emdash 0.39.1 → 0.40.0

package/dist/astro/routes/api/auth/invite/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite\n *\n * Create an invite for a new user. Admin only.\n *\n * When an email provider is configured (via the plugin email pipeline),\n * the invite email is sent automatically.\n * When no provider is configured, returns the invite URL for the admin\n * to share manually (copy-link fallback).\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createInvite, InviteError, Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { inviteCreateBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Default to AUTHOR role if not specified (Zod validates the level)\n\t\tconst role = body.role ?? Role.AUTHOR;\n\n\t\t// Get site config for invite email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in invite emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\n\t\t// Build email sender from the plugin pipeline (if available)\n\t\tconst emailSend = emdash.email?.isAvailable()\n\t\t\t? (message: { to: string; subject: string; text: string; html?: string }) =>\n\t\t\t\t\temdash.email!.send(message, \"system\")\n\t\t\t: undefined;\n\n\t\tconst result = await createInvite(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: emailSend,\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email,\n\t\t\trole,\n\t\t\tuser.id,\n\t\t);\n\n\t\tif (emailSend) {\n\t\t\t// Email was sent\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: `Invite sent to ${body.email}`,\n\t\t\t});\n\t\t}\n\n\t\t// No email provider — return the invite URL for manual sharing\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"Invite created. No email provider configured — share the link manually.\",\n\t\t\t\tinviteUrl: result.url,\n\t\t\t},\n\t\t\t200,\n\t\t);\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tuser_exists: 409,\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 400,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to create invite\", \"INVITE_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAaA,MAAa,YAAY;AAWzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,KAAK,QAAQ,KAAK;EAI/B,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EAGrE,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EAGvE,MAAM,YAAY,OAAO,OAAO,aAAa,IACzC,YACD,OAAO,MAAO,KAAK,SAAS,SAAS,GACrC;EAEH,MAAM,SAAS,MAAM,aACpB;GACC;GACA;GACA,OAAO;GACP,EACD,SACA,KAAK,OACL,MACA,KAAK,GACL;AAED,MAAI,UAEH,QAAO,WAAW;GACjB,SAAS;GACT,SAAS,kBAAkB,KAAK;GAChC,CAAC;AAIH,SAAO,WACN;GACC,SAAS;GACT,SAAS;GACT,WAAW,OAAO;GAClB,EACD,IACA;UACO,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,aAAa;GACb,eAAe;GACf,eAAe;GACf,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,2BAA2B,sBAAsB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite\n *\n * Create an invite for a new user. Admin only.\n *\n * When an email provider is configured (via the plugin email pipeline),\n * the invite email is sent automatically.\n * When no provider is configured, returns the invite URL for the admin\n * to share manually (copy-link fallback).\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { getInviteEmailStrings } from \"@emdash-cms/admin/locales/emails\";\nimport { createInvite, InviteError, Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { resolveEmailLocale } from \"#api/email-locale.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { inviteCreateBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Default to AUTHOR role if not specified (Zod validates the level)\n\t\tconst role = body.role ?? Role.AUTHOR;\n\n\t\t// Get site config for invite email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteOptions = await options.getMany<string>([\"emdash:site_title\", \"emdash:locale\"]);\n\t\tconst siteName = siteOptions.get(\"emdash:site_title\") || \"EmDash\";\n\n\t\t// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in invite emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\n\t\t// Build email sender from the plugin pipeline (if available)\n\t\tconst emailSend = emdash.email?.isAvailable()\n\t\t\t? (message: { to: string; subject: string; text: string; html?: string }) =>\n\t\t\t\t\temdash.email!.send(message, \"system\")\n\t\t\t: undefined;\n\n\t\t// Localize the invite email copy. Only resolved when an\n\t\t// email will actually be sent — the copy-link fallback has no copy.\n\t\tconst emailLocale = emailSend\n\t\t\t? resolveEmailLocale(siteOptions.get(\"emdash:locale\"), request)\n\t\t\t: undefined;\n\t\tconst emailStrings = emailLocale\n\t\t\t? await getInviteEmailStrings(emailLocale, siteName)\n\t\t\t: undefined;\n\n\t\tconst result = await createInvite(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: emailSend,\n\t\t\t\temailStrings,\n\t\t\t\temailLocale,\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email,\n\t\t\trole,\n\t\t\tuser.id,\n\t\t);\n\n\t\tif (emailSend) {\n\t\t\t// Email was sent\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: `Invite sent to ${body.email}`,\n\t\t\t});\n\t\t}\n\n\t\t// No email provider — return the invite URL for manual sharing\n\t\treturn apiSuccess(\n\t\t\t{\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"Invite created. No email provider configured — share the link manually.\",\n\t\t\t\tinviteUrl: result.url,\n\t\t\t},\n\t\t\t200,\n\t\t);\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tuser_exists: 409,\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 400,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to create invite\", \"INVITE_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAaA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,KAAK,QAAQ,KAAK;EAI/B,MAAM,cAAc,MADJ,IAAI,kBAAkB,OAAO,GAAG,CACd,QAAgB,CAAC,qBAAqB,gBAAgB,CAAC;EACzF,MAAM,WAAW,YAAY,IAAI,oBAAoB,IAAI;EAGzD,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EAGvE,MAAM,YAAY,OAAO,OAAO,aAAa,IACzC,YACD,OAAO,MAAO,KAAK,SAAS,SAAS,GACrC;EAIH,MAAM,cAAc,YACjB,mBAAmB,YAAY,IAAI,gBAAgB,EAAE,QAAQ,GAC7D;EAKH,MAAM,SAAS,MAAM,aACpB;GACC;GACA;GACA,OAAO;GACP,cATmB,cAClB,MAAM,sBAAsB,aAAa,SAAS,GAClD;GAQD;GACA,EACD,SACA,KAAK,OACL,MACA,KAAK,GACL;AAED,MAAI,UAEH,QAAO,WAAW;GACjB,SAAS;GACT,SAAS,kBAAkB,KAAK;GAChC,CAAC;AAIH,SAAO,WACN;GACC,SAAS;GACT,SAAS;GACT,WAAW,OAAO;GAClB,EACD,IACA;UACO,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,aAAa;GACb,eAAe;GACf,eAAe;GACf,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,2BAA2B,sBAAsB"}

package/dist/astro/routes/api/auth/invite/register-options.mjs

@@ -1,18 +1,24 @@
-import "../../../../../config-CGVeT8Hc.mjs";
-import { t as OptionsRepository } from "../../../../../options-D5WcorD5.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
+import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import "../../../../../redirects-BCiTaIQ-.mjs";
-import "../../../../../entry-lock-CwWdnFyR.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import { j as inviteRegisterOptionsBody } from "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import { j as inviteRegisterOptionsBody } from "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-BWVHsfQv.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-CkRdSdd8.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-BD-wMaCf.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Bn7U0D7-.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-ppU6Uv13.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-X_H8128a.mjs";
 import { ulid } from "ulidx";
 import { InviteError, validateInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";

package/dist/astro/routes/api/auth/invite/register-options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"register-options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/register-options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite/register-options\n *\n * Generate WebAuthn registration options for an invited user.\n * Validates the invite token and creates a temporary user identity\n * for the passkey registration flow.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { validateInvite, InviteError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { inviteRegisterOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteRegisterOptionsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Validate the invite token to get the email\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst invite = await validateInvite(adapter, body.token);\n\n\t\t// Get passkey config\n\t\t// Resolve siteUrl from config / EMDASH_SITE_URL so the RP ID matches the\n\t\t// browser-facing origin when running behind a TLS-terminating reverse proxy\n\t\t// (e.g. Traefik, nginx). Without this, getPasskeyConfig falls back to\n\t\t// url.hostname — the internal hostname like \"localhost\" — and the browser\n\t\t// rejects the WebAuthn registration. See issue #994.\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options with a temporary user identity\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst tempUser = {\n\t\t\tid: ulid(),\n\t\t\temail: invite.email,\n\t\t\tname: body.name || null,\n\t\t};\n\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\ttempUser,\n\t\t\t[],\n\t\t\tchallengeStore,\n\t\t);\n\n\t\treturn apiSuccess({ options: registrationOptions });\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tinvalid_token: 404,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_exists: 409,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to generate registration options\",\n\t\t\t\"INVITE_REGISTER_OPTIONS_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,0BAA0B;AAChE,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,SAAS,MAAM,eADL,oBAAoB,OAAO,GAAG,EACD,KAAK,MAAM;EAQxD,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAIhC,MAAM,gBAAgB,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;AActD,SAAO,WAAW,EAAE,SAPQ,MAAM,4BACjC,eAPgB;GAChB,IAAI,MAAM;GACV,OAAO,OAAO;GACd,MAAM,KAAK,QAAQ;GACnB,EAKA,EAAE,EACF,eACA,EAEiD,CAAC;UAC3C,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,eAAe;GACf,eAAe;GACf,aAAa;GACb,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YACN,OACA,2CACA,gCACA"}
+{"version":3,"file":"register-options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/invite/register-options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/invite/register-options\n *\n * Generate WebAuthn registration options for an invited user.\n * Validates the invite token and creates a temporary user identity\n * for the passkey registration flow.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { validateInvite, InviteError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { inviteRegisterOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, inviteRegisterOptionsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Validate the invite token to get the email\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst invite = await validateInvite(adapter, body.token);\n\n\t\t// Get passkey config\n\t\t// Resolve siteUrl from config / EMDASH_SITE_URL so the RP ID matches the\n\t\t// browser-facing origin when running behind a TLS-terminating reverse proxy\n\t\t// (e.g. Traefik, nginx). Without this, getPasskeyConfig falls back to\n\t\t// url.hostname — the internal hostname like \"localhost\" — and the browser\n\t\t// rejects the WebAuthn registration. See issue #994.\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options with a temporary user identity\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst tempUser = {\n\t\t\tid: ulid(),\n\t\t\temail: invite.email,\n\t\t\tname: body.name || null,\n\t\t};\n\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\ttempUser,\n\t\t\t[],\n\t\t\tchallengeStore,\n\t\t);\n\n\t\treturn apiSuccess({ options: registrationOptions });\n\t} catch (error) {\n\t\tif (error instanceof InviteError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tinvalid_token: 404,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_exists: 409,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to generate registration options\",\n\t\t\t\"INVITE_REGISTER_OPTIONS_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,0BAA0B;AAChE,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,SAAS,MAAM,eADL,oBAAoB,OAAO,GAAG,EACD,KAAK,MAAM;EAQxD,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAIhC,MAAM,gBAAgB,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;AActD,SAAO,WAAW,EAAE,SAPQ,MAAM,4BACjC,eAPgB;GAChB,IAAI,MAAM;GACV,OAAO,OAAO;GACd,MAAM,KAAK,QAAQ;GACnB,EAKA,EAAE,EACF,eACA,EAEiD,CAAC;UAC3C,OAAO;AACf,MAAI,iBAAiB,YAMpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SALN;GACzC,eAAe;GACf,eAAe;GACf,aAAa;GACb,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YACN,OACA,2CACA,gCACA"}

package/dist/astro/routes/api/auth/logout.mjs

@@ -1,7 +1,9 @@
 import "../../../../base64-DvnNgP7e.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, r as handleError } from "../../../../error-CCTCskie.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-BrChFPIu.mjs";
+import "../../../../errors-DgE1zJGG.mjs";
+import "../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError } from "../../../../error-CfvOHP0M.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-Cd1E7VUt.mjs";
 
 //#region src/astro/routes/api/auth/logout.ts
 const prerender = false;

package/dist/astro/routes/api/auth/logout.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"logout.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/logout.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/logout\n *\n * Destroys the current session and logs the user out.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiSuccess, handleError } from \"#api/error.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\n\nexport const POST: APIRoute = async ({ session, url }) => {\n\ttry {\n\t\t// Destroy session\n\t\tif (session) {\n\t\t\tsession.destroy();\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (isSafeRedirect(redirect)) {\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 302,\n\t\t\t\theaders: { Location: redirect },\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Logged out successfully\",\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Logout failed\", \"LOGOUT_ERROR\");\n\t}\n};\n\n// No GET handler — logout must be POST-only to prevent CSRF via link/img tags\n"],"mappings":";;;;;;AAQA,MAAa,YAAY;AAKzB,MAAa,OAAiB,OAAO,EAAE,SAAS,UAAU;AACzD,KAAI;AAEH,MAAI,QACH,SAAQ,SAAS;EAIlB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,eAAe,SAAS,CAC3B,QAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS,EAAE,UAAU,UAAU;GAC/B,CAAC;AAGH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}
+{"version":3,"file":"logout.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/logout.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/logout\n *\n * Destroys the current session and logs the user out.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiSuccess, handleError } from \"#api/error.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\n\nexport const POST: APIRoute = async ({ session, url }) => {\n\ttry {\n\t\t// Destroy session\n\t\tif (session) {\n\t\t\tsession.destroy();\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (isSafeRedirect(redirect)) {\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 302,\n\t\t\t\theaders: { Location: redirect },\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Logged out successfully\",\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Logout failed\", \"LOGOUT_ERROR\");\n\t}\n};\n\n// No GET handler — logout must be POST-only to prevent CSRF via link/img tags\n"],"mappings":";;;;;;;;AAQA,MAAa,YAAY;AAKzB,MAAa,OAAiB,OAAO,EAAE,SAAS,UAAU;AACzD,KAAI;AAEH,MAAI,QACH,SAAQ,SAAS;EAIlB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,eAAe,SAAS,CAC3B,QAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS,EAAE,UAAU,UAAU;GAC/B,CAAC;AAGH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,iBAAiB,eAAe"}

package/dist/astro/routes/api/auth/magic-link/send.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"send.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"mappings":";;;cAWa,SAAA;AAAA,cAaA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"send.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"mappings":";;;cAWa,SAAA;AAAA,cAeA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/magic-link/send.mjs

@@ -1,20 +1,28 @@
-import "../../../../../config-CGVeT8Hc.mjs";
-import { t as OptionsRepository } from "../../../../../options-D5WcorD5.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
+import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import "../../../../../redirects-BCiTaIQ-.mjs";
-import "../../../../../entry-lock-CwWdnFyR.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import { M as magicLinkSendBody } from "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import { M as magicLinkSendBody } from "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-Cg7SuD15.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-DjhYCaep.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-CqJn-w4h.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-tKiVtyTD.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-BU_bbxwj.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-BZ6nybgc.mjs";
+import { t as resolveEmailLocale } from "../../../../../email-locale-CN6WAMx0.mjs";
 import { sendMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { getMagicLinkEmailStrings } from "@emdash-cms/admin/locales/emails";
 
 //#region src/astro/routes/api/auth/magic-link/send.ts
 const prerender = false;
@@ -31,10 +39,16 @@ const POST = async ({ request, locals }) => {
 		});
 		if (!emdash.email?.isAvailable()) return apiError("EMAIL_NOT_CONFIGURED", "Email is not configured. Magic link authentication requires an email provider.", 503);
 		const options = new OptionsRepository(emdash.db);
+		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
+		const siteOptions = await options.getMany(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") ?? "EmDash";
+		const emailLocale = resolveEmailLocale(siteOptions.get("emdash:locale"), request);
 		await sendMagicLink({
-			baseUrl: await getSiteBaseUrl(emdash.db, request, emdash.config),
-			siteName: await options.get("emdash:site_title") ?? "EmDash",
-			email: (message) => emdash.email.send(message, "system")
+			baseUrl,
+			siteName,
+			email: (message) => emdash.email.send(message, "system"),
+			emailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),
+			emailLocale
 		}, createKyselyAdapter(emdash.db), body.email.toLowerCase());
 		return apiSuccess({
 			success: true,

package/dist/astro/routes/api/auth/magic-link/send.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? \"EmDash\";\n\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAYhD,QAAM,cAR0B;GAC/B,SAJe,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;GAKtE,UAJiB,MAAM,QAAQ,IAAY,oBAAoB,IAAK;GAKpE,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}
+{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { getMagicLinkEmailStrings } from \"@emdash-cms/admin/locales/emails\";\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { resolveEmailLocale } from \"#api/email-locale.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteOptions = await options.getMany<string>([\"emdash:site_title\", \"emdash:locale\"]);\n\t\tconst siteName = siteOptions.get(\"emdash:site_title\") ?? \"EmDash\";\n\n\t\t// Localized copy following the site locale; the locale also\n\t\t// drives lang/dir on the email HTML so RTL copy renders correctly.\n\t\tconst emailLocale = resolveEmailLocale(siteOptions.get(\"emdash:locale\"), request);\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\temailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),\n\t\t\temailLocale,\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EACvE,MAAM,cAAc,MAAM,QAAQ,QAAgB,CAAC,qBAAqB,gBAAgB,CAAC;EACzF,MAAM,WAAW,YAAY,IAAI,oBAAoB,IAAI;EAIzD,MAAM,cAAc,mBAAmB,YAAY,IAAI,gBAAgB,EAAE,QAAQ;AAWjF,QAAM,cAV0B;GAC/B;GACA;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,cAAc,MAAM,yBAAyB,aAAa,SAAS;GACnE;GACA,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}

package/dist/astro/routes/api/auth/magic-link/verify.d.mts

@@ -3,6 +3,7 @@ import { APIRoute } from "astro";
 //#region src/astro/routes/api/auth/magic-link/verify.d.ts
 declare const prerender = false;
 declare const GET: APIRoute;
+declare const POST: APIRoute;
 //#endregion
-export { GET, prerender };
+export { GET, POST, prerender };
 //# sourceMappingURL=verify.d.mts.map

package/dist/astro/routes/api/auth/magic-link/verify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"mappings":";;;cASa,SAAA;AAAA,cAQA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"mappings":";;;cAca,SAAA;AAAA,cASA,GAAA,EAAK,QAAA;AAAA,cAYL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/magic-link/verify.mjs

@@ -1,35 +1,55 @@
+import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { t as isSafeRedirect } from "../../../../../redirect-BrChFPIu.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import { N as magicLinkVerifyBody } from "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
+import "../../../../../api/schemas/index.mjs";
 import { MagicLinkError, verifyMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/magic-link/verify.ts
 const prerender = false;
-const GET = async ({ url, locals, session, redirect }) => {
-	const { emdash } = locals;
-	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+const GET = async ({ url, redirect }) => {
 	const token = url.searchParams.get("token");
 	if (!token) return redirect("/_emdash/admin/login?error=missing_token");
+	const confirmUrl = new URLSearchParams({ token });
+	const rawRedirect = url.searchParams.get("redirect");
+	if (rawRedirect) confirmUrl.set("redirect", rawRedirect);
+	return redirect(`/_emdash/admin/login/magic-link?${confirmUrl.toString()}`);
+};
+const POST = async ({ request, locals, session }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	try {
+		const body = await parseBody(request, magicLinkVerifyBody);
+		if (isParseError(body)) return body;
 		const adapter = createKyselyAdapter(emdash.db);
-		const user = await verifyMagicLink(adapter, token);
+		const user = await verifyMagicLink(adapter, body.token);
 		adapter.deleteExpiredTokens().catch(() => {});
-		if (session) session.set("user", { id: user.id });
-		const rawRedirect = url.searchParams.get("redirect");
-		return redirect(isSafeRedirect(rawRedirect) ? rawRedirect : "/_emdash/admin");
+		session?.set("user", { id: user.id });
+		return apiSuccess({ success: true });
 	} catch (error) {
-		console.error("Magic link verify error:", error);
-		if (error instanceof MagicLinkError) switch (error.code) {
-			case "invalid_token": return redirect("/_emdash/admin/login?error=invalid_link");
-			case "token_expired": return redirect("/_emdash/admin/login?error=link_expired");
-			case "user_not_found": return redirect("/_emdash/admin/login?error=user_not_found");
-		}
-		return redirect("/_emdash/admin/login?error=verification_failed");
+		if (error instanceof MagicLinkError) return apiError(error.code.toUpperCase(), error.message, {
+			invalid_token: 400,
+			token_expired: 410,
+			user_not_found: 404,
+			email_not_configured: 500
+		}[error.code]);
+		return handleError(error, "Failed to verify magic link", "MAGIC_LINK_VERIFY_ERROR");
 	}
 };
 
 //#endregion
-export { GET, prerender };
+export { GET, POST, prerender };
 //# sourceMappingURL=verify.mjs.map

package/dist/astro/routes/api/auth/magic-link/verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/magic-link/verify\n *\n * Verify a magic link token and create a session.\n * Tokens are single-use and expire after 15 minutes.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { verifyMagicLink, MagicLinkError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError } from \"#api/error.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\n\nexport const GET: APIRoute = async ({ url, locals, session, redirect }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Get token from query params\n\tconst token = url.searchParams.get(\"token\");\n\n\tif (!token) {\n\t\t// Redirect to login with error\n\t\treturn redirect(\"/_emdash/admin/login?error=missing_token\");\n\t}\n\n\ttry {\n\t\t// Verify the magic link token\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await verifyMagicLink(adapter, token);\n\n\t\t// Fire-and-forget cleanup of expired tokens -- prevents accumulation\n\t\tvoid adapter.deleteExpiredTokens().catch(() => {});\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Check for a stored redirect URL (from original request)\n\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\tconst rawRedirect = url.searchParams.get(\"redirect\");\n\t\tconst redirectUrl = isSafeRedirect(rawRedirect) ? rawRedirect : \"/_emdash/admin\";\n\n\t\t// Redirect to admin dashboard or original URL\n\t\treturn redirect(redirectUrl);\n\t} catch (error) {\n\t\tconsole.error(\"Magic link verify error:\", error);\n\n\t\t// Handle specific errors\n\t\tif (error instanceof MagicLinkError) {\n\t\t\tswitch (error.code) {\n\t\t\t\tcase \"invalid_token\":\n\t\t\t\t\treturn redirect(\"/_emdash/admin/login?error=invalid_link\");\n\t\t\t\tcase \"token_expired\":\n\t\t\t\t\treturn redirect(\"/_emdash/admin/login?error=link_expired\");\n\t\t\t\tcase \"user_not_found\":\n\t\t\t\t\treturn redirect(\"/_emdash/admin/login?error=user_not_found\");\n\t\t\t}\n\t\t}\n\n\t\t// Generic error\n\t\treturn redirect(\"/_emdash/admin/login?error=verification_failed\");\n\t}\n};\n"],"mappings":";;;;;;;;AASA,MAAa,YAAY;AAQzB,MAAa,MAAgB,OAAO,EAAE,KAAK,QAAQ,SAAS,eAAe;CAC1E,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,KAAI,CAAC,MAEJ,QAAO,SAAS,2CAA2C;AAG5D,KAAI;EAEH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,OAAO,MAAM,gBAAgB,SAAS,MAAM;AAGlD,EAAK,QAAQ,qBAAqB,CAAC,YAAY,GAAG;AAGlD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAKrC,MAAM,cAAc,IAAI,aAAa,IAAI,WAAW;AAIpD,SAAO,SAHa,eAAe,YAAY,GAAG,cAAc,iBAGpC;UACpB,OAAO;AACf,UAAQ,MAAM,4BAA4B,MAAM;AAGhD,MAAI,iBAAiB,eACpB,SAAQ,MAAM,MAAd;GACC,KAAK,gBACJ,QAAO,SAAS,0CAA0C;GAC3D,KAAK,gBACJ,QAAO,SAAS,0CAA0C;GAC3D,KAAK,iBACJ,QAAO,SAAS,4CAA4C;;AAK/D,SAAO,SAAS,iDAAiD"}
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"sourcesContent":["/**\n * GET  /_emdash/api/auth/magic-link/verify\n * POST /_emdash/api/auth/magic-link/verify\n *\n * GET is the link in the email. It only forwards to the admin confirmation\n * page, because mail scanners fetch every link in a message and would\n * otherwise use up the single-use token before the recipient clicks.\n *\n * POST verifies the token and creates the session.\n * Tokens are single-use and expire after 15 minutes.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { verifyMagicLink, MagicLinkError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkVerifyBody } from \"#api/schemas.js\";\n\nexport const GET: APIRoute = async ({ url, redirect }) => {\n\tconst token = url.searchParams.get(\"token\");\n\tif (!token) {\n\t\treturn redirect(\"/_emdash/admin/login?error=missing_token\");\n\t}\n\n\tconst confirmUrl = new URLSearchParams({ token });\n\tconst rawRedirect = url.searchParams.get(\"redirect\");\n\tif (rawRedirect) confirmUrl.set(\"redirect\", rawRedirect);\n\treturn redirect(`/_emdash/admin/login/magic-link?${confirmUrl.toString()}`);\n};\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, magicLinkVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await verifyMagicLink(adapter, body.token);\n\n\t\t// Fire-and-forget cleanup of expired tokens -- prevents accumulation\n\t\tvoid adapter.deleteExpiredTokens().catch(() => {});\n\n\t\tsession?.set(\"user\", { id: user.id });\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\tif (error instanceof MagicLinkError) {\n\t\t\tconst statusMap: Record<MagicLinkError[\"code\"], number> = {\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_not_found: 404,\n\t\t\t\temail_not_configured: 500,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code]);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to verify magic link\", \"MAGIC_LINK_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AASzB,MAAa,MAAgB,OAAO,EAAE,KAAK,eAAe;CACzD,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAC3C,KAAI,CAAC,MACJ,QAAO,SAAS,2CAA2C;CAG5D,MAAM,aAAa,IAAI,gBAAgB,EAAE,OAAO,CAAC;CACjD,MAAM,cAAc,IAAI,aAAa,IAAI,WAAW;AACpD,KAAI,YAAa,YAAW,IAAI,YAAY,YAAY;AACxD,QAAO,SAAS,mCAAmC,WAAW,UAAU,GAAG;;AAG5E,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB;AAC1D,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,OAAO,MAAM,gBAAgB,SAAS,KAAK,MAAM;AAGvD,EAAK,QAAQ,qBAAqB,CAAC,YAAY,GAAG;AAElD,WAAS,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAErC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,MAAI,iBAAiB,eAOpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SANU;GACzD,eAAe;GACf,eAAe;GACf,gBAAgB;GAChB,sBAAsB;GACtB,CACkE,MAAM,MAAM;AAGhF,SAAO,YAAY,OAAO,+BAA+B,0BAA0B"}

package/dist/astro/routes/api/auth/me.mjs

@@ -1,14 +1,20 @@
-import "../../../../config-CGVeT8Hc.mjs";
+import "../../../../config-CvmjJcVw.mjs";
 import "../../../../base64-DvnNgP7e.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import { t as UserRepository } from "../../../../user-2R1gceFl.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-Cr379Av9.mjs";
-import "../../../../redirects-BCiTaIQ-.mjs";
-import "../../../../entry-lock-CwWdnFyR.mjs";
-import "../../../../comments-BVzzt6x5.mjs";
-import { O as authMeActionBody } from "../../../../relations-B4w-G5U9.mjs";
-import "../../../../status-DLoBmcDz.mjs";
+import { t as UserRepository } from "../../../../user-DDSL-sGw.mjs";
+import "../../../../errors-DgE1zJGG.mjs";
+import "../../../../settings-DYidIB26.mjs";
+import "../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-DY6OD1j_.mjs";
+import "../../../../redirects-Cv9apQKj.mjs";
+import "../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../media-Pu1L6xir.mjs";
+import "../../../../comments-fHZ8ON9O.mjs";
+import { O as authMeActionBody } from "../../../../relations-CK9CYUyr.mjs";
+import "../../../../menus-BM7BPLOb.mjs";
+import "../../../../status-DZKIG4a9.mjs";
 import "../../../../api/schemas/index.mjs";
 
 //#region src/astro/routes/api/auth/me.ts

package/dist/astro/routes/api/auth/me.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"me.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/me.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/me\n *\n * Returns the current authenticated user's info.\n * Used by the admin UI to display user info in the header.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { authMeActionBody } from \"#api/schemas.js\";\nimport { UserRepository } from \"#db/repositories/user.js\";\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tlet userData = user.data;\n\tif (locals.__playgroundDb) {\n\t\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\t\ttry {\n\t\t\tconst persistedUser = await new UserRepository(emdash.db).findById(user.id);\n\t\t\tif (persistedUser) userData = persistedUser.data;\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to fetch current user\", \"CURRENT_USER_ERROR\");\n\t\t}\n\t}\n\n\t// Check if this is the user's first login (for welcome modal).\n\t// The flag is persisted in the user's `data` JSON column so it survives\n\t// session expiry / rotation.\n\tconst isFirstLogin = !userData?.welcomeDismissed;\n\n\t// Return safe user info (no sensitive data)\n\treturn apiSuccess({\n\t\tid: user.id,\n\t\temail: user.email,\n\t\tname: user.name,\n\t\trole: user.role,\n\t\tavatarUrl: user.avatarUrl,\n\t\tisFirstLogin,\n\t});\n};\n\n/**\n * POST /_emdash/api/auth/me\n *\n * Mark that the user has seen the welcome modal.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst body = await parseBody(request, authMeActionBody);\n\tif (isParseError(body)) return body;\n\n\tif (body.action === \"dismissWelcome\") {\n\t\ttry {\n\t\t\t// Persist in the user's data column so it survives session expiry.\n\t\t\tconst userRepo = new UserRepository(emdash.db);\n\t\t\tawait userRepo.update(user.id, {\n\t\t\t\tdata: { ...user.data, welcomeDismissed: true },\n\t\t\t});\n\t\t\treturn apiSuccess({ success: true });\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to dismiss welcome\", \"WELCOME_DISMISS_ERROR\");\n\t\t}\n\t}\n\n\treturn apiError(\"UNKNOWN_ACTION\", \"Unknown action\", 400);\n};\n"],"mappings":";;;;;;;;;;;;;;AASA,MAAa,YAAY;AAOzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;CAG/D,IAAI,WAAW,KAAK;AACpB,KAAI,OAAO,gBAAgB;AAC1B,MAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEhF,MAAI;GACH,MAAM,gBAAgB,MAAM,IAAI,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,GAAG;AAC3E,OAAI,cAAe,YAAW,cAAc;WACpC,OAAO;AACf,UAAO,YAAY,OAAO,gCAAgC,qBAAqB;;;CAOjF,MAAM,eAAe,CAAC,UAAU;AAGhC,QAAO,WAAW;EACjB,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB;EACA,CAAC;;;;;;;AAQH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,KAAI,aAAa,KAAK,CAAE,QAAO;AAE/B,KAAI,KAAK,WAAW,iBACnB,KAAI;AAGH,QADiB,IAAI,eAAe,OAAO,GAAG,CAC/B,OAAO,KAAK,IAAI,EAC9B,MAAM;GAAE,GAAG,KAAK;GAAM,kBAAkB;GAAM,EAC9C,CAAC;AACF,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB;;AAIjF,QAAO,SAAS,kBAAkB,kBAAkB,IAAI"}
+{"version":3,"file":"me.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/me.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/me\n *\n * Returns the current authenticated user's info.\n * Used by the admin UI to display user info in the header.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { authMeActionBody } from \"#api/schemas.js\";\nimport { UserRepository } from \"#db/repositories/user.js\";\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tlet userData = user.data;\n\tif (locals.__playgroundDb) {\n\t\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\t\ttry {\n\t\t\tconst persistedUser = await new UserRepository(emdash.db).findById(user.id);\n\t\t\tif (persistedUser) userData = persistedUser.data;\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to fetch current user\", \"CURRENT_USER_ERROR\");\n\t\t}\n\t}\n\n\t// Check if this is the user's first login (for welcome modal).\n\t// The flag is persisted in the user's `data` JSON column so it survives\n\t// session expiry / rotation.\n\tconst isFirstLogin = !userData?.welcomeDismissed;\n\n\t// Return safe user info (no sensitive data)\n\treturn apiSuccess({\n\t\tid: user.id,\n\t\temail: user.email,\n\t\tname: user.name,\n\t\trole: user.role,\n\t\tavatarUrl: user.avatarUrl,\n\t\tisFirstLogin,\n\t});\n};\n\n/**\n * POST /_emdash/api/auth/me\n *\n * Mark that the user has seen the welcome modal.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst body = await parseBody(request, authMeActionBody);\n\tif (isParseError(body)) return body;\n\n\tif (body.action === \"dismissWelcome\") {\n\t\ttry {\n\t\t\t// Persist in the user's data column so it survives session expiry.\n\t\t\tconst userRepo = new UserRepository(emdash.db);\n\t\t\tawait userRepo.update(user.id, {\n\t\t\t\tdata: { ...user.data, welcomeDismissed: true },\n\t\t\t});\n\t\t\treturn apiSuccess({ success: true });\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to dismiss welcome\", \"WELCOME_DISMISS_ERROR\");\n\t\t}\n\t}\n\n\treturn apiError(\"UNKNOWN_ACTION\", \"Unknown action\", 400);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAOzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;CAG/D,IAAI,WAAW,KAAK;AACpB,KAAI,OAAO,gBAAgB;AAC1B,MAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEhF,MAAI;GACH,MAAM,gBAAgB,MAAM,IAAI,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,GAAG;AAC3E,OAAI,cAAe,YAAW,cAAc;WACpC,OAAO;AACf,UAAO,YAAY,OAAO,gCAAgC,qBAAqB;;;CAOjF,MAAM,eAAe,CAAC,UAAU;AAGhC,QAAO,WAAW;EACjB,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB;EACA,CAAC;;;;;;;AAQH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,KAAI,aAAa,KAAK,CAAE,QAAO;AAE/B,KAAI,KAAK,WAAW,iBACnB,KAAI;AAGH,QADiB,IAAI,eAAe,OAAO,GAAG,CAC/B,OAAO,KAAK,IAAI,EAC9B,MAAM;GAAE,GAAG,KAAK;GAAM,kBAAkB;GAAM,EAC9C,CAAC;AACF,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB;;AAIjF,QAAO,SAAS,kBAAkB,kBAAkB,IAAI"}

package/dist/astro/routes/api/auth/mode.mjs

@@ -1,7 +1,9 @@
 import "../../../../base64-DvnNgP7e.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess } from "../../../../error-CCTCskie.mjs";
-import { t as getAuthMode } from "../../../../mode-CkmOhFqj.mjs";
+import "../../../../errors-DgE1zJGG.mjs";
+import "../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess } from "../../../../error-CfvOHP0M.mjs";
+import { t as getAuthMode } from "../../../../mode-CCuKXUci.mjs";
 
 //#region src/astro/routes/api/auth/mode.ts
 const prerender = false;

package/dist/astro/routes/api/auth/mode.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mode.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/mode.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/mode\n *\n * Public endpoint that returns the active authentication mode.\n * Used by the login page to determine which login UI to render.\n *\n * Unlike the full manifest endpoint, this is intentionally public\n * and returns only the auth mode — no collection schemas, plugin\n * info, or other internal details.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiSuccess } from \"#api/error.js\";\nimport { getAuthMode } from \"#auth/mode.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash } = locals;\n\n\tconst authMode = getAuthMode(emdash?.config);\n\n\t// Only check signup for passkey auth (external providers handle their own)\n\tlet signupEnabled = false;\n\tif (emdash?.db && authMode.type === \"passkey\") {\n\t\ttry {\n\t\t\tconst { sql } = await import(\"kysely\");\n\t\t\tconst result = await sql<{ cnt: unknown }>`\n\t\t\t\tSELECT COUNT(*) as cnt FROM allowed_domains WHERE enabled = 1\n\t\t\t`.execute(emdash.db);\n\t\t\tsignupEnabled = Number(result.rows[0]?.cnt ?? 0) > 0;\n\t\t} catch {\n\t\t\t// Table may not exist yet\n\t\t}\n\t}\n\n\t// Collect pluggable auth providers (from authProviders config)\n\tconst providers = (emdash?.config?.authProviders ?? []).map((p) => ({\n\t\tid: p.id,\n\t\tlabel: p.label,\n\t}));\n\n\treturn apiSuccess({\n\t\tauthMode: authMode.type === \"external\" ? authMode.providerType : \"passkey\",\n\t\tsignupEnabled,\n\t\tproviders,\n\t});\n};\n"],"mappings":";;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,WAAW;CAEnB,MAAM,WAAW,YAAY,QAAQ,OAAO;CAG5C,IAAI,gBAAgB;AACpB,KAAI,QAAQ,MAAM,SAAS,SAAS,UACnC,KAAI;EACH,MAAM,EAAE,QAAQ,MAAM,OAAO;EAC7B,MAAM,SAAS,MAAM,GAAqB;;KAExC,QAAQ,OAAO,GAAG;AACpB,kBAAgB,OAAO,OAAO,KAAK,IAAI,OAAO,EAAE,GAAG;SAC5C;CAMT,MAAM,aAAa,QAAQ,QAAQ,iBAAiB,EAAE,EAAE,KAAK,OAAO;EACnE,IAAI,EAAE;EACN,OAAO,EAAE;EACT,EAAE;AAEH,QAAO,WAAW;EACjB,UAAU,SAAS,SAAS,aAAa,SAAS,eAAe;EACjE;EACA;EACA,CAAC"}
+{"version":3,"file":"mode.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/mode.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/mode\n *\n * Public endpoint that returns the active authentication mode.\n * Used by the login page to determine which login UI to render.\n *\n * Unlike the full manifest endpoint, this is intentionally public\n * and returns only the auth mode — no collection schemas, plugin\n * info, or other internal details.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiSuccess } from \"#api/error.js\";\nimport { getAuthMode } from \"#auth/mode.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash } = locals;\n\n\tconst authMode = getAuthMode(emdash?.config);\n\n\t// Only check signup for passkey auth (external providers handle their own)\n\tlet signupEnabled = false;\n\tif (emdash?.db && authMode.type === \"passkey\") {\n\t\ttry {\n\t\t\tconst { sql } = await import(\"kysely\");\n\t\t\tconst result = await sql<{ cnt: unknown }>`\n\t\t\t\tSELECT COUNT(*) as cnt FROM allowed_domains WHERE enabled = 1\n\t\t\t`.execute(emdash.db);\n\t\t\tsignupEnabled = Number(result.rows[0]?.cnt ?? 0) > 0;\n\t\t} catch {\n\t\t\t// Table may not exist yet\n\t\t}\n\t}\n\n\t// Collect pluggable auth providers (from authProviders config)\n\tconst providers = (emdash?.config?.authProviders ?? []).map((p) => ({\n\t\tid: p.id,\n\t\tlabel: p.label,\n\t}));\n\n\treturn apiSuccess({\n\t\tauthMode: authMode.type === \"external\" ? authMode.providerType : \"passkey\",\n\t\tsignupEnabled,\n\t\tproviders,\n\t});\n};\n"],"mappings":";;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,WAAW;CAEnB,MAAM,WAAW,YAAY,QAAQ,OAAO;CAG5C,IAAI,gBAAgB;AACpB,KAAI,QAAQ,MAAM,SAAS,SAAS,UACnC,KAAI;EACH,MAAM,EAAE,QAAQ,MAAM,OAAO;EAC7B,MAAM,SAAS,MAAM,GAAqB;;KAExC,QAAQ,OAAO,GAAG;AACpB,kBAAgB,OAAO,OAAO,KAAK,IAAI,OAAO,EAAE,GAAG;SAC5C;CAMT,MAAM,aAAa,QAAQ,QAAQ,iBAAiB,EAAE,EAAE,KAAK,OAAO;EACnE,IAAI,EAAE;EACN,OAAO,EAAE;EACT,EAAE;AAEH,QAAO,WAAW;EACjB,UAAU,SAAS,SAAS,aAAa,SAAS,eAAe;EACjE;EACA;EACA,CAAC"}

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs

@@ -1,7 +1,7 @@
-import { t as OptionsRepository } from "../../../../../../options-D5WcorD5.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-BWVHsfQv.mjs";
-import { t as finalizeSetup } from "../../../../../../setup-complete-BrZaXpVV.mjs";
-import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-0gIdb48-.mjs";
+import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-Bn7U0D7-.mjs";
+import { t as finalizeSetup } from "../../../../../../setup-complete-bOogcHWG.mjs";
+import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-BbjnZXNC.mjs";
 import { OAuthError, Role, handleOAuthCallback } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/oauth/_provider_.mjs

@@ -1,5 +1,5 @@
-import { r as getPublicOrigin } from "../../../../../public-url-BWVHsfQv.mjs";
-import { t as createOAuthStateStore } from "../../../../../oauth-state-store-0gIdb48-.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Bn7U0D7-.mjs";
+import { t as createOAuthStateStore } from "../../../../../oauth-state-store-BbjnZXNC.mjs";
 import { createAuthorizationUrl } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/auth/oauth/[provider].ts

package/dist/astro/routes/api/auth/passkey/_id_.mjs

@@ -1,13 +1,19 @@
-import "../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import "../../../../../redirects-BCiTaIQ-.mjs";
-import "../../../../../entry-lock-CwWdnFyR.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import { I as passkeyRenameBody } from "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import { L as passkeyRenameBody } from "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/passkey/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/[id].ts"],"sourcesContent":["/**\n * PATCH/DELETE /_emdash/api/auth/passkey/[id]\n *\n * Rename or delete a passkey\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { passkeyRenameBody } from \"#api/schemas.js\";\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\n/**\n * PATCH - Rename a passkey\n */\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRenameBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Update the name\n\t\tconst trimmedName = body.name.trim() || null;\n\t\tawait adapter.updateCredentialName(id, trimmedName);\n\n\t\t// Return updated passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: trimmedName,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to rename passkey\", \"PASSKEY_RENAME_ERROR\");\n\t}\n};\n\n/**\n * DELETE - Remove a passkey\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Check that this isn't the last passkey\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\n\t\tif (count <= 1) {\n\t\t\treturn apiError(\"LAST_PASSKEY\", \"Cannot remove your last passkey\", 400);\n\t\t}\n\n\t\t// Delete the passkey\n\t\tawait adapter.deleteCredential(id);\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete passkey\", \"PASSKEY_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAQA,MAAa,YAAY;;;;AAoBzB,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;EAIvD,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,cAAc,KAAK,KAAK,MAAM,IAAI;AACxC,QAAM,QAAQ,qBAAqB,IAAI,YAAY;AAYnD,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM;GACN,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;;;;AAO/E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;AAMvD,MAFc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAEhD,EACZ,QAAO,SAAS,gBAAgB,mCAAmC,IAAI;AAIxE,QAAM,QAAQ,iBAAiB,GAAG;AAElC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/[id].ts"],"sourcesContent":["/**\n * PATCH/DELETE /_emdash/api/auth/passkey/[id]\n *\n * Rename or delete a passkey\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { passkeyRenameBody } from \"#api/schemas.js\";\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\n/**\n * PATCH - Rename a passkey\n */\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRenameBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Update the name\n\t\tconst trimmedName = body.name.trim() || null;\n\t\tawait adapter.updateCredentialName(id, trimmedName);\n\n\t\t// Return updated passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: trimmedName,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to rename passkey\", \"PASSKEY_RENAME_ERROR\");\n\t}\n};\n\n/**\n * DELETE - Remove a passkey\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Check that this isn't the last passkey\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\n\t\tif (count <= 1) {\n\t\t\treturn apiError(\"LAST_PASSKEY\", \"Cannot remove your last passkey\", 400);\n\t\t}\n\n\t\t// Delete the passkey\n\t\tawait adapter.deleteCredential(id);\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete passkey\", \"PASSKEY_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;;;;AAoBzB,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;EAIvD,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,cAAc,KAAK,KAAK,MAAM,IAAI;AACxC,QAAM,QAAQ,qBAAqB,IAAI,YAAY;AAYnD,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM;GACN,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;;;;AAO/E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;AAMvD,MAFc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAEhD,EACZ,QAAO,SAAS,gBAAgB,mCAAmC,IAAI;AAIxE,QAAM,QAAQ,iBAAiB,GAAG;AAElC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}

package/dist/astro/routes/api/auth/passkey/index.mjs

@@ -1,6 +1,8 @@
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CCTCskie.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/passkey/index.ts

package/dist/astro/routes/api/auth/passkey/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/index.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/passkey\n *\n * List all passkeys for the authenticated user\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst credentials = await adapter.getCredentialsByUserId(user.id);\n\n\t\t// Map to public response format (exclude sensitive fields)\n\t\tconst passkeys: PasskeyResponse[] = credentials.map((cred) => ({\n\t\t\tid: cred.id,\n\t\t\tname: cred.name,\n\t\t\tdeviceType: cred.deviceType,\n\t\t\tbackedUp: cred.backedUp,\n\t\t\tcreatedAt: cred.createdAt.toISOString(),\n\t\t\tlastUsedAt: cred.lastUsedAt.toISOString(),\n\t\t}));\n\n\t\treturn apiSuccess({ items: passkeys });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list passkeys\", \"PASSKEY_LIST_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;AAQA,MAAa,YAAY;AAezB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;AAcH,SAAO,WAAW,EAAE,QAZA,MADJ,oBAAoB,OAAO,GAAG,CACZ,uBAAuB,KAAK,GAAG,EAGjB,KAAK,UAAU;GAC9D,IAAI,KAAK;GACT,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,UAAU,KAAK;GACf,WAAW,KAAK,UAAU,aAAa;GACvC,YAAY,KAAK,WAAW,aAAa;GACzC,EAAE,EAEkC,CAAC;UAC9B,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,qBAAqB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/index.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/passkey\n *\n * List all passkeys for the authenticated user\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst credentials = await adapter.getCredentialsByUserId(user.id);\n\n\t\t// Map to public response format (exclude sensitive fields)\n\t\tconst passkeys: PasskeyResponse[] = credentials.map((cred) => ({\n\t\t\tid: cred.id,\n\t\t\tname: cred.name,\n\t\t\tdeviceType: cred.deviceType,\n\t\t\tbackedUp: cred.backedUp,\n\t\t\tcreatedAt: cred.createdAt.toISOString(),\n\t\t\tlastUsedAt: cred.lastUsedAt.toISOString(),\n\t\t}));\n\n\t\treturn apiSuccess({ items: passkeys });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list passkeys\", \"PASSKEY_LIST_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;AAQA,MAAa,YAAY;AAezB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;AAcH,SAAO,WAAW,EAAE,QAZA,MADJ,oBAAoB,OAAO,GAAG,CACZ,uBAAuB,KAAK,GAAG,EAGjB,KAAK,UAAU;GAC9D,IAAI,KAAK;GACT,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,UAAU,KAAK;GACf,WAAW,KAAK,UAAU,aAAa;GACvC,YAAY,KAAK,WAAW,aAAa;GACzC,EAAE,EAEkC,CAAC;UAC9B,OAAO;AACf,SAAO,YAAY,OAAO,2BAA2B,qBAAqB"}

package/dist/astro/routes/api/auth/passkey/options.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"mappings":";;;cAUa,SAAA;AAAA,cAeA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"options.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"mappings":";;;cAUa,SAAA;AAAA,cAcA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/passkey/options.mjs

@@ -1,21 +1,26 @@
-import "../../../../../config-CGVeT8Hc.mjs";
-import { t as OptionsRepository } from "../../../../../options-D5WcorD5.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
+import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import "../../../../../redirects-BCiTaIQ-.mjs";
-import "../../../../../entry-lock-CwWdnFyR.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import { N as passkeyOptionsBody } from "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import { P as passkeyOptionsBody } from "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-Cg7SuD15.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-BWVHsfQv.mjs";
-import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-CkRdSdd8.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-BD-wMaCf.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-CqJn-w4h.mjs";
-import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-tKiVtyTD.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Bn7U0D7-.mjs";
+import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-ppU6Uv13.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-BZ6nybgc.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-X_H8128a.mjs";
 import { generateAuthenticationOptions } from "@emdash-cms/auth/passkey";
 
 //#region src/astro/routes/api/auth/passkey/options.ts
@@ -29,18 +34,10 @@ const POST = async ({ request, locals }) => {
 		if (isParseError(body)) return body;
 		const ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));
 		if (!(await checkRateLimit(emdash.db, ip, "passkey/options", 10, 60)).allowed) return rateLimitResponse(60);
-		const adapter = createKyselyAdapter(emdash.db);
-		let credentials = [];
-		if (body.email) {
-			const user = await adapter.getUserByEmail(body.email);
-			if (user) credentials = await adapter.getCredentialsByUserId(user.id);
-		}
 		const url = new URL(request.url);
-		const passkeyConfig = getPasskeyConfig(url, await new OptionsRepository(emdash.db).get("emdash:site_title") ?? void 0, getPublicOrigin(url, emdash?.config));
-		const challengeStore = createChallengeStore(emdash.db);
 		return apiSuccess({
 			success: true,
-			options: await generateAuthenticationOptions(passkeyConfig, credentials, challengeStore)
+			options: await generateAuthenticationOptions(getPasskeyConfig(url, await new OptionsRepository(emdash.db).get("emdash:site_title") ?? void 0, getPublicOrigin(url, emdash?.config)), [], createChallengeStore(emdash.db))
 		});
 	} catch (error) {
 		return handleError(error, "Failed to generate passkey options", "PASSKEY_OPTIONS_ERROR");