emdash 1.2.0 → 1.3.1

package/dist/astro/routes/api/settings.mjs

@@ -1,33 +1,38 @@
 import "../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../config-CvmjJcVw.mjs";
+import "../../../config-Cs_AwWXI.mjs";
 import "../../../after-PcEvMY_6.mjs";
 import "../../../options-DhrI7eMv.mjs";
 import "../../../secrets-Cc_O3Kp-.mjs";
 import "../../../base64-BQBZwXCx.mjs";
-import "../../../object-cache-Bo6DGaC9.mjs";
-import "../../../request-cache-C4CIo5ad.mjs";
-import "../../../url-Dn3IStq8.mjs";
-import "../../../types-C-Xp0CcN.mjs";
-import "../../../media-IT8hQleU.mjs";
-import { n as siteSettingsTag } from "../../../chrome-tags-BIKBMZYO.mjs";
-import "../../../loader-CetY659y.mjs";
-import "../../../errors-CjtE5aWF.mjs";
-import "../../../errors-hskQ0C8G.mjs";
-import "../../../settings-GaZ5sVgg.mjs";
-import "../../../site-settings-CDdT4mVm.mjs";
-import "../../../settings-B1jOxAIl.mjs";
-import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-Bc1IBl1t.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-DxgQdaZ_.mjs";
-import { n as parseBody, t as isParseError } from "../../../parse-Cn5aSk1N.mjs";
-import "../../../redirects-DFT7Wr-e.mjs";
-import { O as settingsUpdateBody } from "../../../entry-lock-Cjz0h45X.mjs";
-import "../../../media-CRKsKlfK.mjs";
-import "../../../comments-BzmIKVb2.mjs";
-import "../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../menus-D1HC8npj.mjs";
-import "../../../status-Dl85BK39.mjs";
+import "../../../query-BFHjCzSh.mjs";
+import "../../../object-cache-EjasjtoQ.mjs";
+import "../../../request-cache-5z2WzWmh.mjs";
+import "../../../url-DTfGDJhI.mjs";
+import "../../../types-DwhEvIVb.mjs";
+import "../../../media-B_x5B9EA.mjs";
+import "../../../version-BOFfLiVT.mjs";
+import { n as siteSettingsTag } from "../../../chrome-tags-BDs29G3g.mjs";
+import "../../../loader-D4w4XE7q.mjs";
+import "../../../json-recordset-BjYIWFkV.mjs";
+import "../../../errors-DlJwot7q.mjs";
+import "../../../errors-BMaCpLeS.mjs";
+import "../../../settings-B3ZmPF_8.mjs";
+import "../../../site-settings-uPkW0e6o.mjs";
+import "../../../settings-yIqoN-Ok.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-CT2SsX5S.mjs";
+import "../../../fence-BOD3SxZG.mjs";
+import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-P5hwPX6_.mjs";
+import { n as parseBody, t as isParseError } from "../../../parse-2W-E2f7w.mjs";
+import "../../../redirects-BA_TvtuH.mjs";
+import { O as settingsUpdateBody } from "../../../entry-lock-DDuWaAiP.mjs";
+import "../../../media-qTTHVkls.mjs";
+import "../../../comments-DVjWJm8X.mjs";
+import "../../../byline-fields-B1qHvRps.mjs";
+import "../../../menus-BI6oBXco.mjs";
+import "../../../status-DSURZwKS.mjs";
 import "../../../api/schemas/index.mjs";
-import { i as requirePerm } from "../../../authorize-TdIGpRSE.mjs";
+import { o as requirePerm } from "../../../authorize-CoDsRRp5.mjs";
+import { t as invalidateRouteCache } from "../../../route-cache-DAG5dPhh.mjs";
 
 //#region src/astro/routes/api/settings.ts
 const prerender = false;
@@ -64,7 +69,7 @@ const POST = async ({ request, locals, cache }) => {
 		if (isParseError(body)) return body;
 		const result = await handleSettingsUpdate(emdash.db, emdash.storage, body);
 		if (!result.success) return unwrapResult(result);
-		if (cache?.enabled) await cache.invalidate({ tags: [siteSettingsTag()] });
+		await invalidateRouteCache(cache, [siteSettingsTag()]);
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update settings", "SETTINGS_UPDATE_ERROR");

package/dist/astro/routes/api/settings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings.mjs","names":[],"sources":["../../../../src/astro/routes/api/settings.ts"],"sourcesContent":["/**\n * Site Settings API endpoint\n *\n * GET  /_emdash/api/settings - Get all site settings\n * POST /_emdash/api/settings - Update site settings\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleSettingsGet, handleSettingsUpdate } from \"#api/handlers/settings.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { settingsUpdateBody } from \"#api/schemas.js\";\nimport { siteSettingsTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\n/**\n * GET /_emdash/api/settings\n *\n * Returns all site settings as a JSON object.\n * Unset values are undefined. Media references include resolved URLs.\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst result = await handleSettingsGet(emdash.db, emdash.storage);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get settings\", \"SETTINGS_READ_ERROR\");\n\t}\n};\n\n/**\n * POST /_emdash/api/settings\n *\n * Updates site settings. Accepts a partial settings object.\n * Merges with existing settings and returns the updated settings.\n */\nexport const POST: APIRoute = async ({ request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, settingsUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSettingsUpdate(emdash.db, emdash.storage, body);\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [siteSettingsTag()] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update settings\", \"SETTINGS_UPDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;;;;;;;AAQzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI;AAEH,SAAO,aADQ,MAAM,kBAAkB,OAAO,IAAI,OAAO,QAAQ,CACtC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,sBAAsB;;;;;;;;;AAU5E,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,YAAY;CACnE,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,OAAO,SAAS,KAAK;AAC1E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACzE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}
+{"version":3,"file":"settings.mjs","names":[],"sources":["../../../../src/astro/routes/api/settings.ts"],"sourcesContent":["/**\n * Site Settings API endpoint\n *\n * GET  /_emdash/api/settings - Get all site settings\n * POST /_emdash/api/settings - Update site settings\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleSettingsGet, handleSettingsUpdate } from \"#api/handlers/settings.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { settingsUpdateBody } from \"#api/schemas.js\";\nimport { siteSettingsTag } from \"#cache/chrome-tags.js\";\nimport { invalidateRouteCache } from \"#cache/route-cache.js\";\n\nexport const prerender = false;\n\n/**\n * GET /_emdash/api/settings\n *\n * Returns all site settings as a JSON object.\n * Unset values are undefined. Media references include resolved URLs.\n */\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst result = await handleSettingsGet(emdash.db, emdash.storage);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get settings\", \"SETTINGS_READ_ERROR\");\n\t}\n};\n\n/**\n * POST /_emdash/api/settings\n *\n * Updates site settings. Accepts a partial settings object.\n * Merges with existing settings and returns the updated settings.\n */\nexport const POST: APIRoute = async ({ request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"settings:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, settingsUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleSettingsUpdate(emdash.db, emdash.storage, body);\n\t\tif (!result.success) return unwrapResult(result);\n\t\tawait invalidateRouteCache(cache, [siteSettingsTag()]);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update settings\", \"SETTINGS_UPDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;;;;;;;AAQzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AAEnB,KAAI;AAEH,SAAO,aADQ,MAAM,kBAAkB,OAAO,IAAI,OAAO,QAAQ,CACtC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,sBAAsB;;;;;;;;;AAU5E,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,YAAY;CACnE,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,mBAAmB;AACzD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,OAAO,SAAS,KAAK;AAC1E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,QAAM,qBAAqB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACtD,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB"}

package/dist/astro/routes/api/setup/admin-verify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-verify.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin-verify.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAiBA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"admin-verify.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin-verify.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAmBA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/setup/admin-verify.mjs

@@ -1,38 +1,41 @@
 import "../../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../../config-CvmjJcVw.mjs";
+import "../../../../config-Cs_AwWXI.mjs";
+import "../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../errors-CjtE5aWF.mjs";
-import "../../../../errors-hskQ0C8G.mjs";
-import "../../../../settings-GaZ5sVgg.mjs";
-import "../../../../site-settings-CDdT4mVm.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
-import "../../../../redirects-DFT7Wr-e.mjs";
-import "../../../../entry-lock-Cjz0h45X.mjs";
-import "../../../../media-CRKsKlfK.mjs";
-import "../../../../comments-BzmIKVb2.mjs";
-import { l as setupAdminVerifyBody } from "../../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../../menus-D1HC8npj.mjs";
-import "../../../../status-Dl85BK39.mjs";
+import "../../../../url-DTfGDJhI.mjs";
+import "../../../../types-DwhEvIVb.mjs";
+import "../../../../errors-DlJwot7q.mjs";
+import "../../../../errors-BMaCpLeS.mjs";
+import "../../../../settings-B3ZmPF_8.mjs";
+import "../../../../site-settings-uPkW0e6o.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CT2SsX5S.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-2W-E2f7w.mjs";
+import "../../../../redirects-BA_TvtuH.mjs";
+import "../../../../entry-lock-DDuWaAiP.mjs";
+import "../../../../media-qTTHVkls.mjs";
+import "../../../../comments-DVjWJm8X.mjs";
+import { l as setupAdminVerifyBody } from "../../../../byline-fields-B1qHvRps.mjs";
+import "../../../../menus-BI6oBXco.mjs";
+import "../../../../status-DSURZwKS.mjs";
 import "../../../../api/schemas/index.mjs";
-import { i as getPublicOrigin } from "../../../../public-url-uT1Ok2Tu.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../allowed-origins-CLpHGGlc.mjs";
-import { n as createChallengeStore } from "../../../../challenge-store-BHgdPVze.mjs";
-import { t as createFirstAdmin } from "../../../../setup-complete-DidMAWJS.mjs";
-import { t as getPasskeyConfig } from "../../../../passkey-config-mMFRQUCj.mjs";
-import { t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-DKl4S4c6.mjs";
+import { i as getPublicOrigin } from "../../../../public-url-CQwzRljH.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../allowed-origins-CovsTkm3.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-Cfjdvw86.mjs";
+import { r as sessionUnavailableError } from "../../../../session-user-2DpQDMKw.mjs";
+import { t as createFirstAdmin } from "../../../../setup-complete-eu6MUQnt.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-DTTZB6EI.mjs";
+import { t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-CyPOapqY.mjs";
 import { secureCompare } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";
 
 //#region src/astro/routes/api/setup/admin-verify.ts
 const prerender = false;
-const POST = async ({ cookies, request, locals }) => {
+const POST = async ({ cookies, request, locals, session }) => {
 	const { emdash } = locals;
 	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!session) return sessionUnavailableError();
 	try {
 		const options = new OptionsRepository(emdash.db);
 		const setupComplete = await options.get("emdash:setup_complete");
@@ -62,6 +65,7 @@ const POST = async ({ cookies, request, locals }) => {
 		if (!user) return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
 		await registerPasskey(adapter, user.id, verified, "Setup passkey");
 		await options.set("emdash:setup_complete", true);
+		session.set("user", { id: user.id });
 		await options.delete("emdash:setup_state");
 		cookies.delete(SETUP_NONCE_COOKIE, { path: "/_emdash/" });
 		return apiSuccess({

package/dist/astro/routes/api/setup/admin-verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin-verify.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin-verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/admin/verify\n *\n * Complete admin creation by verifying the passkey registration\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { secureCompare } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupAdminVerifyBody } from \"#api/schemas.js\";\nimport { createFirstAdmin } from \"#api/setup-complete.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { SETUP_NONCE_COOKIE } from \"#auth/setup-nonce.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ cookies, request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Check if setup is already complete\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\t\tconst isComplete = setupComplete === true || setupComplete === \"true\";\n\n\t\t// Check if any users exist\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst userCount = await adapter.countUsers();\n\n\t\tif (userCount > 0) {\n\t\t\tif (isComplete) {\n\t\t\t\treturn apiError(\"SETUP_COMPLETE\", \"Setup already complete\", 400);\n\t\t\t}\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// `setup_complete` with ZERO users is a recoverable half-state —\n\t\t// see the matching guard in ./admin.ts. The verify step must\n\t\t// accept it too, or the wizard dies between its two calls.\n\n\t\t// Get setup state\n\t\tconst setupState = await options.get<{\n\t\t\tstep?: string;\n\t\t\temail?: string;\n\t\t\tname?: string | null;\n\t\t\tnonce?: string;\n\t\t}>(\"emdash:setup_state\");\n\n\t\tif (!setupState || setupState.step !== \"admin\") {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Verify the session nonce. The cookie was minted by POST /setup/admin\n\t\t// and stored alongside setup_state; presenting a matching cookie is\n\t\t// proof that this verify call comes from the same browser that\n\t\t// started the admin step. Constant-time compare to avoid leaking the\n\t\t// stored value through timing.\n\t\tconst cookieNonce = cookies.get(SETUP_NONCE_COOKIE)?.value;\n\t\tif (!setupState.nonce || !cookieNonce || !secureCompare(cookieNonce, setupState.nonce)) {\n\t\t\treturn apiError(\n\t\t\t\t\"INVALID_STATE\",\n\t\t\t\t\"Setup session expired or tampered with. Please restart the admin step.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\tif (!setupState.email) {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupAdminVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\tconst user = await createFirstAdmin(emdash.db, {\n\t\t\temail: setupState.email,\n\t\t\tname: setupState.name ?? null,\n\t\t});\n\t\tif (!user) {\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// Register the passkey\n\t\tawait registerPasskey(adapter, user.id, verified, \"Setup passkey\");\n\n\t\t// Mark setup as complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Clean up setup state and the session nonce cookie\n\t\tawait options.delete(\"emdash:setup_state\");\n\t\tcookies.delete(SETUP_NONCE_COOKIE, { path: \"/_emdash/\" });\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to verify admin setup\", \"SETUP_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAiBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,SAAS,aAAa;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;EAChE,MAAM,aAAa,kBAAkB,QAAQ,kBAAkB;EAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAG9C,MAFkB,MAAM,QAAQ,YAAY,GAE5B,GAAG;AAClB,OAAI,WACH,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAEjE,UAAO,SAAS,gBAAgB,6BAA6B,IAAI;;EAQlE,MAAM,aAAa,MAAM,QAAQ,IAK9B,qBAAqB;AAExB,MAAI,CAAC,cAAc,WAAW,SAAS,QACtC,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAQpF,MAAM,cAAc,QAAQ,IAAI,mBAAmB,EAAE;AACrD,MAAI,CAAC,WAAW,SAAS,CAAC,eAAe,CAAC,cAAc,aAAa,WAAW,MAAM,CACrF,QAAO,SACN,iBACA,0EACA,IACA;AAGF,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAIpF,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,WAAY,MAAM,QAAQ,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAEtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAED,MAAM,OAAO,MAAM,iBAAiB,OAAO,IAAI;GAC9C,OAAO,WAAW;GAClB,MAAM,WAAW,QAAQ;GACzB,CAAC;AACF,MAAI,CAAC,KACJ,QAAO,SAAS,gBAAgB,6BAA6B,IAAI;AAIlE,QAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,gBAAgB;AAGlE,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,QAAM,QAAQ,OAAO,qBAAqB;AAC1C,UAAQ,OAAO,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzD,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}
+{"version":3,"file":"admin-verify.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/admin-verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/admin/verify\n *\n * Complete admin creation by verifying the passkey registration\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { secureCompare } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { setupAdminVerifyBody } from \"#api/schemas.js\";\nimport { createFirstAdmin } from \"#api/setup-complete.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { SETUP_NONCE_COOKIE } from \"#auth/setup-nonce.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nimport { sessionUnavailableError } from \"../../../session-user.js\";\n\nexport const POST: APIRoute = async ({ cookies, request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!session) return sessionUnavailableError();\n\n\ttry {\n\t\t// Check if setup is already complete\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\t\tconst isComplete = setupComplete === true || setupComplete === \"true\";\n\n\t\t// Check if any users exist\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst userCount = await adapter.countUsers();\n\n\t\tif (userCount > 0) {\n\t\t\tif (isComplete) {\n\t\t\t\treturn apiError(\"SETUP_COMPLETE\", \"Setup already complete\", 400);\n\t\t\t}\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// `setup_complete` with ZERO users is a recoverable half-state —\n\t\t// see the matching guard in ./admin.ts. The verify step must\n\t\t// accept it too, or the wizard dies between its two calls.\n\n\t\t// Get setup state\n\t\tconst setupState = await options.get<{\n\t\t\tstep?: string;\n\t\t\temail?: string;\n\t\t\tname?: string | null;\n\t\t\tnonce?: string;\n\t\t}>(\"emdash:setup_state\");\n\n\t\tif (!setupState || setupState.step !== \"admin\") {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Verify the session nonce. The cookie was minted by POST /setup/admin\n\t\t// and stored alongside setup_state; presenting a matching cookie is\n\t\t// proof that this verify call comes from the same browser that\n\t\t// started the admin step. Constant-time compare to avoid leaking the\n\t\t// stored value through timing.\n\t\tconst cookieNonce = cookies.get(SETUP_NONCE_COOKIE)?.value;\n\t\tif (!setupState.nonce || !cookieNonce || !secureCompare(cookieNonce, setupState.nonce)) {\n\t\t\treturn apiError(\n\t\t\t\t\"INVALID_STATE\",\n\t\t\t\t\"Setup session expired or tampered with. Please restart the admin step.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\tif (!setupState.email) {\n\t\t\treturn apiError(\"INVALID_STATE\", \"Invalid setup state. Please restart setup.\", 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, setupAdminVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\tconst user = await createFirstAdmin(emdash.db, {\n\t\t\temail: setupState.email,\n\t\t\tname: setupState.name ?? null,\n\t\t});\n\t\tif (!user) {\n\t\t\treturn apiError(\"ADMIN_EXISTS\", \"Admin user already exists\", 400);\n\t\t}\n\n\t\t// Register the passkey\n\t\tawait registerPasskey(adapter, user.id, verified, \"Setup passkey\");\n\n\t\t// Mark setup as complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Authenticate the newly created admin so the dashboard opens immediately.\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\t// Clean up setup state and the session nonce cookie\n\t\tawait options.delete(\"emdash:setup_state\");\n\t\tcookies.delete(SETUP_NONCE_COOKIE, { path: \"/_emdash/\" });\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to verify admin setup\", \"SETUP_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAmBzB,MAAa,OAAiB,OAAO,EAAE,SAAS,SAAS,QAAQ,cAAc;CAC9E,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,QAAS,QAAO,yBAAyB;AAE9C,KAAI;EAEH,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;EAChE,MAAM,aAAa,kBAAkB,QAAQ,kBAAkB;EAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAG9C,MAFkB,MAAM,QAAQ,YAAY,GAE5B,GAAG;AAClB,OAAI,WACH,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAEjE,UAAO,SAAS,gBAAgB,6BAA6B,IAAI;;EAQlE,MAAM,aAAa,MAAM,QAAQ,IAK9B,qBAAqB;AAExB,MAAI,CAAC,cAAc,WAAW,SAAS,QACtC,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAQpF,MAAM,cAAc,QAAQ,IAAI,mBAAmB,EAAE;AACrD,MAAI,CAAC,WAAW,SAAS,CAAC,eAAe,CAAC,cAAc,aAAa,WAAW,MAAM,CACrF,QAAO,SACN,iBACA,0EACA,IACA;AAGF,MAAI,CAAC,WAAW,MACf,QAAO,SAAS,iBAAiB,8CAA8C,IAAI;EAIpF,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,WAAY,MAAM,QAAQ,IAAY,oBAAoB,IAAK;EACrE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EAEtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAED,MAAM,OAAO,MAAM,iBAAiB,OAAO,IAAI;GAC9C,OAAO,WAAW;GAClB,MAAM,WAAW,QAAQ;GACzB,CAAC;AACF,MAAI,CAAC,KACJ,QAAO,SAAS,gBAAgB,6BAA6B,IAAI;AAIlE,QAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,gBAAgB;AAGlE,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAGpC,QAAM,QAAQ,OAAO,qBAAqB;AAC1C,UAAQ,OAAO,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzD,SAAO,WAAW;GACjB,SAAS;GACT,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}

package/dist/astro/routes/api/setup/admin.mjs

@@ -1,26 +1,26 @@
-import "../../../../config-CvmjJcVw.mjs";
+import "../../../../config-Cs_AwWXI.mjs";
 import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../errors-CjtE5aWF.mjs";
-import "../../../../errors-hskQ0C8G.mjs";
-import "../../../../settings-GaZ5sVgg.mjs";
-import "../../../../site-settings-CDdT4mVm.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
-import "../../../../redirects-DFT7Wr-e.mjs";
-import "../../../../entry-lock-Cjz0h45X.mjs";
-import "../../../../media-CRKsKlfK.mjs";
-import "../../../../comments-BzmIKVb2.mjs";
-import { c as setupAdminBody } from "../../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../../menus-D1HC8npj.mjs";
-import "../../../../status-Dl85BK39.mjs";
+import "../../../../url-DTfGDJhI.mjs";
+import "../../../../types-DwhEvIVb.mjs";
+import "../../../../errors-DlJwot7q.mjs";
+import "../../../../errors-BMaCpLeS.mjs";
+import "../../../../settings-B3ZmPF_8.mjs";
+import "../../../../site-settings-uPkW0e6o.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CT2SsX5S.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-2W-E2f7w.mjs";
+import "../../../../redirects-BA_TvtuH.mjs";
+import "../../../../entry-lock-DDuWaAiP.mjs";
+import "../../../../media-qTTHVkls.mjs";
+import "../../../../comments-DVjWJm8X.mjs";
+import { c as setupAdminBody } from "../../../../byline-fields-B1qHvRps.mjs";
+import "../../../../menus-BI6oBXco.mjs";
+import "../../../../status-DSURZwKS.mjs";
 import "../../../../api/schemas/index.mjs";
-import { i as getPublicOrigin } from "../../../../public-url-uT1Ok2Tu.mjs";
-import { n as createChallengeStore } from "../../../../challenge-store-BHgdPVze.mjs";
-import { t as getPasskeyConfig } from "../../../../passkey-config-mMFRQUCj.mjs";
-import { n as SETUP_NONCE_MAX_AGE_SECONDS, t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-DKl4S4c6.mjs";
+import { i as getPublicOrigin } from "../../../../public-url-CQwzRljH.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-Cfjdvw86.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-DTTZB6EI.mjs";
+import { n as SETUP_NONCE_MAX_AGE_SECONDS, t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-CyPOapqY.mjs";
 import { generateToken } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/setup/dev-bypass.mjs

@@ -1,57 +1,61 @@
 import "../../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../../config-CvmjJcVw.mjs";
+import "../../../../config-Cs_AwWXI.mjs";
 import "../../../../datetime-normalization-PeiEdcRY.mjs";
 import "../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
 import "../../../../secrets-Cc_O3Kp-.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../content-CcHrqkgp.mjs";
-import "../../../../object-cache-Bo6DGaC9.mjs";
-import "../../../../slugify-bu2-jKia.mjs";
-import "../../../../request-cache-C4CIo5ad.mjs";
-import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../revision-BWEH2qQB.mjs";
-import "../../../../media-IT8hQleU.mjs";
-import "../../../../taxonomy-QrNmTfIZ.mjs";
-import "../../../../resolve-D-kqyKns.mjs";
-import "../../../../redirect-B39kTQ_0.mjs";
-import "../../../../byline-registry-dvt4N3xV.mjs";
-import "../../../../field-defs-cache-zoow36nz.mjs";
-import "../../../../byline-BmVKOQ8l.mjs";
-import "../../../../staged-DboEaWsV.mjs";
-import "../../../../dist-Cfu8mMBs.mjs";
-import "../../../../fts-manager-WJCN8uU6.mjs";
-import "../../../../loader-CetY659y.mjs";
-import "../../../../collection-slugs-cache-B2Gs9Jwx.mjs";
-import "../../../../capture-triggers-C9JKoIdT.mjs";
-import "../../../../activation-xomsCMJg.mjs";
-import "../../../../media-usage-work-cgDYGvrt.mjs";
-import "../../../../registry-DeZ27gVi.mjs";
-import "../../../../hash-C4DFoJ7Z.mjs";
-import "../../../../zod-generator-BQilAboC.mjs";
-import "../../../../errors-CjtE5aWF.mjs";
-import "../../../../canonical-BUcKRYpG.mjs";
-import "../../../../digest-xJmyPv2r.mjs";
-import "../../../../block-values-C4N_F2-G.mjs";
-import "../../../../query-C_CWlifp.mjs";
-import "../../../../schema-I74JwYte.mjs";
-import "../../../../relations-DBB1bRJW.mjs";
-import "../../../../errors-hskQ0C8G.mjs";
-import { n as repairContentMediaUsageCollection } from "../../../../content-repair-havk1F0-.mjs";
-import "../../../../schema-BXIW-JHi.mjs";
-import "../../../../settings-B1jOxAIl.mjs";
-import "../../../../ssrf-LM_0wpGA.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
-import { t as applySeed } from "../../../../apply-Cx48saFC.mjs";
-import "../../../../ssrf-BvNItdxk.mjs";
-import { n as validateSeed } from "../../../../validate-BSZbSUDk.mjs";
-import { t as loadSeed } from "../../../../load-DjUqmf3s.mjs";
-import { i as getPublicOrigin } from "../../../../public-url-uT1Ok2Tu.mjs";
-import { t as escapeHtml } from "../../../../escape-ESFhYzwG.mjs";
-import "../../../../api-tokens-D2zgAIEt.mjs";
-import { n as handleApiTokenCreate, t as deleteApiTokensByName } from "../../../../api-tokens-B0ZipcZ-.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-BguJ00Pv.mjs";
+import "../../../../content-Dt0Os_WQ.mjs";
+import "../../../../query-BFHjCzSh.mjs";
+import "../../../../object-cache-EjasjtoQ.mjs";
+import "../../../../slugify-BDEG9pLk.mjs";
+import "../../../../request-cache-5z2WzWmh.mjs";
+import "../../../../url-DTfGDJhI.mjs";
+import "../../../../types-DwhEvIVb.mjs";
+import "../../../../revision-Dx7Uth1X.mjs";
+import "../../../../media-B_x5B9EA.mjs";
+import "../../../../taxonomy-BG_xu2Qf.mjs";
+import "../../../../resolve-DdNXBJSr.mjs";
+import "../../../../redirect-DcmNMvOs.mjs";
+import "../../../../byline-registry-BhzpO41z.mjs";
+import "../../../../field-defs-cache-C7sR7ZeU.mjs";
+import "../../../../byline-CzGZC2Zs.mjs";
+import "../../../../staged-B5vQGeSf.mjs";
+import "../../../../dist-DY0aOmAP.mjs";
+import "../../../../version-BOFfLiVT.mjs";
+import "../../../../fts-manager-BzFo0xx6.mjs";
+import "../../../../loader-D4w4XE7q.mjs";
+import "../../../../json-recordset-BjYIWFkV.mjs";
+import "../../../../collection-slugs-cache-B2J5aESO.mjs";
+import "../../../../media-usage-work-L8-Au4j-.mjs";
+import "../../../../capture-triggers-D7g3fOZj.mjs";
+import "../../../../activation-sGF9br3X.mjs";
+import "../../../../registry-DymfZkAN.mjs";
+import "../../../../hash-A-o2ZX8O.mjs";
+import "../../../../zod-generator-VxCPVDpo.mjs";
+import "../../../../errors-DlJwot7q.mjs";
+import "../../../../canonical-DjF_z6GI.mjs";
+import "../../../../digest-DlBa7kJl.mjs";
+import "../../../../block-values-CgbMtSGU.mjs";
+import "../../../../query-DuwyFr5Z.mjs";
+import "../../../../schema-Bss8qImF.mjs";
+import "../../../../relations-DrEs3Sc1.mjs";
+import "../../../../errors-BMaCpLeS.mjs";
+import { n as repairContentMediaUsageCollection } from "../../../../content-repair-CjwbLy4m.mjs";
+import "../../../../schema-C036pqEw.mjs";
+import "../../../../settings-yIqoN-Ok.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CT2SsX5S.mjs";
+import "../../../../fence-BOD3SxZG.mjs";
+import "../../../../ssrf-mcCKMH6B.mjs";
+import { t as applySeed } from "../../../../apply-CLjfxvyH.mjs";
+import "../../../../ssrf-BBXcxG-f.mjs";
+import { n as validateSeed } from "../../../../validate-BxLvcDYh.mjs";
+import { t as loadSeed } from "../../../../load-Dds3KhXr.mjs";
+import { i as getPublicOrigin } from "../../../../public-url-CQwzRljH.mjs";
+import { t as escapeHtml } from "../../../../escape-BfbDyuQ-.mjs";
+import "../../../../api-tokens-C7l0GUAF.mjs";
+import { n as handleApiTokenCreate, t as deleteApiTokensByName } from "../../../../api-tokens-DQ9Ee-vP.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-BtiMkehU.mjs";
 import { ulid } from "ulidx";
 
 //#region src/astro/routes/api/setup/dev-bypass.ts

package/dist/astro/routes/api/setup/dev-bypass.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/dev-bypass\n * GET  /_emdash/api/setup/dev-bypass\n *\n * Development-only endpoint to bypass the setup wizard.\n * Creates a dev admin user and marks setup complete after runtime initialization.\n * Newly applied sample content has its Media Usage index prepared before redirecting.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with setup info\n * - ?content=0 (or ?content=false): apply schema/structure only, skipping\n *   sample content entries, bylines, and taxonomy terms\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { deleteApiTokensByName, handleApiTokenCreate } from \"#api/handlers/api-tokens.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { repairContentMediaUsageCollection } from \"#media/usage/content-repair.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\nconst DEV_SITE_TITLE = \"EmDash Dev Site\";\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Apply seed (user seed or built-in default). `?content=0` (or `false`)\n\t\t// applies schema/structure only — no sample content, bylines, or terms.\n\t\tconst contentParam = url.searchParams.get(\"content\");\n\t\tconst includeContent = contentParam !== \"0\" && contentParam !== \"false\";\n\t\tconst seed = await loadSeed();\n\t\tconst validation = validateSeed(seed);\n\t\tif (validation.valid) {\n\t\t\tconst seedResult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t\tconsole.log(\n\t\t\t\t`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`,\n\t\t\t);\n\t\t\tif (includeContent && seedResult.content.created + seedResult.content.updated > 0) {\n\t\t\t\tfor (const collectionSlug of Object.keys(seed.content ?? {})) {\n\t\t\t\t\tconst repair = await repairContentMediaUsageCollection(emdash.db, {\n\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t});\n\t\t\t\t\tif (repair.status !== \"complete\") {\n\t\t\t\t\t\tthrow new Error(`Seeded Media Usage indexing failed for ${collectionSlug}`);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\t\tlet userCreated = false;\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tuserCreated = true;\n\t\t\tconsole.log(\"[setup-dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Set site title if not already set\n\t\tconst existingTitle = await options.get(\"emdash:site_title\");\n\t\tif (!existingTitle) {\n\t\t\tawait options.set(\"emdash:site_title\", DEV_SITE_TITLE);\n\t\t}\n\n\t\t// Store canonical site URL (used by magic-link/recovery emails)\n\t\tawait options.set(\"emdash:site_url\", getPublicOrigin(url, emdash?.config));\n\n\t\t// Mark setup complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Optionally create a PAT token (?token=1) for headless/CLI testing.\n\t\tlet token: string | undefined;\n\t\tif (url.searchParams.has(\"token\")) {\n\t\t\t// Idempotent by name: a prior reset can leave a stale dev-bypass-token,\n\t\t\t// and the raw token is only available at creation, so drop any existing\n\t\t\t// one and mint a fresh, usable PAT rather than accumulating duplicates.\n\t\t\tawait deleteApiTokensByName(emdash.db, user.id, \"dev-bypass-token\");\n\t\t\tconst result = await handleApiTokenCreate(emdash.db, user.id, {\n\t\t\t\tname: \"dev-bypass-token\",\n\t\t\t\tscopes: [\n\t\t\t\t\t\"content:read\",\n\t\t\t\t\t\"content:write\",\n\t\t\t\t\t\"media:read\",\n\t\t\t\t\t\"media:write\",\n\t\t\t\t\t\"schema:read\",\n\t\t\t\t\t\"schema:write\",\n\t\t\t\t\t\"admin\",\n\t\t\t\t],\n\t\t\t});\n\t\t\tif (result.success) {\n\t\t\t\ttoken = result.data.token;\n\t\t\t}\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev setup complete\",\n\t\t\tmigrations: [],\n\t\t\tuserCreated,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t\t...(token ? { token } : {}),\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAgBzB,MAAM,aAAa;AAEnB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AAEvB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAGH,MAAM,eAAe,IAAI,aAAa,IAAI,UAAU;EACpD,MAAM,iBAAiB,iBAAiB,OAAO,iBAAiB;EAChE,MAAM,OAAO,MAAM,UAAU;AAE7B,MADmB,aAAa,KAAK,CACtB,OAAO;GACrB,MAAM,aAAa,MAAM,UAAU,OAAO,IAAI,MAAM;IACnD;IACA,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;AACF,WAAQ,IACP,oCAAoC,WAAW,YAAY,QAAQ,gBAAgB,WAAW,OAAO,QAAQ,SAC7G;AACD,OAAI,kBAAkB,WAAW,QAAQ,UAAU,WAAW,QAAQ,UAAU,GAC/E;SAAK,MAAM,kBAAkB,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC,CAI3D,MAHe,MAAM,kCAAkC,OAAO,IAAI,EACjE,gBACA,CAAC,EACS,WAAW,WACrB,OAAM,IAAI,MAAM,0CAA0C,iBAAiB;;;EAM/E,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAGhD,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;EACJ,IAAI,cAAc;AAElB,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,iBAAc;AACd,WAAQ,IAAI,8CAA8C,KAAK,MAAM;QAErE,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAKF,MAAI,CADkB,MAAM,QAAQ,IAAI,oBAAoB,CAE3D,OAAM,QAAQ,IAAI,qBAAqB,eAAe;AAIvD,QAAM,QAAQ,IAAI,mBAAmB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AAG1E,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,IAAI;AACJ,MAAI,IAAI,aAAa,IAAI,QAAQ,EAAE;AAIlC,SAAM,sBAAsB,OAAO,IAAI,KAAK,IAAI,mBAAmB;GACnE,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,KAAK,IAAI;IAC7D,MAAM;IACN,QAAQ;KACP;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACD,CAAC;AACF,OAAI,OAAO,QACV,SAAQ,OAAO,KAAK;;EAKtB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,YAAY,EAAE;GACd;GACA,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;GAC1B,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,qBAAqB,mBAAmB;;;AAKpE,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}
+{"version":3,"file":"dev-bypass.mjs","names":[],"sources":["../../../../../src/astro/routes/api/setup/dev-bypass.ts"],"sourcesContent":["/**\n * POST /_emdash/api/setup/dev-bypass\n * GET  /_emdash/api/setup/dev-bypass\n *\n * Development-only endpoint to bypass the setup wizard.\n * Creates a dev admin user and marks setup complete after runtime initialization.\n * Newly applied sample content has its Media Usage index prepared before redirecting.\n *\n * ONLY available when import.meta.env.DEV is true.\n *\n * Usage:\n * - GET with redirect: /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n * - POST for API: Returns JSON with setup info\n * - ?content=0 (or ?content=false): apply schema/structure only, skipping\n *   sample content entries, bylines, and taxonomy terms\n *\n * For agent/browser testing, navigate to:\n *   /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { ulid } from \"ulidx\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { escapeHtml } from \"#api/escape.js\";\nimport { deleteApiTokensByName, handleApiTokenCreate } from \"#api/handlers/api-tokens.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isSafeRedirect } from \"#api/redirect.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\nimport { repairContentMediaUsageCollection } from \"#media/usage/content-repair.js\";\nimport { applySeed } from \"#seed/apply.js\";\nimport { loadSeed } from \"#seed/load.js\";\nimport { validateSeed } from \"#seed/validate.js\";\n\n// RBAC role levels (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\n\nconst DEV_USER_EMAIL = \"dev@emdash.local\";\nconst DEV_USER_NAME = \"Dev Admin\";\nconst DEV_SITE_TITLE = \"EmDash Dev Site\";\n\nasync function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {\n\t// CRITICAL: Only allow in development mode\n\tif (!import.meta.env.DEV) {\n\t\treturn apiError(\"FORBIDDEN\", \"Dev bypass is only available in development mode\", 403);\n\t}\n\n\tconst { locals, url, session } = context;\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Apply seed (user seed or built-in default). `?content=0` (or `false`)\n\t\t// applies schema/structure only — no sample content, bylines, or terms.\n\t\tconst contentParam = url.searchParams.get(\"content\");\n\t\tconst includeContent = contentParam !== \"0\" && contentParam !== \"false\";\n\t\tconst seed = await loadSeed();\n\t\tconst validation = validateSeed(seed);\n\t\tif (validation.valid) {\n\t\t\tconst seedResult = await applySeed(emdash.db, seed, {\n\t\t\t\tincludeContent,\n\t\t\t\tonConflict: \"skip\",\n\t\t\t\tstorage: emdash.storage ?? undefined,\n\t\t\t});\n\t\t\tconsole.log(\n\t\t\t\t`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`,\n\t\t\t);\n\t\t\tif (includeContent && seedResult.content.created + seedResult.content.updated > 0) {\n\t\t\t\tfor (const collectionSlug of Object.keys(seed.content ?? {})) {\n\t\t\t\t\tconst repair = await repairContentMediaUsageCollection(emdash.db, {\n\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t});\n\t\t\t\t\tif (repair.status !== \"complete\") {\n\t\t\t\t\t\tthrow new Error(`Seeded Media Usage indexing failed for ${collectionSlug}`);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\n\t\t// Find or create dev user (direct DB access to avoid @emdash-cms/auth import issues in dev)\n\t\tconst existingUser = await emdash.db\n\t\t\t.selectFrom(\"users\")\n\t\t\t.selectAll()\n\t\t\t.where(\"email\", \"=\", DEV_USER_EMAIL)\n\t\t\t.executeTakeFirst();\n\n\t\tlet user: { id: string; email: string; name: string; role: number };\n\t\tlet userCreated = false;\n\n\t\tif (!existingUser) {\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: DEV_USER_EMAIL,\n\t\t\t\tname: DEV_USER_NAME,\n\t\t\t\trole: ROLE_ADMIN,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = {\n\t\t\t\tid: newUser.id,\n\t\t\t\temail: newUser.email,\n\t\t\t\tname: newUser.name,\n\t\t\t\trole: newUser.role,\n\t\t\t};\n\t\t\tuserCreated = true;\n\t\t\tconsole.log(\"[setup-dev-bypass] Created dev admin user:\", user.email);\n\t\t} else {\n\t\t\tuser = {\n\t\t\t\tid: existingUser.id,\n\t\t\t\temail: existingUser.email,\n\t\t\t\tname: existingUser.name || DEV_USER_NAME,\n\t\t\t\trole: existingUser.role,\n\t\t\t};\n\t\t}\n\n\t\t// Set site title if not already set\n\t\tconst existingTitle = await options.get(\"emdash:site_title\");\n\t\tif (!existingTitle) {\n\t\t\tawait options.set(\"emdash:site_title\", DEV_SITE_TITLE);\n\t\t}\n\n\t\t// Store canonical site URL (used by magic-link/recovery emails)\n\t\tawait options.set(\"emdash:site_url\", getPublicOrigin(url, emdash?.config));\n\n\t\t// Mark setup complete\n\t\tawait options.set(\"emdash:setup_complete\", true);\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Optionally create a PAT token (?token=1) for headless/CLI testing.\n\t\tlet token: string | undefined;\n\t\tif (url.searchParams.has(\"token\")) {\n\t\t\t// Idempotent by name: a prior reset can leave a stale dev-bypass-token,\n\t\t\t// and the raw token is only available at creation, so drop any existing\n\t\t\t// one and mint a fresh, usable PAT rather than accumulating duplicates.\n\t\t\tawait deleteApiTokensByName(emdash.db, user.id, \"dev-bypass-token\");\n\t\t\tconst result = await handleApiTokenCreate(emdash.db, user.id, {\n\t\t\t\tname: \"dev-bypass-token\",\n\t\t\t\tscopes: [\n\t\t\t\t\t\"content:read\",\n\t\t\t\t\t\"content:write\",\n\t\t\t\t\t\"media:read\",\n\t\t\t\t\t\"media:write\",\n\t\t\t\t\t\"schema:read\",\n\t\t\t\t\t\"schema:write\",\n\t\t\t\t\t\"admin\",\n\t\t\t\t],\n\t\t\t});\n\t\t\tif (result.success) {\n\t\t\t\ttoken = result.data.token;\n\t\t\t}\n\t\t}\n\n\t\t// Check for redirect parameter\n\t\tconst redirect = url.searchParams.get(\"redirect\");\n\n\t\tif (redirect) {\n\t\t\t// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\\evil.com)\n\t\t\tif (!isSafeRedirect(redirect)) {\n\t\t\t\treturn apiError(\"INVALID_REDIRECT\", \"Redirect must be a local path\", 400);\n\t\t\t}\n\n\t\t\t// Return an HTML page with meta-refresh redirect\n\t\t\t// This ensures the session is fully saved before redirect\n\t\t\tconst safeRedirect = escapeHtml(redirect);\n\t\t\tconst html = `<!DOCTYPE html>\n<html>\n<head>\n\t<meta http-equiv=\"refresh\" content=\"0;url=${safeRedirect}\">\n</head>\n<body>Redirecting...</body>\n</html>`;\n\t\t\treturn new Response(html, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: { \"Content-Type\": \"text/html\" },\n\t\t\t});\n\t\t}\n\n\t\t// Return JSON response\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"Dev setup complete\",\n\t\t\tmigrations: [],\n\t\t\tuserCreated,\n\t\t\tuser: {\n\t\t\t\tid: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\tname: user.name,\n\t\t\t\trole: user.role,\n\t\t\t},\n\t\t\t...(token ? { token } : {}),\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Dev bypass failed\", \"DEV_BYPASS_ERROR\");\n\t}\n}\n\n// Support both GET and POST\nexport const GET: APIRoute = handleDevBypass;\nexport const POST: APIRoute = handleDevBypass;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAgBzB,MAAM,aAAa;AAEnB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AAEvB,eAAe,gBAAgB,SAAqD;AAEnF,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,QAAO,SAAS,aAAa,oDAAoD,IAAI;CAGtF,MAAM,EAAE,QAAQ,KAAK,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAGH,MAAM,eAAe,IAAI,aAAa,IAAI,UAAU;EACpD,MAAM,iBAAiB,iBAAiB,OAAO,iBAAiB;EAChE,MAAM,OAAO,MAAM,UAAU;AAE7B,MADmB,aAAa,KAAK,CACtB,OAAO;GACrB,MAAM,aAAa,MAAM,UAAU,OAAO,IAAI,MAAM;IACnD;IACA,YAAY;IACZ,SAAS,OAAO,WAAW;IAC3B,CAAC;AACF,WAAQ,IACP,oCAAoC,WAAW,YAAY,QAAQ,gBAAgB,WAAW,OAAO,QAAQ,SAC7G;AACD,OAAI,kBAAkB,WAAW,QAAQ,UAAU,WAAW,QAAQ,UAAU,GAC/E;SAAK,MAAM,kBAAkB,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC,CAI3D,MAHe,MAAM,kCAAkC,OAAO,IAAI,EACjE,gBACA,CAAC,EACS,WAAW,WACrB,OAAM,IAAI,MAAM,0CAA0C,iBAAiB;;;EAM/E,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAGhD,MAAM,eAAe,MAAM,OAAO,GAChC,WAAW,QAAQ,CACnB,WAAW,CACX,MAAM,SAAS,KAAK,eAAe,CACnC,kBAAkB;EAEpB,IAAI;EACJ,IAAI,cAAc;AAElB,MAAI,CAAC,cAAc;GAClB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO;IACN,IAAI,QAAQ;IACZ,OAAO,QAAQ;IACf,MAAM,QAAQ;IACd,MAAM,QAAQ;IACd;AACD,iBAAc;AACd,WAAQ,IAAI,8CAA8C,KAAK,MAAM;QAErE,QAAO;GACN,IAAI,aAAa;GACjB,OAAO,aAAa;GACpB,MAAM,aAAa,QAAQ;GAC3B,MAAM,aAAa;GACnB;AAKF,MAAI,CADkB,MAAM,QAAQ,IAAI,oBAAoB,CAE3D,OAAM,QAAQ,IAAI,qBAAqB,eAAe;AAIvD,QAAM,QAAQ,IAAI,mBAAmB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AAG1E,QAAM,QAAQ,IAAI,yBAAyB,KAAK;AAGhD,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;EAIrC,IAAI;AACJ,MAAI,IAAI,aAAa,IAAI,QAAQ,EAAE;AAIlC,SAAM,sBAAsB,OAAO,IAAI,KAAK,IAAI,mBAAmB;GACnE,MAAM,SAAS,MAAM,qBAAqB,OAAO,IAAI,KAAK,IAAI;IAC7D,MAAM;IACN,QAAQ;KACP;KACA;KACA;KACA;KACA;KACA;KACA;KACA;IACD,CAAC;AACF,OAAI,OAAO,QACV,SAAQ,OAAO,KAAK;;EAKtB,MAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AAEjD,MAAI,UAAU;AAEb,OAAI,CAAC,eAAe,SAAS,CAC5B,QAAO,SAAS,oBAAoB,iCAAiC,IAAI;GAM1E,MAAM,OAAO;;;6CADQ,WAAW,SAAS,CAIc;;;;AAIvD,UAAO,IAAI,SAAS,MAAM;IACzB,QAAQ;IACR,SAAS,EAAE,gBAAgB,aAAa;IACxC,CAAC;;AAIH,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,YAAY,EAAE;GACd;GACA,MAAM;IACL,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,MAAM,KAAK;IACX,MAAM,KAAK;IACX;GACD,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;GAC1B,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,qBAAqB,mBAAmB;;;AAKpE,MAAa,MAAgB;AAC7B,MAAa,OAAiB"}

package/dist/astro/routes/api/setup/dev-reset.mjs

@@ -1,9 +1,9 @@
 import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../errors-CjtE5aWF.mjs";
-import "../../../../errors-hskQ0C8G.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
+import "../../../../types-DwhEvIVb.mjs";
+import "../../../../errors-DlJwot7q.mjs";
+import "../../../../errors-BMaCpLeS.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CT2SsX5S.mjs";
 
 //#region src/astro/routes/api/setup/dev-reset.ts
 const prerender = false;

package/dist/astro/routes/api/setup/index.mjs

@@ -1,64 +1,68 @@
 import "../../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../../config-CvmjJcVw.mjs";
+import "../../../../config-Cs_AwWXI.mjs";
 import "../../../../datetime-normalization-PeiEdcRY.mjs";
 import "../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../options-DhrI7eMv.mjs";
 import "../../../../secrets-Cc_O3Kp-.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../content-CcHrqkgp.mjs";
-import "../../../../object-cache-Bo6DGaC9.mjs";
-import "../../../../slugify-bu2-jKia.mjs";
-import "../../../../request-cache-C4CIo5ad.mjs";
-import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../revision-BWEH2qQB.mjs";
-import "../../../../media-IT8hQleU.mjs";
-import "../../../../taxonomy-QrNmTfIZ.mjs";
-import "../../../../resolve-D-kqyKns.mjs";
-import "../../../../redirect-B39kTQ_0.mjs";
-import "../../../../byline-registry-dvt4N3xV.mjs";
-import "../../../../field-defs-cache-zoow36nz.mjs";
-import "../../../../byline-BmVKOQ8l.mjs";
-import "../../../../staged-DboEaWsV.mjs";
-import "../../../../dist-Cfu8mMBs.mjs";
-import "../../../../fts-manager-WJCN8uU6.mjs";
-import "../../../../loader-CetY659y.mjs";
-import "../../../../collection-slugs-cache-B2Gs9Jwx.mjs";
-import "../../../../capture-triggers-C9JKoIdT.mjs";
-import "../../../../activation-xomsCMJg.mjs";
-import "../../../../media-usage-work-cgDYGvrt.mjs";
-import "../../../../registry-DeZ27gVi.mjs";
-import "../../../../hash-C4DFoJ7Z.mjs";
-import "../../../../zod-generator-BQilAboC.mjs";
-import "../../../../errors-CjtE5aWF.mjs";
-import "../../../../canonical-BUcKRYpG.mjs";
-import "../../../../digest-xJmyPv2r.mjs";
-import "../../../../block-values-C4N_F2-G.mjs";
-import "../../../../query-C_CWlifp.mjs";
-import "../../../../schema-I74JwYte.mjs";
-import "../../../../relations-DBB1bRJW.mjs";
-import "../../../../errors-hskQ0C8G.mjs";
-import "../../../../settings-GaZ5sVgg.mjs";
-import "../../../../site-settings-CDdT4mVm.mjs";
-import "../../../../schema-BXIW-JHi.mjs";
-import { l as setSiteSettings } from "../../../../settings-B1jOxAIl.mjs";
-import "../../../../ssrf-LM_0wpGA.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
-import "../../../../redirects-DFT7Wr-e.mjs";
-import "../../../../entry-lock-Cjz0h45X.mjs";
-import "../../../../media-CRKsKlfK.mjs";
-import "../../../../comments-BzmIKVb2.mjs";
-import { d as setupBody } from "../../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../../menus-D1HC8npj.mjs";
-import "../../../../status-Dl85BK39.mjs";
+import "../../../../content-Dt0Os_WQ.mjs";
+import "../../../../query-BFHjCzSh.mjs";
+import "../../../../object-cache-EjasjtoQ.mjs";
+import "../../../../slugify-BDEG9pLk.mjs";
+import "../../../../request-cache-5z2WzWmh.mjs";
+import "../../../../url-DTfGDJhI.mjs";
+import "../../../../types-DwhEvIVb.mjs";
+import "../../../../revision-Dx7Uth1X.mjs";
+import "../../../../media-B_x5B9EA.mjs";
+import "../../../../taxonomy-BG_xu2Qf.mjs";
+import "../../../../resolve-DdNXBJSr.mjs";
+import "../../../../redirect-DcmNMvOs.mjs";
+import "../../../../byline-registry-BhzpO41z.mjs";
+import "../../../../field-defs-cache-C7sR7ZeU.mjs";
+import "../../../../byline-CzGZC2Zs.mjs";
+import "../../../../staged-B5vQGeSf.mjs";
+import "../../../../dist-DY0aOmAP.mjs";
+import "../../../../version-BOFfLiVT.mjs";
+import "../../../../fts-manager-BzFo0xx6.mjs";
+import "../../../../loader-D4w4XE7q.mjs";
+import "../../../../json-recordset-BjYIWFkV.mjs";
+import "../../../../collection-slugs-cache-B2J5aESO.mjs";
+import "../../../../media-usage-work-L8-Au4j-.mjs";
+import "../../../../capture-triggers-D7g3fOZj.mjs";
+import "../../../../activation-sGF9br3X.mjs";
+import "../../../../registry-DymfZkAN.mjs";
+import "../../../../hash-A-o2ZX8O.mjs";
+import "../../../../zod-generator-VxCPVDpo.mjs";
+import "../../../../errors-DlJwot7q.mjs";
+import "../../../../canonical-DjF_z6GI.mjs";
+import "../../../../digest-DlBa7kJl.mjs";
+import "../../../../block-values-CgbMtSGU.mjs";
+import "../../../../query-DuwyFr5Z.mjs";
+import "../../../../schema-Bss8qImF.mjs";
+import "../../../../relations-DrEs3Sc1.mjs";
+import "../../../../errors-BMaCpLeS.mjs";
+import "../../../../settings-B3ZmPF_8.mjs";
+import "../../../../site-settings-uPkW0e6o.mjs";
+import "../../../../schema-C036pqEw.mjs";
+import { d as setSiteSettings } from "../../../../settings-yIqoN-Ok.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CT2SsX5S.mjs";
+import "../../../../fence-BOD3SxZG.mjs";
+import "../../../../ssrf-mcCKMH6B.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-2W-E2f7w.mjs";
+import "../../../../redirects-BA_TvtuH.mjs";
+import "../../../../entry-lock-DDuWaAiP.mjs";
+import "../../../../media-qTTHVkls.mjs";
+import "../../../../comments-DVjWJm8X.mjs";
+import { d as setupBody } from "../../../../byline-fields-B1qHvRps.mjs";
+import "../../../../menus-BI6oBXco.mjs";
+import "../../../../status-DSURZwKS.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as applySeedWithinBudget } from "../../../../apply-Cx48saFC.mjs";
-import "../../../../ssrf-BvNItdxk.mjs";
-import { n as validateSeed } from "../../../../validate-BSZbSUDk.mjs";
-import { t as loadSeed } from "../../../../load-DjUqmf3s.mjs";
-import { t as getConfiguredOrigin } from "../../../../public-url-uT1Ok2Tu.mjs";
-import { t as getAuthMode } from "../../../../mode-eieqAWLe.mjs";
+import { n as applySeedWithinBudget } from "../../../../apply-CLjfxvyH.mjs";
+import "../../../../ssrf-BBXcxG-f.mjs";
+import { n as validateSeed } from "../../../../validate-BxLvcDYh.mjs";
+import { t as loadSeed } from "../../../../load-Dds3KhXr.mjs";
+import { t as getConfiguredOrigin } from "../../../../public-url-CQwzRljH.mjs";
+import { t as getAuthMode } from "../../../../mode-DIDSUwuN.mjs";
 
 //#region src/astro/routes/api/setup/index.ts
 const prerender = false;