emdash 0.40.0 → 0.40.1

package/dist/astro/routes/api/schema/collections/index.mjs

@@ -9,13 +9,13 @@ import "../../../../../content-DFaIEDj9.mjs";
 import "../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../slugify-T5GHH42D.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../media-Qp5S3eH3.mjs";
+import "../../../../../media-CPXTbb1R.mjs";
 import "../../../../../user-DDSL-sGw.mjs";
 import "../../../../../taxonomy-C3Fu1YeH.mjs";
 import "../../../../../comment-CrBl22OF.mjs";
 import "../../../../../menus-ITeAbcIF.mjs";
 import "../../../../../resolve-2WbQsCvT.mjs";
-import "../../../../../redirect-iJf5fltD.mjs";
+import "../../../../../redirect-B29UjdUn.mjs";
 import "../../../../../request-cache-DzLYKm_x.mjs";
 import "../../../../../byline-registry-gnKscbQX.mjs";
 import "../../../../../field-defs-cache-HIgBbqZZ.mjs";
@@ -27,7 +27,7 @@ import "../../../../../fts-manager-S-K0laoS.mjs";
 import "../../../../../loader-BzqeR1ZN.mjs";
 import "../../../../../collection-slugs-cache-CjGk__zp.mjs";
 import "../../../../../taxonomies-C1IwNe8Q.mjs";
-import "../../../../../api-cFFZpyS0.mjs";
+import "../../../../../api-CuyNEHZG.mjs";
 import "../../../../../capture-triggers-kJyl_yyM.mjs";
 import "../../../../../activation-LOkDM5WT.mjs";
 import "../../../../../block-type-registry-DUI_3KxT.mjs";
@@ -37,14 +37,14 @@ import "../../../../../canonical-YhEQezjg.mjs";
 import "../../../../../digest-BarSh-pN.mjs";
 import "../../../../../hash-SDAW6zC-.mjs";
 import "../../../../../zod-generator-D6uE4WiS.mjs";
-import "../../../../../dashboard-DjrB-xxZ.mjs";
+import "../../../../../dashboard-BP-iJqpd.mjs";
 import "../../../../../block-values-C_VIPr5t.mjs";
-import "../../../../../media-h7tOiDLj.mjs";
+import "../../../../../media-JXRWDhw3.mjs";
 import "../../../../../media-folders-BE0oo2eX.mjs";
 import "../../../../../media-usage-work-C2OZLCAd.mjs";
 import "../../../../../content-repair-Q8IUrpLL.mjs";
 import "../../../../../collection-deletion-processor-Br6rxs3u.mjs";
-import "../../../../../media-usage-My-Vi-ex.mjs";
+import "../../../../../media-usage-De-zeR9E.mjs";
 import "../../../../../settings-DYidIB26.mjs";
 import "../../../../../site-settings-DOgRUoFX.mjs";
 import "../../../../../errors-BF0_LFhW.mjs";
@@ -55,9 +55,9 @@ import "../../../../../schema-BABiRdsH.mjs";
 import { o as handleSchemaCollectionList, r as handleSchemaCollectionCreate } from "../../../../../schema-Du3MzCG0.mjs";
 import "../../../../../block-types-BmZmLmAD.mjs";
 import "../../../../../seo-CZT2oLtT.mjs";
-import "../../../../../settings-CgjRWGW9.mjs";
+import "../../../../../settings-B4vDl1fK.mjs";
 import "../../../../../sections-Ddptx_o9.mjs";
-import "../../../../../settings-2xNYr90o.mjs";
+import "../../../../../settings-Dyj6v8C4.mjs";
 import "../../../../../taxonomies-C_XMoRcX.mjs";
 import "../../../../../manifest-schema-CY3zng_M.mjs";
 import "../../../../../artifact-fetch-DZMOGZ3-.mjs";

package/dist/astro/routes/api/schema/collections/reorder.mjs

@@ -9,13 +9,13 @@ import "../../../../../content-DFaIEDj9.mjs";
 import "../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../slugify-T5GHH42D.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../media-Qp5S3eH3.mjs";
+import "../../../../../media-CPXTbb1R.mjs";
 import "../../../../../user-DDSL-sGw.mjs";
 import "../../../../../taxonomy-C3Fu1YeH.mjs";
 import "../../../../../comment-CrBl22OF.mjs";
 import "../../../../../menus-ITeAbcIF.mjs";
 import "../../../../../resolve-2WbQsCvT.mjs";
-import "../../../../../redirect-iJf5fltD.mjs";
+import "../../../../../redirect-B29UjdUn.mjs";
 import "../../../../../request-cache-DzLYKm_x.mjs";
 import "../../../../../byline-registry-gnKscbQX.mjs";
 import "../../../../../field-defs-cache-HIgBbqZZ.mjs";
@@ -27,7 +27,7 @@ import "../../../../../fts-manager-S-K0laoS.mjs";
 import "../../../../../loader-BzqeR1ZN.mjs";
 import "../../../../../collection-slugs-cache-CjGk__zp.mjs";
 import "../../../../../taxonomies-C1IwNe8Q.mjs";
-import "../../../../../api-cFFZpyS0.mjs";
+import "../../../../../api-CuyNEHZG.mjs";
 import "../../../../../capture-triggers-kJyl_yyM.mjs";
 import "../../../../../activation-LOkDM5WT.mjs";
 import "../../../../../block-type-registry-DUI_3KxT.mjs";
@@ -37,14 +37,14 @@ import "../../../../../canonical-YhEQezjg.mjs";
 import "../../../../../digest-BarSh-pN.mjs";
 import "../../../../../hash-SDAW6zC-.mjs";
 import "../../../../../zod-generator-D6uE4WiS.mjs";
-import "../../../../../dashboard-DjrB-xxZ.mjs";
+import "../../../../../dashboard-BP-iJqpd.mjs";
 import "../../../../../block-values-C_VIPr5t.mjs";
-import "../../../../../media-h7tOiDLj.mjs";
+import "../../../../../media-JXRWDhw3.mjs";
 import "../../../../../media-folders-BE0oo2eX.mjs";
 import "../../../../../media-usage-work-C2OZLCAd.mjs";
 import "../../../../../content-repair-Q8IUrpLL.mjs";
 import "../../../../../collection-deletion-processor-Br6rxs3u.mjs";
-import "../../../../../media-usage-My-Vi-ex.mjs";
+import "../../../../../media-usage-De-zeR9E.mjs";
 import "../../../../../settings-DYidIB26.mjs";
 import "../../../../../site-settings-DOgRUoFX.mjs";
 import "../../../../../errors-BF0_LFhW.mjs";
@@ -55,9 +55,9 @@ import "../../../../../schema-BABiRdsH.mjs";
 import { s as handleSchemaCollectionReorder } from "../../../../../schema-Du3MzCG0.mjs";
 import "../../../../../block-types-BmZmLmAD.mjs";
 import "../../../../../seo-CZT2oLtT.mjs";
-import "../../../../../settings-CgjRWGW9.mjs";
+import "../../../../../settings-B4vDl1fK.mjs";
 import "../../../../../sections-Ddptx_o9.mjs";
-import "../../../../../settings-2xNYr90o.mjs";
+import "../../../../../settings-Dyj6v8C4.mjs";
 import "../../../../../taxonomies-C_XMoRcX.mjs";
 import "../../../../../manifest-schema-CY3zng_M.mjs";
 import "../../../../../artifact-fetch-DZMOGZ3-.mjs";

package/dist/astro/routes/api/schema/orphans/_slug_.mjs

@@ -9,13 +9,13 @@ import "../../../../../content-DFaIEDj9.mjs";
 import "../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../slugify-T5GHH42D.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../media-Qp5S3eH3.mjs";
+import "../../../../../media-CPXTbb1R.mjs";
 import "../../../../../user-DDSL-sGw.mjs";
 import "../../../../../taxonomy-C3Fu1YeH.mjs";
 import "../../../../../comment-CrBl22OF.mjs";
 import "../../../../../menus-ITeAbcIF.mjs";
 import "../../../../../resolve-2WbQsCvT.mjs";
-import "../../../../../redirect-iJf5fltD.mjs";
+import "../../../../../redirect-B29UjdUn.mjs";
 import "../../../../../request-cache-DzLYKm_x.mjs";
 import "../../../../../byline-registry-gnKscbQX.mjs";
 import "../../../../../field-defs-cache-HIgBbqZZ.mjs";
@@ -27,7 +27,7 @@ import "../../../../../fts-manager-S-K0laoS.mjs";
 import "../../../../../loader-BzqeR1ZN.mjs";
 import "../../../../../collection-slugs-cache-CjGk__zp.mjs";
 import "../../../../../taxonomies-C1IwNe8Q.mjs";
-import "../../../../../api-cFFZpyS0.mjs";
+import "../../../../../api-CuyNEHZG.mjs";
 import "../../../../../capture-triggers-kJyl_yyM.mjs";
 import "../../../../../activation-LOkDM5WT.mjs";
 import "../../../../../block-type-registry-DUI_3KxT.mjs";
@@ -37,14 +37,14 @@ import "../../../../../canonical-YhEQezjg.mjs";
 import "../../../../../digest-BarSh-pN.mjs";
 import "../../../../../hash-SDAW6zC-.mjs";
 import "../../../../../zod-generator-D6uE4WiS.mjs";
-import "../../../../../dashboard-DjrB-xxZ.mjs";
+import "../../../../../dashboard-BP-iJqpd.mjs";
 import "../../../../../block-values-C_VIPr5t.mjs";
-import "../../../../../media-h7tOiDLj.mjs";
+import "../../../../../media-JXRWDhw3.mjs";
 import "../../../../../media-folders-BE0oo2eX.mjs";
 import "../../../../../media-usage-work-C2OZLCAd.mjs";
 import "../../../../../content-repair-Q8IUrpLL.mjs";
 import "../../../../../collection-deletion-processor-Br6rxs3u.mjs";
-import "../../../../../media-usage-My-Vi-ex.mjs";
+import "../../../../../media-usage-De-zeR9E.mjs";
 import "../../../../../settings-DYidIB26.mjs";
 import "../../../../../site-settings-DOgRUoFX.mjs";
 import "../../../../../errors-BF0_LFhW.mjs";
@@ -55,9 +55,9 @@ import "../../../../../schema-BABiRdsH.mjs";
 import { n as handleOrphanedTableRegister } from "../../../../../schema-Du3MzCG0.mjs";
 import "../../../../../block-types-BmZmLmAD.mjs";
 import "../../../../../seo-CZT2oLtT.mjs";
-import "../../../../../settings-CgjRWGW9.mjs";
+import "../../../../../settings-B4vDl1fK.mjs";
 import "../../../../../sections-Ddptx_o9.mjs";
-import "../../../../../settings-2xNYr90o.mjs";
+import "../../../../../settings-Dyj6v8C4.mjs";
 import "../../../../../taxonomies-C_XMoRcX.mjs";
 import "../../../../../manifest-schema-CY3zng_M.mjs";
 import "../../../../../artifact-fetch-DZMOGZ3-.mjs";

package/dist/astro/routes/api/schema/orphans/index.mjs

@@ -9,13 +9,13 @@ import "../../../../../content-DFaIEDj9.mjs";
 import "../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../slugify-T5GHH42D.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../media-Qp5S3eH3.mjs";
+import "../../../../../media-CPXTbb1R.mjs";
 import "../../../../../user-DDSL-sGw.mjs";
 import "../../../../../taxonomy-C3Fu1YeH.mjs";
 import "../../../../../comment-CrBl22OF.mjs";
 import "../../../../../menus-ITeAbcIF.mjs";
 import "../../../../../resolve-2WbQsCvT.mjs";
-import "../../../../../redirect-iJf5fltD.mjs";
+import "../../../../../redirect-B29UjdUn.mjs";
 import "../../../../../request-cache-DzLYKm_x.mjs";
 import "../../../../../byline-registry-gnKscbQX.mjs";
 import "../../../../../field-defs-cache-HIgBbqZZ.mjs";
@@ -27,7 +27,7 @@ import "../../../../../fts-manager-S-K0laoS.mjs";
 import "../../../../../loader-BzqeR1ZN.mjs";
 import "../../../../../collection-slugs-cache-CjGk__zp.mjs";
 import "../../../../../taxonomies-C1IwNe8Q.mjs";
-import "../../../../../api-cFFZpyS0.mjs";
+import "../../../../../api-CuyNEHZG.mjs";
 import "../../../../../capture-triggers-kJyl_yyM.mjs";
 import "../../../../../activation-LOkDM5WT.mjs";
 import "../../../../../block-type-registry-DUI_3KxT.mjs";
@@ -37,14 +37,14 @@ import "../../../../../canonical-YhEQezjg.mjs";
 import "../../../../../digest-BarSh-pN.mjs";
 import "../../../../../hash-SDAW6zC-.mjs";
 import "../../../../../zod-generator-D6uE4WiS.mjs";
-import "../../../../../dashboard-DjrB-xxZ.mjs";
+import "../../../../../dashboard-BP-iJqpd.mjs";
 import "../../../../../block-values-C_VIPr5t.mjs";
-import "../../../../../media-h7tOiDLj.mjs";
+import "../../../../../media-JXRWDhw3.mjs";
 import "../../../../../media-folders-BE0oo2eX.mjs";
 import "../../../../../media-usage-work-C2OZLCAd.mjs";
 import "../../../../../content-repair-Q8IUrpLL.mjs";
 import "../../../../../collection-deletion-processor-Br6rxs3u.mjs";
-import "../../../../../media-usage-My-Vi-ex.mjs";
+import "../../../../../media-usage-De-zeR9E.mjs";
 import "../../../../../settings-DYidIB26.mjs";
 import "../../../../../site-settings-DOgRUoFX.mjs";
 import "../../../../../errors-BF0_LFhW.mjs";
@@ -55,9 +55,9 @@ import "../../../../../schema-BABiRdsH.mjs";
 import { t as handleOrphanedTableList } from "../../../../../schema-Du3MzCG0.mjs";
 import "../../../../../block-types-BmZmLmAD.mjs";
 import "../../../../../seo-CZT2oLtT.mjs";
-import "../../../../../settings-CgjRWGW9.mjs";
+import "../../../../../settings-B4vDl1fK.mjs";
 import "../../../../../sections-Ddptx_o9.mjs";
-import "../../../../../settings-2xNYr90o.mjs";
+import "../../../../../settings-Dyj6v8C4.mjs";
 import "../../../../../taxonomies-C_XMoRcX.mjs";
 import "../../../../../manifest-schema-CY3zng_M.mjs";
 import "../../../../../artifact-fetch-DZMOGZ3-.mjs";

package/dist/astro/routes/api/settings/backups/archives/_name_.mjs

@@ -5,8 +5,8 @@ import "../../../../../../types-BkUg2yHx.mjs";
 import "../../../../../../errors-DgE1zJGG.mjs";
 import { t as ErrorCode } from "../../../../../../errors-BF0_LFhW.mjs";
 import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
-import "../../../../../../snapshot-CugwUqKQ.mjs";
-import { a as deleteBackupArchive, c as isValidArchiveName, r as BACKUP_STORAGE_PREFIX } from "../../../../../../backup-CBu0LrXf.mjs";
+import "../../../../../../snapshot-PawoX-WG.mjs";
+import { a as deleteBackupArchive, c as isValidArchiveName, r as BACKUP_STORAGE_PREFIX } from "../../../../../../backup-BQRj3afm.mjs";
 import { i as requirePerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/settings/backups/archives/[name].ts

package/dist/astro/routes/api/settings/backups/archives/index.mjs

@@ -5,8 +5,8 @@ import "../../../../../../types-BkUg2yHx.mjs";
 import "../../../../../../errors-DgE1zJGG.mjs";
 import "../../../../../../errors-BF0_LFhW.mjs";
 import { a as unwrapResult, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
-import "../../../../../../snapshot-CugwUqKQ.mjs";
-import { d as runBackupToStorage, s as getBackupSettings } from "../../../../../../backup-CBu0LrXf.mjs";
+import "../../../../../../snapshot-PawoX-WG.mjs";
+import { d as runBackupToStorage, s as getBackupSettings } from "../../../../../../backup-BQRj3afm.mjs";
 import { i as requirePerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/settings/backups/archives/index.ts

package/dist/astro/routes/api/settings/backups/export.mjs

@@ -5,8 +5,8 @@ import "../../../../../types-BkUg2yHx.mjs";
 import "../../../../../errors-DgE1zJGG.mjs";
 import { t as ErrorCode } from "../../../../../errors-BF0_LFhW.mjs";
 import { r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
-import "../../../../../snapshot-CugwUqKQ.mjs";
-import { i as archiveNameForDate, o as generateBackupJson } from "../../../../../backup-CBu0LrXf.mjs";
+import "../../../../../snapshot-PawoX-WG.mjs";
+import { i as archiveNameForDate, o as generateBackupJson } from "../../../../../backup-BQRj3afm.mjs";
 import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/settings/backups/export.ts

package/dist/astro/routes/api/settings/backups/index.mjs

@@ -6,8 +6,8 @@ import "../../../../../errors-DgE1zJGG.mjs";
 import { t as ErrorCode } from "../../../../../errors-BF0_LFhW.mjs";
 import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
 import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../snapshot-CugwUqKQ.mjs";
-import { f as updateBackupSettings, l as listBackupArchives, n as BACKUP_RETENTION_MIN, s as getBackupSettings, t as BACKUP_RETENTION_MAX } from "../../../../../backup-CBu0LrXf.mjs";
+import "../../../../../snapshot-PawoX-WG.mjs";
+import { f as updateBackupSettings, l as listBackupArchives, n as BACKUP_RETENTION_MIN, s as getBackupSettings, t as BACKUP_RETENTION_MAX } from "../../../../../backup-BQRj3afm.mjs";
 import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 import { z } from "zod";
 

package/dist/astro/routes/api/settings.mjs

@@ -6,7 +6,7 @@ import "../../../base64-DvnNgP7e.mjs";
 import "../../../secrets-CIi0nFiR.mjs";
 import "../../../object-cache-CqWNY5uP.mjs";
 import "../../../types-BkUg2yHx.mjs";
-import "../../../media-Qp5S3eH3.mjs";
+import "../../../media-CPXTbb1R.mjs";
 import "../../../request-cache-DzLYKm_x.mjs";
 import { n as siteSettingsTag } from "../../../chrome-tags-DApCQSIk.mjs";
 import "../../../loader-BzqeR1ZN.mjs";
@@ -14,8 +14,8 @@ import "../../../errors-DgE1zJGG.mjs";
 import "../../../settings-DYidIB26.mjs";
 import "../../../site-settings-DOgRUoFX.mjs";
 import "../../../errors-BF0_LFhW.mjs";
-import "../../../settings-CgjRWGW9.mjs";
-import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-2xNYr90o.mjs";
+import "../../../settings-B4vDl1fK.mjs";
+import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-Dyj6v8C4.mjs";
 import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-CfvOHP0M.mjs";
 import { n as parseBody, t as isParseError } from "../../../parse-DY6OD1j_.mjs";
 import "../../../redirects-Cv9apQKj.mjs";

package/dist/astro/routes/api/setup/dev-bypass.mjs

@@ -9,10 +9,10 @@ import "../../../../content-DFaIEDj9.mjs";
 import "../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../slugify-T5GHH42D.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import "../../../../media-Qp5S3eH3.mjs";
+import "../../../../media-CPXTbb1R.mjs";
 import "../../../../taxonomy-C3Fu1YeH.mjs";
 import "../../../../resolve-2WbQsCvT.mjs";
-import "../../../../redirect-iJf5fltD.mjs";
+import "../../../../redirect-B29UjdUn.mjs";
 import "../../../../request-cache-DzLYKm_x.mjs";
 import "../../../../byline-registry-gnKscbQX.mjs";
 import "../../../../field-defs-cache-HIgBbqZZ.mjs";
@@ -34,10 +34,10 @@ import "../../../../block-values-C_VIPr5t.mjs";
 import "../../../../media-usage-work-C2OZLCAd.mjs";
 import { n as repairContentMediaUsageCollection } from "../../../../content-repair-Q8IUrpLL.mjs";
 import "../../../../errors-BF0_LFhW.mjs";
-import "../../../../settings-CgjRWGW9.mjs";
+import "../../../../settings-B4vDl1fK.mjs";
 import "../../../../ssrf-CJUnJymJ.mjs";
 import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CfvOHP0M.mjs";
-import { t as applySeed } from "../../../../apply-CoT603H3.mjs";
+import { t as applySeed } from "../../../../apply-npY1TAhG.mjs";
 import "../../../../ssrf-DpBH7aOt.mjs";
 import { n as validateSeed } from "../../../../validate-CHosPEhs.mjs";
 import { t as loadSeed } from "../../../../load-XgJiE6_3.mjs";

package/dist/astro/routes/api/setup/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAYA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAuBA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/setup/index.mjs

@@ -9,10 +9,10 @@ import "../../../../content-DFaIEDj9.mjs";
 import "../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../slugify-T5GHH42D.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import "../../../../media-Qp5S3eH3.mjs";
+import "../../../../media-CPXTbb1R.mjs";
 import "../../../../taxonomy-C3Fu1YeH.mjs";
 import "../../../../resolve-2WbQsCvT.mjs";
-import "../../../../redirect-iJf5fltD.mjs";
+import "../../../../redirect-B29UjdUn.mjs";
 import "../../../../request-cache-DzLYKm_x.mjs";
 import "../../../../byline-registry-gnKscbQX.mjs";
 import "../../../../field-defs-cache-HIgBbqZZ.mjs";
@@ -34,7 +34,7 @@ import "../../../../block-values-C_VIPr5t.mjs";
 import "../../../../settings-DYidIB26.mjs";
 import "../../../../site-settings-DOgRUoFX.mjs";
 import "../../../../errors-BF0_LFhW.mjs";
-import "../../../../settings-CgjRWGW9.mjs";
+import "../../../../settings-B4vDl1fK.mjs";
 import "../../../../ssrf-CJUnJymJ.mjs";
 import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CfvOHP0M.mjs";
 import { n as parseBody, t as isParseError } from "../../../../parse-DY6OD1j_.mjs";
@@ -46,15 +46,28 @@ import { x as setupBody } from "../../../../relations-CK9CYUyr.mjs";
 import "../../../../menus-BM7BPLOb.mjs";
 import "../../../../status-DZKIG4a9.mjs";
 import "../../../../api/schemas/index.mjs";
-import { t as applySeed } from "../../../../apply-CoT603H3.mjs";
+import { n as applySeedWithinBudget } from "../../../../apply-npY1TAhG.mjs";
 import "../../../../ssrf-DpBH7aOt.mjs";
 import { n as validateSeed } from "../../../../validate-CHosPEhs.mjs";
 import { t as loadSeed } from "../../../../load-XgJiE6_3.mjs";
-import { r as getPublicOrigin } from "../../../../public-url-Bn7U0D7-.mjs";
+import { t as getConfiguredOrigin } from "../../../../public-url-Bn7U0D7-.mjs";
 import { t as getAuthMode } from "../../../../mode-CCuKXUci.mjs";
 
 //#region src/astro/routes/api/setup/index.ts
 const prerender = false;
+/**
+* What one setup request may spend on the seed before the rest continues in
+* the next request. Cloudflare Workers Free allows 1,000 calls to D1, KV and R2
+* and 50 external fetches per request. A `$media` download takes at least three
+* fetches (two DNS-over-HTTPS lookups in `ssrfSafeFetch`, then the file) and
+* three more per redirect. The margin covers a redirect per download, the entry
+* that crosses the budget with its images, the phases after content and the
+* object-cache writes at the end.
+*/
+const SEED_BUDGET_PER_REQUEST = {
+	queries: 500,
+	mediaDownloads: 5
+};
 const POST = async ({ request, url, locals }) => {
 	const { emdash } = locals;
 	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
@@ -63,6 +76,10 @@ const POST = async ({ request, url, locals }) => {
 			const setupComplete = await new OptionsRepository(emdash.db).get("emdash:setup_complete");
 			if (setupComplete === true || setupComplete === "true") return apiError("ALREADY_CONFIGURED", "Setup has already been completed", 409);
 		} catch {}
+		const configuredSiteUrl = getConfiguredOrigin(emdash.config);
+		const loopbackHost = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+		const siteUrl = configuredSiteUrl ?? (import.meta.env.DEV && loopbackHost ? url.origin : void 0);
+		if (!siteUrl) return apiError("SITE_URL_REQUIRED", "Set siteUrl or EMDASH_SITE_URL before running production setup", 500);
 		const body = await parseBody(request, setupBody);
 		if (isParseError(body)) return body;
 		const seed = await loadSeed();
@@ -73,22 +90,22 @@ const POST = async ({ request, url, locals }) => {
 		};
 		const validation = validateSeed(seed);
 		if (!validation.valid) return apiError("INVALID_SEED", `Invalid seed file: ${validation.errors.join(", ")}`, 400);
-		let result;
+		let seeded;
 		try {
-			result = await applySeed(emdash.db, seed, {
+			seeded = await applySeedWithinBudget(emdash.db, seed, {
 				includeContent: body.includeContent,
 				onConflict: "skip",
 				storage: emdash.storage ?? void 0
-			});
+			}, SEED_BUDGET_PER_REQUEST);
 		} catch (error) {
 			return handleError(error, "Failed to apply seed", "SEED_ERROR");
 		}
+		const { result, complete: seedComplete, progress: seedProgress } = seeded;
 		const useExternalAuth = getAuthMode(emdash.config).type === "external";
 		try {
 			const options = new OptionsRepository(emdash.db);
-			const siteUrl = getPublicOrigin(url, emdash.config);
 			await options.setIfAbsent("emdash:site_url", siteUrl);
-			if (useExternalAuth) {
+			if (seedComplete) if (useExternalAuth) {
 				await options.set("emdash:setup_complete", true);
 				await options.set("emdash:site_title", body.title);
 				if (body.tagline) await options.set("emdash:site_tagline", body.tagline);
@@ -100,9 +117,17 @@ const POST = async ({ request, url, locals }) => {
 		} catch (error) {
 			console.error("Failed to save setup state:", error);
 		}
+		if (!seedComplete) return apiSuccess({
+			success: true,
+			setupComplete: false,
+			seedComplete: false,
+			seedProgress,
+			result
+		});
 		return apiSuccess({
 			success: true,
 			setupComplete: useExternalAuth,
+			seedComplete: true,
 			result
 		});
 	} catch (error) {

package/dist/astro/routes/api/setup/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup\n *\n * Executes the setup wizard - applies seed file and marks setup complete\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupBody } from \"#api/schemas.js\";\nimport { getAuthMode } from \"#auth/mode.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\nexport const POST: APIRoute = async ({ request, url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Guard: reject if setup has already been completed.\n\t\t// The options table may not exist on first-ever setup (pre-migration),\n\t\t// so a query failure means setup hasn't run yet — allow it to proceed.\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\t\treturn apiError(\"ALREADY_CONFIGURED\", \"Setup has already been completed\", 409);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Options table doesn't exist yet — first-ever setup, allow it\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Load seed file (user seed or built-in default)\n\t\tconst seed = await loadSeed();\n\n\t\t// Override seed settings with form values\n\t\tseed.settings = {\n\t\t\t...seed.settings,\n\t\t\ttitle: body.title,\n\t\t\ttagline: body.tagline,\n\t\t};\n\n\t\t// Apply seed\n\t\tconst validation = validateSeed(seed);\n\t\tif (!validation.valid) {\n\t\t\treturn apiError(\"INVALID_SEED\", `Invalid seed file: ${validation.errors.join(\", \")}`, 400);\n\t\t}\n\n\t\tlet result;\n\t\ttry {\n\t\t\tresult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent: body.includeContent,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to apply seed\", \"SEED_ERROR\");\n\t\t}\n\n\t\t// Store setup state\n\t\t// In external auth mode, mark setup complete immediately (first user to login becomes admin)\n\t\t// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)\n\t\tconst authMode = getAuthMode(emdash.config);\n\t\tconst useExternalAuth = authMode.type === \"external\";\n\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t\t// Store the canonical site URL from the setup request.\n\t\t\t// Write-once at the DB level so concurrent setup POSTs can't both\n\t\t\t// observe an empty value and race to write. A spoofed Host header\n\t\t\t// on a later call during the wizard window must not be able to\n\t\t\t// replace the first value.\n\t\t\tconst siteUrl = getPublicOrigin(url, emdash.config);\n\t\t\tawait options.setIfAbsent(\"emdash:site_url\", siteUrl);\n\n\t\t\tif (useExternalAuth) {\n\t\t\t\t// External auth mode: mark setup complete now\n\t\t\t\t// First user to log in via external provider will become admin\n\t\t\t\tawait options.set(\"emdash:setup_complete\", true);\n\t\t\t\tawait options.set(\"emdash:site_title\", body.title);\n\t\t\t\tif (body.tagline) {\n\t\t\t\t\tawait options.set(\"emdash:site_tagline\", body.tagline);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Passkey/provider mode: store state for next step (admin creation)\n\t\t\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t\t\tstep: \"site_complete\",\n\t\t\t\t\ttitle: body.title,\n\t\t\t\t\ttagline: body.tagline,\n\t\t\t\t});\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconsole.error(\"Failed to save setup state:\", error);\n\t\t\t// Non-fatal - continue anyway\n\t\t}\n\n\t\t// Return success with result\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\t// In external auth mode, setup is complete - redirect to admin\n\t\t\tsetupComplete: useExternalAuth,\n\t\t\tresult,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Setup failed\", \"SETUP_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAYzB,MAAa,OAAiB,OAAO,EAAE,SAAS,KAAK,aAAa;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAIH,MAAI;GAEH,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAEhE,OAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,sBAAsB,oCAAoC,IAAI;UAExE;EAKR,MAAM,OAAO,MAAM,UAAU,SAAS,UAAU;AAChD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,MAAM,UAAU;AAG7B,OAAK,WAAW;GACf,GAAG,KAAK;GACR,OAAO,KAAK;GACZ,SAAS,KAAK;GACd;EAGD,MAAM,aAAa,aAAa,KAAK;AACrC,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,gBAAgB,sBAAsB,WAAW,OAAO,KAAK,KAAK,IAAI,IAAI;EAG3F,IAAI;AACJ,MAAI;AACH,YAAS,MAAM,UAAU,OAAO,IAAI,MAAM;IACzC,gBAAgB,KAAK;IACrB,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;WACM,OAAO;AACf,UAAO,YAAY,OAAO,wBAAwB,aAAa;;EAOhE,MAAM,kBADW,YAAY,OAAO,OAAO,CACV,SAAS;AAE1C,MAAI;GACH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;GAOhD,MAAM,UAAU,gBAAgB,KAAK,OAAO,OAAO;AACnD,SAAM,QAAQ,YAAY,mBAAmB,QAAQ;AAErD,OAAI,iBAAiB;AAGpB,UAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,UAAM,QAAQ,IAAI,qBAAqB,KAAK,MAAM;AAClD,QAAI,KAAK,QACR,OAAM,QAAQ,IAAI,uBAAuB,KAAK,QAAQ;SAIvD,OAAM,QAAQ,IAAI,sBAAsB;IACvC,MAAM;IACN,OAAO,KAAK;IACZ,SAAS,KAAK;IACd,CAAC;WAEK,OAAO;AACf,WAAQ,MAAM,+BAA+B,MAAM;;AAKpD,SAAO,WAAW;GACjB,SAAS;GAET,eAAe;GACf;GACA,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gBAAgB,cAAc"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup\n *\n * Executes the setup wizard - applies seed file and marks setup complete\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getConfiguredOrigin } from \"#api/public-url.js\";\nimport { setupBody } from \"#api/schemas.js\";\nimport { getAuthMode } from \"#auth/mode.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { applySeedWithinBudget, type SeedApplyBudget } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\n/**\n * What one setup request may spend on the seed before the rest continues in\n * the next request. Cloudflare Workers Free allows 1,000 calls to D1, KV and R2\n * and 50 external fetches per request. A `$media` download takes at least three\n * fetches (two DNS-over-HTTPS lookups in `ssrfSafeFetch`, then the file) and\n * three more per redirect. The margin covers a redirect per download, the entry\n * that crosses the budget with its images, the phases after content and the\n * object-cache writes at the end.\n */\nconst SEED_BUDGET_PER_REQUEST: SeedApplyBudget = { queries: 500, mediaDownloads: 5 };\n\nexport const POST: APIRoute = async ({ request, url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Guard: reject if setup has already been completed.\n\t\t// The options table may not exist on first-ever setup (pre-migration),\n\t\t// so a query failure means setup hasn't run yet — allow it to proceed.\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\t\treturn apiError(\"ALREADY_CONFIGURED\", \"Setup has already been completed\", 409);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Options table doesn't exist yet — first-ever setup, allow it\n\t\t}\n\n\t\tconst configuredSiteUrl = getConfiguredOrigin(emdash.config);\n\t\tconst loopbackHost =\n\t\t\turl.hostname === \"localhost\" || url.hostname === \"127.0.0.1\" || url.hostname === \"[::1]\";\n\t\tconst siteUrl =\n\t\t\tconfiguredSiteUrl ?? (import.meta.env.DEV && loopbackHost ? url.origin : undefined);\n\t\tif (!siteUrl) {\n\t\t\treturn apiError(\n\t\t\t\t\"SITE_URL_REQUIRED\",\n\t\t\t\t\"Set siteUrl or EMDASH_SITE_URL before running production setup\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Load seed file (user seed or built-in default)\n\t\tconst seed = await loadSeed();\n\n\t\t// Override seed settings with form values\n\t\tseed.settings = {\n\t\t\t...seed.settings,\n\t\t\ttitle: body.title,\n\t\t\ttagline: body.tagline,\n\t\t};\n\n\t\t// Apply seed\n\t\tconst validation = validateSeed(seed);\n\t\tif (!validation.valid) {\n\t\t\treturn apiError(\"INVALID_SEED\", `Invalid seed file: ${validation.errors.join(\", \")}`, 400);\n\t\t}\n\n\t\tlet seeded;\n\t\ttry {\n\t\t\tseeded = await applySeedWithinBudget(\n\t\t\t\temdash.db,\n\t\t\t\tseed,\n\t\t\t\t{\n\t\t\t\t\tincludeContent: body.includeContent,\n\t\t\t\t\tonConflict: \"skip\",\n\t\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t\t},\n\t\t\t\tSEED_BUDGET_PER_REQUEST,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to apply seed\", \"SEED_ERROR\");\n\t\t}\n\t\tconst { result, complete: seedComplete, progress: seedProgress } = seeded;\n\n\t\t// Store setup state\n\t\t// In external auth mode, mark setup complete immediately (first user to login becomes admin)\n\t\t// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)\n\t\tconst authMode = getAuthMode(emdash.config);\n\t\tconst useExternalAuth = authMode.type === \"external\";\n\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t\t// Store the canonical site URL from the setup request.\n\t\t\t// Write-once at the DB level so concurrent setup POSTs can't both\n\t\t\t// observe an empty value and race to write. A spoofed Host header\n\t\t\t// on a later call during the wizard window must not be able to\n\t\t\t// replace the first value.\n\t\t\tawait options.setIfAbsent(\"emdash:site_url\", siteUrl);\n\n\t\t\tif (seedComplete) {\n\t\t\t\tif (useExternalAuth) {\n\t\t\t\t\t// External auth mode: mark setup complete now\n\t\t\t\t\t// First user to log in via external provider will become admin\n\t\t\t\t\tawait options.set(\"emdash:setup_complete\", true);\n\t\t\t\t\tawait options.set(\"emdash:site_title\", body.title);\n\t\t\t\t\tif (body.tagline) {\n\t\t\t\t\t\tawait options.set(\"emdash:site_tagline\", body.tagline);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\t// Passkey/provider mode: store state for next step (admin creation)\n\t\t\t\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t\t\t\tstep: \"site_complete\",\n\t\t\t\t\t\ttitle: body.title,\n\t\t\t\t\t\ttagline: body.tagline,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconsole.error(\"Failed to save setup state:\", error);\n\t\t\t// Non-fatal - continue anyway\n\t\t}\n\n\t\tif (!seedComplete) {\n\t\t\t// The wizard posts again; items already created are skipped.\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tsetupComplete: false,\n\t\t\t\tseedComplete: false,\n\t\t\t\tseedProgress,\n\t\t\t\tresult,\n\t\t\t});\n\t\t}\n\n\t\t// Return success with result\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\t// In external auth mode, setup is complete - redirect to admin\n\t\t\tsetupComplete: useExternalAuth,\n\t\t\tseedComplete: true,\n\t\t\tresult,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Setup failed\", \"SETUP_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;;;;;;;;;;AAqBzB,MAAM,0BAA2C;CAAE,SAAS;CAAK,gBAAgB;CAAG;AAEpF,MAAa,OAAiB,OAAO,EAAE,SAAS,KAAK,aAAa;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAIH,MAAI;GAEH,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAEhE,OAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,sBAAsB,oCAAoC,IAAI;UAExE;EAIR,MAAM,oBAAoB,oBAAoB,OAAO,OAAO;EAC5D,MAAM,eACL,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa;EAClF,MAAM,UACL,sBAAsB,OAAO,KAAK,IAAI,OAAO,eAAe,IAAI,SAAS;AAC1E,MAAI,CAAC,QACJ,QAAO,SACN,qBACA,kEACA,IACA;EAIF,MAAM,OAAO,MAAM,UAAU,SAAS,UAAU;AAChD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,MAAM,UAAU;AAG7B,OAAK,WAAW;GACf,GAAG,KAAK;GACR,OAAO,KAAK;GACZ,SAAS,KAAK;GACd;EAGD,MAAM,aAAa,aAAa,KAAK;AACrC,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,gBAAgB,sBAAsB,WAAW,OAAO,KAAK,KAAK,IAAI,IAAI;EAG3F,IAAI;AACJ,MAAI;AACH,YAAS,MAAM,sBACd,OAAO,IACP,MACA;IACC,gBAAgB,KAAK;IACrB,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,EACD,wBACA;WACO,OAAO;AACf,UAAO,YAAY,OAAO,wBAAwB,aAAa;;EAEhE,MAAM,EAAE,QAAQ,UAAU,cAAc,UAAU,iBAAiB;EAMnE,MAAM,kBADW,YAAY,OAAO,OAAO,CACV,SAAS;AAE1C,MAAI;GACH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAOhD,SAAM,QAAQ,YAAY,mBAAmB,QAAQ;AAErD,OAAI,aACH,KAAI,iBAAiB;AAGpB,UAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,UAAM,QAAQ,IAAI,qBAAqB,KAAK,MAAM;AAClD,QAAI,KAAK,QACR,OAAM,QAAQ,IAAI,uBAAuB,KAAK,QAAQ;SAIvD,OAAM,QAAQ,IAAI,sBAAsB;IACvC,MAAM;IACN,OAAO,KAAK;IACZ,SAAS,KAAK;IACd,CAAC;WAGI,OAAO;AACf,WAAQ,MAAM,+BAA+B,MAAM;;AAIpD,MAAI,CAAC,aAEJ,QAAO,WAAW;GACjB,SAAS;GACT,eAAe;GACf,cAAc;GACd;GACA;GACA,CAAC;AAIH,SAAO,WAAW;GACjB,SAAS;GAET,eAAe;GACf,cAAc;GACd;GACA,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gBAAgB,cAAc"}

package/dist/astro/routes/api/snapshot.mjs

@@ -8,7 +8,7 @@ import "../../../errors-DgE1zJGG.mjs";
 import "../../../errors-BF0_LFhW.mjs";
 import { n as apiSuccess, r as handleError, t as apiError } from "../../../error-CfvOHP0M.mjs";
 import { r as getPublicOrigin } from "../../../public-url-Bn7U0D7-.mjs";
-import { n as parsePreviewSignatureHeader, r as verifyPreviewSignature, t as generateSnapshot } from "../../../snapshot-CugwUqKQ.mjs";
+import { n as parsePreviewSignatureHeader, r as verifyPreviewSignature, t as generateSnapshot } from "../../../snapshot-PawoX-WG.mjs";
 import { t as resolveSessionUser } from "../../../session-user-BhaVp8w0.mjs";
 import { i as requirePerm } from "../../../authorize-seCifOMJ.mjs";
 
@@ -53,7 +53,7 @@ const GET = async ({ request, locals, url, session }) => {
 		if (schemaDenied) return schemaDenied;
 	}
 	try {
-		const includeDrafts = url.searchParams.get("drafts") === "true";
+		const includeDrafts = !authorized && url.searchParams.get("drafts") === "true";
 		return apiSuccess(await generateSnapshot(emdash.db, {
 			includeDrafts,
 			origin: getPublicOrigin(url, emdash.config)

package/dist/astro/routes/api/snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../../src/astro/routes/api/snapshot.ts"],"sourcesContent":["/**\n * Snapshot endpoint — exports a portable database snapshot for preview mode.\n *\n * Security:\n * - Authenticated users: requires content:read + schema:read permissions\n * - Preview services: requires valid X-Preview-Signature header (HMAC-SHA256)\n * - Excludes auth/user/session/token tables\n */\n\nimport type { User } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport {\n\tgenerateSnapshot,\n\tparsePreviewSignatureHeader,\n\tverifyPreviewSignature,\n} from \"#api/handlers/snapshot.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { resolveSecretsCached } from \"#config/secrets.js\";\n\nimport { resolveSessionUser } from \"../../session-user.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals, url, session }) => {\n\tconst { emdash } = locals;\n\t// This route is in PUBLIC_API_EXACT (for preview-signature callers with no session),\n\t// so auth middleware skips user resolution. Manually resolve the session user here\n\t// to support session-authenticated admin users alongside preview-signature auth.\n\tlet user: User | undefined = (locals as { user?: User }).user;\n\tif (!user && session && emdash?.db) {\n\t\ttry {\n\t\t\tconst { createKyselyAdapter } = await import(\"@emdash-cms/auth/adapters/kysely\");\n\t\t\tconst sessionUser = await resolveSessionUser(session);\n\t\t\tif (sessionUser?.id) {\n\t\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\t\tconst resolved = await adapter.getUserById(sessionUser.id);\n\t\t\t\tif (resolved && !resolved.disabled) {\n\t\t\t\t\tuser = resolved;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Session resolution failed, continue to preview-signature check\n\t\t}\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Check for preview signature auth (used by DO preview services)\n\tconst previewSig = request.headers.get(\"X-Preview-Signature\");\n\tlet authorized = false;\n\n\tif (previewSig) {\n\t\t// Resolves env override or DB-stored value. Always non-empty after\n\t\t// resolution, so the signature path is never silently disabled.\n\t\t// Note: a signing process without access to this database (e.g. a\n\t\t// remote preview Worker) must set the same `EMDASH_PREVIEW_SECRET`\n\t\t// env var on both sides.\n\t\tconst { previewSecret: secret, previewSecretSource } = await resolveSecretsCached(emdash.db);\n\t\tconst parsed = parsePreviewSignatureHeader(previewSig);\n\t\tif (!parsed) {\n\t\t\tconsole.warn(\"[snapshot] Failed to parse X-Preview-Signature header\");\n\t\t} else {\n\t\t\tauthorized = await verifyPreviewSignature(parsed.source, parsed.exp, parsed.sig, secret);\n\t\t\tif (!authorized) {\n\t\t\t\tconst fields: Record<string, unknown> = {\n\t\t\t\t\tsource: parsed.source,\n\t\t\t\t\texp: parsed.exp,\n\t\t\t\t\texpired: parsed.exp < Date.now() / 1000,\n\t\t\t\t\tsecretSource: previewSecretSource,\n\t\t\t\t};\n\t\t\t\tif (previewSecretSource === \"db\") {\n\t\t\t\t\tfields.hint =\n\t\t\t\t\t\t\"Set EMDASH_PREVIEW_SECRET in both this process and the signing process to share secrets across deployments\";\n\t\t\t\t}\n\t\t\t\tconsole.warn(\"[snapshot] Preview signature verification failed\", fields);\n\t\t\t}\n\t\t}\n\t}\n\n\tif (!authorized) {\n\t\t// Fall back to standard user auth\n\t\tconst contentDenied = requirePerm(user, \"content:read\");\n\t\tif (contentDenied) return contentDenied;\n\t\tconst schemaDenied = requirePerm(user, \"schema:read\");\n\t\tif (schemaDenied) return schemaDenied;\n\t}\n\n\ttry {\n\t\tconst includeDrafts = url.searchParams.get(\"drafts\") === \"true\";\n\t\tconst snapshot = await generateSnapshot(emdash.db, {\n\t\t\tincludeDrafts,\n\t\t\torigin: getPublicOrigin(url, emdash.config),\n\t\t});\n\n\t\treturn apiSuccess(snapshot);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate snapshot\", \"SNAPSHOT_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,QAAQ,KAAK,cAAc;CACzE,MAAM,EAAE,WAAW;CAInB,IAAI,OAA0B,OAA2B;AACzD,KAAI,CAAC,QAAQ,WAAW,QAAQ,GAC/B,KAAI;EACH,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,MAAI,aAAa,IAAI;GAEpB,MAAM,WAAW,MADD,oBAAoB,OAAO,GAAG,CACf,YAAY,YAAY,GAAG;AAC1D,OAAI,YAAY,CAAC,SAAS,SACzB,QAAO;;SAGF;AAKT,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,aAAa,QAAQ,QAAQ,IAAI,sBAAsB;CAC7D,IAAI,aAAa;AAEjB,KAAI,YAAY;EAMf,MAAM,EAAE,eAAe,QAAQ,wBAAwB,MAAM,qBAAqB,OAAO,GAAG;EAC5F,MAAM,SAAS,4BAA4B,WAAW;AACtD,MAAI,CAAC,OACJ,SAAQ,KAAK,wDAAwD;OAC/D;AACN,gBAAa,MAAM,uBAAuB,OAAO,QAAQ,OAAO,KAAK,OAAO,KAAK,OAAO;AACxF,OAAI,CAAC,YAAY;IAChB,MAAM,SAAkC;KACvC,QAAQ,OAAO;KACf,KAAK,OAAO;KACZ,SAAS,OAAO,MAAM,KAAK,KAAK,GAAG;KACnC,cAAc;KACd;AACD,QAAI,wBAAwB,KAC3B,QAAO,OACN;AAEF,YAAQ,KAAK,oDAAoD,OAAO;;;;AAK3E,KAAI,CAAC,YAAY;EAEhB,MAAM,gBAAgB,YAAY,MAAM,eAAe;AACvD,MAAI,cAAe,QAAO;EAC1B,MAAM,eAAe,YAAY,MAAM,cAAc;AACrD,MAAI,aAAc,QAAO;;AAG1B,KAAI;EACH,MAAM,gBAAgB,IAAI,aAAa,IAAI,SAAS,KAAK;AAMzD,SAAO,WALU,MAAM,iBAAiB,OAAO,IAAI;GAClD;GACA,QAAQ,gBAAgB,KAAK,OAAO,OAAO;GAC3C,CAAC,CAEyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,+BAA+B,iBAAiB"}
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../../src/astro/routes/api/snapshot.ts"],"sourcesContent":["/**\n * Snapshot endpoint — exports a portable database snapshot for preview mode.\n *\n * Security:\n * - Authenticated users: requires content:read + schema:read permissions\n * - Preview services: requires valid X-Preview-Signature header (HMAC-SHA256)\n * - Excludes auth/user/session/token tables\n */\n\nimport type { User } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport {\n\tgenerateSnapshot,\n\tparsePreviewSignatureHeader,\n\tverifyPreviewSignature,\n} from \"#api/handlers/snapshot.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { resolveSecretsCached } from \"#config/secrets.js\";\n\nimport { resolveSessionUser } from \"../../session-user.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals, url, session }) => {\n\tconst { emdash } = locals;\n\t// This route is in PUBLIC_API_EXACT (for preview-signature callers with no session),\n\t// so auth middleware skips user resolution. Manually resolve the session user here\n\t// to support session-authenticated admin users alongside preview-signature auth.\n\tlet user: User | undefined = (locals as { user?: User }).user;\n\tif (!user && session && emdash?.db) {\n\t\ttry {\n\t\t\tconst { createKyselyAdapter } = await import(\"@emdash-cms/auth/adapters/kysely\");\n\t\t\tconst sessionUser = await resolveSessionUser(session);\n\t\t\tif (sessionUser?.id) {\n\t\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\t\tconst resolved = await adapter.getUserById(sessionUser.id);\n\t\t\t\tif (resolved && !resolved.disabled) {\n\t\t\t\t\tuser = resolved;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Session resolution failed, continue to preview-signature check\n\t\t}\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Check for preview signature auth (used by DO preview services)\n\tconst previewSig = request.headers.get(\"X-Preview-Signature\");\n\tlet authorized = false;\n\n\tif (previewSig) {\n\t\t// Resolves env override or DB-stored value. Always non-empty after\n\t\t// resolution, so the signature path is never silently disabled.\n\t\t// Note: a signing process without access to this database (e.g. a\n\t\t// remote preview Worker) must set the same `EMDASH_PREVIEW_SECRET`\n\t\t// env var on both sides.\n\t\tconst { previewSecret: secret, previewSecretSource } = await resolveSecretsCached(emdash.db);\n\t\tconst parsed = parsePreviewSignatureHeader(previewSig);\n\t\tif (!parsed) {\n\t\t\tconsole.warn(\"[snapshot] Failed to parse X-Preview-Signature header\");\n\t\t} else {\n\t\t\tauthorized = await verifyPreviewSignature(parsed.source, parsed.exp, parsed.sig, secret);\n\t\t\tif (!authorized) {\n\t\t\t\tconst fields: Record<string, unknown> = {\n\t\t\t\t\tsource: parsed.source,\n\t\t\t\t\texp: parsed.exp,\n\t\t\t\t\texpired: parsed.exp < Date.now() / 1000,\n\t\t\t\t\tsecretSource: previewSecretSource,\n\t\t\t\t};\n\t\t\t\tif (previewSecretSource === \"db\") {\n\t\t\t\t\tfields.hint =\n\t\t\t\t\t\t\"Set EMDASH_PREVIEW_SECRET in both this process and the signing process to share secrets across deployments\";\n\t\t\t\t}\n\t\t\t\tconsole.warn(\"[snapshot] Preview signature verification failed\", fields);\n\t\t\t}\n\t\t}\n\t}\n\n\tif (!authorized) {\n\t\t// Fall back to standard user auth\n\t\tconst contentDenied = requirePerm(user, \"content:read\");\n\t\tif (contentDenied) return contentDenied;\n\t\tconst schemaDenied = requirePerm(user, \"schema:read\");\n\t\tif (schemaDenied) return schemaDenied;\n\t}\n\n\ttry {\n\t\t// A preview signature covers published content only.\n\t\tconst includeDrafts = !authorized && url.searchParams.get(\"drafts\") === \"true\";\n\t\tconst snapshot = await generateSnapshot(emdash.db, {\n\t\t\tincludeDrafts,\n\t\t\torigin: getPublicOrigin(url, emdash.config),\n\t\t});\n\n\t\treturn apiSuccess(snapshot);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate snapshot\", \"SNAPSHOT_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,QAAQ,KAAK,cAAc;CACzE,MAAM,EAAE,WAAW;CAInB,IAAI,OAA0B,OAA2B;AACzD,KAAI,CAAC,QAAQ,WAAW,QAAQ,GAC/B,KAAI;EACH,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,MAAI,aAAa,IAAI;GAEpB,MAAM,WAAW,MADD,oBAAoB,OAAO,GAAG,CACf,YAAY,YAAY,GAAG;AAC1D,OAAI,YAAY,CAAC,SAAS,SACzB,QAAO;;SAGF;AAKT,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,aAAa,QAAQ,QAAQ,IAAI,sBAAsB;CAC7D,IAAI,aAAa;AAEjB,KAAI,YAAY;EAMf,MAAM,EAAE,eAAe,QAAQ,wBAAwB,MAAM,qBAAqB,OAAO,GAAG;EAC5F,MAAM,SAAS,4BAA4B,WAAW;AACtD,MAAI,CAAC,OACJ,SAAQ,KAAK,wDAAwD;OAC/D;AACN,gBAAa,MAAM,uBAAuB,OAAO,QAAQ,OAAO,KAAK,OAAO,KAAK,OAAO;AACxF,OAAI,CAAC,YAAY;IAChB,MAAM,SAAkC;KACvC,QAAQ,OAAO;KACf,KAAK,OAAO;KACZ,SAAS,OAAO,MAAM,KAAK,KAAK,GAAG;KACnC,cAAc;KACd;AACD,QAAI,wBAAwB,KAC3B,QAAO,OACN;AAEF,YAAQ,KAAK,oDAAoD,OAAO;;;;AAK3E,KAAI,CAAC,YAAY;EAEhB,MAAM,gBAAgB,YAAY,MAAM,eAAe;AACvD,MAAI,cAAe,QAAO;EAC1B,MAAM,eAAe,YAAY,MAAM,cAAc;AACrD,MAAI,aAAc,QAAO;;AAG1B,KAAI;EAEH,MAAM,gBAAgB,CAAC,cAAc,IAAI,aAAa,IAAI,SAAS,KAAK;AAMxE,SAAO,WALU,MAAM,iBAAiB,OAAO,IAAI;GAClD;GACA,QAAQ,gBAAgB,KAAK,OAAO,OAAO;GAC3C,CAAC,CAEyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,+BAA+B,iBAAiB"}

package/dist/astro/routes/robots.txt.mjs

@@ -6,10 +6,10 @@ import "../../base64-DvnNgP7e.mjs";
 import "../../secrets-CIi0nFiR.mjs";
 import "../../object-cache-CqWNY5uP.mjs";
 import "../../types-BkUg2yHx.mjs";
-import "../../media-Qp5S3eH3.mjs";
+import "../../media-CPXTbb1R.mjs";
 import "../../request-cache-DzLYKm_x.mjs";
 import "../../loader-BzqeR1ZN.mjs";
-import { o as getSiteSettingsWithDb } from "../../settings-CgjRWGW9.mjs";
+import { o as getSiteSettingsWithDb } from "../../settings-B4vDl1fK.mjs";
 import { r as getPublicOrigin } from "../../public-url-Bn7U0D7-.mjs";
 
 //#region src/astro/routes/robots.txt.ts

package/dist/astro/routes/sitemap-_collection_.xml.mjs

@@ -6,12 +6,12 @@ import "../../base64-DvnNgP7e.mjs";
 import "../../secrets-CIi0nFiR.mjs";
 import "../../object-cache-CqWNY5uP.mjs";
 import "../../types-BkUg2yHx.mjs";
-import "../../media-Qp5S3eH3.mjs";
+import "../../media-CPXTbb1R.mjs";
 import { a as resolveLocalizedContentRoutePath } from "../../resolve-2WbQsCvT.mjs";
 import "../../request-cache-DzLYKm_x.mjs";
 import "../../loader-BzqeR1ZN.mjs";
 import { t as handleSitemapData } from "../../seo-CZT2oLtT.mjs";
-import { o as getSiteSettingsWithDb } from "../../settings-CgjRWGW9.mjs";
+import { o as getSiteSettingsWithDb } from "../../settings-B4vDl1fK.mjs";
 import { t as buildSeoImageUrl } from "../../media-url-jArBpzIG.mjs";
 import { r as getPublicOrigin } from "../../public-url-Bn7U0D7-.mjs";
 import virtualConfig from "virtual:emdash/config";

package/dist/astro/routes/sitemap.xml.mjs

@@ -6,11 +6,11 @@ import "../../base64-DvnNgP7e.mjs";
 import "../../secrets-CIi0nFiR.mjs";
 import "../../object-cache-CqWNY5uP.mjs";
 import "../../types-BkUg2yHx.mjs";
-import "../../media-Qp5S3eH3.mjs";
+import "../../media-CPXTbb1R.mjs";
 import "../../request-cache-DzLYKm_x.mjs";
 import "../../loader-BzqeR1ZN.mjs";
 import { t as handleSitemapData } from "../../seo-CZT2oLtT.mjs";
-import { o as getSiteSettingsWithDb } from "../../settings-CgjRWGW9.mjs";
+import { o as getSiteSettingsWithDb } from "../../settings-B4vDl1fK.mjs";
 import { r as getPublicOrigin } from "../../public-url-Bn7U0D7-.mjs";
 
 //#region src/astro/routes/sitemap.xml.ts

package/dist/astro/types.d.mts

@@ -5,11 +5,11 @@ import { d as ContentResponse, u as ContentListResponse } from "../parse-CVgO-Qa
 import { t as Database } from "../types-B7Lmsh1E.mjs";
 import { At as PageMetadataContribution, Dt as PageFragmentContribution, Gt as PluginEditorAction, nn as PublicPageContext, pn as ResolvedPlugin, qt as PluginEditorPanel, t as ActorInfo, x as ContentActionOrigin } from "../types-Cr-Kg-3D.mjs";
 import "../options-SQCHQCPH.mjs";
-import "../entry-lock-DVhCt49A.mjs";
+import "../entry-lock-Cf5OoIgN.mjs";
 import { f as MediaProvider, p as MediaProviderCapabilities } from "../placeholder-MSEd8gty.mjs";
-import { Br as MediaListResponse, Vr as MediaResponse, _r as RouteCallerInput, br as EmDashConfig, fr as SandboxedPluginEntry, gr as PluginContentCacheInvalidator, lr as PluginEditorExtensionDispatch, t as ManifestRegistryConfigurationError, ur as ResolvedPluginEditorExtension, vr as RouteMeta } from "../config-5ii2haYu.mjs";
+import { Br as MediaListResponse, Vr as MediaResponse, _r as RouteCallerInput, br as EmDashConfig, fr as SandboxedPluginEntry, gr as PluginContentCacheInvalidator, lr as PluginEditorExtensionDispatch, t as ManifestRegistryConfigurationError, ur as ResolvedPluginEditorExtension, vr as RouteMeta } from "../config-BjEm_3xL.mjs";
 import "../runner-D5_LzKXI.mjs";
-import { K as EmailPipeline, Q as MediaItem, b as SandboxRunner, q as HookPipeline } from "../storage-query-Bdv7A62k.mjs";
+import { K as EmailPipeline, Q as MediaItem, b as SandboxRunner, q as HookPipeline } from "../storage-query-FXJH5pI8.mjs";
 import "../index-D-hdtLe8.mjs";
 import { d as Storage } from "../types-DA1Te3Oy.mjs";
 import "../types-Cd-O03VG.mjs";
@@ -396,6 +396,10 @@ interface EmDashHandlers {
     authorId?: string;
     folderId?: string | null;
   }) => Promise<HandlerResponse>;
+  handleMediaRegisterUpload: (input: {
+    storageKey: string;
+    authorId?: string;
+  }) => Promise<HandlerResponse>;
   handleMediaUpdate: (id: string, input: {
     alt?: string;
     caption?: string;