emdash 1.1.0 → 1.2.0

package/dist/astro/routes/api/media/_id_/replace.mjs

@@ -4,21 +4,21 @@ import "../../../../../url-Dn3IStq8.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
 import { n as normalizeMime } from "../../../../../mime-B5M9R53H.mjs";
 import { n as computeContentHash } from "../../../../../hash-C4DFoJ7Z.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import { n as DEFAULT_MAX_UPLOAD_SIZE, w as mediaReplaceMetadataForm } from "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import { n as DEFAULT_MAX_UPLOAD_SIZE, w as mediaReplaceMetadataForm } from "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { MUTABLE_MEDIA_CACHE_CONTROL } from "../../../../../media/image-endpoint.mjs";
-import { i as requirePerm, r as requireOwnerPerm } from "../../../../../authorize-DeWfk--K.mjs";
+import { i as requirePerm, r as requireOwnerPerm } from "../../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/[id]/replace.ts
 const prerender = false;

package/dist/astro/routes/api/media/_id_/upload.mjs

@@ -1,13 +1,13 @@
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import { t as MediaRepository } from "../../../../../media-BzUDu7nl.mjs";
+import { t as MediaRepository } from "../../../../../media-IT8hQleU.mjs";
 import { n as normalizeMime } from "../../../../../mime-B5M9R53H.mjs";
 import { n as computeContentHash, t as MAX_CONTENT_HASH_BYTES } from "../../../../../hash-C4DFoJ7Z.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { t as removeUploadAttempt } from "../../../../../upload-attempts-nzdc3cay.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { i as requirePerm, r as requireOwnerPerm } from "../../../../../authorize-DeWfk--K.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { t as removeUploadAttempt } from "../../../../../upload-attempts-D8CPPvRU.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { i as requirePerm, r as requireOwnerPerm } from "../../../../../authorize-TdIGpRSE.mjs";
 import { ulid } from "ulidx";
 
 //#region src/astro/routes/api/media/[id]/upload.ts

package/dist/astro/routes/api/media/_id_/usage.mjs

@@ -4,36 +4,36 @@ import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../request-cache-C4CIo5ad.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../media-BzUDu7nl.mjs";
-import "../../../../../fts-manager-DacCYIe4.mjs";
+import "../../../../../media-IT8hQleU.mjs";
+import "../../../../../fts-manager-WJCN8uU6.mjs";
 import "../../../../../collection-slugs-cache-B2Gs9Jwx.mjs";
 import "../../../../../capture-triggers-C9JKoIdT.mjs";
 import "../../../../../activation-xomsCMJg.mjs";
-import "../../../../../media-usage-work-C734aq6s.mjs";
-import "../../../../../registry-DaXmUsD4.mjs";
+import "../../../../../media-usage-work-cgDYGvrt.mjs";
+import "../../../../../registry-DeZ27gVi.mjs";
 import "../../../../../hash-C4DFoJ7Z.mjs";
 import "../../../../../zod-generator-BQilAboC.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../canonical-Y1dpjCnp.mjs";
-import "../../../../../digest-xIpR3o64.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../content-repair-B7wnbzhN.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { t as handleMediaUsageDetails } from "../../../../../media-usage-CHHpV7ee.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { i as parseQuery, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import { J as mediaUsageDetailsQuery } from "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../canonical-BUcKRYpG.mjs";
+import "../../../../../digest-xJmyPv2r.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../content-repair-havk1F0-.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { t as handleMediaUsageDetails } from "../../../../../media-usage-DEPHZZ9X.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import { Y as mediaUsageDetailsQuery } from "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import "../../../../../api-tokens-BLz2MtQs.mjs";
-import { i as requirePerm } from "../../../../../authorize-DeWfk--K.mjs";
-import { n as requireScope } from "../../../../../scopes-BRnGlL9t.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import { i as requirePerm } from "../../../../../authorize-TdIGpRSE.mjs";
+import { n as requireScope } from "../../../../../scopes-RWZ5ft_Z.mjs";
 
 //#region src/astro/routes/api/media/[id]/usage.ts
 const prerender = false;

package/dist/astro/routes/api/media/_id_.mjs

@@ -4,34 +4,34 @@ import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../request-cache-C4CIo5ad.mjs";
 import "../../../../url-Dn3IStq8.mjs";
 import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../media-BzUDu7nl.mjs";
-import "../../../../fts-manager-DacCYIe4.mjs";
+import "../../../../media-IT8hQleU.mjs";
+import "../../../../fts-manager-WJCN8uU6.mjs";
 import "../../../../collection-slugs-cache-B2Gs9Jwx.mjs";
 import "../../../../capture-triggers-C9JKoIdT.mjs";
 import "../../../../activation-xomsCMJg.mjs";
-import "../../../../media-usage-work-C734aq6s.mjs";
-import "../../../../registry-DaXmUsD4.mjs";
+import "../../../../media-usage-work-cgDYGvrt.mjs";
+import "../../../../registry-DeZ27gVi.mjs";
 import "../../../../hash-C4DFoJ7Z.mjs";
 import "../../../../zod-generator-BQilAboC.mjs";
-import "../../../../errors-CuHQRiBW.mjs";
-import "../../../../canonical-Y1dpjCnp.mjs";
-import "../../../../digest-xIpR3o64.mjs";
-import "../../../../errors-DTE6C3K_.mjs";
-import "../../../../content-repair-B7wnbzhN.mjs";
-import "../../../../settings-WHr45II1.mjs";
-import "../../../../site-settings-KJOqJW6W.mjs";
-import { a as handleMediaUsageSummaries } from "../../../../media-usage-CHHpV7ee.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../error-B0rgPgsQ.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-CmFDTGzp.mjs";
-import "../../../../redirects-D4EWeXAo.mjs";
-import "../../../../entry-lock-sxz2PGAT.mjs";
-import { O as mediaUpdateBody, m as mediaGetQuery } from "../../../../media-aahnKHze.mjs";
-import "../../../../comments-BRtp992B.mjs";
-import "../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../menus-BQKqf0Up.mjs";
-import "../../../../status-D39Fpy8R.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../canonical-BUcKRYpG.mjs";
+import "../../../../digest-xJmyPv2r.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import "../../../../content-repair-havk1F0-.mjs";
+import "../../../../settings-GaZ5sVgg.mjs";
+import "../../../../site-settings-CDdT4mVm.mjs";
+import { a as handleMediaUsageSummaries } from "../../../../media-usage-DEPHZZ9X.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
+import "../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../entry-lock-Cjz0h45X.mjs";
+import { O as mediaUpdateBody, m as mediaGetQuery } from "../../../../media-CRKsKlfK.mjs";
+import "../../../../comments-BzmIKVb2.mjs";
+import "../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../menus-D1HC8npj.mjs";
+import "../../../../status-Dl85BK39.mjs";
 import "../../../../api/schemas/index.mjs";
-import { i as requirePerm, r as requireOwnerPerm, t as canReadMediaUsageCount } from "../../../../authorize-DeWfk--K.mjs";
+import { i as requirePerm, r as requireOwnerPerm, t as canReadMediaUsageCount } from "../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/[id].ts
 const prerender = false;

package/dist/astro/routes/api/media/asset/_id_/_filename_.mjs

@@ -1,10 +1,10 @@
 import "../../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../../types-C-Xp0CcN.mjs";
-import { t as MediaRepository } from "../../../../../../media-BzUDu7nl.mjs";
-import "../../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../../errors-DTE6C3K_.mjs";
-import { r as handleError, t as apiError } from "../../../../../../error-B0rgPgsQ.mjs";
-import { i as requirePerm } from "../../../../../../authorize-DeWfk--K.mjs";
+import { t as MediaRepository } from "../../../../../../media-IT8hQleU.mjs";
+import "../../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../../errors-hskQ0C8G.mjs";
+import { r as handleError, t as apiError } from "../../../../../../error-DxgQdaZ_.mjs";
+import { i as requirePerm } from "../../../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/asset/[id]/[filename].ts
 const prerender = false;

package/dist/astro/routes/api/media/file/_...key_.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_...key_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"mappings":";;;cAaa,SAAA;AAAA,cA4CA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"_...key_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"mappings":";;;cAmBa,SAAA;AAAA,cA4CA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/media/file/_...key_.mjs

@@ -1,14 +1,15 @@
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../canonical-Y1dpjCnp.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import { r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL } from "../../../../../media/image-endpoint.mjs";
-import "../../../../../kinds-BQl5gN6e.mjs";
-import "../../../../../paths-kr8hAMMI.mjs";
-import { t as isRefusedStorageKey } from "../../../../../keys-DxqxcAD4.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../canonical-BUcKRYpG.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import { r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as resolveByteRange, t as parseRangeHeader } from "../../../../../range-CXK_kDbI.mjs";
+import { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL, isNotModified, validatorHeaders } from "../../../../../media/image-endpoint.mjs";
+import "../../../../../kinds-DT1W4T4Y.mjs";
+import "../../../../../paths-BmcAdBo9.mjs";
+import { t as isRefusedStorageKey } from "../../../../../keys-CGvAndSp.mjs";
 
 //#region src/astro/routes/api/media/file/[...key].ts
 const prerender = false;
@@ -51,23 +52,52 @@ const SAFE_INLINE_TYPES = new Set([
 	"audio/wav",
 	"audio/ogg"
 ]);
-const GET = async ({ params, locals }) => {
+const GET = async ({ params, locals, request, cache }) => {
 	const { key } = params;
 	const { emdash } = locals;
 	if (!key) return apiError("NOT_FOUND", "File not found", 404);
 	if (isPrivateMediaKey(key)) return apiError("NOT_FOUND", "File not found", 404);
 	if (!emdash?.storage) return apiError("NOT_CONFIGURED", "Storage not configured", 500);
 	try {
-		const result = await emdash.storage.download(key);
+		const range = request.headers.has("If-Range") ? null : parseRangeHeader(request.headers.get("Range"));
+		if (range && cache?.enabled) cache.set(false);
+		const result = range ? await emdash.storage.download(key, { range }) : await emdash.storage.download(key);
+		const served = range ? result.range : void 0;
+		if (range && !served && result.size > 0 && !resolveByteRange(range, result.size)) {
+			await result.body.cancel().catch(() => void 0);
+			const response = apiError("RANGE_NOT_SATISFIABLE", "Range not satisfiable", 416);
+			response.headers.set("Content-Range", `bytes */${result.size}`);
+			return response;
+		}
+		const cacheControl = result.contentType.startsWith("image/") ? MUTABLE_MEDIA_CACHE_CONTROL : IMMUTABLE_IMAGE_CACHE;
+		if (isNotModified(request, result.size, result.lastModified)) return new Response(null, {
+			status: 304,
+			headers: {
+				"Content-Type": result.contentType,
+				"Cache-Control": cacheControl,
+				...validatorHeaders(result.size, result.lastModified)
+			}
+		});
 		const headers = {
 			"Content-Type": result.contentType,
-			"Cache-Control": result.contentType.startsWith("image/") ? MUTABLE_MEDIA_CACHE_CONTROL : IMMUTABLE_IMAGE_CACHE,
+			"Cache-Control": cacheControl,
+			"Accept-Ranges": "bytes",
 			"X-Content-Type-Options": "nosniff",
-			"Content-Security-Policy": "sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'"
+			"Content-Security-Policy": "sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'",
+			...validatorHeaders(result.size, result.lastModified)
 		};
-		if (result.size) headers["Content-Length"] = String(result.size);
 		if (SAFE_INLINE_TYPES.has(result.contentType)) headers["Content-Disposition"] = "inline";
 		else headers["Content-Disposition"] = "attachment";
+		if (served) {
+			const end = served.offset + served.length - 1;
+			headers["Content-Range"] = `bytes ${served.offset}-${end}/${result.size}`;
+			headers["Content-Length"] = String(served.length);
+			return new Response(result.body, {
+				status: 206,
+				headers
+			});
+		}
+		if (result.size) headers["Content-Length"] = String(result.size);
 		return new Response(result.body, {
 			status: 200,
 			headers

package/dist/astro/routes/api/media/file/_...key_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL } from \"#media/image-endpoint.js\";\n\nimport { isRefusedStorageKey } from \"../../../../../transfer/staging/keys.js\";\n\nexport const prerender = false;\n\nconst MAX_KEY_DECODES = 3;\n\n/**\n * Whether a key is, or percent-decodes to, a key this route must refuse.\n * Every decoding layer is checked because storage backends differ in whether\n * they decode keys; a key that is still encoded after the last layer, or\n * does not decode, is refused.\n */\nfunction isPrivateMediaKey(key: string): boolean {\n\tlet candidate = key;\n\tfor (let layer = 0; layer <= MAX_KEY_DECODES; layer++) {\n\t\tif (isRefusedStorageKey(candidate)) return true;\n\t\tlet decoded: string;\n\t\ttry {\n\t\t\tdecoded = decodeURIComponent(candidate);\n\t\t} catch {\n\t\t\treturn true;\n\t\t}\n\t\tif (decoded === candidate) return false;\n\t\tcandidate = decoded;\n\t}\n\treturn true;\n}\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\t// Backup archives and transfer staging share the storage bucket but hold\n\t// whole-site content; they must never be reachable through this public,\n\t// unauthenticated route.\n\tif (isPrivateMediaKey(key)) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\tconst result = await emdash.storage.download(key);\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": result.contentType.startsWith(\"image/\")\n\t\t\t\t? MUTABLE_MEDIA_CACHE_CONTROL\n\t\t\t\t: IMMUTABLE_IMAGE_CACHE,\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t};\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tif (SAFE_INLINE_TYPES.has(result.contentType)) {\n\t\t\theaders[\"Content-Disposition\"] = \"inline\";\n\t\t} else {\n\t\t\theaders[\"Content-Disposition\"] = \"attachment\";\n\t\t}\n\n\t\treturn new Response(result.body, { status: 200, headers });\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,YAAY;AAEzB,MAAM,kBAAkB;;;;;;;AAQxB,SAAS,kBAAkB,KAAsB;CAChD,IAAI,YAAY;AAChB,MAAK,IAAI,QAAQ,GAAG,SAAS,iBAAiB,SAAS;AACtD,MAAI,oBAAoB,UAAU,CAAE,QAAO;EAC3C,IAAI;AACJ,MAAI;AACH,aAAU,mBAAmB,UAAU;UAChC;AACP,UAAO;;AAER,MAAI,YAAY,UAAW,QAAO;AAClC,cAAY;;AAEb,QAAO;;;;;;AAOR,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAMpD,KAAI,kBAAkB,IAAI,CACzB,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAGjE,KAAI;EACH,MAAM,SAAS,MAAM,OAAO,QAAQ,SAAS,IAAI;EAEjD,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB,OAAO,YAAY,WAAW,SAAS,GACrD,8BACA;GACH,0BAA0B;GAG1B,2BACC;GACD;AAED,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;AAKhD,MAAI,kBAAkB,IAAI,OAAO,YAAY,CAC5C,SAAQ,yBAAyB;MAEjC,SAAQ,yBAAyB;AAGlC,SAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;UAClD,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB"}
+{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage, or a byte range of it\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport {\n\tIMMUTABLE_IMAGE_CACHE,\n\tMUTABLE_MEDIA_CACHE_CONTROL,\n\tisNotModified,\n\tvalidatorHeaders,\n} from \"#media/image-endpoint.js\";\n\nimport { parseRangeHeader, resolveByteRange } from \"../../../../../storage/range.js\";\nimport { isRefusedStorageKey } from \"../../../../../transfer/staging/keys.js\";\n\nexport const prerender = false;\n\nconst MAX_KEY_DECODES = 3;\n\n/**\n * Whether a key is, or percent-decodes to, a key this route must refuse.\n * Every decoding layer is checked because storage backends differ in whether\n * they decode keys; a key that is still encoded after the last layer, or\n * does not decode, is refused.\n */\nfunction isPrivateMediaKey(key: string): boolean {\n\tlet candidate = key;\n\tfor (let layer = 0; layer <= MAX_KEY_DECODES; layer++) {\n\t\tif (isRefusedStorageKey(candidate)) return true;\n\t\tlet decoded: string;\n\t\ttry {\n\t\t\tdecoded = decodeURIComponent(candidate);\n\t\t} catch {\n\t\t\treturn true;\n\t\t}\n\t\tif (decoded === candidate) return false;\n\t\tcandidate = decoded;\n\t}\n\treturn true;\n}\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals, request, cache }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\t// Backup archives and transfer staging share the storage bucket but hold\n\t// whole-site content; they must never be reachable through this public,\n\t// unauthenticated route.\n\tif (isPrivateMediaKey(key)) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\t// Range requests that include If-Range are served as whole-file responses\n\t\t// because this route does not compare If-Range validators.\n\t\tconst range = request.headers.has(\"If-Range\")\n\t\t\t? null\n\t\t\t: parseRangeHeader(request.headers.get(\"Range\"));\n\t\t// The route cache keys entries by URL alone, so a cached partial\n\t\t// response would be served to requests for the whole file.\n\t\tif (range && cache?.enabled) cache.set(false);\n\t\tconst result = range\n\t\t\t? await emdash.storage.download(key, { range })\n\t\t\t: await emdash.storage.download(key);\n\t\tconst served = range ? result.range : undefined;\n\n\t\t// Adapters return the whole file for a range they don't serve, including\n\t\t// one past the end. A size of 0 may be unknown, so it rules nothing out.\n\t\tif (range && !served && result.size > 0 && !resolveByteRange(range, result.size)) {\n\t\t\tawait result.body.cancel().catch(() => undefined);\n\t\t\tconst response = apiError(\"RANGE_NOT_SATISFIABLE\", \"Range not satisfiable\", 416);\n\t\t\tresponse.headers.set(\"Content-Range\", `bytes */${result.size}`);\n\t\t\treturn response;\n\t\t}\n\n\t\tconst cacheControl = result.contentType.startsWith(\"image/\")\n\t\t\t? MUTABLE_MEDIA_CACHE_CONTROL\n\t\t\t: IMMUTABLE_IMAGE_CACHE;\n\n\t\tif (isNotModified(request, result.size, result.lastModified)) {\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 304,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\t\t\"Cache-Control\": cacheControl,\n\t\t\t\t\t...validatorHeaders(result.size, result.lastModified),\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": cacheControl,\n\t\t\t\"Accept-Ranges\": \"bytes\",\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t\t...validatorHeaders(result.size, result.lastModified),\n\t\t};\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tif (SAFE_INLINE_TYPES.has(result.contentType)) {\n\t\t\theaders[\"Content-Disposition\"] = \"inline\";\n\t\t} else {\n\t\t\theaders[\"Content-Disposition\"] = \"attachment\";\n\t\t}\n\n\t\tif (served) {\n\t\t\tconst end = served.offset + served.length - 1;\n\t\t\theaders[\"Content-Range\"] = `bytes ${served.offset}-${end}/${result.size}`;\n\t\t\theaders[\"Content-Length\"] = String(served.length);\n\t\t\treturn new Response(result.body, { status: 206, headers });\n\t\t}\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\treturn new Response(result.body, { status: 200, headers });\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAEzB,MAAM,kBAAkB;;;;;;;AAQxB,SAAS,kBAAkB,KAAsB;CAChD,IAAI,YAAY;AAChB,MAAK,IAAI,QAAQ,GAAG,SAAS,iBAAiB,SAAS;AACtD,MAAI,oBAAoB,UAAU,CAAE,QAAO;EAC3C,IAAI;AACJ,MAAI;AACH,aAAU,mBAAmB,UAAU;UAChC;AACP,UAAO;;AAER,MAAI,YAAY,UAAW,QAAO;AAClC,cAAY;;AAEb,QAAO;;;;;;AAOR,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,QAAQ,SAAS,YAAY;CAC1E,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAMpD,KAAI,kBAAkB,IAAI,CACzB,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAGjE,KAAI;EAGH,MAAM,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAC1C,OACA,iBAAiB,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAGjD,MAAI,SAAS,OAAO,QAAS,OAAM,IAAI,MAAM;EAC7C,MAAM,SAAS,QACZ,MAAM,OAAO,QAAQ,SAAS,KAAK,EAAE,OAAO,CAAC,GAC7C,MAAM,OAAO,QAAQ,SAAS,IAAI;EACrC,MAAM,SAAS,QAAQ,OAAO,QAAQ;AAItC,MAAI,SAAS,CAAC,UAAU,OAAO,OAAO,KAAK,CAAC,iBAAiB,OAAO,OAAO,KAAK,EAAE;AACjF,SAAM,OAAO,KAAK,QAAQ,CAAC,YAAY,OAAU;GACjD,MAAM,WAAW,SAAS,yBAAyB,yBAAyB,IAAI;AAChF,YAAS,QAAQ,IAAI,iBAAiB,WAAW,OAAO,OAAO;AAC/D,UAAO;;EAGR,MAAM,eAAe,OAAO,YAAY,WAAW,SAAS,GACzD,8BACA;AAEH,MAAI,cAAc,SAAS,OAAO,MAAM,OAAO,aAAa,CAC3D,QAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS;IACR,gBAAgB,OAAO;IACvB,iBAAiB;IACjB,GAAG,iBAAiB,OAAO,MAAM,OAAO,aAAa;IACrD;GACD,CAAC;EAGH,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB;GACjB,iBAAiB;GACjB,0BAA0B;GAG1B,2BACC;GACD,GAAG,iBAAiB,OAAO,MAAM,OAAO,aAAa;GACrD;AAID,MAAI,kBAAkB,IAAI,OAAO,YAAY,CAC5C,SAAQ,yBAAyB;MAEjC,SAAQ,yBAAyB;AAGlC,MAAI,QAAQ;GACX,MAAM,MAAM,OAAO,SAAS,OAAO,SAAS;AAC5C,WAAQ,mBAAmB,SAAS,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO;AACnE,WAAQ,oBAAoB,OAAO,OAAO,OAAO;AACjD,UAAO,IAAI,SAAS,OAAO,MAAM;IAAE,QAAQ;IAAK;IAAS,CAAC;;AAG3D,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;AAGhD,SAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;UAClD,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB"}

package/dist/astro/routes/api/media/folders/_id_.mjs

@@ -2,22 +2,22 @@ import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { a as handleMediaFolderUpdate, n as handleMediaFolderDelete, r as handleMediaFolderGet } from "../../../../../media-folders-kabR1oJf.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import { c as mediaFolderBody, l as mediaFolderIdSchema } from "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as handleMediaFolderUpdate, n as handleMediaFolderDelete, r as handleMediaFolderGet } from "../../../../../media-folders-DtMt-vAA.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import { c as mediaFolderBody, l as mediaFolderIdSchema } from "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { i as requirePerm } from "../../../../../authorize-DeWfk--K.mjs";
+import { i as requirePerm } from "../../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/folders/[id].ts
 const prerender = false;

package/dist/astro/routes/api/media/folders/index.mjs

@@ -2,22 +2,22 @@ import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { i as handleMediaFolderList, t as handleMediaFolderCreate } from "../../../../../media-folders-kabR1oJf.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import { c as mediaFolderBody, u as mediaFolderListQuery } from "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { i as handleMediaFolderList, t as handleMediaFolderCreate } from "../../../../../media-folders-DtMt-vAA.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import { c as mediaFolderBody, u as mediaFolderListQuery } from "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { i as requirePerm } from "../../../../../authorize-DeWfk--K.mjs";
+import { i as requirePerm } from "../../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/folders/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/_providerId_/_itemId_.mjs

@@ -1,9 +1,9 @@
 import "../../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-B0rgPgsQ.mjs";
-import { i as requirePerm } from "../../../../../../authorize-DeWfk--K.mjs";
+import "../../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../../errors-hskQ0C8G.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DxgQdaZ_.mjs";
+import { i as requirePerm } from "../../../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/providers/[providerId]/[itemId].ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/_providerId_/index.mjs

@@ -1,9 +1,9 @@
 import "../../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-B0rgPgsQ.mjs";
-import { i as requirePerm } from "../../../../../../authorize-DeWfk--K.mjs";
+import "../../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../../errors-hskQ0C8G.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DxgQdaZ_.mjs";
+import { i as requirePerm } from "../../../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/providers/[providerId]/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/index.mjs

@@ -1,9 +1,9 @@
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { i as requirePerm } from "../../../../../authorize-DeWfk--K.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { i as requirePerm } from "../../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/media/providers/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/upload-url.mjs

@@ -2,24 +2,24 @@ import "../../../../config-CvmjJcVw.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../url-Dn3IStq8.mjs";
 import "../../../../types-C-Xp0CcN.mjs";
-import { t as MediaRepository } from "../../../../media-BzUDu7nl.mjs";
+import { t as MediaRepository } from "../../../../media-IT8hQleU.mjs";
 import { i as resolveUploadMimeType, n as normalizeMime, t as matchesMimeAllowlist } from "../../../../mime-B5M9R53H.mjs";
-import "../../../../errors-CuHQRiBW.mjs";
-import "../../../../errors-DTE6C3K_.mjs";
-import "../../../../settings-WHr45II1.mjs";
-import "../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CmFDTGzp.mjs";
-import "../../../../redirects-D4EWeXAo.mjs";
-import "../../../../entry-lock-sxz2PGAT.mjs";
-import { M as mediaUploadUrlBody, n as DEFAULT_MAX_UPLOAD_SIZE } from "../../../../media-aahnKHze.mjs";
-import "../../../../comments-BRtp992B.mjs";
-import "../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../menus-BQKqf0Up.mjs";
-import "../../../../status-D39Fpy8R.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import "../../../../settings-GaZ5sVgg.mjs";
+import "../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
+import "../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../entry-lock-Cjz0h45X.mjs";
+import { N as mediaUploadUrlBody, n as DEFAULT_MAX_UPLOAD_SIZE } from "../../../../media-CRKsKlfK.mjs";
+import "../../../../comments-BzmIKVb2.mjs";
+import "../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../menus-D1HC8npj.mjs";
+import "../../../../status-Dl85BK39.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../../media-allowlist-RMrjo8TU.mjs";
-import { i as requirePerm } from "../../../../authorize-DeWfk--K.mjs";
+import { n as resolveFieldAllowlist, t as GLOBAL_UPLOAD_ALLOWLIST } from "../../../../media-allowlist-Ct6wvnT2.mjs";
+import { i as requirePerm } from "../../../../authorize-TdIGpRSE.mjs";
 import { ulid } from "ulidx";
 import * as path from "node:path";
 
@@ -48,9 +48,29 @@ const POST = async ({ request, locals }) => {
 	try {
 		const maxSize = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;
 		if (!Number.isFinite(maxSize) || maxSize <= 0) return apiError("CONFIGURATION_ERROR", "Invalid maxUploadSize configuration. Expected a positive finite number.", 500);
-		const body = await parseBody(request, mediaUploadUrlBody(maxSize));
+		const uploadSchema = mediaUploadUrlBody(maxSize);
+		const body = await parseBody(request, uploadSchema);
 		if (isParseError(body)) return body;
-		const mimeType = resolveUploadMimeType(body.filename, body.contentType);
+		let beforeUploadFile = {
+			name: body.filename,
+			type: body.contentType,
+			size: body.size
+		};
+		if (emdash.hooks?.hasHooks("media:beforeUpload")) {
+			const hookResult = await emdash.hooks.runMediaBeforeUpload(beforeUploadFile);
+			const metadata = uploadSchema.safeParse({
+				filename: hookResult.file?.name,
+				contentType: hookResult.file?.type,
+				size: body.size
+			});
+			if (!metadata.success) return apiError("VALIDATION_ERROR", "Invalid media:beforeUpload result", 400);
+			beforeUploadFile = {
+				name: metadata.data.filename,
+				type: metadata.data.contentType,
+				size: body.size
+			};
+		}
+		const mimeType = resolveUploadMimeType(beforeUploadFile.name, beforeUploadFile.type);
 		const normalizedContentType = normalizeMime(mimeType);
 		if (!matchesMimeAllowlist(mimeType, (body.fieldId ? await resolveFieldAllowlist(emdash.db, body.fieldId) : null) ?? [...GLOBAL_UPLOAD_ALLOWLIST])) return apiError("INVALID_TYPE", "File type not allowed", 400);
 		const repo = new MediaRepository(emdash.db);
@@ -63,7 +83,7 @@ const POST = async ({ request, locals }) => {
 				url: `/_emdash/api/media/file/${existing.storageKey}`
 			});
 		}
-		const filename = body.ensureUniqueFilename ? await repo.findAvailableFilename(body.filename) : body.filename;
+		const filename = body.ensureUniqueFilename ? await repo.findAvailableFilename(beforeUploadFile.name) : beforeUploadFile.name;
 		const storageKey = `${ulid()}${path.extname(filename) || ""}`;
 		let signedUrl;
 		try {

package/dist/astro/routes/api/media/upload-url.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"upload-url.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/upload-url.ts"],"sourcesContent":["/**\n * Media upload URL endpoint\n *\n * POST /_emdash/api/media/upload-url\n *\n * Returns a signed URL for direct upload to storage.\n * Creates a pending media record that must be confirmed after upload.\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { matchesMimeAllowlist, normalizeMime, resolveUploadMimeType } from \"#media/mime.js\";\n\nexport const prerender = false;\n\ninterface UploadUrlResponse {\n\tuploadUrl: string;\n\tmethod: \"PUT\";\n\theaders: Record<string, string>;\n\tmediaId: string;\n\tstorageKey: string;\n\texpiresAt: string;\n}\n\n/** Response when content already exists (deduplication) */\ninterface ExistingMediaResponse {\n\texisting: true;\n\tmediaId: string;\n\tstorageKey: string;\n\turl: string;\n}\n\nfunction isUnsupportedSignedUpload(error: unknown): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === \"NOT_SUPPORTED\";\n}\n\n/**\n * Get a signed upload URL for direct-to-storage upload\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\n\t\t\t\"NO_STORAGE\",\n\t\t\t\"Storage not configured. Signed URL uploads require S3-compatible storage.\",\n\t\t\t501,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst maxSize = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(maxSize) || maxSize <= 0) {\n\t\t\treturn apiError(\n\t\t\t\t\"CONFIGURATION_ERROR\",\n\t\t\t\t\"Invalid maxUploadSize configuration. Expected a positive finite number.\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t\tconst body = await parseBody(request, mediaUploadUrlBody(maxSize));\n\t\tif (isParseError(body)) return body;\n\n\t\t// Clients that don't recognise an extension may send an empty or generic\n\t\t// content type; fall back to the filename extension before allowlisting.\n\t\tconst mimeType = resolveUploadMimeType(body.filename, body.contentType);\n\t\tconst normalizedContentType = normalizeMime(mimeType);\n\n\t\t// Validate content type (field-aware widening)\n\t\tconst fieldAllowlist = body.fieldId\n\t\t\t? await resolveFieldAllowlist(emdash.db, body.fieldId)\n\t\t\t: null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(mimeType, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Check for existing content with same hash (deduplication)\n\t\tif (body.deduplicate !== false && body.contentHash && body.size > 0) {\n\t\t\tconst existing = await repo.findByContentHash(body.contentHash);\n\t\t\tif (existing && existing.mimeType === normalizedContentType && existing.size === body.size) {\n\t\t\t\tconst response: ExistingMediaResponse = {\n\t\t\t\t\texisting: true,\n\t\t\t\t\tmediaId: existing.id,\n\t\t\t\t\tstorageKey: existing.storageKey,\n\t\t\t\t\turl: `/_emdash/api/media/file/${existing.storageKey}`,\n\t\t\t\t};\n\t\t\t\treturn apiSuccess(response);\n\t\t\t}\n\t\t}\n\t\tconst filename = body.ensureUniqueFilename\n\t\t\t? await repo.findAvailableFilename(body.filename)\n\t\t\t: body.filename;\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\tlet signedUrl: Awaited<ReturnType<typeof emdash.storage.getSignedUploadUrl>> | null;\n\t\ttry {\n\t\t\tsignedUrl = await emdash.storage.getSignedUploadUrl({\n\t\t\t\tkey: storageKey,\n\t\t\t\tcontentType: mimeType,\n\t\t\t\tsize: body.size,\n\t\t\t\texpiresIn: 3600,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (!isUnsupportedSignedUpload(error)) throw error;\n\t\t\tsignedUrl = null;\n\t\t}\n\n\t\tconst mediaItem = await repo.createPending({\n\t\t\tfilename,\n\t\t\tmimeType: normalizedContentType,\n\t\t\tsize: body.size,\n\t\t\tstorageKey,\n\t\t\tauthorId: user?.id,\n\t\t\tfolderId: body.folderId,\n\t\t});\n\n\t\tconst response: UploadUrlResponse = {\n\t\t\tuploadUrl: signedUrl?.url ?? `/_emdash/api/media/${mediaItem.id}/upload`,\n\t\t\tmethod: signedUrl?.method ?? \"PUT\",\n\t\t\theaders: signedUrl?.headers ?? {\n\t\t\t\t\"Content-Type\": normalizedContentType,\n\t\t\t\t\"X-EmDash-Request\": \"1\",\n\t\t\t},\n\t\t\tmediaId: mediaItem.id,\n\t\t\tstorageKey,\n\t\t\texpiresAt: signedUrl?.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString(),\n\t\t};\n\n\t\treturn apiSuccess(response);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate upload URL\", \"UPLOAD_URL_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAmBzB,SAAS,0BAA0B,OAAyB;AAC3D,QAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;;;;;AAMpE,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,QACZ,QAAO,SACN,cACA,6EACA,IACA;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,UAAU,OAAO,OAAO,iBAAiB;AAC/C,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC3C,QAAO,SACN,uBACA,2EACA,IACA;EAEF,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB,QAAQ,CAAC;AAClE,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,WAAW,sBAAsB,KAAK,UAAU,KAAK,YAAY;EACvE,MAAM,wBAAwB,cAAc,SAAS;AAQrD,MAAI,CAAC,qBAAqB,WALH,KAAK,UACzB,MAAM,sBAAsB,OAAO,IAAI,KAAK,QAAQ,GACpD,SACiC,CAAC,GAAG,wBAAwB,CAElB,CAC7C,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;EAG9D,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAG3C,MAAI,KAAK,gBAAgB,SAAS,KAAK,eAAe,KAAK,OAAO,GAAG;GACpE,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,YAAY;AAC/D,OAAI,YAAY,SAAS,aAAa,yBAAyB,SAAS,SAAS,KAAK,KAOrF,QAAO,WANiC;IACvC,UAAU;IACV,SAAS,SAAS;IAClB,YAAY,SAAS;IACrB,KAAK,2BAA2B,SAAS;IACzC,CAC0B;;EAG7B,MAAM,WAAW,KAAK,uBACnB,MAAM,KAAK,sBAAsB,KAAK,SAAS,GAC/C,KAAK;EAKR,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,SAAS,IAAI;EAGtC,IAAI;AACJ,MAAI;AACH,eAAY,MAAM,OAAO,QAAQ,mBAAmB;IACnD,KAAK;IACL,aAAa;IACb,MAAM,KAAK;IACX,WAAW;IACX,CAAC;WACM,OAAO;AACf,OAAI,CAAC,0BAA0B,MAAM,CAAE,OAAM;AAC7C,eAAY;;EAGb,MAAM,YAAY,MAAM,KAAK,cAAc;GAC1C;GACA,UAAU;GACV,MAAM,KAAK;GACX;GACA,UAAU,MAAM;GAChB,UAAU,KAAK;GACf,CAAC;AAcF,SAAO,WAZ6B;GACnC,WAAW,WAAW,OAAO,sBAAsB,UAAU,GAAG;GAChE,QAAQ,WAAW,UAAU;GAC7B,SAAS,WAAW,WAAW;IAC9B,gBAAgB;IAChB,oBAAoB;IACpB;GACD,SAAS,UAAU;GACnB;GACA,WAAW,WAAW,aAAa,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,IAAK,CAAC,aAAa;GACnF,CAE0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,iCAAiC,mBAAmB"}
+{"version":3,"file":"upload-url.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/upload-url.ts"],"sourcesContent":["/**\n * Media upload URL endpoint\n *\n * POST /_emdash/api/media/upload-url\n *\n * Returns a signed URL for direct upload to storage.\n * Creates a pending media record that must be confirmed after upload.\n */\n\nimport * as path from \"node:path\";\n\nimport type { APIRoute } from \"astro\";\nimport { ulid } from \"ulidx\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from \"#api/handlers/media-allowlist.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from \"#api/schemas.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { matchesMimeAllowlist, normalizeMime, resolveUploadMimeType } from \"#media/mime.js\";\n\nexport const prerender = false;\n\ninterface UploadUrlResponse {\n\tuploadUrl: string;\n\tmethod: \"PUT\";\n\theaders: Record<string, string>;\n\tmediaId: string;\n\tstorageKey: string;\n\texpiresAt: string;\n}\n\n/** Response when content already exists (deduplication) */\ninterface ExistingMediaResponse {\n\texisting: true;\n\tmediaId: string;\n\tstorageKey: string;\n\turl: string;\n}\n\nfunction isUnsupportedSignedUpload(error: unknown): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === \"NOT_SUPPORTED\";\n}\n\n/**\n * Get a signed upload URL for direct-to-storage upload\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"media:upload\");\n\tif (denied) return denied;\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\n\t\t\t\"NO_STORAGE\",\n\t\t\t\"Storage not configured. Signed URL uploads require S3-compatible storage.\",\n\t\t\t501,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst maxSize = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;\n\t\tif (!Number.isFinite(maxSize) || maxSize <= 0) {\n\t\t\treturn apiError(\n\t\t\t\t\"CONFIGURATION_ERROR\",\n\t\t\t\t\"Invalid maxUploadSize configuration. Expected a positive finite number.\",\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t\tconst uploadSchema = mediaUploadUrlBody(maxSize);\n\t\tconst body = await parseBody(request, uploadSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\tlet beforeUploadFile = {\n\t\t\tname: body.filename,\n\t\t\ttype: body.contentType,\n\t\t\tsize: body.size,\n\t\t};\n\t\tif (emdash.hooks?.hasHooks(\"media:beforeUpload\")) {\n\t\t\tconst hookResult = await emdash.hooks.runMediaBeforeUpload(beforeUploadFile);\n\t\t\tconst metadata = uploadSchema.safeParse({\n\t\t\t\tfilename: hookResult.file?.name,\n\t\t\t\tcontentType: hookResult.file?.type,\n\t\t\t\tsize: body.size,\n\t\t\t});\n\t\t\tif (!metadata.success) {\n\t\t\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid media:beforeUpload result\", 400);\n\t\t\t}\n\t\t\t// Hooks change metadata, but the client still uploads the original bytes.\n\t\t\tbeforeUploadFile = {\n\t\t\t\tname: metadata.data.filename,\n\t\t\t\ttype: metadata.data.contentType,\n\t\t\t\tsize: body.size,\n\t\t\t};\n\t\t}\n\n\t\t// Clients that don't recognise an extension may send an empty or generic\n\t\t// content type; fall back to the filename extension before allowlisting.\n\t\tconst mimeType = resolveUploadMimeType(beforeUploadFile.name, beforeUploadFile.type);\n\t\tconst normalizedContentType = normalizeMime(mimeType);\n\n\t\t// Validate content type (field-aware widening)\n\t\tconst fieldAllowlist = body.fieldId\n\t\t\t? await resolveFieldAllowlist(emdash.db, body.fieldId)\n\t\t\t: null;\n\t\tconst allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];\n\n\t\tif (!matchesMimeAllowlist(mimeType, allowlist)) {\n\t\t\treturn apiError(\"INVALID_TYPE\", \"File type not allowed\", 400);\n\t\t}\n\n\t\tconst repo = new MediaRepository(emdash.db);\n\n\t\t// Check for existing content with same hash (deduplication)\n\t\tif (body.deduplicate !== false && body.contentHash && body.size > 0) {\n\t\t\tconst existing = await repo.findByContentHash(body.contentHash);\n\t\t\tif (existing && existing.mimeType === normalizedContentType && existing.size === body.size) {\n\t\t\t\tconst response: ExistingMediaResponse = {\n\t\t\t\t\texisting: true,\n\t\t\t\t\tmediaId: existing.id,\n\t\t\t\t\tstorageKey: existing.storageKey,\n\t\t\t\t\turl: `/_emdash/api/media/file/${existing.storageKey}`,\n\t\t\t\t};\n\t\t\t\treturn apiSuccess(response);\n\t\t\t}\n\t\t}\n\t\tconst filename = body.ensureUniqueFilename\n\t\t\t? await repo.findAvailableFilename(beforeUploadFile.name)\n\t\t\t: beforeUploadFile.name;\n\n\t\t// Generate unique storage key\n\t\tconst id = ulid();\n\t\tconst ext = path.extname(filename) || \"\";\n\t\tconst storageKey = `${id}${ext}`;\n\n\t\tlet signedUrl: Awaited<ReturnType<typeof emdash.storage.getSignedUploadUrl>> | null;\n\t\ttry {\n\t\t\tsignedUrl = await emdash.storage.getSignedUploadUrl({\n\t\t\t\tkey: storageKey,\n\t\t\t\tcontentType: mimeType,\n\t\t\t\tsize: body.size,\n\t\t\t\texpiresIn: 3600,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (!isUnsupportedSignedUpload(error)) throw error;\n\t\t\tsignedUrl = null;\n\t\t}\n\n\t\tconst mediaItem = await repo.createPending({\n\t\t\tfilename,\n\t\t\tmimeType: normalizedContentType,\n\t\t\tsize: body.size,\n\t\t\tstorageKey,\n\t\t\tauthorId: user?.id,\n\t\t\tfolderId: body.folderId,\n\t\t});\n\n\t\tconst response: UploadUrlResponse = {\n\t\t\tuploadUrl: signedUrl?.url ?? `/_emdash/api/media/${mediaItem.id}/upload`,\n\t\t\tmethod: signedUrl?.method ?? \"PUT\",\n\t\t\theaders: signedUrl?.headers ?? {\n\t\t\t\t\"Content-Type\": normalizedContentType,\n\t\t\t\t\"X-EmDash-Request\": \"1\",\n\t\t\t},\n\t\t\tmediaId: mediaItem.id,\n\t\t\tstorageKey,\n\t\t\texpiresAt: signedUrl?.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString(),\n\t\t};\n\n\t\treturn apiSuccess(response);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate upload URL\", \"UPLOAD_URL_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAmBzB,SAAS,0BAA0B,OAAyB;AAC3D,QAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;;;;;AAMpE,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,QAAQ,QACZ,QAAO,SACN,cACA,6EACA,IACA;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,UAAU,OAAO,OAAO,iBAAiB;AAC/C,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC3C,QAAO,SACN,uBACA,2EACA,IACA;EAEF,MAAM,eAAe,mBAAmB,QAAQ;EAChD,MAAM,OAAO,MAAM,UAAU,SAAS,aAAa;AACnD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,IAAI,mBAAmB;GACtB,MAAM,KAAK;GACX,MAAM,KAAK;GACX,MAAM,KAAK;GACX;AACD,MAAI,OAAO,OAAO,SAAS,qBAAqB,EAAE;GACjD,MAAM,aAAa,MAAM,OAAO,MAAM,qBAAqB,iBAAiB;GAC5E,MAAM,WAAW,aAAa,UAAU;IACvC,UAAU,WAAW,MAAM;IAC3B,aAAa,WAAW,MAAM;IAC9B,MAAM,KAAK;IACX,CAAC;AACF,OAAI,CAAC,SAAS,QACb,QAAO,SAAS,oBAAoB,qCAAqC,IAAI;AAG9E,sBAAmB;IAClB,MAAM,SAAS,KAAK;IACpB,MAAM,SAAS,KAAK;IACpB,MAAM,KAAK;IACX;;EAKF,MAAM,WAAW,sBAAsB,iBAAiB,MAAM,iBAAiB,KAAK;EACpF,MAAM,wBAAwB,cAAc,SAAS;AAQrD,MAAI,CAAC,qBAAqB,WALH,KAAK,UACzB,MAAM,sBAAsB,OAAO,IAAI,KAAK,QAAQ,GACpD,SACiC,CAAC,GAAG,wBAAwB,CAElB,CAC7C,QAAO,SAAS,gBAAgB,yBAAyB,IAAI;EAG9D,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;AAG3C,MAAI,KAAK,gBAAgB,SAAS,KAAK,eAAe,KAAK,OAAO,GAAG;GACpE,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,YAAY;AAC/D,OAAI,YAAY,SAAS,aAAa,yBAAyB,SAAS,SAAS,KAAK,KAOrF,QAAO,WANiC;IACvC,UAAU;IACV,SAAS,SAAS;IAClB,YAAY,SAAS;IACrB,KAAK,2BAA2B,SAAS;IACzC,CAC0B;;EAG7B,MAAM,WAAW,KAAK,uBACnB,MAAM,KAAK,sBAAsB,iBAAiB,KAAK,GACvD,iBAAiB;EAKpB,MAAM,aAAa,GAFR,MAAM,GACL,KAAK,QAAQ,SAAS,IAAI;EAGtC,IAAI;AACJ,MAAI;AACH,eAAY,MAAM,OAAO,QAAQ,mBAAmB;IACnD,KAAK;IACL,aAAa;IACb,MAAM,KAAK;IACX,WAAW;IACX,CAAC;WACM,OAAO;AACf,OAAI,CAAC,0BAA0B,MAAM,CAAE,OAAM;AAC7C,eAAY;;EAGb,MAAM,YAAY,MAAM,KAAK,cAAc;GAC1C;GACA,UAAU;GACV,MAAM,KAAK;GACX;GACA,UAAU,MAAM;GAChB,UAAU,KAAK;GACf,CAAC;AAcF,SAAO,WAZ6B;GACnC,WAAW,WAAW,OAAO,sBAAsB,UAAU,GAAG;GAChE,QAAQ,WAAW,UAAU;GAC7B,SAAS,WAAW,WAAW;IAC9B,gBAAgB;IAChB,oBAAoB;IACpB;GACD,SAAS,UAAU;GACnB;GACA,WAAW,WAAW,aAAa,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,IAAK,CAAC,aAAa;GACnF,CAE0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,iCAAiC,mBAAmB"}

package/dist/astro/routes/api/media.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"media.d.mts","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"mappings":";;;cAgCa,SAAA;AAgBb;;;AAAA,cAAa,GAAA,EAAK,QAAA;;AAgElB;;;;cAAa,IAAA,EAAM,QAAA"}
+{"version":3,"file":"media.d.mts","names":[],"sources":["../../../../src/astro/routes/api/media.ts"],"mappings":";;;cAiCa,SAAA;AAgBb;;;AAAA,cAAa,GAAA,EAAK,QAAA;;AAgElB;;;;cAAa,IAAA,EAAM,QAAA"}