emdash 1.0.0 → 1.0.1-rc.0

package/dist/astro/routes/api/setup/admin.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/admin.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=admin.d.mts.map

package/dist/astro/routes/api/setup/admin.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAeA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/setup/admin.mjs

@@ -0,0 +1,83 @@
+import "../../../../config-CvmjJcVw.mjs";
+import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
+import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../url-Dn3IStq8.mjs";
+import "../../../../types-j6MBDjlZ.mjs";
+import "../../../../errors-CjXd1LgH.mjs";
+import "../../../../errors-CNvATh_7.mjs";
+import "../../../../settings-B0zQj_Tj.mjs";
+import "../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-Gt2l4Sld.mjs";
+import "../../../../redirects-D4EWeXAo.mjs";
+import "../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../media-D1z_jisb.mjs";
+import "../../../../comments-BRtp992B.mjs";
+import { c as setupAdminBody } from "../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../menus-BQKqf0Up.mjs";
+import "../../../../status-D39Fpy8R.mjs";
+import "../../../../api/schemas/index.mjs";
+import { r as getPublicOrigin } from "../../../../public-url-B5a0QAh6.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-CxZxPqaw.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-C-MxsV22.mjs";
+import { n as SETUP_NONCE_MAX_AGE_SECONDS, t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-CJV9ftSK.mjs";
+import { generateToken } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";
+
+//#region src/astro/routes/api/setup/admin.ts
+const prerender = false;
+const POST = async ({ cookies, request, locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		const options = new OptionsRepository(emdash.db);
+		const setupComplete = await options.get("emdash:setup_complete");
+		const isComplete = setupComplete === true || setupComplete === "true";
+		if (await createKyselyAdapter(emdash.db).countUsers() > 0) {
+			if (isComplete) return apiError("SETUP_COMPLETE", "Setup already complete", 400);
+			return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		}
+		const body = await parseBody(request, setupAdminBody);
+		if (isParseError(body)) return body;
+		const existingState = await options.get("emdash:setup_state");
+		const nonce = generateToken();
+		const url = new URL(request.url);
+		const siteName = await options.get("emdash:site_title") ?? void 0;
+		const siteUrl = getPublicOrigin(url, emdash?.config);
+		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);
+		const challengeStore = createChallengeStore(emdash.db);
+		const tempUser = {
+			id: `setup-${Date.now()}`,
+			email: body.email.toLowerCase(),
+			name: body.name || null
+		};
+		const registrationOptions = await generateRegistrationOptions(passkeyConfig, tempUser, [], challengeStore);
+		await options.set("emdash:setup_state", {
+			...existingState,
+			step: "admin",
+			email: body.email.toLowerCase(),
+			name: body.name || null,
+			tempUserId: tempUser.id,
+			nonce
+		});
+		const publicOrigin = new URL(siteUrl);
+		cookies.set(SETUP_NONCE_COOKIE, nonce, {
+			path: "/_emdash/",
+			httpOnly: true,
+			sameSite: "strict",
+			secure: publicOrigin.protocol === "https:",
+			maxAge: SETUP_NONCE_MAX_AGE_SECONDS
+		});
+		return apiSuccess({
+			success: true,
+			options: registrationOptions
+		});
+	} catch (error) {
+		return handleError(error, "Failed to create admin", "SETUP_ADMIN_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=admin.mjs.map

package/dist/astro/routes/api/setup/admin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/admin\n *\n * Step 3 of setup: Start admin creation by returning passkey registration options\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateToken } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupAdminBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { SETUP_NONCE_COOKIE, SETUP_NONCE_MAX_AGE_SECONDS } from \"#auth/setup-nonce.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ cookies, request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Check if setup is already complete\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\t\tconst isComplete = setupComplete === true || setupComplete === \"true\";\n\n\t\t// Check if any users exist\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst userCount = await adapter.countUsers();\n\n\t\tif (userCount > 0) {\n\t\t\tif (isComplete) {\n\t\t\t\treturn apiError(\"SETUP_COMPLETE\", \"Setup already complete\", 400);\n\t\t\t}\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// `setup_complete` with ZERO users is a recoverable half-state (a\n\t\t// wiped/sanitised users table — e.g. a DB copied between\n\t\t// environments). /api/setup/status already resumes the wizard at\n\t\t// the admin step for exactly this state, so admin creation must be\n\t\t// allowed here too — rejecting on the stale flag alone leaves the\n\t\t// instance with no UI path to an admin account.\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupAdminBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Preserve title/tagline from step 1 by reading existing setup state\n\t\t// before we overwrite it below.\n\t\tconst existingState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\n\t\t// Mint a fresh session nonce. This binds the follow-up\n\t\t// /setup/admin/verify call to the same browser that made this\n\t\t// request, so an unauthenticated attacker on another host cannot\n\t\t// substitute their own email into the setup state during the\n\t\t// setup window. Rotates on every call so a legitimate retry\n\t\t// always gets a working session.\n\t\tconst nonce = generateToken();\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\t// Create a temporary user object for registration options\n\t\t// (not persisted until passkey is verified)\n\t\tconst tempUser = {\n\t\t\tid: `setup-${Date.now()}`, // Temporary ID\n\t\t\temail: body.email.toLowerCase(),\n\t\t\tname: body.name || null,\n\t\t};\n\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\ttempUser,\n\t\t\t[], // No existing credentials\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Store the nonce alongside the rest of the setup state, preserving\n\t\t// title/tagline from step 1. The verify endpoint will constant-time\n\t\t// compare the nonce with the incoming cookie.\n\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t...existingState,\n\t\t\tstep: \"admin\",\n\t\t\temail: body.email.toLowerCase(),\n\t\t\tname: body.name || null,\n\t\t\ttempUserId: tempUser.id,\n\t\t\tnonce,\n\t\t});\n\n\t\t// HttpOnly + SameSite=Strict + path-scoped. The cookie must not be\n\t\t// accessible to JS (nothing in the admin UI needs to read it) and\n\t\t// must not be sent on cross-site navigations. The /_emdash/ path\n\t\t// scope keeps it away from user-authored frontend code.\n\t\t//\n\t\t// Derive `secure` from the public origin, not the internal request\n\t\t// URL. Behind a TLS-terminating reverse proxy the internal hop is\n\t\t// often `http:` while the browser-facing origin is `https:` —\n\t\t// using `url.protocol` there would drop the Secure flag on a\n\t\t// sensitive cookie over the public HTTPS connection.\n\t\tconst publicOrigin = new URL(siteUrl);\n\t\tcookies.set(SETUP_NONCE_COOKIE, nonce, {\n\t\t\tpath: \"/_emdash/\",\n\t\t\thttpOnly: true,\n\t\t\tsameSite: \"strict\",\n\t\t\tsecure: publicOrigin.protocol === \"https:\",\n\t\t\tmaxAge: SETUP_NONCE_MAX_AGE_SECONDS,\n\t\t});\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: registrationOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create admin\", \"SETUP_ADMIN_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,SAAS,aAAa;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;EAChE,MAAM,aAAa,kBAAkB,QAAQ,kBAAkB;AAM/D,MAFkB,MADF,oBAAoB,OAAO,GAAG,CACd,YAAY,GAE5B,GAAG;AAClB,OAAI,WACH,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAEjE,UAAO,SAAS,gBAAgB,6BAA6B,IAAI;;EAWlE,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,gBAAgB,MAAM,QAAQ,IAA6B,qBAAqB;EAQtF,MAAM,QAAQ,eAAe;EAG7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,WAAY,MAAM,QAAQ,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EACpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,QAAQ;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAItD,MAAM,WAAW;GAChB,IAAI,SAAS,KAAK,KAAK;GACvB,OAAO,KAAK,MAAM,aAAa;GAC/B,MAAM,KAAK,QAAQ;GACnB;EAED,MAAM,sBAAsB,MAAM,4BACjC,eACA,UACA,EAAE,EACF,eACA;AAKD,QAAM,QAAQ,IAAI,sBAAsB;GACvC,GAAG;GACH,MAAM;GACN,OAAO,KAAK,MAAM,aAAa;GAC/B,MAAM,KAAK,QAAQ;GACnB,YAAY,SAAS;GACrB;GACA,CAAC;EAYF,MAAM,eAAe,IAAI,IAAI,QAAQ;AACrC,UAAQ,IAAI,oBAAoB,OAAO;GACtC,MAAM;GACN,UAAU;GACV,UAAU;GACV,QAAQ,aAAa,aAAa;GAClC,QAAQ;GACR,CAAC;AAEF,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,oBAAoB"}

package/dist/astro/routes/api/setup/dev-bypass.d.mts

@@ -0,0 +1,9 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/dev-bypass.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=dev-bypass.d.mts.map

package/dist/astro/routes/api/setup/dev-bypass.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-bypass.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"mappings":";;;cAsBa,SAAA;AAAA,cAgMA,GAAA,EAAK,QAAA;AAAA,cACL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/setup/dev-bypass.mjs

@@ -0,0 +1,172 @@
+import "../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../config-CvmjJcVw.mjs";
+import "../../../../datetime-normalization-PeiEdcRY.mjs";
+import "../../../../after-PcEvMY_6.mjs";
+import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
+import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../secrets-CIi0nFiR.mjs";
+import "../../../../content-RzEXY3QX.mjs";
+import "../../../../object-cache-Bo6DGaC9.mjs";
+import "../../../../slugify-T5GHH42D.mjs";
+import "../../../../request-cache-C4CIo5ad.mjs";
+import "../../../../url-Dn3IStq8.mjs";
+import "../../../../types-j6MBDjlZ.mjs";
+import "../../../../revision-CGkQA0e5.mjs";
+import "../../../../media-CputjGE1.mjs";
+import "../../../../taxonomy-BesdHIwi.mjs";
+import "../../../../resolve-D-kqyKns.mjs";
+import "../../../../redirect-BvFKh8Sz.mjs";
+import "../../../../byline-registry-dvt4N3xV.mjs";
+import "../../../../field-defs-cache-DEkFYCDE.mjs";
+import "../../../../byline-02tu_Uc-.mjs";
+import "../../../../staged-Bw5eHbKS.mjs";
+import "../../../../dist-Cfu8mMBs.mjs";
+import "../../../../fts-manager-DU03MxWu.mjs";
+import "../../../../loader-CWb-ja1p.mjs";
+import "../../../../collection-slugs-cache-BNRAPNiu.mjs";
+import "../../../../capture-triggers-CdZfvHtF.mjs";
+import "../../../../activation-DDuqAat2.mjs";
+import "../../../../collection-deletion-JecE26cS.mjs";
+import "../../../../registry-CtHRqVe-.mjs";
+import "../../../../hash-CY4QdeMJ.mjs";
+import "../../../../zod-generator-DnfG5sGQ.mjs";
+import "../../../../errors-CjXd1LgH.mjs";
+import "../../../../canonical-CAecl1UQ.mjs";
+import "../../../../digest-DiYAoZpf.mjs";
+import "../../../../block-values-BrTrtA-v.mjs";
+import "../../../../query-DSEkrw_m.mjs";
+import "../../../../schema-BZPj3kwZ.mjs";
+import "../../../../relations-CVI2nbrn.mjs";
+import "../../../../errors-CNvATh_7.mjs";
+import "../../../../media-usage-work-BlMjwPg8.mjs";
+import { n as repairContentMediaUsageCollection } from "../../../../content-repair-B-k5JrVN.mjs";
+import "../../../../schema-Berj5VQx.mjs";
+import "../../../../settings-CnWoEDb0.mjs";
+import "../../../../ssrf-DsmvZB80.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEdm_AWU.mjs";
+import { t as applySeed } from "../../../../apply-BNvvsD51.mjs";
+import "../../../../ssrf-tA45vIPX.mjs";
+import { n as validateSeed } from "../../../../validate-WkjGwBSO.mjs";
+import { t as loadSeed } from "../../../../load-dHcR5yh9.mjs";
+import { r as getPublicOrigin } from "../../../../public-url-B5a0QAh6.mjs";
+import { t as escapeHtml } from "../../../../escape-nJW7dR0s.mjs";
+import "../../../../api-tokens-BLz2MtQs.mjs";
+import { n as handleApiTokenCreate, t as deleteApiTokensByName } from "../../../../api-tokens-P3mAaQgr.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-BRoLiWQE.mjs";
+import { ulid } from "ulidx";
+
+//#region src/astro/routes/api/setup/dev-bypass.ts
+const prerender = false;
+const ROLE_ADMIN = 50;
+const DEV_USER_EMAIL = "dev@emdash.local";
+const DEV_USER_NAME = "Dev Admin";
+const DEV_SITE_TITLE = "EmDash Dev Site";
+async function handleDevBypass(context) {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Dev bypass is only available in development mode", 403);
+	const { locals, url, session } = context;
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		const contentParam = url.searchParams.get("content");
+		const includeContent = contentParam !== "0" && contentParam !== "false";
+		const seed = await loadSeed();
+		if (validateSeed(seed).valid) {
+			const seedResult = await applySeed(emdash.db, seed, {
+				includeContent,
+				onConflict: "skip",
+				storage: emdash.storage ?? void 0
+			});
+			console.log(`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`);
+			if (includeContent && seedResult.content.created + seedResult.content.updated > 0) {
+				for (const collectionSlug of Object.keys(seed.content ?? {})) if ((await repairContentMediaUsageCollection(emdash.db, { collectionSlug })).status !== "complete") throw new Error(`Seeded Media Usage indexing failed for ${collectionSlug}`);
+			}
+		}
+		const options = new OptionsRepository(emdash.db);
+		const existingUser = await emdash.db.selectFrom("users").selectAll().where("email", "=", DEV_USER_EMAIL).executeTakeFirst();
+		let user;
+		let userCreated = false;
+		if (!existingUser) {
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const newUser = {
+				id: ulid(),
+				email: DEV_USER_EMAIL,
+				name: DEV_USER_NAME,
+				role: ROLE_ADMIN,
+				email_verified: 1,
+				created_at: now,
+				updated_at: now
+			};
+			await emdash.db.insertInto("users").values(newUser).execute();
+			user = {
+				id: newUser.id,
+				email: newUser.email,
+				name: newUser.name,
+				role: newUser.role
+			};
+			userCreated = true;
+			console.log("[setup-dev-bypass] Created dev admin user:", user.email);
+		} else user = {
+			id: existingUser.id,
+			email: existingUser.email,
+			name: existingUser.name || DEV_USER_NAME,
+			role: existingUser.role
+		};
+		if (!await options.get("emdash:site_title")) await options.set("emdash:site_title", DEV_SITE_TITLE);
+		await options.set("emdash:site_url", getPublicOrigin(url, emdash?.config));
+		await options.set("emdash:setup_complete", true);
+		if (session) session.set("user", { id: user.id });
+		let token;
+		if (url.searchParams.has("token")) {
+			await deleteApiTokensByName(emdash.db, user.id, "dev-bypass-token");
+			const result = await handleApiTokenCreate(emdash.db, user.id, {
+				name: "dev-bypass-token",
+				scopes: [
+					"content:read",
+					"content:write",
+					"media:read",
+					"media:write",
+					"schema:read",
+					"schema:write",
+					"admin"
+				]
+			});
+			if (result.success) token = result.data.token;
+		}
+		const redirect = url.searchParams.get("redirect");
+		if (redirect) {
+			if (!isSafeRedirect(redirect)) return apiError("INVALID_REDIRECT", "Redirect must be a local path", 400);
+			const html = `<!DOCTYPE html>
+<html>
+<head>
+	<meta http-equiv="refresh" content="0;url=${escapeHtml(redirect)}">
+</head>
+<body>Redirecting...</body>
+</html>`;
+			return new Response(html, {
+				status: 200,
+				headers: { "Content-Type": "text/html" }
+			});
+		}
+		return apiSuccess({
+			success: true,
+			message: "Dev setup complete",
+			migrations: [],
+			userCreated,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role
+			},
+			...token ? { token } : {}
+		});
+	} catch (error) {
+		return handleError(error, "Dev bypass failed", "DEV_BYPASS_ERROR");
+	}
+}
+const GET = handleDevBypass;
+const POST = handleDevBypass;
+
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=dev-bypass.mjs.map

package/dist/astro/routes/api/setup/dev-bypass.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/dev-bypass\n * GET  /_emdash/api/setup/dev-bypass\n *\n * Development-only endpoint to bypass the setup wizard.\n * Creates a dev admin user and marks setup complete after runtime initialization.\n * Newly applied sample content has its Media Usage index prepared before redirecting.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with setup info\n * - ?content=0 (or ?content=false): apply schema/structure only, skipping\n *   sample content entries, bylines, and taxonomy terms\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { deleteApiTokensByName, handleApiTokenCreate } from \"#api/handlers/api-tokens.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { repairContentMediaUsageCollection } from \"#media/usage/content-repair.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\nconst DEV_SITE_TITLE = \"EmDash Dev Site\";\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Apply seed (user seed or built-in default). `?content=0` (or `false`)\n\t\t// applies schema/structure only — no sample content, bylines, or terms.\n\t\tconst contentParam = url.searchParams.get(\"content\");\n\t\tconst includeContent = contentParam !== \"0\" && contentParam !== \"false\";\n\t\tconst seed = await loadSeed();\n\t\tconst validation = validateSeed(seed);\n\t\tif (validation.valid) {\n\t\t\tconst seedResult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t\tconsole.log(\n\t\t\t\t`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`,\n\t\t\t);\n\t\t\tif (includeContent && seedResult.content.created + seedResult.content.updated > 0) {\n\t\t\t\tfor (const collectionSlug of Object.keys(seed.content ?? {})) {\n\t\t\t\t\tconst repair = await repairContentMediaUsageCollection(emdash.db, {\n\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t});\n\t\t\t\t\tif (repair.status !== \"complete\") {\n\t\t\t\t\t\tthrow new Error(`Seeded Media Usage indexing failed for ${collectionSlug}`);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\t\tlet userCreated = false;\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tuserCreated = true;\n\t\t\tconsole.log(\"[setup-dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Set site title if not already set\n\t\tconst existingTitle = await options.get(\"emdash:site_title\");\n\t\tif (!existingTitle) {\n\t\t\tawait options.set(\"emdash:site_title\", DEV_SITE_TITLE);\n\t\t}\n\n\t\t// Store canonical site URL (used by magic-link/recovery emails)\n\t\tawait options.set(\"emdash:site_url\", getPublicOrigin(url, emdash?.config));\n\n\t\t// Mark setup complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Optionally create a PAT token (?token=1) for headless/CLI testing.\n\t\tlet token: string | undefined;\n\t\tif (url.searchParams.has(\"token\")) {\n\t\t\t// Idempotent by name: a prior reset can leave a stale dev-bypass-token,\n\t\t\t// and the raw token is only available at creation, so drop any existing\n\t\t\t// one and mint a fresh, usable PAT rather than accumulating duplicates.\n\t\t\tawait deleteApiTokensByName(emdash.db, user.id, \"dev-bypass-token\");\n\t\t\tconst result = await handleApiTokenCreate(emdash.db, user.id, {\n\t\t\t\tname: \"dev-bypass-token\",\n\t\t\t\tscopes: [\n\t\t\t\t\t\"content:read\",\n\t\t\t\t\t\"content:write\",\n\t\t\t\t\t\"media:read\",\n\t\t\t\t\t\"media:write\",\n\t\t\t\t\t\"schema:read\",\n\t\t\t\t\t\"schema:write\",\n\t\t\t\t\t\"admin\",\n\t\t\t\t],\n\t\t\t});\n\t\t\tif (result.success) {\n\t\t\t\ttoken = result.data.token;\n\t\t\t}\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev setup complete\",\n\t\t\tmigrations: [],\n\t\t\tuserCreated,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t\t...(token ? { token } : {}),\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAgBzB,MAAM,aAAa;AAEnB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AAEvB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAGH,MAAM,eAAe,IAAI,aAAa,IAAI,UAAU;EACpD,MAAM,iBAAiB,iBAAiB,OAAO,iBAAiB;EAChE,MAAM,OAAO,MAAM,UAAU;AAE7B,MADmB,aAAa,KAAK,CACtB,OAAO;GACrB,MAAM,aAAa,MAAM,UAAU,OAAO,IAAI,MAAM;IACnD;IACA,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;AACF,WAAQ,IACP,oCAAoC,WAAW,YAAY,QAAQ,gBAAgB,WAAW,OAAO,QAAQ,SAC7G;AACD,OAAI,kBAAkB,WAAW,QAAQ,UAAU,WAAW,QAAQ,UAAU,GAC/E;SAAK,MAAM,kBAAkB,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC,CAI3D,MAHe,MAAM,kCAAkC,OAAO,IAAI,EACjE,gBACA,CAAC,EACS,WAAW,WACrB,OAAM,IAAI,MAAM,0CAA0C,iBAAiB;;;EAM/E,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAGhD,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;EACJ,IAAI,cAAc;AAElB,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,iBAAc;AACd,WAAQ,IAAI,8CAA8C,KAAK,MAAM;QAErE,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAKF,MAAI,CADkB,MAAM,QAAQ,IAAI,oBAAoB,CAE3D,OAAM,QAAQ,IAAI,qBAAqB,eAAe;AAIvD,QAAM,QAAQ,IAAI,mBAAmB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AAG1E,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,IAAI;AACJ,MAAI,IAAI,aAAa,IAAI,QAAQ,EAAE;AAIlC,SAAM,sBAAsB,OAAO,IAAI,KAAK,IAAI,mBAAmB;GACnE,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,KAAK,IAAI;IAC7D,MAAM;IACN,QAAQ;KACP;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACD,CAAC;AACF,OAAI,OAAO,QACV,SAAQ,OAAO,KAAK;;EAKtB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,YAAY,EAAE;GACd;GACA,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;GAC1B,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,qBAAqB,mBAAmB;;;AAKpE,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}

package/dist/astro/routes/api/setup/dev-reset.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/dev-reset.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=dev-reset.d.mts.map

package/dist/astro/routes/api/setup/dev-reset.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-reset.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-reset.ts"],"mappings":";;;cAYa,SAAA;AAAA,cAKA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/setup/dev-reset.mjs

@@ -0,0 +1,27 @@
+import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
+import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../types-j6MBDjlZ.mjs";
+import "../../../../errors-CjXd1LgH.mjs";
+import "../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEdm_AWU.mjs";
+
+//#region src/astro/routes/api/setup/dev-reset.ts
+const prerender = false;
+const POST = async ({ locals }) => {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Dev reset is only available in development mode", 403);
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		const options = new OptionsRepository(emdash.db);
+		await options.delete("emdash:setup_complete");
+		await options.delete("emdash:setup_state");
+		await emdash.db.deleteFrom("users").execute();
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Dev reset failed", "DEV_RESET_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=dev-reset.mjs.map

package/dist/astro/routes/api/setup/dev-reset.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-reset.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-reset.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/dev-reset\n *\n * Development-only endpoint to reset setup state for testing.\n * Clears the setup_complete flag and deletes all users,\n * returning the site to the pre-setup state.\n *\n * ONLY available when import.meta.env.DEV is true.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ locals }) => {\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev reset is only available in development mode\", 403);\n\t}\n\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\tawait options.delete(\"emdash:setup_complete\");\n\t\tawait options.delete(\"emdash:setup_state\");\n\t\tawait emdash.db.deleteFrom(\"users\").execute();\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev reset failed\", \"DEV_RESET_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;AAYA,MAAa,YAAY;AAKzB,MAAa,OAAiB,OAAO,EAAE,aAAa;AACnD,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,mDAAmD,IAAI;CAGrF,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAEhD,QAAM,QAAQ,OAAO,wBAAwB;AAC7C,QAAM,QAAQ,OAAO,qBAAqB;AAC1C,QAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,SAAS;AAE7C,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,oBAAoB,kBAAkB"}

package/dist/astro/routes/api/setup/index.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/index.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/setup/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAuBA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/setup/index.mjs

@@ -0,0 +1,147 @@
+import "../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../config-CvmjJcVw.mjs";
+import "../../../../datetime-normalization-PeiEdcRY.mjs";
+import "../../../../after-PcEvMY_6.mjs";
+import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
+import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../secrets-CIi0nFiR.mjs";
+import "../../../../content-RzEXY3QX.mjs";
+import "../../../../object-cache-Bo6DGaC9.mjs";
+import "../../../../slugify-T5GHH42D.mjs";
+import "../../../../request-cache-C4CIo5ad.mjs";
+import "../../../../url-Dn3IStq8.mjs";
+import "../../../../types-j6MBDjlZ.mjs";
+import "../../../../revision-CGkQA0e5.mjs";
+import "../../../../media-CputjGE1.mjs";
+import "../../../../taxonomy-BesdHIwi.mjs";
+import "../../../../resolve-D-kqyKns.mjs";
+import "../../../../redirect-BvFKh8Sz.mjs";
+import "../../../../byline-registry-dvt4N3xV.mjs";
+import "../../../../field-defs-cache-DEkFYCDE.mjs";
+import "../../../../byline-02tu_Uc-.mjs";
+import "../../../../staged-Bw5eHbKS.mjs";
+import "../../../../dist-Cfu8mMBs.mjs";
+import "../../../../fts-manager-DU03MxWu.mjs";
+import "../../../../loader-CWb-ja1p.mjs";
+import "../../../../collection-slugs-cache-BNRAPNiu.mjs";
+import "../../../../capture-triggers-CdZfvHtF.mjs";
+import "../../../../activation-DDuqAat2.mjs";
+import "../../../../collection-deletion-JecE26cS.mjs";
+import "../../../../registry-CtHRqVe-.mjs";
+import "../../../../hash-CY4QdeMJ.mjs";
+import "../../../../zod-generator-DnfG5sGQ.mjs";
+import "../../../../errors-CjXd1LgH.mjs";
+import "../../../../canonical-CAecl1UQ.mjs";
+import "../../../../digest-DiYAoZpf.mjs";
+import "../../../../block-values-BrTrtA-v.mjs";
+import "../../../../query-DSEkrw_m.mjs";
+import "../../../../schema-BZPj3kwZ.mjs";
+import "../../../../relations-CVI2nbrn.mjs";
+import "../../../../errors-CNvATh_7.mjs";
+import "../../../../settings-B0zQj_Tj.mjs";
+import "../../../../site-settings-AYFvhwQn.mjs";
+import "../../../../schema-Berj5VQx.mjs";
+import "../../../../settings-CnWoEDb0.mjs";
+import "../../../../ssrf-DsmvZB80.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-Gt2l4Sld.mjs";
+import "../../../../redirects-D4EWeXAo.mjs";
+import "../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../media-D1z_jisb.mjs";
+import "../../../../comments-BRtp992B.mjs";
+import { d as setupBody } from "../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../menus-BQKqf0Up.mjs";
+import "../../../../status-D39Fpy8R.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as applySeedWithinBudget } from "../../../../apply-BNvvsD51.mjs";
+import "../../../../ssrf-tA45vIPX.mjs";
+import { n as validateSeed } from "../../../../validate-WkjGwBSO.mjs";
+import { t as loadSeed } from "../../../../load-dHcR5yh9.mjs";
+import { t as getConfiguredOrigin } from "../../../../public-url-B5a0QAh6.mjs";
+import { t as getAuthMode } from "../../../../mode-nh0ppSX5.mjs";
+
+//#region src/astro/routes/api/setup/index.ts
+const prerender = false;
+/**
+* What one setup request may spend on the seed before the rest continues in
+* the next request. Cloudflare Workers Free allows 1,000 calls to D1, KV and R2
+* and 50 external fetches per request. A `$media` download takes at least three
+* fetches (two DNS-over-HTTPS lookups in `ssrfSafeFetch`, then the file) and
+* three more per redirect. The margin covers a redirect per download, the entry
+* that crosses the budget with its images, the phases after content and the
+* object-cache writes at the end.
+*/
+const SEED_BUDGET_PER_REQUEST = {
+	queries: 500,
+	mediaDownloads: 5
+};
+const POST = async ({ request, url, locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		try {
+			const setupComplete = await new OptionsRepository(emdash.db).get("emdash:setup_complete");
+			if (setupComplete === true || setupComplete === "true") return apiError("ALREADY_CONFIGURED", "Setup has already been completed", 409);
+		} catch {}
+		const configuredSiteUrl = getConfiguredOrigin(emdash.config);
+		const loopbackHost = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+		const siteUrl = configuredSiteUrl ?? (import.meta.env.DEV && loopbackHost ? url.origin : void 0);
+		if (!siteUrl) return apiError("SITE_URL_REQUIRED", "Set siteUrl or EMDASH_SITE_URL before running production setup", 500);
+		const body = await parseBody(request, setupBody);
+		if (isParseError(body)) return body;
+		const seed = await loadSeed();
+		seed.settings = {
+			...seed.settings,
+			title: body.title,
+			tagline: body.tagline
+		};
+		const validation = validateSeed(seed);
+		if (!validation.valid) return apiError("INVALID_SEED", `Invalid seed file: ${validation.errors.join(", ")}`, 400);
+		let seeded;
+		try {
+			seeded = await applySeedWithinBudget(emdash.db, seed, {
+				includeContent: body.includeContent,
+				onConflict: "skip",
+				storage: emdash.storage ?? void 0
+			}, SEED_BUDGET_PER_REQUEST);
+		} catch (error) {
+			return handleError(error, "Failed to apply seed", "SEED_ERROR");
+		}
+		const { result, complete: seedComplete, progress: seedProgress } = seeded;
+		const useExternalAuth = getAuthMode(emdash.config).type === "external";
+		try {
+			const options = new OptionsRepository(emdash.db);
+			await options.setIfAbsent("emdash:site_url", siteUrl);
+			if (seedComplete) if (useExternalAuth) {
+				await options.set("emdash:setup_complete", true);
+				await options.set("emdash:site_title", body.title);
+				if (body.tagline) await options.set("emdash:site_tagline", body.tagline);
+			} else await options.set("emdash:setup_state", {
+				step: "site_complete",
+				title: body.title,
+				tagline: body.tagline
+			});
+		} catch (error) {
+			console.error("Failed to save setup state:", error);
+		}
+		if (!seedComplete) return apiSuccess({
+			success: true,
+			setupComplete: false,
+			seedComplete: false,
+			seedProgress,
+			result
+		});
+		return apiSuccess({
+			success: true,
+			setupComplete: useExternalAuth,
+			seedComplete: true,
+			result
+		});
+	} catch (error) {
+		return handleError(error, "Setup failed", "SETUP_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/setup/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/index.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup\n *\n * Executes the setup wizard - applies seed file and marks setup complete\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getConfiguredOrigin } from \"#api/public-url.js\";\nimport { setupBody } from \"#api/schemas.js\";\nimport { getAuthMode } from \"#auth/mode.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { applySeedWithinBudget, type SeedApplyBudget } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\n/**\n * What one setup request may spend on the seed before the rest continues in\n * the next request. Cloudflare Workers Free allows 1,000 calls to D1, KV and R2\n * and 50 external fetches per request. A `$media` download takes at least three\n * fetches (two DNS-over-HTTPS lookups in `ssrfSafeFetch`, then the file) and\n * three more per redirect. The margin covers a redirect per download, the entry\n * that crosses the budget with its images, the phases after content and the\n * object-cache writes at the end.\n */\nconst SEED_BUDGET_PER_REQUEST: SeedApplyBudget = { queries: 500, mediaDownloads: 5 };\n\nexport const POST: APIRoute = async ({ request, url, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Guard: reject if setup has already been completed.\n\t\t// The options table may not exist on first-ever setup (pre-migration),\n\t\t// so a query failure means setup hasn't run yet — allow it to proceed.\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\n\t\t\tif (setupComplete === true || setupComplete === \"true\") {\n\t\t\t\treturn apiError(\"ALREADY_CONFIGURED\", \"Setup has already been completed\", 409);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Options table doesn't exist yet — first-ever setup, allow it\n\t\t}\n\n\t\tconst configuredSiteUrl = getConfiguredOrigin(emdash.config);\n\t\tconst loopbackHost =\n\t\t\turl.hostname === \"localhost\" || url.hostname === \"127.0.0.1\" || url.hostname === \"[::1]\";\n\t\tconst siteUrl =\n\t\t\tconfiguredSiteUrl ?? (import.meta.env.DEV && loopbackHost ? url.origin : undefined);\n\t\tif (!siteUrl) {\n\t\t\treturn apiError(\n\t\t\t\t\"SITE_URL_REQUIRED\",\n\t\t\t\t\"Set siteUrl or EMDASH_SITE_URL before running production setup\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Load seed file (user seed or built-in default)\n\t\tconst seed = await loadSeed();\n\n\t\t// Override seed settings with form values\n\t\tseed.settings = {\n\t\t\t...seed.settings,\n\t\t\ttitle: body.title,\n\t\t\ttagline: body.tagline,\n\t\t};\n\n\t\t// Apply seed\n\t\tconst validation = validateSeed(seed);\n\t\tif (!validation.valid) {\n\t\t\treturn apiError(\"INVALID_SEED\", `Invalid seed file: ${validation.errors.join(\", \")}`, 400);\n\t\t}\n\n\t\tlet seeded;\n\t\ttry {\n\t\t\tseeded = await applySeedWithinBudget(\n\t\t\t\temdash.db,\n\t\t\t\tseed,\n\t\t\t\t{\n\t\t\t\t\tincludeContent: body.includeContent,\n\t\t\t\t\tonConflict: \"skip\",\n\t\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t\t},\n\t\t\t\tSEED_BUDGET_PER_REQUEST,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to apply seed\", \"SEED_ERROR\");\n\t\t}\n\t\tconst { result, complete: seedComplete, progress: seedProgress } = seeded;\n\n\t\t// Store setup state\n\t\t// In external auth mode, mark setup complete immediately (first user to login becomes admin)\n\t\t// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)\n\t\tconst authMode = getAuthMode(emdash.config);\n\t\tconst useExternalAuth = authMode.type === \"external\";\n\n\t\ttry {\n\t\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t\t// Store the canonical site URL from the setup request.\n\t\t\t// Write-once at the DB level so concurrent setup POSTs can't both\n\t\t\t// observe an empty value and race to write. A spoofed Host header\n\t\t\t// on a later call during the wizard window must not be able to\n\t\t\t// replace the first value.\n\t\t\tawait options.setIfAbsent(\"emdash:site_url\", siteUrl);\n\n\t\t\tif (seedComplete) {\n\t\t\t\tif (useExternalAuth) {\n\t\t\t\t\t// External auth mode: mark setup complete now\n\t\t\t\t\t// First user to log in via external provider will become admin\n\t\t\t\t\tawait options.set(\"emdash:setup_complete\", true);\n\t\t\t\t\tawait options.set(\"emdash:site_title\", body.title);\n\t\t\t\t\tif (body.tagline) {\n\t\t\t\t\t\tawait options.set(\"emdash:site_tagline\", body.tagline);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\t// Passkey/provider mode: store state for next step (admin creation)\n\t\t\t\t\tawait options.set(\"emdash:setup_state\", {\n\t\t\t\t\t\tstep: \"site_complete\",\n\t\t\t\t\t\ttitle: body.title,\n\t\t\t\t\t\ttagline: body.tagline,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconsole.error(\"Failed to save setup state:\", error);\n\t\t\t// Non-fatal - continue anyway\n\t\t}\n\n\t\tif (!seedComplete) {\n\t\t\t// The wizard posts again; items already created are skipped.\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tsetupComplete: false,\n\t\t\t\tseedComplete: false,\n\t\t\t\tseedProgress,\n\t\t\t\tresult,\n\t\t\t});\n\t\t}\n\n\t\t// Return success with result\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\t// In external auth mode, setup is complete - redirect to admin\n\t\t\tsetupComplete: useExternalAuth,\n\t\t\tseedComplete: true,\n\t\t\tresult,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Setup failed\", \"SETUP_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;;;;;;;;;;AAqBzB,MAAM,0BAA2C;CAAE,SAAS;CAAK,gBAAgB;CAAG;AAEpF,MAAa,OAAiB,OAAO,EAAE,SAAS,KAAK,aAAa;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAIH,MAAI;GAEH,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAEhE,OAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO,SAAS,sBAAsB,oCAAoC,IAAI;UAExE;EAIR,MAAM,oBAAoB,oBAAoB,OAAO,OAAO;EAC5D,MAAM,eACL,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa;EAClF,MAAM,UACL,sBAAsB,OAAO,KAAK,IAAI,OAAO,eAAe,IAAI,SAAS;AAC1E,MAAI,CAAC,QACJ,QAAO,SACN,qBACA,kEACA,IACA;EAIF,MAAM,OAAO,MAAM,UAAU,SAAS,UAAU;AAChD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,MAAM,UAAU;AAG7B,OAAK,WAAW;GACf,GAAG,KAAK;GACR,OAAO,KAAK;GACZ,SAAS,KAAK;GACd;EAGD,MAAM,aAAa,aAAa,KAAK;AACrC,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,gBAAgB,sBAAsB,WAAW,OAAO,KAAK,KAAK,IAAI,IAAI;EAG3F,IAAI;AACJ,MAAI;AACH,YAAS,MAAM,sBACd,OAAO,IACP,MACA;IACC,gBAAgB,KAAK;IACrB,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,EACD,wBACA;WACO,OAAO;AACf,UAAO,YAAY,OAAO,wBAAwB,aAAa;;EAEhE,MAAM,EAAE,QAAQ,UAAU,cAAc,UAAU,iBAAiB;EAMnE,MAAM,kBADW,YAAY,OAAO,OAAO,CACV,SAAS;AAE1C,MAAI;GACH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAOhD,SAAM,QAAQ,YAAY,mBAAmB,QAAQ;AAErD,OAAI,aACH,KAAI,iBAAiB;AAGpB,UAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,UAAM,QAAQ,IAAI,qBAAqB,KAAK,MAAM;AAClD,QAAI,KAAK,QACR,OAAM,QAAQ,IAAI,uBAAuB,KAAK,QAAQ;SAIvD,OAAM,QAAQ,IAAI,sBAAsB;IACvC,MAAM;IACN,OAAO,KAAK;IACZ,SAAS,KAAK;IACd,CAAC;WAGI,OAAO;AACf,WAAQ,MAAM,+BAA+B,MAAM;;AAIpD,MAAI,CAAC,aAEJ,QAAO,WAAW;GACjB,SAAS;GACT,eAAe;GACf,cAAc;GACd;GACA;GACA,CAAC;AAIH,SAAO,WAAW;GACjB,SAAS;GAET,eAAe;GACf,cAAc;GACd;GACA,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gBAAgB,cAAc"}

package/dist/astro/routes/api/setup/status.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/status.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=status.d.mts.map

package/dist/astro/routes/api/setup/status.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/status.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAMA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/setup/status.mjs

@@ -0,0 +1,62 @@
+import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../types-j6MBDjlZ.mjs";
+import "../../../../errors-CjXd1LgH.mjs";
+import "../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEdm_AWU.mjs";
+import { n as loadUserSeed } from "../../../../load-dHcR5yh9.mjs";
+import { t as getAuthMode } from "../../../../mode-nh0ppSX5.mjs";
+
+//#region src/astro/routes/api/setup/status.ts
+const prerender = false;
+const GET = async ({ locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	try {
+		const setupComplete = await emdash.db.selectFrom("options").select("value").where("name", "=", "emdash:setup_complete").executeTakeFirst();
+		const isComplete = setupComplete && (() => {
+			try {
+				const parsed = JSON.parse(setupComplete.value);
+				return parsed === true || parsed === "true";
+			} catch {
+				return false;
+			}
+		})();
+		let hasUsers = false;
+		try {
+			hasUsers = (await emdash.db.selectFrom("users").select((eb) => eb.fn.countAll().as("count")).executeTakeFirstOrThrow()).count > 0;
+		} catch {}
+		if (isComplete && hasUsers) return apiSuccess({ needsSetup: false });
+		let step = "start";
+		const setupState = await emdash.db.selectFrom("options").select("value").where("name", "=", "emdash:setup_state").executeTakeFirst();
+		if (setupState) try {
+			const state = JSON.parse(setupState.value);
+			if (state.step === "admin") step = "admin";
+			else if (state.step === "site") step = "site";
+		} catch {}
+		if (isComplete && !hasUsers) step = "admin";
+		const authMode = getAuthMode(emdash.config);
+		const useExternalAuth = authMode.type === "external";
+		if (useExternalAuth && isComplete) return apiSuccess({ needsSetup: false });
+		const seed = await loadUserSeed();
+		const seedInfo = seed ? {
+			name: seed.meta?.name || "Unknown Template",
+			description: seed.meta?.description || "",
+			collections: seed.collections?.length || 0,
+			hasContent: !!(seed.content && Object.keys(seed.content).length > 0),
+			title: seed.settings?.title,
+			tagline: seed.settings?.tagline
+		} : null;
+		return apiSuccess({
+			needsSetup: true,
+			step,
+			seedInfo,
+			authMode: useExternalAuth ? authMode.providerType : "passkey"
+		});
+	} catch (error) {
+		return handleError(error, "Failed to check setup status", "SETUP_STATUS_ERROR");
+	}
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=status.mjs.map