emdash 0.34.0 → 0.36.0

package/src/security/ssrf.ts

@@ -389,6 +389,22 @@ export async function resolveAndValidateExternalUrl(
 	url: string,
 	options?: { resolver?: DnsResolver },
 ): Promise<URL> {
+	return (await resolveAndValidateExternalUrlTarget(url, options)).url;
+}
+
+export interface ResolvedExternalUrlTarget {
+	url: URL;
+	addresses: readonly string[];
+}
+
+/**
+ * Validate a URL and return the exact public addresses approved for the
+ * subsequent connection.
+ */
+export async function resolveAndValidateExternalUrlTarget(
+	url: string,
+	options?: { resolver?: DnsResolver },
+): Promise<ResolvedExternalUrlTarget> {
 	const parsed = validateExternalUrl(url);
 
 	// Strip brackets from IPv6 hostnames
@@ -397,7 +413,7 @@ export async function resolveAndValidateExternalUrl(
 	// If the hostname is already an IP literal, validateExternalUrl has
 	// already checked it against the private-range list. Skip DNS.
 	if (isIpLiteral(hostname)) {
-		return parsed;
+		return { url: parsed, addresses: [hostname] };
 	}
 
 	const resolver = options?.resolver ?? defaultResolver ?? cloudflareDohResolver;
@@ -416,12 +432,15 @@ export async function resolveAndValidateExternalUrl(
 	}
 
 	for (const ip of addresses) {
+		if (!isIpLiteral(ip)) {
+			throw new SsrfError("Hostname resolver returned a non-IP address");
+		}
 		if (isPrivateIp(ip)) {
 			throw new SsrfError("Hostname resolves to a private IP address");
 		}
 	}
 
-	return parsed;
+	return { url: parsed, addresses };
 }
 
 /** True when a string looks like an IPv4 or IPv6 literal. */

package/src/seed/apply.ts

@@ -1419,9 +1419,9 @@ async function resolveMedia(
 		const ext = getExtensionFromContentType(contentType) || getExtensionFromUrl(url) || ".bin";
 
 		// Generate filename and storage key
-		const id = ulid();
+		const storageId = ulid();
 		const finalFilename = filename || generateFilename(url, ext);
-		const storageKey = `${id}${ext}`;
+		const storageKey = `${storageId}${ext}`;
 
 		// Get the body as buffer
 		const arrayBuffer = await response.arrayBuffer();
@@ -1445,7 +1445,7 @@ async function resolveMedia(
 
 		// Create media record
 		const mediaRepo = new MediaRepository(ctx.db);
-		await mediaRepo.create({
+		const media = await mediaRepo.create({
 			filename: finalFilename,
 			mimeType: contentType,
 			size: body.length,
@@ -1460,7 +1460,7 @@ async function resolveMedia(
 		// Create the MediaValue - only store id, URL is built at runtime by EmDashMedia
 		const mediaValue: MediaValue = {
 			provider: "local",
-			id,
+			id: media.id,
 			alt: alt ?? undefined,
 			width,
 			height,

package/src/ui.ts

@@ -45,6 +45,8 @@ export {
 export {
 	// Main Image component for EmDash media
 	EmDashImage as Image,
+	// Unified media component that delegates rendering to the provider's getEmbed()
+	EmDashMedia as Media,
 	// Main component (wrapper with EmDash defaults)
 	PortableText,
 	// Block style override (paragraph/heading/blockquote — emits

package/src/virtual-modules.d.ts

@@ -16,6 +16,7 @@ declare module "virtual:emdash/config" {
 
 	interface VirtualConfig {
 		database?: DatabaseDescriptor;
+		migrations?: import("./database/migrations/policy.js").RuntimeMigrationConfig;
 		storage?: StorageDescriptor;
 		auth?: AuthDescriptor;
 		authProviders?: AuthProviderDescriptor[];
@@ -54,6 +55,13 @@ declare module "virtual:emdash/dialect" {
 	export interface RequestScopedDbOpts {
 		config: unknown;
 		isAuthenticated: boolean;
+		/**
+		 * Evaluated at commit() time: whether the request ended authenticated.
+		 * Login/signup/invite requests start unauthenticated and establish a
+		 * session mid-request; `isAuthenticated` captures only the request-start
+		 * state.
+		 */
+		endedAuthenticated?: () => boolean;
 		isWrite: boolean;
 		/** Whether core routing allows this request to use an anonymous public-read cache. */
 		canUseCachedBinding?: boolean;

package/dist/adapters-34EN2eXO.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapters-34EN2eXO.d.mts","names":[],"sources":["../src/db/adapters.ts"],"mappings":";;AA0BA;;;;;AAEA;;;;;;;;;;;;;;;AAeA;;;;AAAA,KAjBY,mBAAA;AAAA,KAEA,4BAAA;EAET,MAAA;EACA,YAAA;EACA,cAAA;EACA,UAAA;EACA,WAAA;AAAA;EAGA,MAAA;EACA,YAAA;EACA,cAAA;EACA,UAAA;AAAA;AAAA,KAGS,6BAAA;EACP,OAAA;AAAA;EACA,OAAA;AAAA;EACA,OAAA;AAAA;EACA,OAAA;AAAA;AAAA,KAEO,8BAAA,IACX,MAAA,WACA,KAAA,EAAO,4BAAA,KACH,OAAA,CAAQ,6BAAA;;;;UAKI,kBAAA;EAChB,UAAA;EACA,MAAA;EACA,IAAA,EAAM,mBAAA;EAuBN;;;;;AAcD;;;;;AAOA;;;;EA7BC,oBAAA;EAkDe;;;;;;;EA1Cf,uBAAA;EA0C+D;AAqBhE;;;;;;;EAtDC,kBAAA;EAsD+D;EApD/D,+BAAA;AAAA;AAAA,UAGgB,YAAA;EA4Dc;;;EAxD9B,GAAA;AAAA;AAAA,UAGgB,YAAA;EA2DhB;;;EAvDA,GAAA;EAyDuB;;;EArDvB,SAAA;AAAA;;;;;;;;;;;iBAae,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;;;;;;;;;;;iBAqB9B,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;UAW7B,cAAA;EAChB,gBAAA;EACA,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,GAAA;EACA,IAAA;IAAS,GAAA;IAAc,GAAA;EAAA;AAAA;;;;;;;;;;;iBAaR,QAAA,CAAS,MAAA,EAAQ,cAAA,GAAiB,kBAAA"}