types-CrRUFdej.mjs";
-import { n as apiSuccess, r as handleError } from "../../../../error-DJ98TRbQ.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-Botom7X6.mjs";
+import "../../../../types-Cd8iuS1J.mjs";
+import { n as apiSuccess, r as handleError } from "../../../../error-oh_9i6bR.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-Egf2R9yP.mjs";
 
 //#region src/astro/routes/api/auth/logout.ts
 const prerender = false;

package/dist/astro/routes/api/auth/magic-link/send.mjs

@@ -1,16 +1,16 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { M as magicLinkSendBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { M as magicLinkSendBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CwjQj0YG.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-NGJT6NTU.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-D3IEiUi2.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-D20_7fyX.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-I-lJ5kma.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-kug6q99V.mjs";
 import { sendMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
@@ -30,7 +30,7 @@ const POST = async ({ request, locals }) => {
 		if (!emdash.email?.isAvailable()) return apiError("EMAIL_NOT_CONFIGURED", "Email is not configured. Magic link authentication requires an email provider.", 503);
 		const options = new OptionsRepository(emdash.db);
 		await sendMagicLink({
-			baseUrl: await getSiteBaseUrl(emdash.db, request),
+			baseUrl: await getSiteBaseUrl(emdash.db, request, emdash.config),
 			siteName: await options.get("emdash:site_title") ?? "EmDash",
 			email: (message) => emdash.email.send(message, "system")
 		}, createKyselyAdapter(emdash.db), body.email.toLowerCase());

package/dist/astro/routes/api/auth/magic-link/send.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using stored site URL (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? \"EmDash\";\n\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAYhD,QAAM,cAR0B;GAC/B,SAJe,MAAM,eAAe,OAAO,IAAI,QAAQ;GAKvD,UAJiB,MAAM,QAAQ,IAAY,oBAAoB,IAAK;GAKpE,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}
+{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? \"EmDash\";\n\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAYhD,QAAM,cAR0B;GAC/B,SAJe,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;GAKtE,UAJiB,MAAM,QAAQ,IAAY,oBAAoB,IAAK;GAKpE,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}

package/dist/astro/routes/api/auth/magic-link/verify.mjs

@@ -1,7 +1,7 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { t as isSafeRedirect } from "../../../../../redirect-Botom7X6.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { t as isSafeRedirect } from "../../../../../redirect-Egf2R9yP.mjs";
 import { MagicLinkError, verifyMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/me.mjs

@@ -1,12 +1,12 @@
 import "../../../../base64-B-PsqheR.mjs";
-import "../../../../types-CrRUFdej.mjs";
-import { t as UserRepository } from "../../../../user-aTXqmXBz.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-53zyxlpv.mjs";
-import "../../../../media-BJ6SRY3g.mjs";
-import "../../../../redirects-D457qwt0.mjs";
-import { O as authMeActionBody } from "../../../../relations-CZMpBqEd.mjs";
-import "../../../../status-COfycGIU.mjs";
+import "../../../../types-Cd8iuS1J.mjs";
+import { t as UserRepository } from "../../../../user-DBrq4UVq.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-CJKNuewM.mjs";
+import "../../../../media-OhYL-7Io.mjs";
+import "../../../../redirects-G8wAhWAf.mjs";
+import { O as authMeActionBody } from "../../../../relations-Bw_E1TXo.mjs";
+import "../../../../status-CIsmlC1E.mjs";
 import "../../../../api/schemas/index.mjs";
 
 //#region src/astro/routes/api/auth/me.ts

package/dist/astro/routes/api/auth/mode.mjs

@@ -1,7 +1,7 @@
 import "../../../../base64-B-PsqheR.mjs";
-import "../../../../types-CrRUFdej.mjs";
-import { n as apiSuccess } from "../../../../error-DJ98TRbQ.mjs";
-import { t as getAuthMode } from "../../../../mode-fiXRMfeA.mjs";
+import "../../../../types-Cd8iuS1J.mjs";
+import { n as apiSuccess } from "../../../../error-oh_9i6bR.mjs";
+import { t as getAuthMode } from "../../../../mode-BWyTBe3I.mjs";
 
 //#region src/astro/routes/api/auth/mode.ts
 const prerender = false;

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs

@@ -1,7 +1,7 @@
-import { t as OptionsRepository } from "../../../../../../options-BlmBHTvX.mjs";
-import { n as getPublicOrigin } from "../../../../../../public-url-DSGTnJFw.mjs";
-import { t as finalizeSetup } from "../../../../../../setup-complete-CdIlqloh.mjs";
-import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-DnvjRMy6.mjs";
+import { t as OptionsRepository } from "../../../../../../options-CBXIHUoT.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-Ox9oOlgp.mjs";
+import { t as finalizeSetup } from "../../../../../../setup-complete-u50Qm8rY.mjs";
+import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-B1ofdTiQ.mjs";
 import { OAuthError, Role, handleOAuthCallback } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/oauth/_provider_.mjs

@@ -1,5 +1,5 @@
-import { n as getPublicOrigin } from "../../../../../public-url-DSGTnJFw.mjs";
-import { t as createOAuthStateStore } from "../../../../../oauth-state-store-DnvjRMy6.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Ox9oOlgp.mjs";
+import { t as createOAuthStateStore } from "../../../../../oauth-state-store-B1ofdTiQ.mjs";
 import { createAuthorizationUrl } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/auth/oauth/[provider].ts

package/dist/astro/routes/api/auth/passkey/_id_.mjs

@@ -1,11 +1,11 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { I as passkeyRenameBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { I as passkeyRenameBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/passkey/index.mjs

@@ -1,6 +1,6 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/passkey/index.ts

package/dist/astro/routes/api/auth/passkey/options.mjs

@@ -1,18 +1,18 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { N as passkeyOptionsBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { N as passkeyOptionsBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CwjQj0YG.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-DSGTnJFw.mjs";
-import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-BFzgFRog.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-C-SKpc0-.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-D3IEiUi2.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-D20_7fyX.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Ox9oOlgp.mjs";
+import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-D9VNKELo.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-D-zrzMJI.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-kug6q99V.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateAuthenticationOptions } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/options.mjs

@@ -1,16 +1,16 @@
 import "../../../../../../base64-B-PsqheR.mjs";
-import "../../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DJ98TRbQ.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-53zyxlpv.mjs";
-import "../../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../../redirects-D457qwt0.mjs";
-import { P as passkeyRegisterOptionsBody } from "../../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../../status-COfycGIU.mjs";
+import "../../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-oh_9i6bR.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-CJKNuewM.mjs";
+import "../../../../../../media-OhYL-7Io.mjs";
+import "../../../../../../redirects-G8wAhWAf.mjs";
+import { P as passkeyRegisterOptionsBody } from "../../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../../status-CIsmlC1E.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../../public-url-DSGTnJFw.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-BFzgFRog.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-C-SKpc0-.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-Ox9oOlgp.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-D9VNKELo.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-D-zrzMJI.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/verify.mjs

@@ -1,17 +1,17 @@
 import "../../../../../../base64-B-PsqheR.mjs";
-import "../../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-53zyxlpv.mjs";
-import "../../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../../redirects-D457qwt0.mjs";
-import { F as passkeyRegisterVerifyBody } from "../../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../../status-COfycGIU.mjs";
+import "../../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-CJKNuewM.mjs";
+import "../../../../../../media-OhYL-7Io.mjs";
+import "../../../../../../redirects-G8wAhWAf.mjs";
+import { F as passkeyRegisterVerifyBody } from "../../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../../status-CIsmlC1E.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../../public-url-DSGTnJFw.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-CCEi9bPI.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-BFzgFRog.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-C-SKpc0-.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-Ox9oOlgp.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-CG1pACtS.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-D9VNKELo.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-D-zrzMJI.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/verify.mjs

@@ -1,17 +1,17 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { L as passkeyVerifyBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { L as passkeyVerifyBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-DSGTnJFw.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CCEi9bPI.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-BFzgFRog.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-C-SKpc0-.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Ox9oOlgp.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CG1pACtS.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-D9VNKELo.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-D-zrzMJI.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { PasskeyAuthenticationError, authenticateWithPasskey } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/signup/complete.mjs

@@ -1,17 +1,17 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { R as signupCompleteBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { R as signupCompleteBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-DSGTnJFw.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CCEi9bPI.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-BFzgFRog.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-C-SKpc0-.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Ox9oOlgp.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CG1pACtS.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-D9VNKELo.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-D-zrzMJI.mjs";
 import { SignupError, completeSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/auth/signup/request.mjs

@@ -1,16 +1,16 @@
 import "../../../../../base64-B-PsqheR.mjs";
-import "../../../../../types-CrRUFdej.mjs";
-import { t as OptionsRepository } from "../../../../../options-BlmBHTvX.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
-import "../../../../../media-BJ6SRY3g.mjs";
-import "../../../../../redirects-D457qwt0.mjs";
-import { z as signupRequestBody } from "../../../../../relations-CZMpBqEd.mjs";
-import "../../../../../status-COfycGIU.mjs";
+import "../../../../../types-Cd8iuS1J.mjs";
+import { t as OptionsRepository } from "../../../../../options-CBXIHUoT.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-oh_9i6bR.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-CJKNuewM.mjs";
+import "../../../../../media-OhYL-7Io.mjs";
+import "../../../../../redirects-G8wAhWAf.mjs";
+import { z as signupRequestBody } from "../../../../../relations-Bw_E1TXo.mjs";
+import "../../../../../status-CIsmlC1E.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CwjQj0YG.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-NGJT6NTU.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-D3IEiUi2.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-D20_7fyX.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-I-lJ5kma.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-kug6q99V.mjs";
 import { requestSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
@@ -32,7 +32,7 @@ const POST = async ({ request, locals }) => {
 		const adapter = createKyselyAdapter(emdash.db);
 		const siteName = await new OptionsRepository(emdash.db).get("emdash:site_title") || "EmDash";
 		await requestSignup({
-			baseUrl: await getSiteBaseUrl(emdash.db, request),
+			baseUrl: await getSiteBaseUrl(emdash.db, request, emdash.config),
 			siteName,
 			email: (message) => emdash.email.send(message, "system")
 		}, adapter, body.email.toLowerCase().trim());