emdash 0.39.0 → 0.40.0

package/dist/astro/routes/api/media/file/_...key_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL } from \"#media/image-endpoint.js\";\n\nexport const prerender = false;\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\t// Backup archives share the storage bucket but hold the site's full\n\t// content export — they must never be reachable through the public,\n\t// unauthenticated media route. Admins download them via the\n\t// authenticated backups API.\n\tif (key.startsWith(\"backups/\")) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst result = await emdash.storage.download(key);\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": result.contentType.startsWith(\"image/\")\n\t\t\t\t? MUTABLE_MEDIA_CACHE_CONTROL\n\t\t\t\t: IMMUTABLE_IMAGE_CACHE,\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t};\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tif (SAFE_INLINE_TYPES.has(result.contentType)) {\n\t\t\theaders[\"Content-Disposition\"] = \"inline\";\n\t\t} else {\n\t\t\theaders[\"Content-Disposition\"] = \"attachment\";\n\t\t}\n\n\t\treturn new Response(result.body, { status: 200, headers });\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;AAWA,MAAa,YAAY;;;;;AAMzB,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAOpD,KAAI,IAAI,WAAW,WAAW,CAC7B,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAGjE,KAAI;EACH,MAAM,SAAS,MAAM,OAAO,QAAQ,SAAS,IAAI;EAEjD,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB,OAAO,YAAY,WAAW,SAAS,GACrD,8BACA;GACH,0BAA0B;GAG1B,2BACC;GACD;AAED,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;AAKhD,MAAI,kBAAkB,IAAI,OAAO,YAAY,CAC5C,SAAQ,yBAAyB;MAEjC,SAAQ,yBAAyB;AAGlC,SAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;UAClD,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB"}
+{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL } from \"#media/image-endpoint.js\";\n\nimport { isRefusedStorageKey } from \"../../../../../transfer/staging/keys.js\";\n\nexport const prerender = false;\n\nconst MAX_KEY_DECODES = 3;\n\n/**\n * Whether a key is, or percent-decodes to, a key this route must refuse.\n * Every decoding layer is checked because storage backends differ in whether\n * they decode keys; a key that is still encoded after the last layer, or\n * does not decode, is refused.\n */\nfunction isPrivateMediaKey(key: string): boolean {\n\tlet candidate = key;\n\tfor (let layer = 0; layer <= MAX_KEY_DECODES; layer++) {\n\t\tif (isRefusedStorageKey(candidate)) return true;\n\t\tlet decoded: string;\n\t\ttry {\n\t\t\tdecoded = decodeURIComponent(candidate);\n\t\t} catch {\n\t\t\treturn true;\n\t\t}\n\t\tif (decoded === candidate) return false;\n\t\tcandidate = decoded;\n\t}\n\treturn true;\n}\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\t// Backup archives and transfer staging share the storage bucket but hold\n\t// whole-site content; they must never be reachable through this public,\n\t// unauthenticated route.\n\tif (isPrivateMediaKey(key)) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst result = await emdash.storage.download(key);\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": result.contentType.startsWith(\"image/\")\n\t\t\t\t? MUTABLE_MEDIA_CACHE_CONTROL\n\t\t\t\t: IMMUTABLE_IMAGE_CACHE,\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t};\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tif (SAFE_INLINE_TYPES.has(result.contentType)) {\n\t\t\theaders[\"Content-Disposition\"] = \"inline\";\n\t\t} else {\n\t\t\theaders[\"Content-Disposition\"] = \"attachment\";\n\t\t}\n\n\t\treturn new Response(result.body, { status: 200, headers });\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,YAAY;AAEzB,MAAM,kBAAkB;;;;;;;AAQxB,SAAS,kBAAkB,KAAsB;CAChD,IAAI,YAAY;AAChB,MAAK,IAAI,QAAQ,GAAG,SAAS,iBAAiB,SAAS;AACtD,MAAI,oBAAoB,UAAU,CAAE,QAAO;EAC3C,IAAI;AACJ,MAAI;AACH,aAAU,mBAAmB,UAAU;UAChC;AACP,UAAO;;AAER,MAAI,YAAY,UAAW,QAAO;AAClC,cAAY;;AAEb,QAAO;;;;;;AAOR,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAMpD,KAAI,kBAAkB,IAAI,CACzB,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAGjE,KAAI;EACH,MAAM,SAAS,MAAM,OAAO,QAAQ,SAAS,IAAI;EAEjD,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB,OAAO,YAAY,WAAW,SAAS,GACrD,8BACA;GACH,0BAA0B;GAG1B,2BACC;GACD;AAED,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;AAKhD,MAAI,kBAAkB,IAAI,OAAO,YAAY,CAC5C,SAAQ,yBAAyB;MAEjC,SAAQ,yBAAyB;AAGlC,SAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;UAClD,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB"}

package/dist/astro/routes/api/media/folders/_id_.mjs

@@ -1,16 +1,22 @@
-import "../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { a as handleMediaFolderUpdate, n as handleMediaFolderDelete, r as handleMediaFolderGet } from "../../../../../media-folders-ClIRLUQv.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import "../../../../../redirects-BCiTaIQ-.mjs";
-import { It as mediaFolderBody, Lt as mediaFolderIdSchema } from "../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import { a as handleMediaFolderUpdate, n as handleMediaFolderDelete, r as handleMediaFolderGet } from "../../../../../media-folders-BE0oo2eX.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import { c as mediaFolderBody, l as mediaFolderIdSchema } from "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/media/folders/[id].ts
 const prerender = false;

package/dist/astro/routes/api/media/folders/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/folders/[id].ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleMediaFolderDelete,\n\thandleMediaFolderGet,\n\thandleMediaFolderUpdate,\n} from \"#api/handlers/media-folders.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { mediaFolderBody, mediaFolderIdSchema } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nfunction parseFolderId(id: string | undefined): string | Response {\n\tconst result = mediaFolderIdSchema.safeParse(id);\n\treturn result.success\n\t\t? result.data\n\t\t: apiError(\"VALIDATION_ERROR\", \"Invalid media folder ID\", 400);\n}\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst id = parseFolderId(params.id);\n\tif (id instanceof Response) return id;\n\treturn unwrapResult(await handleMediaFolderGet(emdash.db, id));\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:edit_any\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst id = parseFolderId(params.id);\n\tif (id instanceof Response) return id;\n\tconst body = await parseBody(request, mediaFolderBody);\n\tif (isParseError(body)) return body;\n\treturn unwrapResult(await handleMediaFolderUpdate(emdash.db, id, body));\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:edit_any\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst id = parseFolderId(params.id);\n\tif (id instanceof Response) return id;\n\treturn unwrapResult(await handleMediaFolderDelete(emdash.db, id));\n};\n"],"mappings":";;;;;;;;;;;;;;;AAYA,MAAa,YAAY;AAEzB,SAAS,cAAc,IAA2C;CACjE,MAAM,SAAS,oBAAoB,UAAU,GAAG;AAChD,QAAO,OAAO,UACX,OAAO,OACP,SAAS,oBAAoB,2BAA2B,IAAI;;AAGhE,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,KAAK,cAAc,OAAO,GAAG;AACnC,KAAI,cAAc,SAAU,QAAO;AACnC,QAAO,aAAa,MAAM,qBAAqB,OAAO,IAAI,GAAG,CAAC;;AAG/D,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,KAAK,cAAc,OAAO,GAAG;AACnC,KAAI,cAAc,SAAU,QAAO;CACnC,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,KAAI,aAAa,KAAK,CAAE,QAAO;AAC/B,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,IAAI,KAAK,CAAC;;AAGxE,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,KAAK,cAAc,OAAO,GAAG;AACnC,KAAI,cAAc,SAAU,QAAO;AACnC,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,GAAG,CAAC"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/folders/[id].ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleMediaFolderDelete,\n\thandleMediaFolderGet,\n\thandleMediaFolderUpdate,\n} from \"#api/handlers/media-folders.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { mediaFolderBody, mediaFolderIdSchema } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nfunction parseFolderId(id: string | undefined): string | Response {\n\tconst result = mediaFolderIdSchema.safeParse(id);\n\treturn result.success\n\t\t? result.data\n\t\t: apiError(\"VALIDATION_ERROR\", \"Invalid media folder ID\", 400);\n}\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst id = parseFolderId(params.id);\n\tif (id instanceof Response) return id;\n\treturn unwrapResult(await handleMediaFolderGet(emdash.db, id));\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:edit_any\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst id = parseFolderId(params.id);\n\tif (id instanceof Response) return id;\n\tconst body = await parseBody(request, mediaFolderBody);\n\tif (isParseError(body)) return body;\n\treturn unwrapResult(await handleMediaFolderUpdate(emdash.db, id, body));\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:edit_any\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst id = parseFolderId(params.id);\n\tif (id instanceof Response) return id;\n\treturn unwrapResult(await handleMediaFolderDelete(emdash.db, id));\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYA,MAAa,YAAY;AAEzB,SAAS,cAAc,IAA2C;CACjE,MAAM,SAAS,oBAAoB,UAAU,GAAG;AAChD,QAAO,OAAO,UACX,OAAO,OACP,SAAS,oBAAoB,2BAA2B,IAAI;;AAGhE,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,KAAK,cAAc,OAAO,GAAG;AACnC,KAAI,cAAc,SAAU,QAAO;AACnC,QAAO,aAAa,MAAM,qBAAqB,OAAO,IAAI,GAAG,CAAC;;AAG/D,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,KAAK,cAAc,OAAO,GAAG;AACnC,KAAI,cAAc,SAAU,QAAO;CACnC,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,KAAI,aAAa,KAAK,CAAE,QAAO;AAC/B,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,IAAI,KAAK,CAAC;;AAGxE,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,KAAK,cAAc,OAAO,GAAG;AACnC,KAAI,cAAc,SAAU,QAAO;AACnC,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,GAAG,CAAC"}

package/dist/astro/routes/api/media/folders/index.mjs

@@ -1,16 +1,22 @@
-import "../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { i as handleMediaFolderList, t as handleMediaFolderCreate } from "../../../../../media-folders-ClIRLUQv.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import "../../../../../redirects-BCiTaIQ-.mjs";
-import { It as mediaFolderBody, Rt as mediaFolderListQuery } from "../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import { i as handleMediaFolderList, t as handleMediaFolderCreate } from "../../../../../media-folders-BE0oo2eX.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import { c as mediaFolderBody, u as mediaFolderListQuery } from "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/media/folders/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/folders/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/folders/index.ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaFolderCreate, handleMediaFolderList } from \"#api/handlers/media-folders.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { mediaFolderBody, mediaFolderListQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst query = parseQuery(new URL(request.url), mediaFolderListQuery);\n\tif (isParseError(query)) return query;\n\treturn unwrapResult(\n\t\tawait handleMediaFolderList(emdash.db, {\n\t\t\tlimit: query.limit,\n\t\t\tcursor: query.cursor,\n\t\t\tq: query.q,\n\t\t}),\n\t);\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:edit_any\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst body = await parseBody(request, mediaFolderBody);\n\tif (isParseError(body)) return body;\n\treturn unwrapResult(await handleMediaFolderCreate(emdash.db, body), 201);\n};\n"],"mappings":";;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,qBAAqB;AACpE,KAAI,aAAa,MAAM,CAAE,QAAO;AAChC,QAAO,aACN,MAAM,sBAAsB,OAAO,IAAI;EACtC,OAAO,MAAM;EACb,QAAQ,MAAM;EACd,GAAG,MAAM;EACT,CAAC,CACF;;AAGF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,KAAI,aAAa,KAAK,CAAE,QAAO;AAC/B,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,KAAK,EAAE,IAAI"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/folders/index.ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaFolderCreate, handleMediaFolderList } from \"#api/handlers/media-folders.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { mediaFolderBody, mediaFolderListQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst query = parseQuery(new URL(request.url), mediaFolderListQuery);\n\tif (isParseError(query)) return query;\n\treturn unwrapResult(\n\t\tawait handleMediaFolderList(emdash.db, {\n\t\t\tlimit: query.limit,\n\t\t\tcursor: query.cursor,\n\t\t\tq: query.q,\n\t\t}),\n\t);\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:edit_any\");\n\tif (denied) return denied;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst body = await parseBody(request, mediaFolderBody);\n\tif (isParseError(body)) return body;\n\treturn unwrapResult(await handleMediaFolderCreate(emdash.db, body), 201);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,qBAAqB;AACpE,KAAI,aAAa,MAAM,CAAE,QAAO;AAChC,QAAO,aACN,MAAM,sBAAsB,OAAO,IAAI;EACtC,OAAO,MAAM;EACb,QAAQ,MAAM;EACd,GAAG,MAAM;EACT,CAAC,CACF;;AAGF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,KAAI,aAAa,KAAK,CAAE,QAAO;AAC/B,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,KAAK,EAAE,IAAI"}

package/dist/astro/routes/api/media/providers/_providerId_/_itemId_.mjs

@@ -1,7 +1,9 @@
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { i as requirePerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/media/providers/[providerId]/[itemId].ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/_providerId_/_itemId_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_itemId_.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/media/providers/[providerId]/[itemId].ts"],"sourcesContent":["/**\n * Media Provider Item Endpoint\n *\n * GET /_emdash/api/media/providers/:providerId/:itemId - Get single item\n * DELETE /_emdash/api/media/providers/:providerId/:itemId - Delete item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * Get a single media item from a provider\n */\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\tconst { providerId, itemId } = params;\n\n\tif (!providerId || !itemId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID and Item ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tif (!provider.get) {\n\t\treturn apiError(\n\t\t\t\"NOT_SUPPORTED\",\n\t\t\t`Provider \"${providerId}\" does not support getting individual items`,\n\t\t\t400,\n\t\t);\n\t}\n\n\ttry {\n\t\tconst item = await provider.get(itemId);\n\n\t\tif (!item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Item not found\", 404);\n\t\t}\n\n\t\treturn apiSuccess({ item });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get item from provider\", \"PROVIDER_GET_ERROR\");\n\t}\n};\n\n/**\n * Delete a media item from a provider\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:delete_any\");\n\tif (denied) return denied;\n\tconst { providerId, itemId } = params;\n\n\tif (!providerId || !itemId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID and Item ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tif (!provider.delete) {\n\t\treturn apiError(\"NOT_SUPPORTED\", `Provider \"${providerId}\" does not support deletion`, 400);\n\t}\n\n\ttry {\n\t\tawait provider.delete(itemId);\n\n\t\treturn apiSuccess({ deleted: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete item from provider\", \"PROVIDER_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;AAYA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CACnB,MAAM,EAAE,YAAY,WAAW;AAE/B,KAAI,CAAC,cAAc,CAAC,OACnB,QAAO,SAAS,mBAAmB,oCAAoC,IAAI;AAG5E,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;AAGxE,KAAI,CAAC,SAAS,IACb,QAAO,SACN,iBACA,aAAa,WAAW,8CACxB,IACA;AAGF,KAAI;EACH,MAAM,OAAO,MAAM,SAAS,IAAI,OAAO;AAEvC,MAAI,CAAC,KACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,SAAO,WAAW,EAAE,MAAM,CAAC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,oCAAoC,qBAAqB;;;;;;AAOrF,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,mBAAmB;AACpD,KAAI,OAAQ,QAAO;CACnB,MAAM,EAAE,YAAY,WAAW;AAE/B,KAAI,CAAC,cAAc,CAAC,OACnB,QAAO,SAAS,mBAAmB,oCAAoC,IAAI;AAG5E,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;AAGxE,KAAI,CAAC,SAAS,OACb,QAAO,SAAS,iBAAiB,aAAa,WAAW,8BAA8B,IAAI;AAG5F,KAAI;AACH,QAAM,SAAS,OAAO,OAAO;AAE7B,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,uCAAuC,wBAAwB"}
+{"version":3,"file":"_itemId_.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/media/providers/[providerId]/[itemId].ts"],"sourcesContent":["/**\n * Media Provider Item Endpoint\n *\n * GET /_emdash/api/media/providers/:providerId/:itemId - Get single item\n * DELETE /_emdash/api/media/providers/:providerId/:itemId - Delete item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * Get a single media item from a provider\n */\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\tconst { providerId, itemId } = params;\n\n\tif (!providerId || !itemId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID and Item ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tif (!provider.get) {\n\t\treturn apiError(\n\t\t\t\"NOT_SUPPORTED\",\n\t\t\t`Provider \"${providerId}\" does not support getting individual items`,\n\t\t\t400,\n\t\t);\n\t}\n\n\ttry {\n\t\tconst item = await provider.get(itemId);\n\n\t\tif (!item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Item not found\", 404);\n\t\t}\n\n\t\treturn apiSuccess({ item });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get item from provider\", \"PROVIDER_GET_ERROR\");\n\t}\n};\n\n/**\n * Delete a media item from a provider\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"media:delete_any\");\n\tif (denied) return denied;\n\tconst { providerId, itemId } = params;\n\n\tif (!providerId || !itemId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID and Item ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tif (!provider.delete) {\n\t\treturn apiError(\"NOT_SUPPORTED\", `Provider \"${providerId}\" does not support deletion`, 400);\n\t}\n\n\ttry {\n\t\tawait provider.delete(itemId);\n\n\t\treturn apiSuccess({ deleted: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete item from provider\", \"PROVIDER_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;AAYA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CACnB,MAAM,EAAE,YAAY,WAAW;AAE/B,KAAI,CAAC,cAAc,CAAC,OACnB,QAAO,SAAS,mBAAmB,oCAAoC,IAAI;AAG5E,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;AAGxE,KAAI,CAAC,SAAS,IACb,QAAO,SACN,iBACA,aAAa,WAAW,8CACxB,IACA;AAGF,KAAI;EACH,MAAM,OAAO,MAAM,SAAS,IAAI,OAAO;AAEvC,MAAI,CAAC,KACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,SAAO,WAAW,EAAE,MAAM,CAAC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,oCAAoC,qBAAqB;;;;;;AAOrF,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,mBAAmB;AACpD,KAAI,OAAQ,QAAO;CACnB,MAAM,EAAE,YAAY,WAAW;AAE/B,KAAI,CAAC,cAAc,CAAC,OACnB,QAAO,SAAS,mBAAmB,oCAAoC,IAAI;AAG5E,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;AAGxE,KAAI,CAAC,SAAS,OACb,QAAO,SAAS,iBAAiB,aAAa,WAAW,8BAA8B,IAAI;AAG5F,KAAI;AACH,QAAM,SAAS,OAAO,OAAO;AAE7B,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,uCAAuC,wBAAwB"}

package/dist/astro/routes/api/media/providers/_providerId_/index.mjs

@@ -1,7 +1,9 @@
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { i as requirePerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/media/providers/[providerId]/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/_providerId_/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/media/providers/[providerId]/index.ts"],"sourcesContent":["/**\n * Media Provider List/Upload Endpoint\n *\n * GET /_emdash/api/media/providers/:providerId - List media from provider\n * POST /_emdash/api/media/providers/:providerId - Upload to provider\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * List media from a specific provider\n */\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { providerId } = params;\n\n\tconst readDenied = requirePerm(user, \"media:read\");\n\tif (readDenied) return readDenied;\n\n\tif (!providerId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst cursor = url.searchParams.get(\"cursor\") || undefined;\n\tconst rawLimit = url.searchParams.get(\"limit\");\n\tconst limit = rawLimit ? Math.max(1, Math.min(parseInt(rawLimit, 10) || 50, 100)) : undefined;\n\tconst query = url.searchParams.get(\"query\") || undefined;\n\tconst mimeType = url.searchParams.get(\"mimeType\") || undefined;\n\n\ttry {\n\t\tconst result = await provider.list({\n\t\t\tcursor,\n\t\t\tlimit,\n\t\t\tquery,\n\t\t\tmimeType,\n\t\t});\n\n\t\treturn apiSuccess({\n\t\t\titems: result.items,\n\t\t\tnextCursor: result.nextCursor,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list media from provider\", \"PROVIDER_LIST_ERROR\");\n\t}\n};\n\n/**\n * Upload media to a specific provider\n */\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { providerId } = params;\n\n\tconst uploadDenied = requirePerm(user, \"media:upload\");\n\tif (uploadDenied) return uploadDenied;\n\n\tif (!providerId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tif (!provider.upload) {\n\t\treturn apiError(\"NOT_SUPPORTED\", `Provider \"${providerId}\" does not support uploads`, 400);\n\t}\n\n\ttry {\n\t\tconst formData = await request.formData();\n\t\tconst fileEntry = formData.get(\"file\");\n\t\tconst file = fileEntry instanceof File ? fileEntry : null;\n\t\tconst altEntry = formData.get(\"alt\");\n\t\tconst alt = typeof altEntry === \"string\" ? altEntry : null;\n\n\t\tif (!file) {\n\t\t\treturn apiError(\"NO_FILE\", \"No file provided\", 400);\n\t\t}\n\n\t\t// Basic size validation (default 50MB, configurable via maxUploadSize)\n\t\tconst maxSize = emdash.config?.maxUploadSize ?? 50 * 1024 * 1024;\n\t\tif (file.size > maxSize) {\n\t\t\treturn apiError(\n\t\t\t\t\"FILE_TOO_LARGE\",\n\t\t\t\t`File exceeds maximum size of ${Math.round(maxSize / 1024 / 1024)}MB`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\n\t\tconst item = await provider.upload({\n\t\t\tfile,\n\t\t\tfilename: file.name,\n\t\t\talt: alt || undefined,\n\t\t});\n\n\t\treturn apiSuccess({ item }, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to upload to provider\", \"PROVIDER_UPLOAD_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;AAYA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,eAAe;CAEvB,MAAM,aAAa,YAAY,MAAM,aAAa;AAClD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,WACJ,QAAO,SAAS,mBAAmB,wBAAwB,IAAI;AAGhE,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;CAGxE,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CACjD,MAAM,WAAW,IAAI,aAAa,IAAI,QAAQ;CAC9C,MAAM,QAAQ,WAAW,KAAK,IAAI,GAAG,KAAK,IAAI,SAAS,UAAU,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG;CACpF,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ,IAAI;CAC/C,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW,IAAI;AAErD,KAAI;EACH,MAAM,SAAS,MAAM,SAAS,KAAK;GAClC;GACA;GACA;GACA;GACA,CAAC;AAEF,SAAO,WAAW;GACjB,OAAO,OAAO;GACd,YAAY,OAAO;GACnB,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,sBAAsB;;;;;;AAOxF,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,eAAe;CAEvB,MAAM,eAAe,YAAY,MAAM,eAAe;AACtD,KAAI,aAAc,QAAO;AAEzB,KAAI,CAAC,WACJ,QAAO,SAAS,mBAAmB,wBAAwB,IAAI;AAGhE,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;AAGxE,KAAI,CAAC,SAAS,OACb,QAAO,SAAS,iBAAiB,aAAa,WAAW,6BAA6B,IAAI;AAG3F,KAAI;EACH,MAAM,WAAW,MAAM,QAAQ,UAAU;EACzC,MAAM,YAAY,SAAS,IAAI,OAAO;EACtC,MAAM,OAAO,qBAAqB,OAAO,YAAY;EACrD,MAAM,WAAW,SAAS,IAAI,MAAM;EACpC,MAAM,MAAM,OAAO,aAAa,WAAW,WAAW;AAEtD,MAAI,CAAC,KACJ,QAAO,SAAS,WAAW,oBAAoB,IAAI;EAIpD,MAAM,UAAU,OAAO,QAAQ,iBAAiB,KAAK,OAAO;AAC5D,MAAI,KAAK,OAAO,QACf,QAAO,SACN,kBACA,gCAAgC,KAAK,MAAM,UAAU,OAAO,KAAK,CAAC,KAClE,IACA;AASF,SAAO,WAAW,EAAE,MANP,MAAM,SAAS,OAAO;GAClC;GACA,UAAU,KAAK;GACf,KAAK,OAAO;GACZ,CAAC,EAEwB,EAAE,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,wBAAwB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/media/providers/[providerId]/index.ts"],"sourcesContent":["/**\n * Media Provider List/Upload Endpoint\n *\n * GET /_emdash/api/media/providers/:providerId - List media from provider\n * POST /_emdash/api/media/providers/:providerId - Upload to provider\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * List media from a specific provider\n */\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { providerId } = params;\n\n\tconst readDenied = requirePerm(user, \"media:read\");\n\tif (readDenied) return readDenied;\n\n\tif (!providerId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst cursor = url.searchParams.get(\"cursor\") || undefined;\n\tconst rawLimit = url.searchParams.get(\"limit\");\n\tconst limit = rawLimit ? Math.max(1, Math.min(parseInt(rawLimit, 10) || 50, 100)) : undefined;\n\tconst query = url.searchParams.get(\"query\") || undefined;\n\tconst mimeType = url.searchParams.get(\"mimeType\") || undefined;\n\n\ttry {\n\t\tconst result = await provider.list({\n\t\t\tcursor,\n\t\t\tlimit,\n\t\t\tquery,\n\t\t\tmimeType,\n\t\t});\n\n\t\treturn apiSuccess({\n\t\t\titems: result.items,\n\t\t\tnextCursor: result.nextCursor,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list media from provider\", \"PROVIDER_LIST_ERROR\");\n\t}\n};\n\n/**\n * Upload media to a specific provider\n */\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { providerId } = params;\n\n\tconst uploadDenied = requirePerm(user, \"media:upload\");\n\tif (uploadDenied) return uploadDenied;\n\n\tif (!providerId) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Provider ID required\", 400);\n\t}\n\n\tif (!emdash?.getMediaProvider) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst provider = emdash.getMediaProvider(providerId);\n\tif (!provider) {\n\t\treturn apiError(\"NOT_FOUND\", `Provider \"${providerId}\" not found`, 404);\n\t}\n\n\tif (!provider.upload) {\n\t\treturn apiError(\"NOT_SUPPORTED\", `Provider \"${providerId}\" does not support uploads`, 400);\n\t}\n\n\ttry {\n\t\tconst formData = await request.formData();\n\t\tconst fileEntry = formData.get(\"file\");\n\t\tconst file = fileEntry instanceof File ? fileEntry : null;\n\t\tconst altEntry = formData.get(\"alt\");\n\t\tconst alt = typeof altEntry === \"string\" ? altEntry : null;\n\n\t\tif (!file) {\n\t\t\treturn apiError(\"NO_FILE\", \"No file provided\", 400);\n\t\t}\n\n\t\t// Basic size validation (default 50MB, configurable via maxUploadSize)\n\t\tconst maxSize = emdash.config?.maxUploadSize ?? 50 * 1024 * 1024;\n\t\tif (file.size > maxSize) {\n\t\t\treturn apiError(\n\t\t\t\t\"FILE_TOO_LARGE\",\n\t\t\t\t`File exceeds maximum size of ${Math.round(maxSize / 1024 / 1024)}MB`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\n\t\tconst item = await provider.upload({\n\t\t\tfile,\n\t\t\tfilename: file.name,\n\t\t\talt: alt || undefined,\n\t\t});\n\n\t\treturn apiSuccess({ item }, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to upload to provider\", \"PROVIDER_UPLOAD_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;AAYA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,eAAe;CAEvB,MAAM,aAAa,YAAY,MAAM,aAAa;AAClD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,WACJ,QAAO,SAAS,mBAAmB,wBAAwB,IAAI;AAGhE,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;CAGxE,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CACjD,MAAM,WAAW,IAAI,aAAa,IAAI,QAAQ;CAC9C,MAAM,QAAQ,WAAW,KAAK,IAAI,GAAG,KAAK,IAAI,SAAS,UAAU,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG;CACpF,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ,IAAI;CAC/C,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW,IAAI;AAErD,KAAI;EACH,MAAM,SAAS,MAAM,SAAS,KAAK;GAClC;GACA;GACA;GACA;GACA,CAAC;AAEF,SAAO,WAAW;GACjB,OAAO,OAAO;GACd,YAAY,OAAO;GACnB,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,sBAAsB;;;;;;AAOxF,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,eAAe;CAEvB,MAAM,eAAe,YAAY,MAAM,eAAe;AACtD,KAAI,aAAc,QAAO;AAEzB,KAAI,CAAC,WACJ,QAAO,SAAS,mBAAmB,wBAAwB,IAAI;AAGhE,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,OAAO,iBAAiB,WAAW;AACpD,KAAI,CAAC,SACJ,QAAO,SAAS,aAAa,aAAa,WAAW,cAAc,IAAI;AAGxE,KAAI,CAAC,SAAS,OACb,QAAO,SAAS,iBAAiB,aAAa,WAAW,6BAA6B,IAAI;AAG3F,KAAI;EACH,MAAM,WAAW,MAAM,QAAQ,UAAU;EACzC,MAAM,YAAY,SAAS,IAAI,OAAO;EACtC,MAAM,OAAO,qBAAqB,OAAO,YAAY;EACrD,MAAM,WAAW,SAAS,IAAI,MAAM;EACpC,MAAM,MAAM,OAAO,aAAa,WAAW,WAAW;AAEtD,MAAI,CAAC,KACJ,QAAO,SAAS,WAAW,oBAAoB,IAAI;EAIpD,MAAM,UAAU,OAAO,QAAQ,iBAAiB,KAAK,OAAO;AAC5D,MAAI,KAAK,OAAO,QACf,QAAO,SACN,kBACA,gCAAgC,KAAK,MAAM,UAAU,OAAO,KAAK,CAAC,KAClE,IACA;AASF,SAAO,WAAW,EAAE,MANP,MAAM,SAAS,OAAO;GAClC;GACA,UAAU,KAAK;GACf,KAAK,OAAO;GACZ,CAAC,EAEwB,EAAE,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,wBAAwB"}

package/dist/astro/routes/api/media/providers/index.mjs

@@ -1,7 +1,9 @@
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { r as requirePerm } from "../../../../../authorize-BXpfMpp0.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/media/providers/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/providers/index.ts"],"sourcesContent":["/**\n * Media Providers List Endpoint\n *\n * GET /_emdash/api/media/providers - List all configured media providers\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * List all configured media providers\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.getMediaProviderList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst providers = emdash.getMediaProviderList();\n\n\treturn apiSuccess({ items: providers });\n};\n"],"mappings":";;;;;;AAWA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,qBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAKpE,QAAO,WAAW,EAAE,OAFF,OAAO,sBAAsB,EAET,CAAC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/providers/index.ts"],"sourcesContent":["/**\n * Media Providers List Endpoint\n *\n * GET /_emdash/api/media/providers - List all configured media providers\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\n\nexport const prerender = false;\n\n/**\n * List all configured media providers\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.getMediaProviderList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst providers = emdash.getMediaProviderList();\n\n\treturn apiSuccess({ items: providers });\n};\n"],"mappings":";;;;;;;;AAWA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,qBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAKpE,QAAO,WAAW,EAAE,OAFF,OAAO,sBAAsB,EAET,CAAC"}

package/dist/astro/routes/api/media/upload-url.mjs

@@ -1,18 +1,24 @@
-import "../../../../config-CGVeT8Hc.mjs";
+import "../../../../config-CvmjJcVw.mjs";
 import "../../../../base64-DvnNgP7e.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import { t as MediaRepository } from "../../../../media-TBlKCwo7.mjs";
-import { n as normalizeMime, t as matchesMimeAllowlist } from "../../../../mime-CCYRC4r1.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-Cr379Av9.mjs";
-import "../../../../redirects-BCiTaIQ-.mjs";
-import { At as DEFAULT_MAX_UPLOAD_SIZE, on as mediaUploadUrlBody } from "../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../comments-BVzzt6x5.mjs";
-import "../../../../relations-B4w-G5U9.mjs";
-import "../../../../status-DLoBmcDz.mjs";
+import { t as MediaRepository } from "../../../../media-Qp5S3eH3.mjs";
+import { n as normalizeMime, t as matchesMimeAllowlist } from "../../../../mime-ChLqYwDk.mjs";
+import "../../../../errors-DgE1zJGG.mjs";
+import "../../../../settings-DYidIB26.mjs";
+import "../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-DY6OD1j_.mjs";
+import "../../../../redirects-Cv9apQKj.mjs";
+import "../../../../entry-lock-BJYdBfXb.mjs";
+import { M as mediaUploadUrlBody, n as DEFAULT_MAX_UPLOAD_SIZE } from "../../../../media-Pu1L6xir.mjs";
+import "../../../../comments-fHZ8ON9O.mjs";
+import "../../../../relations-CK9CYUyr.mjs";
+import "../../../../menus-BM7BPLOb.mjs";
+import "../../../../status-DZKIG4a9.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../../media-allowlist-s60eAIf6.mjs";
-import { r as requirePerm } from "../../../../authorize-BXpfMpp0.mjs";
+import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../../media-allowlist-BSoa9Vvm.mjs";
+import { i as requirePerm } from "../../../../authorize-seCifOMJ.mjs";
 import { ulid } from "ulidx";
 import * as path from "node:path";
 

package/dist/astro/routes/api/media/upload-url.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"upload-url.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/upload-url.ts"],"sourcesContent":["/**\n * Media upload URL endpoint\n *\n * POST /_emdash/api/media/upload-url\n *\n * Returns a signed URL for direct upload to storage.\n * Creates a pending media record that must be confirmed after upload.\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\n\nexport const prerender = false;\n\ninterface UploadUrlResponse {\n\tuploadUrl: string;\n\tmethod: \"PUT\";\n\theaders: Record<string, string>;\n\tmediaId: string;\n\tstorageKey: string;\n\texpiresAt: string;\n}\n\n/** Response when content already exists (deduplication) */\ninterface ExistingMediaResponse {\n\texisting: true;\n\tmediaId: string;\n\tstorageKey: string;\n\turl: string;\n}\n\nfunction isUnsupportedSignedUpload(error: unknown): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === \"NOT_SUPPORTED\";\n}\n\n/**\n * Get a signed upload URL for direct-to-storage upload\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\n\t\t\t\"NO_STORAGE\",\n\t\t\t\"Storage not configured. Signed URL uploads require S3-compatible storage.\",\n\t\t\t501,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst maxSize = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(maxSize) || maxSize <= 0) {\n\t\t\treturn apiError(\n\t\t\t\t\"CONFIGURATION_ERROR\",\n\t\t\t\t\"Invalid maxUploadSize configuration. Expected a positive finite number.\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t\tconst body = await parseBody(request, mediaUploadUrlBody(maxSize));\n\t\tif (isParseError(body)) return body;\n\t\tconst normalizedContentType = normalizeMime(body.contentType);\n\n\t\t// Validate content type (field-aware widening)\n\t\tconst fieldAllowlist = body.fieldId\n\t\t\t? await resolveFieldAllowlist(emdash.db, body.fieldId)\n\t\t\t: null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(body.contentType, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Check for existing content with same hash (deduplication)\n\t\tif (body.deduplicate !== false && body.contentHash && body.size > 0) {\n\t\t\tconst existing = await repo.findByContentHash(body.contentHash);\n\t\t\tif (existing && existing.mimeType === normalizedContentType && existing.size === body.size) {\n\t\t\t\tconst response: ExistingMediaResponse = {\n\t\t\t\t\texisting: true,\n\t\t\t\t\tmediaId: existing.id,\n\t\t\t\t\tstorageKey: existing.storageKey,\n\t\t\t\t\turl: `/_emdash/api/media/file/${existing.storageKey}`,\n\t\t\t\t};\n\t\t\t\treturn apiSuccess(response);\n\t\t\t}\n\t\t}\n\t\tconst filename = body.ensureUniqueFilename\n\t\t\t? await repo.findAvailableFilename(body.filename)\n\t\t\t: body.filename;\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\tlet signedUrl: Awaited<ReturnType<typeof emdash.storage.getSignedUploadUrl>> | null;\n\t\ttry {\n\t\t\tsignedUrl = await emdash.storage.getSignedUploadUrl({\n\t\t\t\tkey: storageKey,\n\t\t\t\tcontentType: body.contentType,\n\t\t\t\tsize: body.size,\n\t\t\t\texpiresIn: 3600,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (!isUnsupportedSignedUpload(error)) throw error;\n\t\t\tsignedUrl = null;\n\t\t}\n\n\t\tconst mediaItem = await repo.createPending({\n\t\t\tfilename,\n\t\t\tmimeType: normalizedContentType,\n\t\t\tsize: body.size,\n\t\t\tstorageKey,\n\t\t\tauthorId: user?.id,\n\t\t\tfolderId: body.folderId,\n\t\t});\n\n\t\tconst response: UploadUrlResponse = {\n\t\t\tuploadUrl: signedUrl?.url ?? `/_emdash/api/media/${mediaItem.id}/upload`,\n\t\t\tmethod: signedUrl?.method ?? \"PUT\",\n\t\t\theaders: signedUrl?.headers ?? {\n\t\t\t\t\"Content-Type\": normalizedContentType,\n\t\t\t\t\"X-EmDash-Request\": \"1\",\n\t\t\t},\n\t\t\tmediaId: mediaItem.id,\n\t\t\tstorageKey,\n\t\t\texpiresAt: signedUrl?.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString(),\n\t\t};\n\n\t\treturn apiSuccess(response);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate upload URL\", \"UPLOAD_URL_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAmBzB,SAAS,0BAA0B,OAAyB;AAC3D,QAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;;;;;AAMpE,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,QACZ,QAAO,SACN,cACA,6EACA,IACA;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,UAAU,OAAO,OAAO,iBAAiB;AAC/C,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC3C,QAAO,SACN,uBACA,2EACA,IACA;EAEF,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB,QAAQ,CAAC;AAClE,MAAI,aAAa,KAAK,CAAE,QAAO;EAC/B,MAAM,wBAAwB,cAAc,KAAK,YAAY;EAM7D,MAAM,aAHiB,KAAK,UACzB,MAAM,sBAAsB,OAAO,IAAI,KAAK,QAAQ,GACpD,SACiC,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,aAAa,UAAU,CACrD,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;EAG9D,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAG3C,MAAI,KAAK,gBAAgB,SAAS,KAAK,eAAe,KAAK,OAAO,GAAG;GACpE,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,YAAY;AAC/D,OAAI,YAAY,SAAS,aAAa,yBAAyB,SAAS,SAAS,KAAK,KAOrF,QAAO,WANiC;IACvC,UAAU;IACV,SAAS,SAAS;IAClB,YAAY,SAAS;IACrB,KAAK,2BAA2B,SAAS;IACzC,CAC0B;;EAG7B,MAAM,WAAW,KAAK,uBACnB,MAAM,KAAK,sBAAsB,KAAK,SAAS,GAC/C,KAAK;EAKR,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,SAAS,IAAI;EAGtC,IAAI;AACJ,MAAI;AACH,eAAY,MAAM,OAAO,QAAQ,mBAAmB;IACnD,KAAK;IACL,aAAa,KAAK;IAClB,MAAM,KAAK;IACX,WAAW;IACX,CAAC;WACM,OAAO;AACf,OAAI,CAAC,0BAA0B,MAAM,CAAE,OAAM;AAC7C,eAAY;;EAGb,MAAM,YAAY,MAAM,KAAK,cAAc;GAC1C;GACA,UAAU;GACV,MAAM,KAAK;GACX;GACA,UAAU,MAAM;GAChB,UAAU,KAAK;GACf,CAAC;AAcF,SAAO,WAZ6B;GACnC,WAAW,WAAW,OAAO,sBAAsB,UAAU,GAAG;GAChE,QAAQ,WAAW,UAAU;GAC7B,SAAS,WAAW,WAAW;IAC9B,gBAAgB;IAChB,oBAAoB;IACpB;GACD,SAAS,UAAU;GACnB;GACA,WAAW,WAAW,aAAa,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,IAAK,CAAC,aAAa;GACnF,CAE0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,iCAAiC,mBAAmB"}
+{"version":3,"file":"upload-url.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/upload-url.ts"],"sourcesContent":["/**\n * Media upload URL endpoint\n *\n * POST /_emdash/api/media/upload-url\n *\n * Returns a signed URL for direct upload to storage.\n * Creates a pending media record that must be confirmed after upload.\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\n\nexport const prerender = false;\n\ninterface UploadUrlResponse {\n\tuploadUrl: string;\n\tmethod: \"PUT\";\n\theaders: Record<string, string>;\n\tmediaId: string;\n\tstorageKey: string;\n\texpiresAt: string;\n}\n\n/** Response when content already exists (deduplication) */\ninterface ExistingMediaResponse {\n\texisting: true;\n\tmediaId: string;\n\tstorageKey: string;\n\turl: string;\n}\n\nfunction isUnsupportedSignedUpload(error: unknown): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === \"NOT_SUPPORTED\";\n}\n\n/**\n * Get a signed upload URL for direct-to-storage upload\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\n\t\t\t\"NO_STORAGE\",\n\t\t\t\"Storage not configured. Signed URL uploads require S3-compatible storage.\",\n\t\t\t501,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst maxSize = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(maxSize) || maxSize <= 0) {\n\t\t\treturn apiError(\n\t\t\t\t\"CONFIGURATION_ERROR\",\n\t\t\t\t\"Invalid maxUploadSize configuration. Expected a positive finite number.\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t\tconst body = await parseBody(request, mediaUploadUrlBody(maxSize));\n\t\tif (isParseError(body)) return body;\n\t\tconst normalizedContentType = normalizeMime(body.contentType);\n\n\t\t// Validate content type (field-aware widening)\n\t\tconst fieldAllowlist = body.fieldId\n\t\t\t? await resolveFieldAllowlist(emdash.db, body.fieldId)\n\t\t\t: null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(body.contentType, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Check for existing content with same hash (deduplication)\n\t\tif (body.deduplicate !== false && body.contentHash && body.size > 0) {\n\t\t\tconst existing = await repo.findByContentHash(body.contentHash);\n\t\t\tif (existing && existing.mimeType === normalizedContentType && existing.size === body.size) {\n\t\t\t\tconst response: ExistingMediaResponse = {\n\t\t\t\t\texisting: true,\n\t\t\t\t\tmediaId: existing.id,\n\t\t\t\t\tstorageKey: existing.storageKey,\n\t\t\t\t\turl: `/_emdash/api/media/file/${existing.storageKey}`,\n\t\t\t\t};\n\t\t\t\treturn apiSuccess(response);\n\t\t\t}\n\t\t}\n\t\tconst filename = body.ensureUniqueFilename\n\t\t\t? await repo.findAvailableFilename(body.filename)\n\t\t\t: body.filename;\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\tlet signedUrl: Awaited<ReturnType<typeof emdash.storage.getSignedUploadUrl>> | null;\n\t\ttry {\n\t\t\tsignedUrl = await emdash.storage.getSignedUploadUrl({\n\t\t\t\tkey: storageKey,\n\t\t\t\tcontentType: body.contentType,\n\t\t\t\tsize: body.size,\n\t\t\t\texpiresIn: 3600,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (!isUnsupportedSignedUpload(error)) throw error;\n\t\t\tsignedUrl = null;\n\t\t}\n\n\t\tconst mediaItem = await repo.createPending({\n\t\t\tfilename,\n\t\t\tmimeType: normalizedContentType,\n\t\t\tsize: body.size,\n\t\t\tstorageKey,\n\t\t\tauthorId: user?.id,\n\t\t\tfolderId: body.folderId,\n\t\t});\n\n\t\tconst response: UploadUrlResponse = {\n\t\t\tuploadUrl: signedUrl?.url ?? `/_emdash/api/media/${mediaItem.id}/upload`,\n\t\t\tmethod: signedUrl?.method ?? \"PUT\",\n\t\t\theaders: signedUrl?.headers ?? {\n\t\t\t\t\"Content-Type\": normalizedContentType,\n\t\t\t\t\"X-EmDash-Request\": \"1\",\n\t\t\t},\n\t\t\tmediaId: mediaItem.id,\n\t\t\tstorageKey,\n\t\t\texpiresAt: signedUrl?.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString(),\n\t\t};\n\n\t\treturn apiSuccess(response);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate upload URL\", \"UPLOAD_URL_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAmBzB,SAAS,0BAA0B,OAAyB;AAC3D,QAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;;;;;AAMpE,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,QACZ,QAAO,SACN,cACA,6EACA,IACA;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,UAAU,OAAO,OAAO,iBAAiB;AAC/C,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC3C,QAAO,SACN,uBACA,2EACA,IACA;EAEF,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB,QAAQ,CAAC;AAClE,MAAI,aAAa,KAAK,CAAE,QAAO;EAC/B,MAAM,wBAAwB,cAAc,KAAK,YAAY;EAM7D,MAAM,aAHiB,KAAK,UACzB,MAAM,sBAAsB,OAAO,IAAI,KAAK,QAAQ,GACpD,SACiC,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,aAAa,UAAU,CACrD,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;EAG9D,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAG3C,MAAI,KAAK,gBAAgB,SAAS,KAAK,eAAe,KAAK,OAAO,GAAG;GACpE,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,YAAY;AAC/D,OAAI,YAAY,SAAS,aAAa,yBAAyB,SAAS,SAAS,KAAK,KAOrF,QAAO,WANiC;IACvC,UAAU;IACV,SAAS,SAAS;IAClB,YAAY,SAAS;IACrB,KAAK,2BAA2B,SAAS;IACzC,CAC0B;;EAG7B,MAAM,WAAW,KAAK,uBACnB,MAAM,KAAK,sBAAsB,KAAK,SAAS,GAC/C,KAAK;EAKR,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,SAAS,IAAI;EAGtC,IAAI;AACJ,MAAI;AACH,eAAY,MAAM,OAAO,QAAQ,mBAAmB;IACnD,KAAK;IACL,aAAa,KAAK;IAClB,MAAM,KAAK;IACX,WAAW;IACX,CAAC;WACM,OAAO;AACf,OAAI,CAAC,0BAA0B,MAAM,CAAE,OAAM;AAC7C,eAAY;;EAGb,MAAM,YAAY,MAAM,KAAK,cAAc;GAC1C;GACA,UAAU;GACV,MAAM,KAAK;GACX;GACA,UAAU,MAAM;GAChB,UAAU,KAAK;GACf,CAAC;AAcF,SAAO,WAZ6B;GACnC,WAAW,WAAW,OAAO,sBAAsB,UAAU,GAAG;GAChE,QAAQ,WAAW,UAAU;GAC7B,SAAS,WAAW,WAAW;IAC9B,gBAAgB;IAChB,oBAAoB;IACpB;GACD,SAAS,UAAU;GACnB;GACA,WAAW,WAAW,aAAa,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,IAAK,CAAC,aAAa;GACnF,CAE0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,iCAAiC,mBAAmB"}

package/dist/astro/routes/api/media.mjs

@@ -1,30 +1,42 @@
-import "../../../dialect-helpers-CtYdsX4W.mjs";
-import "../../../config-CGVeT8Hc.mjs";
+import "../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../config-CvmjJcVw.mjs";
 import "../../../base64-DvnNgP7e.mjs";
 import "../../../types-BkUg2yHx.mjs";
-import { t as MediaRepository } from "../../../media-TBlKCwo7.mjs";
-import "../../../dist-2hDLsLeq.mjs";
-import { n as normalizeMime, t as matchesMimeAllowlist } from "../../../mime-CCYRC4r1.mjs";
-import { t as enrichImageMetadata } from "../../../enrich-C2Mk0lwE.mjs";
-import "../../../fts-manager-DMb0sbIQ.mjs";
-import "../../../capture-triggers-gxQxnxrJ.mjs";
-import "../../../activation-CaMfdBt1.mjs";
-import "../../../collection-deletion-C3Xixmkx.mjs";
-import "../../../content-refresh-BHLHJgyt.mjs";
-import { n as computeContentHash } from "../../../hash-CLVFzWvx.mjs";
-import "../../../media-usage-work-Cu5DqewW.mjs";
-import "../../../content-repair-BVll5WNl.mjs";
-import { a as handleMediaUsageSummaries } from "../../../media-usage-C4NolTpQ.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../error-CCTCskie.mjs";
-import { i as parseQuery, t as isParseError } from "../../../parse-Cr379Av9.mjs";
-import "../../../redirects-BCiTaIQ-.mjs";
-import { At as DEFAULT_MAX_UPLOAD_SIZE, Lt as mediaFolderIdSchema, Wt as mediaListQuery, in as mediaUploadEnsureUniqueFilenameForm, jt as formatFileSize, rn as mediaUploadDeduplicateForm } from "../../../entry-lock-D3C99MXS.mjs";
-import "../../../comments-BVzzt6x5.mjs";
-import "../../../relations-B4w-G5U9.mjs";
-import "../../../status-DLoBmcDz.mjs";
+import { t as MediaRepository } from "../../../media-Qp5S3eH3.mjs";
+import "../../../request-cache-DzLYKm_x.mjs";
+import "../../../dist-BNwANFJR.mjs";
+import { n as normalizeMime, t as matchesMimeAllowlist } from "../../../mime-ChLqYwDk.mjs";
+import { t as enrichImageMetadata } from "../../../enrich-Dl3kZ-lP.mjs";
+import "../../../fts-manager-S-K0laoS.mjs";
+import "../../../collection-slugs-cache-CjGk__zp.mjs";
+import "../../../capture-triggers-kJyl_yyM.mjs";
+import "../../../activation-LOkDM5WT.mjs";
+import "../../../block-type-registry-DUI_3KxT.mjs";
+import "../../../collection-deletion-BIm28mo3.mjs";
+import "../../../errors-DgE1zJGG.mjs";
+import "../../../canonical-YhEQezjg.mjs";
+import "../../../digest-BarSh-pN.mjs";
+import { n as computeContentHash } from "../../../hash-SDAW6zC-.mjs";
+import "../../../zod-generator-D6uE4WiS.mjs";
+import "../../../media-usage-work-C2OZLCAd.mjs";
+import "../../../content-repair-Q8IUrpLL.mjs";
+import "../../../collection-deletion-processor-Br6rxs3u.mjs";
+import { a as handleMediaUsageSummaries } from "../../../media-usage-My-Vi-ex.mjs";
+import "../../../settings-DYidIB26.mjs";
+import "../../../site-settings-DOgRUoFX.mjs";
+import "../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, t as isParseError } from "../../../parse-DY6OD1j_.mjs";
+import "../../../redirects-Cv9apQKj.mjs";
+import "../../../entry-lock-BJYdBfXb.mjs";
+import { A as mediaUploadEnsureUniqueFilenameForm, g as mediaListQuery, k as mediaUploadDeduplicateForm, l as mediaFolderIdSchema, n as DEFAULT_MAX_UPLOAD_SIZE, r as formatFileSize } from "../../../media-Pu1L6xir.mjs";
+import "../../../comments-fHZ8ON9O.mjs";
+import "../../../relations-CK9CYUyr.mjs";
+import "../../../menus-BM7BPLOb.mjs";
+import "../../../status-DZKIG4a9.mjs";
 import "../../../api/schemas/index.mjs";
-import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../media-allowlist-s60eAIf6.mjs";
-import { r as requirePerm, t as canReadMediaUsageCount } from "../../../authorize-BXpfMpp0.mjs";
+import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../media-allowlist-BSoa9Vvm.mjs";
+import { i as requirePerm, t as canReadMediaUsageCount } from "../../../authorize-seCifOMJ.mjs";
 import { ulid } from "ulidx";
 import * as path from "node:path";
 

package/dist/astro/routes/api/media.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"media.mjs","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"sourcesContent":["/**\n * Media list and upload endpoint\n *\n * GET /_emdash/api/media - List all media\n * POST /_emdash/api/media - Upload new media (via configured storage adapter)\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { canReadMediaUsageCount, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { handleMediaUsageSummaries } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport {\n\tDEFAULT_MAX_UPLOAD_SIZE,\n\tformatFileSize,\n\tmediaFolderIdSchema,\n\tmediaListQuery,\n\tmediaUploadDeduplicateForm,\n\tmediaUploadEnsureUniqueFilenameForm,\n} from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { enrichImageMetadata } from \"#media/enrich.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\nimport { computeContentHash } from \"#utils/hash.js\";\n\nimport type { MediaItem } from \"../../types.js\";\n\nexport const prerender = false;\n\n/**\n * Add URL to media items\n * Uses relative URLs to ensure portability across deployments\n */\nfunction addUrlToMedia(item: MediaItem): MediaItem & { url: string } {\n\treturn {\n\t\t...item,\n\t\turl: `/_emdash/api/media/file/${item.storageKey}`,\n\t};\n}\n\n/**\n * List media items\n */\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst query = parseQuery(url, mediaListQuery);\n\tif (isParseError(query)) return query;\n\n\tconst result = await emdash.handleMediaList({\n\t\tcursor: query.cursor,\n\t\tpage: query.page,\n\t\tlimit: query.limit,\n\t\tmimeType: query.mimeType,\n\t\tq: query.q,\n\t\tfolderId: query.folderId === \"unfiled\" ? null : query.folderId,\n\t});\n\n\tif (!result.success) {\n\t\treturn unwrapResult(result);\n\t}\n\n\t// Add URL to each media item (relative URLs for portability)\n\tconst itemsWithUrl = result.data.items.map((item) => addUrlToMedia(item));\n\tif (query.includeUsage !== \"1\") {\n\t\treturn apiSuccess({\n\t\t\titems: itemsWithUrl,\n\t\t\tnextCursor: result.data.nextCursor,\n\t\t\ttotalCount: result.data.totalCount,\n\t\t});\n\t}\n\n\tconst includeCount = canReadMediaUsageCount(user, locals.tokenScopes);\n\tconst usageResult = await handleMediaUsageSummaries(\n\t\temdash.db,\n\t\titemsWithUrl.map((item) => item.id),\n\t\t{ includeCount },\n\t);\n\tif (!usageResult.success) return unwrapResult(usageResult);\n\n\tconst itemsWithUsage = [];\n\tfor (const item of itemsWithUrl) {\n\t\tconst usage = usageResult.data[item.id];\n\t\tif (!usage) return apiError(\"MEDIA_USAGE_READ_ERROR\", \"Failed to read media usage\", 500);\n\t\titemsWithUsage.push({ ...item, usage });\n\t}\n\n\treturn apiSuccess({\n\t\titems: itemsWithUsage,\n\t\tnextCursor: result.data.nextCursor,\n\t\ttotalCount: result.data.totalCount,\n\t});\n};\n\n/**\n * Upload media file\n *\n * Uses the configured storage adapter to store the file.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaCreate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NO_STORAGE\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst rawMax = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(rawMax) || rawMax <= 0) {\n\t\t\treturn apiError(\"CONFIGURATION_ERROR\", \"Invalid maxUploadSize configuration\", 500);\n\t\t}\n\t\tconst maxUploadSize = rawMax;\n\n\t\t// Best-effort size check before buffering the full multipart body\n\t\tconst contentLength = request.headers.get(\"Content-Length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxUploadSize) {\n\t\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Upload too large\", 413);\n\t\t}\n\n\t\tconst formData = await request.formData();\n\t\tconst fileEntry = formData.get(\"file\");\n\t\tconst file = fileEntry instanceof File ? fileEntry : null;\n\n\t\tif (!file) {\n\t\t\treturn apiError(\"NO_FILE\", \"No file provided\", 400);\n\t\t}\n\n\t\tconst deduplicateResult = mediaUploadDeduplicateForm.safeParse(\n\t\t\tformData.get(\"deduplicate\") ?? undefined,\n\t\t);\n\t\tif (!deduplicateResult.success) {\n\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400, {\n\t\t\t\tissues: deduplicateResult.error.issues.map((issue) => ({\n\t\t\t\t\tpath: \"deduplicate\",\n\t\t\t\t\tmessage: issue.message,\n\t\t\t\t})),\n\t\t\t});\n\t\t}\n\t\tconst ensureUniqueFilenameResult = mediaUploadEnsureUniqueFilenameForm.safeParse(\n\t\t\tformData.get(\"ensureUniqueFilename\") ?? undefined,\n\t\t);\n\t\tif (!ensureUniqueFilenameResult.success) {\n\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400);\n\t\t}\n\t\tconst folderEntry = formData.get(\"folderId\");\n\t\tlet folderId: string | null | undefined;\n\t\tif (folderEntry !== null) {\n\t\t\tif (typeof folderEntry !== \"string\") {\n\t\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400);\n\t\t\t}\n\t\t\tif (folderEntry === \"unfiled\") {\n\t\t\t\tfolderId = null;\n\t\t\t} else {\n\t\t\t\tconst folderResult = mediaFolderIdSchema.safeParse(folderEntry);\n\t\t\t\tif (!folderResult.success) {\n\t\t\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400);\n\t\t\t\t}\n\t\t\t\tfolderId = folderResult.data;\n\t\t\t}\n\t\t}\n\n\t\t// Validate file type — widen the allowlist when a field-specific list is configured\n\t\tconst fieldIdEntry = formData.get(\"fieldId\");\n\t\tconst fieldId =\n\t\t\ttypeof fieldIdEntry === \"string\" && fieldIdEntry.length > 0 ? fieldIdEntry : null;\n\n\t\tconst fieldAllowlist = fieldId ? await resolveFieldAllowlist(emdash.db, fieldId) : null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(file.type, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\t// Check file size before buffering\n\t\tif (file.size > maxUploadSize) {\n\t\t\treturn apiError(\n\t\t\t\t\"PAYLOAD_TOO_LARGE\",\n\t\t\t\t`File exceeds maximum size of ${formatFileSize(maxUploadSize)}`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\n\t\t// Get file content and compute hash\n\t\tconst buffer = new Uint8Array(await file.arrayBuffer());\n\t\tconst contentHash = await computeContentHash(buffer);\n\n\t\t// Check for existing media with same content hash (deduplication)\n\t\tconst repo = new MediaRepository(emdash.db);\n\t\tif (deduplicateResult.data) {\n\t\t\tconst existing = await repo.findByContentHash(contentHash);\n\t\t\tif (existing) {\n\t\t\t\tconst itemWithUrl = addUrlToMedia(existing);\n\t\t\t\treturn apiSuccess({ item: itemWithUrl, deduplicated: true });\n\t\t\t}\n\t\t}\n\t\tconst filename = ensureUniqueFilenameResult.data\n\t\t\t? await repo.findAvailableFilename(file.name)\n\t\t\t: file.name;\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\t// Upload to storage using the configured adapter\n\t\tawait emdash.storage.upload({\n\t\t\tkey: storageKey,\n\t\t\tbody: buffer,\n\t\t\tcontentType: file.type,\n\t\t});\n\n\t\t// Get image dimensions from form data (sent by client)\n\t\tconst widthEntry = formData.get(\"width\");\n\t\tconst widthStr = typeof widthEntry === \"string\" ? widthEntry : null;\n\t\tconst heightEntry = formData.get(\"height\");\n\t\tconst heightStr = typeof heightEntry === \"string\" ? heightEntry : null;\n\t\tconst width = widthStr ? parseInt(widthStr, 10) : undefined;\n\t\tconst height = heightStr ? parseInt(heightStr, 10) : undefined;\n\n\t\t// Derive dimensions + LQIP placeholders via the shared helper.\n\t\t// If the client sent a downscaled thumbnail, decode that for the blurhash\n\t\t// (avoids OOM on large originals on memory-constrained runtimes).\n\t\tconst thumbnailEntry = formData.get(\"thumbnail\");\n\t\tconst thumbnail = thumbnailEntry instanceof File ? thumbnailEntry : null;\n\t\tconst enriched = await enrichImageMetadata(buffer, file.type, {\n\t\t\tknownDimensions: width != null && height != null ? { width, height } : undefined,\n\t\t\tplaceholder: thumbnail\n\t\t\t\t? { bytes: new Uint8Array(await thumbnail.arrayBuffer()), contentType: thumbnail.type }\n\t\t\t\t: undefined,\n\t\t});\n\n\t\t// Create media record\n\t\tconst result = await emdash.handleMediaCreate({\n\t\t\tfilename,\n\t\t\tmimeType: normalizeMime(file.type),\n\t\t\tsize: file.size,\n\t\t\t// Client dimensions win over server header dimensions: the browser's\n\t\t\t// naturalWidth/Height apply EXIF orientation, while image-size reports\n\t\t\t// raw (pre-orientation) header dims — swapped for 90°/270° JPEGs.\n\t\t\twidth: width ?? enriched.width,\n\t\t\theight: height ?? enriched.height,\n\t\t\tstorageKey,\n\t\t\tcontentHash,\n\t\t\tblurhash: enriched.blurhash,\n\t\t\tdominantColor: enriched.dominantColor,\n\t\t\tauthorId: user?.id,\n\t\t\tfolderId,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\t// Clean up the uploaded file on failure\n\t\t\ttry {\n\t\t\t\tawait emdash.storage.delete(storageKey);\n\t\t\t} catch {\n\t\t\t\t// Ignore cleanup errors\n\t\t\t}\n\t\t\treturn unwrapResult(result);\n\t\t}\n\n\t\t// Add URL to the response (relative URL for portability)\n\t\tconst itemWithUrl = addUrlToMedia(result.data.item);\n\n\t\treturn apiSuccess({ item: itemWithUrl }, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Upload failed\", \"UPLOAD_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAa,YAAY;;;;;AAMzB,SAAS,cAAc,MAA8C;AACpE,QAAO;EACN,GAAG;EACH,KAAK,2BAA2B,KAAK;EACrC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,gBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,QAAQ,WADF,IAAI,IAAI,QAAQ,IAAI,EACF,eAAe;AAC7C,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,SAAS,MAAM,OAAO,gBAAgB;EAC3C,QAAQ,MAAM;EACd,MAAM,MAAM;EACZ,OAAO,MAAM;EACb,UAAU,MAAM;EAChB,GAAG,MAAM;EACT,UAAU,MAAM,aAAa,YAAY,OAAO,MAAM;EACtD,CAAC;AAEF,KAAI,CAAC,OAAO,QACX,QAAO,aAAa,OAAO;CAI5B,MAAM,eAAe,OAAO,KAAK,MAAM,KAAK,SAAS,cAAc,KAAK,CAAC;AACzE,KAAI,MAAM,iBAAiB,IAC1B,QAAO,WAAW;EACjB,OAAO;EACP,YAAY,OAAO,KAAK;EACxB,YAAY,OAAO,KAAK;EACxB,CAAC;CAGH,MAAM,eAAe,uBAAuB,MAAM,OAAO,YAAY;CACrE,MAAM,cAAc,MAAM,0BACzB,OAAO,IACP,aAAa,KAAK,SAAS,KAAK,GAAG,EACnC,EAAE,cAAc,CAChB;AACD,KAAI,CAAC,YAAY,QAAS,QAAO,aAAa,YAAY;CAE1D,MAAM,iBAAiB,EAAE;AACzB,MAAK,MAAM,QAAQ,cAAc;EAChC,MAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,MAAI,CAAC,MAAO,QAAO,SAAS,0BAA0B,8BAA8B,IAAI;AACxF,iBAAe,KAAK;GAAE,GAAG;GAAM;GAAO,CAAC;;AAGxC,QAAO,WAAW;EACjB,OAAO;EACP,YAAY,OAAO,KAAK;EACxB,YAAY,OAAO,KAAK;EACxB,CAAC;;;;;;;AAQH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,kBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,cAAc,0BAA0B,IAAI;AAG7D,KAAI;EACH,MAAM,SAAS,OAAO,OAAO,iBAAiB;AAC9C,MAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACzC,QAAO,SAAS,uBAAuB,uCAAuC,IAAI;EAEnF,MAAM,gBAAgB;EAGtB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,oBAAoB,IAAI;EAG9D,MAAM,WAAW,MAAM,QAAQ,UAAU;EACzC,MAAM,YAAY,SAAS,IAAI,OAAO;EACtC,MAAM,OAAO,qBAAqB,OAAO,YAAY;AAErD,MAAI,CAAC,KACJ,QAAO,SAAS,WAAW,oBAAoB,IAAI;EAGpD,MAAM,oBAAoB,2BAA2B,UACpD,SAAS,IAAI,cAAc,IAAI,OAC/B;AACD,MAAI,CAAC,kBAAkB,QACtB,QAAO,SAAS,oBAAoB,wBAAwB,KAAK,EAChE,QAAQ,kBAAkB,MAAM,OAAO,KAAK,WAAW;GACtD,MAAM;GACN,SAAS,MAAM;GACf,EAAE,EACH,CAAC;EAEH,MAAM,6BAA6B,oCAAoC,UACtE,SAAS,IAAI,uBAAuB,IAAI,OACxC;AACD,MAAI,CAAC,2BAA2B,QAC/B,QAAO,SAAS,oBAAoB,wBAAwB,IAAI;EAEjE,MAAM,cAAc,SAAS,IAAI,WAAW;EAC5C,IAAI;AACJ,MAAI,gBAAgB,MAAM;AACzB,OAAI,OAAO,gBAAgB,SAC1B,QAAO,SAAS,oBAAoB,wBAAwB,IAAI;AAEjE,OAAI,gBAAgB,UACnB,YAAW;QACL;IACN,MAAM,eAAe,oBAAoB,UAAU,YAAY;AAC/D,QAAI,CAAC,aAAa,QACjB,QAAO,SAAS,oBAAoB,wBAAwB,IAAI;AAEjE,eAAW,aAAa;;;EAK1B,MAAM,eAAe,SAAS,IAAI,UAAU;EAC5C,MAAM,UACL,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,eAAe;EAG9E,MAAM,aADiB,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,GAAG,SAC/C,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,MAAM,UAAU,CAC9C,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;AAI9D,MAAI,KAAK,OAAO,cACf,QAAO,SACN,qBACA,gCAAgC,eAAe,cAAc,IAC7D,IACA;EAIF,MAAM,SAAS,IAAI,WAAW,MAAM,KAAK,aAAa,CAAC;EACvD,MAAM,cAAc,MAAM,mBAAmB,OAAO;EAGpD,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAC3C,MAAI,kBAAkB,MAAM;GAC3B,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY;AAC1D,OAAI,SAEH,QAAO,WAAW;IAAE,MADA,cAAc,SAAS;IACJ,cAAc;IAAM,CAAC;;EAG9D,MAAM,WAAW,2BAA2B,OACzC,MAAM,KAAK,sBAAsB,KAAK,KAAK,GAC3C,KAAK;EAKR,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,SAAS,IAAI;AAItC,QAAM,OAAO,QAAQ,OAAO;GAC3B,KAAK;GACL,MAAM;GACN,aAAa,KAAK;GAClB,CAAC;EAGF,MAAM,aAAa,SAAS,IAAI,QAAQ;EACxC,MAAM,WAAW,OAAO,eAAe,WAAW,aAAa;EAC/D,MAAM,cAAc,SAAS,IAAI,SAAS;EAC1C,MAAM,YAAY,OAAO,gBAAgB,WAAW,cAAc;EAClE,MAAM,QAAQ,WAAW,SAAS,UAAU,GAAG,GAAG;EAClD,MAAM,SAAS,YAAY,SAAS,WAAW,GAAG,GAAG;EAKrD,MAAM,iBAAiB,SAAS,IAAI,YAAY;EAChD,MAAM,YAAY,0BAA0B,OAAO,iBAAiB;EACpE,MAAM,WAAW,MAAM,oBAAoB,QAAQ,KAAK,MAAM;GAC7D,iBAAiB,SAAS,QAAQ,UAAU,OAAO;IAAE;IAAO;IAAQ,GAAG;GACvE,aAAa,YACV;IAAE,OAAO,IAAI,WAAW,MAAM,UAAU,aAAa,CAAC;IAAE,aAAa,UAAU;IAAM,GACrF;GACH,CAAC;EAGF,MAAM,SAAS,MAAM,OAAO,kBAAkB;GAC7C;GACA,UAAU,cAAc,KAAK,KAAK;GAClC,MAAM,KAAK;GAIX,OAAO,SAAS,SAAS;GACzB,QAAQ,UAAU,SAAS;GAC3B;GACA;GACA,UAAU,SAAS;GACnB,eAAe,SAAS;GACxB,UAAU,MAAM;GAChB;GACA,CAAC;AAEF,MAAI,CAAC,OAAO,SAAS;AAEpB,OAAI;AACH,UAAM,OAAO,QAAQ,OAAO,WAAW;WAChC;AAGR,UAAO,aAAa,OAAO;;AAM5B,SAAO,WAAW,EAAE,MAFA,cAAc,OAAO,KAAK,KAAK,EAEZ,EAAE,IAAI;UACrC,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}
+{"version":3,"file":"media.mjs","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"sourcesContent":["/**\n * Media list and upload endpoint\n *\n * GET /_emdash/api/media - List all media\n * POST /_emdash/api/media - Upload new media (via configured storage adapter)\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { canReadMediaUsageCount, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { handleMediaUsageSummaries } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport {\n\tDEFAULT_MAX_UPLOAD_SIZE,\n\tformatFileSize,\n\tmediaFolderIdSchema,\n\tmediaListQuery,\n\tmediaUploadDeduplicateForm,\n\tmediaUploadEnsureUniqueFilenameForm,\n} from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { enrichImageMetadata } from \"#media/enrich.js\";\nimport { matchesMimeAllowlist, normalizeMime } from \"#media/mime.js\";\nimport { computeContentHash } from \"#utils/hash.js\";\n\nimport type { MediaItem } from \"../../types.js\";\n\nexport const prerender = false;\n\n/**\n * Add URL to media items\n * Uses relative URLs to ensure portability across deployments\n */\nfunction addUrlToMedia(item: MediaItem): MediaItem & { url: string } {\n\treturn {\n\t\t...item,\n\t\turl: `/_emdash/api/media/file/${item.storageKey}`,\n\t};\n}\n\n/**\n * List media items\n */\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:read\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst query = parseQuery(url, mediaListQuery);\n\tif (isParseError(query)) return query;\n\n\tconst result = await emdash.handleMediaList({\n\t\tcursor: query.cursor,\n\t\tpage: query.page,\n\t\tlimit: query.limit,\n\t\tmimeType: query.mimeType,\n\t\tq: query.q,\n\t\tfolderId: query.folderId === \"unfiled\" ? null : query.folderId,\n\t});\n\n\tif (!result.success) {\n\t\treturn unwrapResult(result);\n\t}\n\n\t// Add URL to each media item (relative URLs for portability)\n\tconst itemsWithUrl = result.data.items.map((item) => addUrlToMedia(item));\n\tif (query.includeUsage !== \"1\") {\n\t\treturn apiSuccess({\n\t\t\titems: itemsWithUrl,\n\t\t\tnextCursor: result.data.nextCursor,\n\t\t\ttotalCount: result.data.totalCount,\n\t\t});\n\t}\n\n\tconst includeCount = canReadMediaUsageCount(user, locals.tokenScopes);\n\tconst usageResult = await handleMediaUsageSummaries(\n\t\temdash.db,\n\t\titemsWithUrl.map((item) => item.id),\n\t\t{ includeCount },\n\t);\n\tif (!usageResult.success) return unwrapResult(usageResult);\n\n\tconst itemsWithUsage = [];\n\tfor (const item of itemsWithUrl) {\n\t\tconst usage = usageResult.data[item.id];\n\t\tif (!usage) return apiError(\"MEDIA_USAGE_READ_ERROR\", \"Failed to read media usage\", 500);\n\t\titemsWithUsage.push({ ...item, usage });\n\t}\n\n\treturn apiSuccess({\n\t\titems: itemsWithUsage,\n\t\tnextCursor: result.data.nextCursor,\n\t\ttotalCount: result.data.totalCount,\n\t});\n};\n\n/**\n * Upload media file\n *\n * Uses the configured storage adapter to store the file.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.handleMediaCreate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NO_STORAGE\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst rawMax = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(rawMax) || rawMax <= 0) {\n\t\t\treturn apiError(\"CONFIGURATION_ERROR\", \"Invalid maxUploadSize configuration\", 500);\n\t\t}\n\t\tconst maxUploadSize = rawMax;\n\n\t\t// Best-effort size check before buffering the full multipart body\n\t\tconst contentLength = request.headers.get(\"Content-Length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxUploadSize) {\n\t\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Upload too large\", 413);\n\t\t}\n\n\t\tconst formData = await request.formData();\n\t\tconst fileEntry = formData.get(\"file\");\n\t\tconst file = fileEntry instanceof File ? fileEntry : null;\n\n\t\tif (!file) {\n\t\t\treturn apiError(\"NO_FILE\", \"No file provided\", 400);\n\t\t}\n\n\t\tconst deduplicateResult = mediaUploadDeduplicateForm.safeParse(\n\t\t\tformData.get(\"deduplicate\") ?? undefined,\n\t\t);\n\t\tif (!deduplicateResult.success) {\n\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400, {\n\t\t\t\tissues: deduplicateResult.error.issues.map((issue) => ({\n\t\t\t\t\tpath: \"deduplicate\",\n\t\t\t\t\tmessage: issue.message,\n\t\t\t\t})),\n\t\t\t});\n\t\t}\n\t\tconst ensureUniqueFilenameResult = mediaUploadEnsureUniqueFilenameForm.safeParse(\n\t\t\tformData.get(\"ensureUniqueFilename\") ?? undefined,\n\t\t);\n\t\tif (!ensureUniqueFilenameResult.success) {\n\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400);\n\t\t}\n\t\tconst folderEntry = formData.get(\"folderId\");\n\t\tlet folderId: string | null | undefined;\n\t\tif (folderEntry !== null) {\n\t\t\tif (typeof folderEntry !== \"string\") {\n\t\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400);\n\t\t\t}\n\t\t\tif (folderEntry === \"unfiled\") {\n\t\t\t\tfolderId = null;\n\t\t\t} else {\n\t\t\t\tconst folderResult = mediaFolderIdSchema.safeParse(folderEntry);\n\t\t\t\tif (!folderResult.success) {\n\t\t\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400);\n\t\t\t\t}\n\t\t\t\tfolderId = folderResult.data;\n\t\t\t}\n\t\t}\n\n\t\t// Validate file type — widen the allowlist when a field-specific list is configured\n\t\tconst fieldIdEntry = formData.get(\"fieldId\");\n\t\tconst fieldId =\n\t\t\ttypeof fieldIdEntry === \"string\" && fieldIdEntry.length > 0 ? fieldIdEntry : null;\n\n\t\tconst fieldAllowlist = fieldId ? await resolveFieldAllowlist(emdash.db, fieldId) : null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(file.type, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\t// Check file size before buffering\n\t\tif (file.size > maxUploadSize) {\n\t\t\treturn apiError(\n\t\t\t\t\"PAYLOAD_TOO_LARGE\",\n\t\t\t\t`File exceeds maximum size of ${formatFileSize(maxUploadSize)}`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\n\t\t// Get file content and compute hash\n\t\tconst buffer = new Uint8Array(await file.arrayBuffer());\n\t\tconst contentHash = await computeContentHash(buffer);\n\n\t\t// Check for existing media with same content hash (deduplication)\n\t\tconst repo = new MediaRepository(emdash.db);\n\t\tif (deduplicateResult.data) {\n\t\t\tconst existing = await repo.findByContentHash(contentHash);\n\t\t\tif (existing) {\n\t\t\t\tconst itemWithUrl = addUrlToMedia(existing);\n\t\t\t\treturn apiSuccess({ item: itemWithUrl, deduplicated: true });\n\t\t\t}\n\t\t}\n\t\tconst filename = ensureUniqueFilenameResult.data\n\t\t\t? await repo.findAvailableFilename(file.name)\n\t\t\t: file.name;\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\t// Upload to storage using the configured adapter\n\t\tawait emdash.storage.upload({\n\t\t\tkey: storageKey,\n\t\t\tbody: buffer,\n\t\t\tcontentType: file.type,\n\t\t});\n\n\t\t// Get image dimensions from form data (sent by client)\n\t\tconst widthEntry = formData.get(\"width\");\n\t\tconst widthStr = typeof widthEntry === \"string\" ? widthEntry : null;\n\t\tconst heightEntry = formData.get(\"height\");\n\t\tconst heightStr = typeof heightEntry === \"string\" ? heightEntry : null;\n\t\tconst width = widthStr ? parseInt(widthStr, 10) : undefined;\n\t\tconst height = heightStr ? parseInt(heightStr, 10) : undefined;\n\n\t\t// Derive dimensions + LQIP placeholders via the shared helper.\n\t\t// If the client sent a downscaled thumbnail, decode that for the blurhash\n\t\t// (avoids OOM on large originals on memory-constrained runtimes).\n\t\tconst thumbnailEntry = formData.get(\"thumbnail\");\n\t\tconst thumbnail = thumbnailEntry instanceof File ? thumbnailEntry : null;\n\t\tconst enriched = await enrichImageMetadata(buffer, file.type, {\n\t\t\tknownDimensions: width != null && height != null ? { width, height } : undefined,\n\t\t\tplaceholder: thumbnail\n\t\t\t\t? { bytes: new Uint8Array(await thumbnail.arrayBuffer()), contentType: thumbnail.type }\n\t\t\t\t: undefined,\n\t\t});\n\n\t\t// Create media record\n\t\tconst result = await emdash.handleMediaCreate({\n\t\t\tfilename,\n\t\t\tmimeType: normalizeMime(file.type),\n\t\t\tsize: file.size,\n\t\t\t// Client dimensions win over server header dimensions: the browser's\n\t\t\t// naturalWidth/Height apply EXIF orientation, while image-size reports\n\t\t\t// raw (pre-orientation) header dims — swapped for 90°/270° JPEGs.\n\t\t\twidth: width ?? enriched.width,\n\t\t\theight: height ?? enriched.height,\n\t\t\tstorageKey,\n\t\t\tcontentHash,\n\t\t\tblurhash: enriched.blurhash,\n\t\t\tdominantColor: enriched.dominantColor,\n\t\t\tauthorId: user?.id,\n\t\t\tfolderId,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\t// Clean up the uploaded file on failure\n\t\t\ttry {\n\t\t\t\tawait emdash.storage.delete(storageKey);\n\t\t\t} catch {\n\t\t\t\t// Ignore cleanup errors\n\t\t\t}\n\t\t\treturn unwrapResult(result);\n\t\t}\n\n\t\t// Add URL to the response (relative URL for portability)\n\t\tconst itemWithUrl = addUrlToMedia(result.data.item);\n\n\t\treturn apiSuccess({ item: itemWithUrl }, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Upload failed\", \"UPLOAD_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAa,YAAY;;;;;AAMzB,SAAS,cAAc,MAA8C;AACpE,QAAO;EACN,GAAG;EACH,KAAK,2BAA2B,KAAK;EACrC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,gBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,QAAQ,WADF,IAAI,IAAI,QAAQ,IAAI,EACF,eAAe;AAC7C,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,SAAS,MAAM,OAAO,gBAAgB;EAC3C,QAAQ,MAAM;EACd,MAAM,MAAM;EACZ,OAAO,MAAM;EACb,UAAU,MAAM;EAChB,GAAG,MAAM;EACT,UAAU,MAAM,aAAa,YAAY,OAAO,MAAM;EACtD,CAAC;AAEF,KAAI,CAAC,OAAO,QACX,QAAO,aAAa,OAAO;CAI5B,MAAM,eAAe,OAAO,KAAK,MAAM,KAAK,SAAS,cAAc,KAAK,CAAC;AACzE,KAAI,MAAM,iBAAiB,IAC1B,QAAO,WAAW;EACjB,OAAO;EACP,YAAY,OAAO,KAAK;EACxB,YAAY,OAAO,KAAK;EACxB,CAAC;CAGH,MAAM,eAAe,uBAAuB,MAAM,OAAO,YAAY;CACrE,MAAM,cAAc,MAAM,0BACzB,OAAO,IACP,aAAa,KAAK,SAAS,KAAK,GAAG,EACnC,EAAE,cAAc,CAChB;AACD,KAAI,CAAC,YAAY,QAAS,QAAO,aAAa,YAAY;CAE1D,MAAM,iBAAiB,EAAE;AACzB,MAAK,MAAM,QAAQ,cAAc;EAChC,MAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,MAAI,CAAC,MAAO,QAAO,SAAS,0BAA0B,8BAA8B,IAAI;AACxF,iBAAe,KAAK;GAAE,GAAG;GAAM;GAAO,CAAC;;AAGxC,QAAO,WAAW;EACjB,OAAO;EACP,YAAY,OAAO,KAAK;EACxB,YAAY,OAAO,KAAK;EACxB,CAAC;;;;;;;AAQH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,kBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,cAAc,0BAA0B,IAAI;AAG7D,KAAI;EACH,MAAM,SAAS,OAAO,OAAO,iBAAiB;AAC9C,MAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACzC,QAAO,SAAS,uBAAuB,uCAAuC,IAAI;EAEnF,MAAM,gBAAgB;EAGtB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,oBAAoB,IAAI;EAG9D,MAAM,WAAW,MAAM,QAAQ,UAAU;EACzC,MAAM,YAAY,SAAS,IAAI,OAAO;EACtC,MAAM,OAAO,qBAAqB,OAAO,YAAY;AAErD,MAAI,CAAC,KACJ,QAAO,SAAS,WAAW,oBAAoB,IAAI;EAGpD,MAAM,oBAAoB,2BAA2B,UACpD,SAAS,IAAI,cAAc,IAAI,OAC/B;AACD,MAAI,CAAC,kBAAkB,QACtB,QAAO,SAAS,oBAAoB,wBAAwB,KAAK,EAChE,QAAQ,kBAAkB,MAAM,OAAO,KAAK,WAAW;GACtD,MAAM;GACN,SAAS,MAAM;GACf,EAAE,EACH,CAAC;EAEH,MAAM,6BAA6B,oCAAoC,UACtE,SAAS,IAAI,uBAAuB,IAAI,OACxC;AACD,MAAI,CAAC,2BAA2B,QAC/B,QAAO,SAAS,oBAAoB,wBAAwB,IAAI;EAEjE,MAAM,cAAc,SAAS,IAAI,WAAW;EAC5C,IAAI;AACJ,MAAI,gBAAgB,MAAM;AACzB,OAAI,OAAO,gBAAgB,SAC1B,QAAO,SAAS,oBAAoB,wBAAwB,IAAI;AAEjE,OAAI,gBAAgB,UACnB,YAAW;QACL;IACN,MAAM,eAAe,oBAAoB,UAAU,YAAY;AAC/D,QAAI,CAAC,aAAa,QACjB,QAAO,SAAS,oBAAoB,wBAAwB,IAAI;AAEjE,eAAW,aAAa;;;EAK1B,MAAM,eAAe,SAAS,IAAI,UAAU;EAC5C,MAAM,UACL,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,eAAe;EAG9E,MAAM,aADiB,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,GAAG,SAC/C,CAAC,GAAG,wBAAwB;AAEhE,MAAI,CAAC,qBAAqB,KAAK,MAAM,UAAU,CAC9C,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;AAI9D,MAAI,KAAK,OAAO,cACf,QAAO,SACN,qBACA,gCAAgC,eAAe,cAAc,IAC7D,IACA;EAIF,MAAM,SAAS,IAAI,WAAW,MAAM,KAAK,aAAa,CAAC;EACvD,MAAM,cAAc,MAAM,mBAAmB,OAAO;EAGpD,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAC3C,MAAI,kBAAkB,MAAM;GAC3B,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY;AAC1D,OAAI,SAEH,QAAO,WAAW;IAAE,MADA,cAAc,SAAS;IACJ,cAAc;IAAM,CAAC;;EAG9D,MAAM,WAAW,2BAA2B,OACzC,MAAM,KAAK,sBAAsB,KAAK,KAAK,GAC3C,KAAK;EAKR,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,SAAS,IAAI;AAItC,QAAM,OAAO,QAAQ,OAAO;GAC3B,KAAK;GACL,MAAM;GACN,aAAa,KAAK;GAClB,CAAC;EAGF,MAAM,aAAa,SAAS,IAAI,QAAQ;EACxC,MAAM,WAAW,OAAO,eAAe,WAAW,aAAa;EAC/D,MAAM,cAAc,SAAS,IAAI,SAAS;EAC1C,MAAM,YAAY,OAAO,gBAAgB,WAAW,cAAc;EAClE,MAAM,QAAQ,WAAW,SAAS,UAAU,GAAG,GAAG;EAClD,MAAM,SAAS,YAAY,SAAS,WAAW,GAAG,GAAG;EAKrD,MAAM,iBAAiB,SAAS,IAAI,YAAY;EAChD,MAAM,YAAY,0BAA0B,OAAO,iBAAiB;EACpE,MAAM,WAAW,MAAM,oBAAoB,QAAQ,KAAK,MAAM;GAC7D,iBAAiB,SAAS,QAAQ,UAAU,OAAO;IAAE;IAAO;IAAQ,GAAG;GACvE,aAAa,YACV;IAAE,OAAO,IAAI,WAAW,MAAM,UAAU,aAAa,CAAC;IAAE,aAAa,UAAU;IAAM,GACrF;GACH,CAAC;EAGF,MAAM,SAAS,MAAM,OAAO,kBAAkB;GAC7C;GACA,UAAU,cAAc,KAAK,KAAK;GAClC,MAAM,KAAK;GAIX,OAAO,SAAS,SAAS;GACzB,QAAQ,UAAU,SAAS;GAC3B;GACA;GACA,UAAU,SAAS;GACnB,eAAe,SAAS;GACxB,UAAU,MAAM;GAChB;GACA,CAAC;AAEF,MAAI,CAAC,OAAO,SAAS;AAEpB,OAAI;AACH,UAAM,OAAO,QAAQ,OAAO,WAAW;WAChC;AAGR,UAAO,aAAa,OAAO;;AAM5B,SAAO,WAAW,EAAE,MAFA,cAAc,OAAO,KAAK,KAAK,EAEZ,EAAE,IAAI;UACrC,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}

package/dist/astro/routes/api/menus/_name_/items/_id_.mjs

@@ -1,19 +1,25 @@
-import "../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../config-CvmjJcVw.mjs";
 import "../../../../../../after-PcEvMY_6.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import { a as handleMenuItemDelete, s as handleMenuItemUpdate } from "../../../../../../menus-Wy8m5NcH.mjs";
-import { t as menuTag } from "../../../../../../chrome-tags-D7LGB91U.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../parse-Cr379Av9.mjs";
-import { b as localeFilterQuery } from "../../../../../../redirects-BCiTaIQ-.mjs";
-import { ct as updateMenuItemBody } from "../../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../../status-DLoBmcDz.mjs";
+import { a as handleMenuItemDelete, s as handleMenuItemUpdate } from "../../../../../../menus-ITeAbcIF.mjs";
+import { t as menuTag } from "../../../../../../chrome-tags-DApCQSIk.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../settings-DYidIB26.mjs";
+import "../../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../parse-DY6OD1j_.mjs";
+import { b as localeFilterQuery } from "../../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../../media-Pu1L6xir.mjs";
+import "../../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../../relations-CK9CYUyr.mjs";
+import { f as updateMenuItemBody } from "../../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../../status-DZKIG4a9.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/menus/[name]/items/[id].ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_/items/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/menus/[name]/items/[id].ts"],"sourcesContent":["/**\n * Single menu item endpoint\n *\n * PUT    /_emdash/api/menus/:name/items/:id[?locale=xx]\n * DELETE /_emdash/api/menus/:name/items/:id[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemDelete, handleMenuItemUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuItemBody } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const PUT: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemUpdate(emdash.db, name, itemId, body, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu item\", \"MENU_ITEM_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst result = await handleMenuItemDelete(emdash.db, name, itemId, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu item\", \"MENU_ITEM_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC1E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,MAAM,EACxE,QAAQ,QAAQ,QAChB,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB;;;AAInF,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC7E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,EAClE,QAAQ,QAAQ,QAChB,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/menus/[name]/items/[id].ts"],"sourcesContent":["/**\n * Single menu item endpoint\n *\n * PUT    /_emdash/api/menus/:name/items/:id[?locale=xx]\n * DELETE /_emdash/api/menus/:name/items/:id[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemDelete, handleMenuItemUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuItemBody } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const PUT: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemUpdate(emdash.db, name, itemId, body, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu item\", \"MENU_ITEM_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\tconst itemId = params.id;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tif (!itemId) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"id is required\", 400);\n\t}\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst result = await handleMenuItemDelete(emdash.db, name, itemId, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu item\", \"MENU_ITEM_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC1E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,MAAM,EACxE,QAAQ,QAAQ,QAChB,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB;;;AAInF,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC7E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CACpB,MAAM,SAAS,OAAO;CAEtB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OACJ,QAAO,SAAS,oBAAoB,kBAAkB,IAAI;CAG3D,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,MAAM,QAAQ,EAClE,QAAQ,QAAQ,QAChB,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}

package/dist/astro/routes/api/menus/_name_/items.mjs

@@ -1,19 +1,25 @@
-import "../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../after-PcEvMY_6.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { i as handleMenuItemCreate } from "../../../../../menus-Wy8m5NcH.mjs";
-import { t as menuTag } from "../../../../../chrome-tags-D7LGB91U.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import { b as localeFilterQuery } from "../../../../../redirects-BCiTaIQ-.mjs";
-import { $ as createMenuItemBody } from "../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import { i as handleMenuItemCreate } from "../../../../../menus-ITeAbcIF.mjs";
+import { t as menuTag } from "../../../../../chrome-tags-DApCQSIk.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import { b as localeFilterQuery } from "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../relations-CK9CYUyr.mjs";
+import { n as createMenuItemBody } from "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/menus/[name]/items.ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_/items.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"items.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/items.ts"],"sourcesContent":["/**\n * Menu items create endpoint\n *\n * POST /_emdash/api/menus/:name/items[?locale=xx] - Create a new menu item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemCreate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuItemBody, localeFilterQuery } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemCreate(emdash.db, name, body, { locale: localeQ.locale });\n\t\tif (!result.success) return unwrapResult(result, 201);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu item\", \"MENU_ITEM_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,MAAM,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC5F,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,QAAQ,IAAI;AACrD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}
+{"version":3,"file":"items.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/items.ts"],"sourcesContent":["/**\n * Menu items create endpoint\n *\n * POST /_emdash/api/menus/:name/items[?locale=xx] - Create a new menu item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemCreate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuItemBody, localeFilterQuery } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuItemBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemCreate(emdash.db, name, body, { locale: localeQ.locale });\n\t\tif (!result.success) return unwrapResult(result, 201);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu item\", \"MENU_ITEM_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,MAAM,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC5F,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,QAAQ,IAAI;AACrD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,yBAAyB"}