emdash 0.40.1 → 0.42.0

package/dist/astro/routes/api/auth/passkey/index.mjs

@@ -1,8 +1,8 @@
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/passkey/index.ts

package/dist/astro/routes/api/auth/passkey/options.mjs

@@ -1,26 +1,27 @@
 import "../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../settings-DYidIB26.mjs";
-import "../../../../../site-settings-DOgRUoFX.mjs";
-import "../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../redirects-Cv9apQKj.mjs";
-import "../../../../../entry-lock-BJYdBfXb.mjs";
-import "../../../../../media-Pu1L6xir.mjs";
-import "../../../../../comments-fHZ8ON9O.mjs";
-import { P as passkeyOptionsBody } from "../../../../../relations-CK9CYUyr.mjs";
-import "../../../../../menus-BM7BPLOb.mjs";
-import "../../../../../status-DZKIG4a9.mjs";
+import "../../../../../url-Dn3IStq8.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import "../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../media-D1z_jisb.mjs";
+import "../../../../../comments-BRtp992B.mjs";
+import { D as passkeyOptionsBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../status-D39Fpy8R.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-tKiVtyTD.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-Bn7U0D7-.mjs";
-import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-ppU6Uv13.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-BZ6nybgc.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-X_H8128a.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-BqfQFs6a.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
+import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-CxZxPqaw.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-BXx3Ecp9.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-CkQsrcU-.mjs";
 import { generateAuthenticationOptions } from "@emdash-cms/auth/passkey";
 
 //#region src/astro/routes/api/auth/passkey/options.ts

package/dist/astro/routes/api/auth/passkey/options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/options\n *\n * Get authentication options for passkey login.\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateAuthenticationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore, cleanupExpiredChallenges } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fire-and-forget cleanup of expired challenges -- prevents accumulation\n\t\tvoid cleanupExpiredChallenges(emdash.db).catch(() => {});\n\n\t\t// Parse body before rate limiting so malformed requests don't consume slots\n\t\tconst body = await parseOptionalBody(request, passkeyOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"passkey/options\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate authentication options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\t// Never scope to the submitted email: allowCredentials would reveal whether the account exists.\n\t\tconst authOptions = await generateAuthenticationOptions(passkeyConfig, [], challengeStore);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: authOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate passkey options\", \"PASSKEY_OPTIONS_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAczB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,EAAK,yBAAyB,OAAO,GAAG,CAAC,YAAY,GAAG;EAGxD,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,IAAI,GAAG,EACjE,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAWhC,SAAO,WAAW;GACjB,SAAS;GACT,SAJmB,MAAM,8BALJ,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU,EAKS,EAAE,EAFlD,qBAAqB,OAAO,GAAG,CAEoC;GAKzF,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,wBAAwB"}
+{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/options\n *\n * Get authentication options for passkey login.\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateAuthenticationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore, cleanupExpiredChallenges } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fire-and-forget cleanup of expired challenges -- prevents accumulation\n\t\tvoid cleanupExpiredChallenges(emdash.db).catch(() => {});\n\n\t\t// Parse body before rate limiting so malformed requests don't consume slots\n\t\tconst body = await parseOptionalBody(request, passkeyOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"passkey/options\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate authentication options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\t// Never scope to the submitted email: allowCredentials would reveal whether the account exists.\n\t\tconst authOptions = await generateAuthenticationOptions(passkeyConfig, [], challengeStore);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: authOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate passkey options\", \"PASSKEY_OPTIONS_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAczB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,EAAK,yBAAyB,OAAO,GAAG,CAAC,YAAY,GAAG;EAGxD,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,IAAI,GAAG,EACjE,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAWhC,SAAO,WAAW;GACjB,SAAS;GACT,SAJmB,MAAM,8BALJ,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU,EAKS,EAAE,EAFlD,qBAAqB,OAAO,GAAG,CAEoC;GAKzF,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,wBAAwB"}

package/dist/astro/routes/api/auth/passkey/register/options.mjs

@@ -1,24 +1,25 @@
 import "../../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../../settings-DYidIB26.mjs";
-import "../../../../../../site-settings-DOgRUoFX.mjs";
-import "../../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../../redirects-Cv9apQKj.mjs";
-import "../../../../../../entry-lock-BJYdBfXb.mjs";
-import "../../../../../../media-Pu1L6xir.mjs";
-import "../../../../../../comments-fHZ8ON9O.mjs";
-import { F as passkeyRegisterOptionsBody } from "../../../../../../relations-CK9CYUyr.mjs";
-import "../../../../../../menus-BM7BPLOb.mjs";
-import "../../../../../../status-DZKIG4a9.mjs";
+import "../../../../../../url-Dn3IStq8.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../../media-D1z_jisb.mjs";
+import "../../../../../../comments-BRtp992B.mjs";
+import { O as passkeyRegisterOptionsBody } from "../../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../../status-D39Fpy8R.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-Bn7U0D7-.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-ppU6Uv13.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-X_H8128a.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-B5a0QAh6.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-CxZxPqaw.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-CkQsrcU-.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/options\n *\n * Get WebAuthn registration options for adding a new passkey (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse optional name from request\n\t\tconst body = await parseOptionalBody(request, passkeyRegisterOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get existing credentials for excludeCredentials\n\t\tconst existingCredentials = await adapter.getCredentialsByUserId(user.id);\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\t{ id: user.id, email: user.email, name: user.name },\n\t\t\texistingCredentials,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Store the passkey name in the challenge metadata if provided\n\t\t// We'll retrieve it during verification\n\t\tif (body.name) {\n\t\t\t// Store name with challenge for later retrieval\n\t\t\t// The challenge store will need this when verifying\n\t\t\tawait optionsRepo.set(`emdash:passkey_pending:${user.id}`, {\n\t\t\t\tname: body.name,\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\toptions: registrationOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to generate registration options\",\n\t\t\t\"PASSKEY_REGISTER_OPTIONS_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAazB,MAAM,eAAe;AAErB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,kBAAkB,SAAS,4BAA4B,EAAE,CAAC;AAC7E,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,sBAAsB,MAAM,QAAQ,uBAAuB,KAAK,GAAG;EAGzE,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EAGpD,MAAM,gBAAgB,iBAAiB,KAFrB,MAAM,YAAY,IAAY,oBAAoB,IAAK,QACzD,gBAAgB,KAAK,QAAQ,OAAO,CACU;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,sBAAsB,MAAM,4BACjC,eACA;GAAE,IAAI,KAAK;GAAI,OAAO,KAAK;GAAO,MAAM,KAAK;GAAM,EACnD,qBACA,eACA;AAID,MAAI,KAAK,KAGR,OAAM,YAAY,IAAI,0BAA0B,KAAK,MAAM,EAC1D,MAAM,KAAK,MACX,CAAC;AAGH,SAAO,WAAW,EACjB,SAAS,qBACT,CAAC;UACM,OAAO;AACf,SAAO,YACN,OACA,2CACA,iCACA"}
+{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/options\n *\n * Get WebAuthn registration options for adding a new passkey (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse optional name from request\n\t\tconst body = await parseOptionalBody(request, passkeyRegisterOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get existing credentials for excludeCredentials\n\t\tconst existingCredentials = await adapter.getCredentialsByUserId(user.id);\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\t{ id: user.id, email: user.email, name: user.name },\n\t\t\texistingCredentials,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Store the passkey name in the challenge metadata if provided\n\t\t// We'll retrieve it during verification\n\t\tif (body.name) {\n\t\t\t// Store name with challenge for later retrieval\n\t\t\t// The challenge store will need this when verifying\n\t\t\tawait optionsRepo.set(`emdash:passkey_pending:${user.id}`, {\n\t\t\t\tname: body.name,\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\toptions: registrationOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to generate registration options\",\n\t\t\t\"PASSKEY_REGISTER_OPTIONS_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAazB,MAAM,eAAe;AAErB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,kBAAkB,SAAS,4BAA4B,EAAE,CAAC;AAC7E,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,sBAAsB,MAAM,QAAQ,uBAAuB,KAAK,GAAG;EAGzE,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EAGpD,MAAM,gBAAgB,iBAAiB,KAFrB,MAAM,YAAY,IAAY,oBAAoB,IAAK,QACzD,gBAAgB,KAAK,QAAQ,OAAO,CACU;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,sBAAsB,MAAM,4BACjC,eACA;GAAE,IAAI,KAAK;GAAI,OAAO,KAAK;GAAO,MAAM,KAAK;GAAM,EACnD,qBACA,eACA;AAID,MAAI,KAAK,KAGR,OAAM,YAAY,IAAI,0BAA0B,KAAK,MAAM,EAC1D,MAAM,KAAK,MACX,CAAC;AAGH,SAAO,WAAW,EACjB,SAAS,qBACT,CAAC;UACM,OAAO;AACf,SAAO,YACN,OACA,2CACA,iCACA"}

package/dist/astro/routes/api/auth/passkey/register/verify.mjs

@@ -1,25 +1,26 @@
 import "../../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../../settings-DYidIB26.mjs";
-import "../../../../../../site-settings-DOgRUoFX.mjs";
-import "../../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../../redirects-Cv9apQKj.mjs";
-import "../../../../../../entry-lock-BJYdBfXb.mjs";
-import "../../../../../../media-Pu1L6xir.mjs";
-import "../../../../../../comments-fHZ8ON9O.mjs";
-import { I as passkeyRegisterVerifyBody } from "../../../../../../relations-CK9CYUyr.mjs";
-import "../../../../../../menus-BM7BPLOb.mjs";
-import "../../../../../../status-DZKIG4a9.mjs";
+import "../../../../../../url-Dn3IStq8.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../../media-D1z_jisb.mjs";
+import "../../../../../../comments-BRtp992B.mjs";
+import { k as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../../status-D39Fpy8R.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-Bn7U0D7-.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-CHB8oZNM.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-ppU6Uv13.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-X_H8128a.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-B5a0QAh6.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-CFtudhyw.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-CxZxPqaw.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-CkQsrcU-.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/verify\n *\n * Verify and store a new passkey credential (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit again (in case of concurrent requests)\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRegisterVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Get passkey name - prefer body.name, then check stored pending name\n\t\tlet passKeyName: string | undefined = body.name ?? undefined;\n\t\tif (!passKeyName) {\n\t\t\tconst pending = await optionsRepo.get<{ name?: string }>(`emdash:passkey_pending:${user.id}`);\n\t\t\tif (pending?.name) {\n\t\t\t\tpassKeyName = pending.name;\n\t\t\t}\n\t\t}\n\n\t\t// Clean up pending state\n\t\tawait optionsRepo.delete(`emdash:passkey_pending:${user.id}`);\n\n\t\t// Register the passkey\n\t\tconst credential = await registerPasskey(adapter, user.id, verified, passKeyName);\n\n\t\t// Return the new passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: credential.name,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\tconsole.error(\"Passkey registration verify error:\", error);\n\n\t\t// Handle specific errors\n\t\tconst message = error instanceof Error ? error.message : \"\";\n\n\t\t// Check for duplicate credential error\n\t\tif (message.includes(\"credential_exists\") || message.includes(\"already\")) {\n\t\t\treturn apiError(\"CREDENTIAL_EXISTS\", \"This passkey is already registered\", 400);\n\t\t}\n\n\t\t// Check for challenge errors\n\t\tif (message.includes(\"challenge\") || message.includes(\"expired\")) {\n\t\t\treturn apiError(\"CHALLENGE_EXPIRED\", \"Registration expired. Please try again.\", 400);\n\t\t}\n\n\t\treturn apiError(\"PASSKEY_REGISTER_ERROR\", \"Registration failed\", 500);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAczB,MAAM,eAAe;AAWrB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,UAAU,SAAS,0BAA0B;AAChE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EACpD,MAAM,WAAY,MAAM,YAAY,IAAY,oBAAoB,IAAK;EACzE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,IAAI,cAAkC,KAAK,QAAQ;AACnD,MAAI,CAAC,aAAa;GACjB,MAAM,UAAU,MAAM,YAAY,IAAuB,0BAA0B,KAAK,KAAK;AAC7F,OAAI,SAAS,KACZ,eAAc,QAAQ;;AAKxB,QAAM,YAAY,OAAO,0BAA0B,KAAK,KAAK;EAG7D,MAAM,aAAa,MAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,YAAY;AAYjF,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM,WAAW;GACjB,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,UAAQ,MAAM,sCAAsC,MAAM;EAG1D,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AAGzD,MAAI,QAAQ,SAAS,oBAAoB,IAAI,QAAQ,SAAS,UAAU,CACvE,QAAO,SAAS,qBAAqB,sCAAsC,IAAI;AAIhF,MAAI,QAAQ,SAAS,YAAY,IAAI,QAAQ,SAAS,UAAU,CAC/D,QAAO,SAAS,qBAAqB,2CAA2C,IAAI;AAGrF,SAAO,SAAS,0BAA0B,uBAAuB,IAAI"}
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/verify\n *\n * Verify and store a new passkey credential (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit again (in case of concurrent requests)\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRegisterVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Get passkey name - prefer body.name, then check stored pending name\n\t\tlet passKeyName: string | undefined = body.name ?? undefined;\n\t\tif (!passKeyName) {\n\t\t\tconst pending = await optionsRepo.get<{ name?: string }>(`emdash:passkey_pending:${user.id}`);\n\t\t\tif (pending?.name) {\n\t\t\t\tpassKeyName = pending.name;\n\t\t\t}\n\t\t}\n\n\t\t// Clean up pending state\n\t\tawait optionsRepo.delete(`emdash:passkey_pending:${user.id}`);\n\n\t\t// Register the passkey\n\t\tconst credential = await registerPasskey(adapter, user.id, verified, passKeyName);\n\n\t\t// Return the new passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: credential.name,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\tconsole.error(\"Passkey registration verify error:\", error);\n\n\t\t// Handle specific errors\n\t\tconst message = error instanceof Error ? error.message : \"\";\n\n\t\t// Check for duplicate credential error\n\t\tif (message.includes(\"credential_exists\") || message.includes(\"already\")) {\n\t\t\treturn apiError(\"CREDENTIAL_EXISTS\", \"This passkey is already registered\", 400);\n\t\t}\n\n\t\t// Check for challenge errors\n\t\tif (message.includes(\"challenge\") || message.includes(\"expired\")) {\n\t\t\treturn apiError(\"CHALLENGE_EXPIRED\", \"Registration expired. Please try again.\", 400);\n\t\t}\n\n\t\treturn apiError(\"PASSKEY_REGISTER_ERROR\", \"Registration failed\", 500);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAczB,MAAM,eAAe;AAWrB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,UAAU,SAAS,0BAA0B;AAChE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EACpD,MAAM,WAAY,MAAM,YAAY,IAAY,oBAAoB,IAAK;EACzE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,IAAI,cAAkC,KAAK,QAAQ;AACnD,MAAI,CAAC,aAAa;GACjB,MAAM,UAAU,MAAM,YAAY,IAAuB,0BAA0B,KAAK,KAAK;AAC7F,OAAI,SAAS,KACZ,eAAc,QAAQ;;AAKxB,QAAM,YAAY,OAAO,0BAA0B,KAAK,KAAK;EAG7D,MAAM,aAAa,MAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,YAAY;AAYjF,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM,WAAW;GACjB,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,UAAQ,MAAM,sCAAsC,MAAM;EAG1D,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AAGzD,MAAI,QAAQ,SAAS,oBAAoB,IAAI,QAAQ,SAAS,UAAU,CACvE,QAAO,SAAS,qBAAqB,sCAAsC,IAAI;AAIhF,MAAI,QAAQ,SAAS,YAAY,IAAI,QAAQ,SAAS,UAAU,CAC/D,QAAO,SAAS,qBAAqB,2CAA2C,IAAI;AAGrF,SAAO,SAAS,0BAA0B,uBAAuB,IAAI"}

package/dist/astro/routes/api/auth/passkey/verify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/verify.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAcA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/verify.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAgBA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/passkey/verify.mjs

@@ -1,25 +1,28 @@
 import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../settings-DYidIB26.mjs";
-import "../../../../../site-settings-DOgRUoFX.mjs";
-import "../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../redirects-Cv9apQKj.mjs";
-import "../../../../../entry-lock-BJYdBfXb.mjs";
-import "../../../../../media-Pu1L6xir.mjs";
-import "../../../../../comments-fHZ8ON9O.mjs";
-import { R as passkeyVerifyBody } from "../../../../../relations-CK9CYUyr.mjs";
-import "../../../../../menus-BM7BPLOb.mjs";
-import "../../../../../status-DZKIG4a9.mjs";
+import "../../../../../url-Dn3IStq8.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import "../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../media-D1z_jisb.mjs";
+import "../../../../../comments-BRtp992B.mjs";
+import { j as passkeyVerifyBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../status-D39Fpy8R.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-Bn7U0D7-.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CHB8oZNM.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-ppU6Uv13.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-X_H8128a.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CFtudhyw.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-CxZxPqaw.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-DVcHsFD5.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-CkQsrcU-.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { PasskeyAuthenticationError, authenticateWithPasskey } from "@emdash-cms/auth/passkey";
 
@@ -28,6 +31,7 @@ const prerender = false;
 const POST = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!session) return sessionUnavailableError();
 	try {
 		const body = await parseBody(request, passkeyVerifyBody);
 		if (isParseError(body)) return body;
@@ -38,7 +42,7 @@ const POST = async ({ request, locals, session }) => {
 		const adapter = createKyselyAdapter(emdash.db);
 		const challengeStore = createChallengeStore(emdash.db);
 		const user = await authenticateWithPasskey(passkeyConfig, adapter, body.credential, challengeStore);
-		if (session) session.set("user", { id: user.id });
+		session.set("user", { id: user.id });
 		return apiSuccess({
 			success: true,
 			user: {

package/dist/astro/routes/api/auth/passkey/verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/verify\n *\n * Verify a passkey authentication and create a session\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { authenticateWithPasskey, PasskeyAuthenticationError } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, passkeyVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Authenticate with passkey\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\tconst user = await authenticateWithPasskey(\n\t\t\tpasskeyConfig,\n\t\t\tadapter,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof PasskeyAuthenticationError) {\n\t\t\treturn apiError(\"UNAUTHORIZED\", \"Authentication failed\", 401);\n\t\t}\n\n\t\treturn handleError(error, \"Authentication failed\", \"PASSKEY_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAczB,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAEhC,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAEtD,MAAM,OAAO,MAAM,wBAClB,eACA,SACA,KAAK,YACL,eACA;AAGD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAGrC,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,MAAI,iBAAiB,2BACpB,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;AAG9D,SAAO,YAAY,OAAO,yBAAyB,uBAAuB"}
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/verify\n *\n * Verify a passkey authentication and create a session\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { authenticateWithPasskey, PasskeyAuthenticationError } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nimport { sessionUnavailableError } from \"../../../../session-user.js\";\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!session) return sessionUnavailableError();\n\n\ttry {\n\t\tconst body = await parseBody(request, passkeyVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Authenticate with passkey\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\tconst user = await authenticateWithPasskey(\n\t\t\tpasskeyConfig,\n\t\t\tadapter,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof PasskeyAuthenticationError) {\n\t\t\treturn apiError(\"UNAUTHORIZED\", \"Authentication failed\", 401);\n\t\t}\n\n\t\treturn handleError(error, \"Authentication failed\", \"PASSKEY_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAgBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,QAAS,QAAO,yBAAyB;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAEhC,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAEtD,MAAM,OAAO,MAAM,wBAClB,eACA,SACA,KAAK,YACL,eACA;AAED,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAEpC,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,MAAI,iBAAiB,2BACpB,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;AAG9D,SAAO,YAAY,OAAO,yBAAyB,uBAAuB"}

package/dist/astro/routes/api/auth/signup/complete.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"complete.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/complete.ts"],"mappings":";;;cASa,SAAA;AAAA,cAeA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"complete.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/complete.ts"],"mappings":";;;cASa,SAAA;AAAA,cAiBA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/signup/complete.mjs

@@ -1,25 +1,28 @@
 import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../settings-DYidIB26.mjs";
-import "../../../../../site-settings-DOgRUoFX.mjs";
-import "../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../redirects-Cv9apQKj.mjs";
-import "../../../../../entry-lock-BJYdBfXb.mjs";
-import "../../../../../media-Pu1L6xir.mjs";
-import "../../../../../comments-fHZ8ON9O.mjs";
-import { z as signupCompleteBody } from "../../../../../relations-CK9CYUyr.mjs";
-import "../../../../../menus-BM7BPLOb.mjs";
-import "../../../../../status-DZKIG4a9.mjs";
+import "../../../../../url-Dn3IStq8.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import "../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../media-D1z_jisb.mjs";
+import "../../../../../comments-BRtp992B.mjs";
+import { M as signupCompleteBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../status-D39Fpy8R.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-Bn7U0D7-.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CHB8oZNM.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-ppU6Uv13.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-X_H8128a.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CFtudhyw.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-CxZxPqaw.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-DVcHsFD5.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-CkQsrcU-.mjs";
 import { SignupError, completeSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";
@@ -29,6 +32,7 @@ const prerender = false;
 const POST = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!session) return sessionUnavailableError();
 	try {
 		const body = await parseBody(request, signupCompleteBody);
 		if (isParseError(body)) return body;
@@ -41,7 +45,7 @@ const POST = async ({ request, locals, session }) => {
 		const verified = await verifyRegistrationResponse(passkeyConfig, body.credential, challengeStore);
 		const user = await completeSignup(adapter, body.token, { name: body.name });
 		await registerPasskey(adapter, user.id, verified, "Initial passkey");
-		if (session) session.set("user", { id: user.id });
+		session.set("user", { id: user.id });
 		return apiSuccess({
 			success: true,
 			user: {

package/dist/astro/routes/api/auth/signup/complete.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"complete.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/complete.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/signup/complete\n *\n * Complete self-signup by registering a passkey for the new user.\n * This creates the user account and establishes a session.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { completeSignup, SignupError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { signupCompleteBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, signupCompleteBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the passkey registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Complete the signup - creates the user\n\t\tconst user = await completeSignup(adapter, body.token, {\n\t\t\tname: body.name,\n\t\t});\n\n\t\t// Register the passkey for the new user\n\t\tawait registerPasskey(adapter, user.id, verified, \"Initial passkey\");\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof SignupError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tinvalid_token: 404,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_exists: 409,\n\t\t\t\tdomain_not_allowed: 403,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to complete signup\", \"SIGNUP_COMPLETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAEhC,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,MAAM,OAAO,MAAM,eAAe,SAAS,KAAK,OAAO,EACtD,MAAM,KAAK,MACX,CAAC;AAGF,QAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,kBAAkB;AAGpE,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAGrC,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,MAAI,iBAAiB,YAOpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SANN;GACzC,eAAe;GACf,eAAe;GACf,aAAa;GACb,oBAAoB;GACpB,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}
+{"version":3,"file":"complete.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/complete.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/signup/complete\n *\n * Complete self-signup by registering a passkey for the new user.\n * This creates the user account and establishes a session.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { completeSignup, SignupError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { signupCompleteBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nimport { sessionUnavailableError } from \"../../../../session-user.js\";\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!session) return sessionUnavailableError();\n\n\ttry {\n\t\tconst body = await parseBody(request, signupCompleteBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the passkey registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Complete the signup - creates the user\n\t\tconst user = await completeSignup(adapter, body.token, {\n\t\t\tname: body.name,\n\t\t});\n\n\t\t// Register the passkey for the new user\n\t\tawait registerPasskey(adapter, user.id, verified, \"Initial passkey\");\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof SignupError) {\n\t\t\tconst statusMap: Record<string, number> = {\n\t\t\t\tinvalid_token: 404,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_exists: 409,\n\t\t\t\tdomain_not_allowed: 403,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to complete signup\", \"SIGNUP_COMPLETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAiBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,QAAS,QAAO,yBAAyB;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAEhC,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,MAAM,OAAO,MAAM,eAAe,SAAS,KAAK,OAAO,EACtD,MAAM,KAAK,MACX,CAAC;AAGF,QAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,kBAAkB;AAEpE,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAEpC,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,MAAI,iBAAiB,YAOpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SANN;GACzC,eAAe;GACf,eAAe;GACf,aAAa;GACb,oBAAoB;GACpB,CACkE,MAAM,SAAS,IAAI;AAGvF,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}

package/dist/astro/routes/api/auth/signup/request.mjs

@@ -1,24 +1,25 @@
 import "../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../settings-DYidIB26.mjs";
-import "../../../../../site-settings-DOgRUoFX.mjs";
-import "../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../redirects-Cv9apQKj.mjs";
-import "../../../../../entry-lock-BJYdBfXb.mjs";
-import "../../../../../media-Pu1L6xir.mjs";
-import "../../../../../comments-fHZ8ON9O.mjs";
-import { B as signupRequestBody } from "../../../../../relations-CK9CYUyr.mjs";
-import "../../../../../menus-BM7BPLOb.mjs";
-import "../../../../../status-DZKIG4a9.mjs";
+import "../../../../../url-Dn3IStq8.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import "../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../media-D1z_jisb.mjs";
+import "../../../../../comments-BRtp992B.mjs";
+import { N as signupRequestBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../status-D39Fpy8R.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-tKiVtyTD.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-BU_bbxwj.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-BZ6nybgc.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-BqfQFs6a.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-Ceq_AUK0.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-BXx3Ecp9.mjs";
 import { requestSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/signup/request.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/request.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/signup/request\n *\n * Request self-signup. Sends verification email if domain is allowed.\n * Always returns 200 to prevent email enumeration.\n *\n * Rate limited: 3 requests per 5 minutes per IP. Mirrors magic-link/send.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { requestSignup } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { signupRequestBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\n// Generic response body used for both the real success path and the\n// rate-limited / domain-disallowed paths. Keeping them identical prevents\n// the caller from distinguishing between them.\nconst GENERIC_SUCCESS = {\n\tsuccess: true,\n\tmessage: \"If your email domain is allowed, you'll receive a verification email.\",\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Check if email pipeline is available\n\tif (!emdash.email?.isAvailable()) {\n\t\treturn apiError(\n\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\"Email not configured. Self-signup is unavailable.\",\n\t\t\t503,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Parse the body first — this avoids burning a rate-limit slot on\n\t\t// malformed input and keeps the timing of the rate-limited and\n\t\t// real paths aligned.\n\t\tconst body = await parseBody(request, signupRequestBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds per IP. Matches magic-link/send.\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"signup/request\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limiting\n\t\t\t// (and by extension, the fact that the caller is probing).\n\t\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get site config for signup email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in signup emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\n\t\t// Request signup - this handles all checks internally and fails silently\n\t\t// if domain not allowed or user exists (to prevent enumeration)\n\t\tawait requestSignup(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email.toLowerCase().trim(),\n\t\t);\n\n\t\t// Always return success to prevent email enumeration\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t} catch (error) {\n\t\tconsole.error(\"Signup request error:\", error);\n\n\t\t// Don't reveal internal errors - just return generic success\n\t\t// to prevent information leakage\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAgBzB,MAAM,kBAAkB;CACvB,SAAS;CACT,SAAS;CACT;AAED,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,qDACA,IACA;AAGF,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,GAAG,IAAI,EAChE,QAGd,QAAO,WAAW,gBAAgB;EAGnC,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAI9C,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;AAOrE,QAAM,cACL;GACC,SANc,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;GAOrE;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EACD,SACA,KAAK,MAAM,aAAa,CAAC,MAAM,CAC/B;AAGD,SAAO,WAAW,gBAAgB;UAC1B,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAI7C,SAAO,WAAW,gBAAgB"}
+{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/request.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/signup/request\n *\n * Request self-signup. Sends verification email if domain is allowed.\n * Always returns 200 to prevent email enumeration.\n *\n * Rate limited: 3 requests per 5 minutes per IP. Mirrors magic-link/send.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { requestSignup } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { signupRequestBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\n// Generic response body used for both the real success path and the\n// rate-limited / domain-disallowed paths. Keeping them identical prevents\n// the caller from distinguishing between them.\nconst GENERIC_SUCCESS = {\n\tsuccess: true,\n\tmessage: \"If your email domain is allowed, you'll receive a verification email.\",\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Check if email pipeline is available\n\tif (!emdash.email?.isAvailable()) {\n\t\treturn apiError(\n\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\"Email not configured. Self-signup is unavailable.\",\n\t\t\t503,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Parse the body first — this avoids burning a rate-limit slot on\n\t\t// malformed input and keeps the timing of the rate-limited and\n\t\t// real paths aligned.\n\t\tconst body = await parseBody(request, signupRequestBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds per IP. Matches magic-link/send.\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"signup/request\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limiting\n\t\t\t// (and by extension, the fact that the caller is probing).\n\t\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get site config for signup email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in signup emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\n\t\t// Request signup - this handles all checks internally and fails silently\n\t\t// if domain not allowed or user exists (to prevent enumeration)\n\t\tawait requestSignup(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email.toLowerCase().trim(),\n\t\t);\n\n\t\t// Always return success to prevent email enumeration\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t} catch (error) {\n\t\tconsole.error(\"Signup request error:\", error);\n\n\t\t// Don't reveal internal errors - just return generic success\n\t\t// to prevent information leakage\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAgBzB,MAAM,kBAAkB;CACvB,SAAS;CACT,SAAS;CACT;AAED,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,qDACA,IACA;AAGF,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,GAAG,IAAI,EAChE,QAGd,QAAO,WAAW,gBAAgB;EAGnC,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAI9C,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;AAOrE,QAAM,cACL;GACC,SANc,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;GAOrE;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EACD,SACA,KAAK,MAAM,aAAa,CAAC,MAAM,CAC/B;AAGD,SAAO,WAAW,gBAAgB;UAC1B,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAI7C,SAAO,WAAW,gBAAgB"}

package/dist/astro/routes/api/auth/signup/verify.mjs

@@ -1,8 +1,8 @@
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-BkUg2yHx.mjs";
-import "../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../errors-BF0_LFhW.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
 import { SignupError, roleFromLevel, validateSignupToken } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/comments/_collection_/_contentId_/index.mjs

@@ -2,19 +2,19 @@ import "../../../../../../after-PcEvMY_6.mjs";
 import "../../../../../../options-DhrI7eMv.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../secrets-CIi0nFiR.mjs";
-import "../../../../../../object-cache-CqWNY5uP.mjs";
-import "../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../comment-CrBl22OF.mjs";
-import "../../../../../../errors-DgE1zJGG.mjs";
-import "../../../../../../errors-BF0_LFhW.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
-import "../../../../../../parse-DY6OD1j_.mjs";
-import "../../../../../../comments-fHZ8ON9O.mjs";
-import "../../../../../../site-url-BU_bbxwj.mjs";
-import { t as submitPublicComment } from "../../../../../../public-submission-BFBUrqst.mjs";
-import { o as handleCommentList } from "../../../../../../comments-2ah9du9y.mjs";
-import "../../../../../../rate-limit-BZ6nybgc.mjs";
-import "../../../../../../service-DuykXPyW.mjs";
+import "../../../../../../object-cache-Bo6DGaC9.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../comment-Cq1UYN8_.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import "../../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../../comments-BRtp992B.mjs";
+import "../../../../../../site-url-Ceq_AUK0.mjs";
+import { t as submitPublicComment } from "../../../../../../public-submission-yZaTTfsC.mjs";
+import { o as handleCommentList } from "../../../../../../comments-Bi2j9IoX.mjs";
+import "../../../../../../rate-limit-BXx3Ecp9.mjs";
+import "../../../../../../service-BFUImckH.mjs";
 
 //#region src/astro/routes/api/comments/[collection]/[contentId]/index.ts
 const prerender = false;