emdash 1.0.1 → 1.2.0

package/dist/astro/routes/api/auth/passkey/options.mjs

@@ -1,27 +1,28 @@
 import "../../../../../config-CvmjJcVw.mjs";
+import { t as after } from "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
-import "../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import "../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../comments-zrTgWBSg.mjs";
-import { D as passkeyOptionsBody } from "../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../status-C6IrSLMT.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import { D as passkeyOptionsBody } from "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-C0eHXPd-.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-7j0cpCFc.mjs";
-import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-VePApay4.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-D0BcE76H.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-PiQ5cBnt.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-d4Tk6biT.mjs";
+import { i as getPublicOrigin } from "../../../../../public-url-uT1Ok2Tu.mjs";
+import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-BHgdPVze.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-Dvamvay-.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-mMFRQUCj.mjs";
 import { generateAuthenticationOptions } from "@emdash-cms/auth/passkey";
 
 //#region src/astro/routes/api/auth/passkey/options.ts
@@ -30,7 +31,13 @@ const POST = async ({ request, locals }) => {
 	const { emdash } = locals;
 	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	try {
-		cleanupExpiredChallenges(emdash.db).catch(() => {});
+		after(async () => {
+			try {
+				await cleanupExpiredChallenges(emdash.db);
+			} catch (error) {
+				console.error("[passkey] failed to delete expired challenges:", error);
+			}
+		});
 		const body = await parseOptionalBody(request, passkeyOptionsBody, {});
 		if (isParseError(body)) return body;
 		const ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));

package/dist/astro/routes/api/auth/passkey/options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/options\n *\n * Get authentication options for passkey login.\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateAuthenticationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore, cleanupExpiredChallenges } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fire-and-forget cleanup of expired challenges -- prevents accumulation\n\t\tvoid cleanupExpiredChallenges(emdash.db).catch(() => {});\n\n\t\t// Parse body before rate limiting so malformed requests don't consume slots\n\t\tconst body = await parseOptionalBody(request, passkeyOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"passkey/options\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate authentication options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\t// Never scope to the submitted email: allowCredentials would reveal whether the account exists.\n\t\tconst authOptions = await generateAuthenticationOptions(passkeyConfig, [], challengeStore);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: authOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate passkey options\", \"PASSKEY_OPTIONS_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAczB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,EAAK,yBAAyB,OAAO,GAAG,CAAC,YAAY,GAAG;EAGxD,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,IAAI,GAAG,EACjE,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAWhC,SAAO,WAAW;GACjB,SAAS;GACT,SAJmB,MAAM,8BALJ,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU,EAKS,EAAE,EAFlD,qBAAqB,OAAO,GAAG,CAEoC;GAKzF,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,wBAAwB"}
+{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/options\n *\n * Get authentication options for passkey login.\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateAuthenticationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore, cleanupExpiredChallenges } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nimport { after } from \"../../../../../after.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Cleanup of expired challenges -- prevents accumulation\n\t\tafter(async () => {\n\t\t\ttry {\n\t\t\t\tawait cleanupExpiredChallenges(emdash.db);\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\"[passkey] failed to delete expired challenges:\", error);\n\t\t\t}\n\t\t});\n\n\t\t// Parse body before rate limiting so malformed requests don't consume slots\n\t\tconst body = await parseOptionalBody(request, passkeyOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"passkey/options\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate authentication options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\t// Never scope to the submitted email: allowCredentials would reveal whether the account exists.\n\t\tconst authOptions = await generateAuthenticationOptions(passkeyConfig, [], challengeStore);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: authOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate passkey options\", \"PASSKEY_OPTIONS_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAgBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,QAAM,YAAY;AACjB,OAAI;AACH,UAAM,yBAAyB,OAAO,GAAG;YACjC,OAAO;AACf,YAAQ,MAAM,kDAAkD,MAAM;;IAEtE;EAGF,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,IAAI,GAAG,EACjE,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAWhC,SAAO,WAAW;GACjB,SAAS;GACT,SAJmB,MAAM,8BALJ,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU,EAKS,EAAE,EAFlD,qBAAqB,OAAO,GAAG,CAEoC;GAKzF,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,wBAAwB"}

package/dist/astro/routes/api/auth/passkey/register/options.mjs

@@ -1,25 +1,25 @@
 import "../../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
-import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../../url-Dn3IStq8.mjs";
-import "../../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../../errors-CNvATh_7.mjs";
-import "../../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DIYXAVk4.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../../comments-zrTgWBSg.mjs";
-import { O as passkeyRegisterOptionsBody } from "../../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../../status-C6IrSLMT.mjs";
+import "../../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DxgQdaZ_.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../../media-CRKsKlfK.mjs";
+import "../../../../../../comments-BzmIKVb2.mjs";
+import { O as passkeyRegisterOptionsBody } from "../../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../../menus-D1HC8npj.mjs";
+import "../../../../../../status-Dl85BK39.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-7j0cpCFc.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-VePApay4.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-PiQ5cBnt.mjs";
+import { i as getPublicOrigin } from "../../../../../../public-url-uT1Ok2Tu.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-BHgdPVze.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-mMFRQUCj.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/verify.mjs

@@ -1,26 +1,26 @@
 import "../../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
-import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../../url-Dn3IStq8.mjs";
-import "../../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../../errors-CNvATh_7.mjs";
-import "../../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../../comments-zrTgWBSg.mjs";
-import { k as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../../status-C6IrSLMT.mjs";
+import "../../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../../media-CRKsKlfK.mjs";
+import "../../../../../../comments-BzmIKVb2.mjs";
+import { k as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../../menus-D1HC8npj.mjs";
+import "../../../../../../status-Dl85BK39.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-7j0cpCFc.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-D78QvbTO.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-VePApay4.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-PiQ5cBnt.mjs";
+import { i as getPublicOrigin } from "../../../../../../public-url-uT1Ok2Tu.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-CLpHGGlc.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-BHgdPVze.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-mMFRQUCj.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/verify.mjs

@@ -1,28 +1,28 @@
 import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
-import "../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import "../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../comments-zrTgWBSg.mjs";
-import { j as passkeyVerifyBody } from "../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../status-C6IrSLMT.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import { j as passkeyVerifyBody } from "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-7j0cpCFc.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-D78QvbTO.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-VePApay4.mjs";
-import { r as sessionUnavailableError } from "../../../../../session-user-C6IEjuty.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-PiQ5cBnt.mjs";
+import { i as getPublicOrigin } from "../../../../../public-url-uT1Ok2Tu.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CLpHGGlc.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-BHgdPVze.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-1dtJc2zv.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-mMFRQUCj.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { PasskeyAuthenticationError, authenticateWithPasskey } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/signup/complete.mjs

@@ -1,28 +1,28 @@
 import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
-import "../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import "../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../comments-zrTgWBSg.mjs";
-import { M as signupCompleteBody } from "../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../status-C6IrSLMT.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import { M as signupCompleteBody } from "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-7j0cpCFc.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-D78QvbTO.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-VePApay4.mjs";
-import { r as sessionUnavailableError } from "../../../../../session-user-C6IEjuty.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-PiQ5cBnt.mjs";
+import { i as getPublicOrigin } from "../../../../../public-url-uT1Ok2Tu.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CLpHGGlc.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-BHgdPVze.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-1dtJc2zv.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-mMFRQUCj.mjs";
 import { SignupError, completeSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/auth/signup/request.mjs

@@ -1,25 +1,26 @@
 import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
-import "../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import "../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../comments-zrTgWBSg.mjs";
-import { N as signupRequestBody } from "../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../status-C6IrSLMT.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import { N as signupRequestBody } from "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-C0eHXPd-.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-wEYRMHBv.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-D0BcE76H.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-d4Tk6biT.mjs";
+import { n as getSiteBaseUrl } from "../../../../../site-url-CrDZaAvo.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-Dvamvay-.mjs";
 import { requestSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/signup/request.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/request.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/signup/request\n *\n * Request self-signup. Sends verification email if domain is allowed.\n * Always returns 200 to prevent email enumeration.\n *\n * Rate limited: 3 requests per 5 minutes per IP. Mirrors magic-link/send.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { requestSignup } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { signupRequestBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\n// Generic response body used for both the real success path and the\n// rate-limited / domain-disallowed paths. Keeping them identical prevents\n// the caller from distinguishing between them.\nconst GENERIC_SUCCESS = {\n\tsuccess: true,\n\tmessage: \"If your email domain is allowed, you'll receive a verification email.\",\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Check if email pipeline is available\n\tif (!emdash.email?.isAvailable()) {\n\t\treturn apiError(\n\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\"Email not configured. Self-signup is unavailable.\",\n\t\t\t503,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Parse the body first — this avoids burning a rate-limit slot on\n\t\t// malformed input and keeps the timing of the rate-limited and\n\t\t// real paths aligned.\n\t\tconst body = await parseBody(request, signupRequestBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds per IP. Matches magic-link/send.\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"signup/request\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limiting\n\t\t\t// (and by extension, the fact that the caller is probing).\n\t\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get site config for signup email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in signup emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\n\t\t// Request signup - this handles all checks internally and fails silently\n\t\t// if domain not allowed or user exists (to prevent enumeration)\n\t\tawait requestSignup(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email.toLowerCase().trim(),\n\t\t);\n\n\t\t// Always return success to prevent email enumeration\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t} catch (error) {\n\t\tconsole.error(\"Signup request error:\", error);\n\n\t\t// Don't reveal internal errors - just return generic success\n\t\t// to prevent information leakage\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAgBzB,MAAM,kBAAkB;CACvB,SAAS;CACT,SAAS;CACT;AAED,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,qDACA,IACA;AAGF,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,GAAG,IAAI,EAChE,QAGd,QAAO,WAAW,gBAAgB;EAGnC,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAI9C,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;AAOrE,QAAM,cACL;GACC,SANc,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;GAOrE;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EACD,SACA,KAAK,MAAM,aAAa,CAAC,MAAM,CAC/B;AAGD,SAAO,WAAW,gBAAgB;UAC1B,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAI7C,SAAO,WAAW,gBAAgB"}
+{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/signup/request.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/signup/request\n *\n * Request self-signup. Sends verification email if domain is allowed.\n * Always returns 200 to prevent email enumeration.\n *\n * Rate limited: 3 requests per 5 minutes per IP. Mirrors magic-link/send.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { requestSignup } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { signupRequestBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\n// Generic response body used for both the real success path and the\n// rate-limited / domain-disallowed paths. Keeping them identical prevents\n// the caller from distinguishing between them.\nconst GENERIC_SUCCESS = {\n\tsuccess: true,\n\tmessage: \"If your email domain is allowed, you'll receive a verification email.\",\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Check if email pipeline is available\n\tif (!emdash.email?.isAvailable()) {\n\t\treturn apiError(\n\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\"Email not configured. Self-signup is unavailable.\",\n\t\t\t503,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Parse the body first — this avoids burning a rate-limit slot on\n\t\t// malformed input and keeps the timing of the rate-limited and\n\t\t// real paths aligned.\n\t\tconst body = await parseBody(request, signupRequestBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds per IP. Matches magic-link/send.\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"signup/request\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limiting\n\t\t\t// (and by extension, the fact that the caller is probing).\n\t\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get site config for signup email\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) || \"EmDash\";\n\n\t\t// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in signup emails\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\n\t\t// Request signup - this handles all checks internally and fails silently\n\t\t// if domain not allowed or user exists (to prevent enumeration)\n\t\tawait requestSignup(\n\t\t\t{\n\t\t\t\tbaseUrl,\n\t\t\t\tsiteName,\n\t\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\t},\n\t\t\tadapter,\n\t\t\tbody.email.toLowerCase().trim(),\n\t\t);\n\n\t\t// Always return success to prevent email enumeration\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t} catch (error) {\n\t\tconsole.error(\"Signup request error:\", error);\n\n\t\t// Don't reveal internal errors - just return generic success\n\t\t// to prevent information leakage\n\t\treturn apiSuccess(GENERIC_SUCCESS);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAgBzB,MAAM,kBAAkB;CACvB,SAAS;CACT,SAAS;CACT;AAED,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,qDACA,IACA;AAGF,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,GAAG,IAAI,EAChE,QAGd,QAAO,WAAW,gBAAgB;EAGnC,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAI9C,MAAM,WAAY,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK;AAOrE,QAAM,cACL;GACC,SANc,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;GAOrE;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EACD,SACA,KAAK,MAAM,aAAa,CAAC,MAAM,CAC/B;AAGD,SAAO,WAAW,gBAAgB;UAC1B,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAI7C,SAAO,WAAW,gBAAgB"}

package/dist/astro/routes/api/auth/signup/verify.mjs

@@ -1,8 +1,8 @@
-import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
 import { SignupError, roleFromLevel, validateSignupToken } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/calendar.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/calendar.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=calendar.d.mts.map

package/dist/astro/routes/api/calendar.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar.d.mts","names":[],"sources":["../../../../src/astro/routes/api/calendar.ts"],"mappings":";;;cAca,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/calendar.mjs

@@ -0,0 +1,204 @@
+import { t as validateIdentifier } from "../../../validate-DANX1-Qi.mjs";
+import "../../../config-CvmjJcVw.mjs";
+import "../../../base64-BQBZwXCx.mjs";
+import "../../../url-Dn3IStq8.mjs";
+import { c as encodeCursor, i as InvalidCursorError, s as decodeCursor } from "../../../types-C-Xp0CcN.mjs";
+import "../../../errors-CjtE5aWF.mjs";
+import "../../../errors-hskQ0C8G.mjs";
+import "../../../settings-GaZ5sVgg.mjs";
+import "../../../site-settings-CDdT4mVm.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-DxgQdaZ_.mjs";
+import { i as parseQuery, t as isParseError } from "../../../parse-Cn5aSk1N.mjs";
+import "../../../redirects-DFT7Wr-e.mjs";
+import { Tt as calendarQuery } from "../../../entry-lock-Cjz0h45X.mjs";
+import "../../../media-CRKsKlfK.mjs";
+import "../../../comments-BzmIKVb2.mjs";
+import "../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../menus-D1HC8npj.mjs";
+import "../../../status-Dl85BK39.mjs";
+import "../../../api/schemas/index.mjs";
+import { i as requirePerm } from "../../../authorize-TdIGpRSE.mjs";
+import { sql } from "kysely";
+
+//#region src/api/handlers/calendar.ts
+/**
+* Calendar handler
+*
+* Lists published entries at their publish time and scheduled entries at
+* their scheduled time, across every visible collection, in time order.
+*/
+const KINDS = ["published", "scheduled"];
+const KIND_COLUMN = {
+	published: "published_at",
+	scheduled: "scheduled_at"
+};
+const TITLE_FIELD_TYPES = [
+	"string",
+	"text",
+	"slug"
+];
+const SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
+function compareText(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+/** Streams run in collection slug order, published before scheduled. */
+function compareStreams(a, b) {
+	return compareText(a.collection, b.collection) || KINDS.indexOf(a.kind) - KINDS.indexOf(b.kind);
+}
+function isKind(value) {
+	return value === "published" || value === "scheduled";
+}
+/** Stored timestamps are canonical `toISOString()` values. */
+function isCanonicalTime(value) {
+	const time = Date.parse(value);
+	return !Number.isNaN(time) && new Date(time).toISOString() === value;
+}
+function encodeCalendarCursor(entry) {
+	return encodeCursor(`${entry.at}|${entry.collection}|${entry.kind}`, entry.id);
+}
+function decodeCalendarCursor(cursor) {
+	const { orderValue, id } = decodeCursor(cursor);
+	const [at = "", collection = "", kind, ...rest] = orderValue.split("|");
+	if (rest.length > 0 || !isCanonicalTime(at) || !SLUG_PATTERN.test(collection) || !isKind(kind) || !id) throw new InvalidCursorError(cursor);
+	return {
+		at,
+		collection,
+		kind,
+		id
+	};
+}
+/**
+* Title columns follow the admin's rule: the collection's title field, then
+* `title`, then `name`, skipping empty values, then the slug and the id. A
+* `title_field` that names no text field is ignored.
+*/
+async function loadStreams(db) {
+	const rows = await db.selectFrom("_emdash_collections as c").leftJoin("_emdash_fields as f", (join) => join.onRef("f.collection_id", "=", "c.id").on("f.type", "in", TITLE_FIELD_TYPES).on((eb) => eb.or([eb("f.slug", "in", ["title", "name"]), eb("f.slug", "=", eb.ref("c.title_field"))]))).select([
+		"c.slug as slug",
+		"c.title_field as title_field",
+		"f.slug as field"
+	]).where("c.hidden", "=", 0).execute();
+	const collections = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const collection = collections.get(row.slug) ?? {
+			titleField: row.title_field,
+			fields: /* @__PURE__ */ new Set()
+		};
+		if (row.field) collection.fields.add(row.field);
+		collections.set(row.slug, collection);
+	}
+	return [...collections.entries()].toSorted(([a], [b]) => compareText(a, b)).flatMap(([slug, { titleField, fields }]) => {
+		validateIdentifier(slug, "collection slug");
+		const columns = [...new Set([
+			titleField,
+			"title",
+			"name"
+		])].filter((column) => !!column && fields.has(column));
+		const title = sql`COALESCE(${sql.join([...columns, "slug"].map((column) => {
+			validateIdentifier(column, "title column");
+			return sql`NULLIF(${sql.ref(column)}, '')`;
+		}))}, id)`;
+		return KINDS.map((kind) => ({
+			collection: slug,
+			kind,
+			title
+		}));
+	});
+}
+function keysetCondition(stream, cursor) {
+	if (!cursor) return sql``;
+	const column = sql.ref(KIND_COLUMN[stream.kind]);
+	const order = compareStreams(stream, cursor);
+	if (order < 0) return sql`AND ${column} > ${cursor.at}`;
+	if (order === 0) return sql`AND (${column} > ${cursor.at} OR id > ${cursor.id})`;
+	return sql``;
+}
+async function queryStream(db, stream, params, cursor) {
+	const column = sql.ref(KIND_COLUMN[stream.kind]);
+	const lower = cursor && cursor.at > params.from ? cursor.at : params.from;
+	return (await sql`
+		SELECT id, locale, status, ${stream.title} AS title, ${column} AS event_at
+		FROM ${sql.ref(`ec_${stream.collection}`)}
+		WHERE deleted_at IS NULL
+			AND ${column} IS NOT NULL
+			AND ${column} >= ${lower}
+			AND ${column} < ${params.to}
+			${stream.kind === "published" ? sql`AND status = 'published'` : sql``}
+			${keysetCondition(stream, cursor)}
+		ORDER BY ${column} ASC, id ASC
+		LIMIT ${params.limit + 1}
+	`.execute(db)).rows;
+}
+/**
+* Each stream (one collection and kind) is read in its own query, and the
+* rows are merged by time. Ties keep the stream order and then each stream's
+* SQL order, which matches the next page's keyset conditions.
+*/
+async function handleCalendarEntries(db, params) {
+	try {
+		const cursor = params.cursor ? decodeCalendarCursor(params.cursor) : void 0;
+		const streams = await loadStreams(db);
+		const merged = (await Promise.all(streams.map(async (stream) => {
+			return (await queryStream(db, stream, params, cursor)).map((row, position) => ({
+				row,
+				stream,
+				position
+			}));
+		}))).flat().toSorted((a, b) => compareText(a.row.event_at, b.row.event_at) || compareStreams(a.stream, b.stream) || a.position - b.position);
+		const items = merged.slice(0, params.limit).map(({ row, stream }) => ({
+			collection: stream.collection,
+			id: row.id,
+			locale: row.locale,
+			title: row.title,
+			status: row.status,
+			kind: stream.kind,
+			at: row.event_at
+		}));
+		const last = items.at(-1);
+		const nextCursor = merged.length > params.limit && last ? encodeCalendarCursor(last) : void 0;
+		return {
+			success: true,
+			data: nextCursor ? {
+				items,
+				nextCursor
+			} : { items }
+		};
+	} catch (error) {
+		if (error instanceof InvalidCursorError) return {
+			success: false,
+			error: {
+				code: "INVALID_CURSOR",
+				message: error.message
+			}
+		};
+		console.error("Calendar error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CALENDAR_ERROR",
+				message: "Failed to load calendar"
+			}
+		};
+	}
+}
+
+//#endregion
+//#region src/astro/routes/api/calendar.ts
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:read_drafts");
+	if (denied) return denied;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const query = parseQuery(url, calendarQuery);
+	if (isParseError(query)) return query;
+	try {
+		return unwrapResult(await handleCalendarEntries(emdash.db, query));
+	} catch (error) {
+		return handleError(error, "Failed to load calendar", "CALENDAR_ERROR");
+	}
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=calendar.mjs.map