emdash 1.3.0 → 1.4.0

package/dist/astro/routes/api/media/_id_/confirm.mjs

@@ -1,27 +1,27 @@
-import "../../../../../config-CvmjJcVw.mjs";
-import { t as after } from "../../../../../after-PcEvMY_6.mjs";
+import "../../../../../config-Cs_AwWXI.mjs";
+import { t as after } from "../../../../../after-32yNRvd2.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-D2NEXtgB.mjs";
-import { t as MediaRepository } from "../../../../../media-Bws9f18T.mjs";
-import "../../../../../dist-Cfu8mMBs.mjs";
-import { t as enrichImageMetadata } from "../../../../../enrich-Duu4sV3a.mjs";
+import "../../../../../url-DTfGDJhI.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import { t as MediaRepository } from "../../../../../media-DepNLhPq.mjs";
+import "../../../../../dist-BUmWMTbN.mjs";
+import { t as enrichImageMetadata } from "../../../../../enrich-DFlfnd3u.mjs";
 import { n as computeContentHash, t as MAX_CONTENT_HASH_BYTES } from "../../../../../hash-BJaeek87.mjs";
 import "../../../../../errors-B4f4It-2.mjs";
-import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../errors-8gJqv-XV.mjs";
 import "../../../../../settings-Dd1uivmQ.mjs";
 import "../../../../../site-settings-DRHfX7bq.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
-import "../../../../../redirects-BEVSRMa2.mjs";
-import "../../../../../entry-lock-Df6-XhIu.mjs";
-import { i as mediaConfirmBody } from "../../../../../media-1WC65OCB.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BCMgPxdn.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-B_b6gZxG.mjs";
+import "../../../../../redirects-CyvvZrCJ.mjs";
+import "../../../../../entry-lock-CRVmruM0.mjs";
+import { i as mediaConfirmBody } from "../../../../../media-BR4_t-Wd.mjs";
 import "../../../../../comments-yiRFx3w5.mjs";
-import "../../../../../byline-fields-BLXZnX7N.mjs";
-import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../byline-fields-CiR8FvvF.mjs";
+import "../../../../../menus-uEAxWAm1.mjs";
 import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { a as requireOwnerPerm, o as requirePerm } from "../../../../../authorize-DPFBGbE6.mjs";
+import { a as requireOwnerPerm, o as requirePerm } from "../../../../../authorize-NJgp8kLI.mjs";
 
 //#region src/astro/routes/api/media/[id]/confirm.ts
 const prerender = false;

package/dist/astro/routes/api/media/_id_/replace.mjs

@@ -1,24 +1,24 @@
-import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../config-Cs_AwWXI.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-D2NEXtgB.mjs";
-import { n as normalizeMime } from "../../../../../mime-B5M9R53H.mjs";
+import "../../../../../url-DTfGDJhI.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import { n as normalizeMime } from "../../../../../mime-D1We9jUx.mjs";
 import { n as computeContentHash } from "../../../../../hash-BJaeek87.mjs";
 import "../../../../../errors-B4f4It-2.mjs";
-import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../errors-8gJqv-XV.mjs";
 import "../../../../../settings-Dd1uivmQ.mjs";
 import "../../../../../site-settings-DRHfX7bq.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
-import "../../../../../redirects-BEVSRMa2.mjs";
-import "../../../../../entry-lock-Df6-XhIu.mjs";
-import { n as DEFAULT_MAX_UPLOAD_SIZE, w as mediaReplaceMetadataForm } from "../../../../../media-1WC65OCB.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BCMgPxdn.mjs";
+import "../../../../../redirects-CyvvZrCJ.mjs";
+import "../../../../../entry-lock-CRVmruM0.mjs";
+import { n as DEFAULT_MAX_UPLOAD_SIZE, w as mediaReplaceMetadataForm } from "../../../../../media-BR4_t-Wd.mjs";
 import "../../../../../comments-yiRFx3w5.mjs";
-import "../../../../../byline-fields-BLXZnX7N.mjs";
-import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../byline-fields-CiR8FvvF.mjs";
+import "../../../../../menus-uEAxWAm1.mjs";
 import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { MUTABLE_MEDIA_CACHE_CONTROL } from "../../../../../media/image-endpoint.mjs";
-import { a as requireOwnerPerm, o as requirePerm } from "../../../../../authorize-DPFBGbE6.mjs";
+import { a as requireOwnerPerm, o as requirePerm } from "../../../../../authorize-NJgp8kLI.mjs";
 
 //#region src/astro/routes/api/media/[id]/replace.ts
 const prerender = false;

package/dist/astro/routes/api/media/_id_/upload.mjs

@@ -1,13 +1,13 @@
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../types-D2NEXtgB.mjs";
-import { t as MediaRepository } from "../../../../../media-Bws9f18T.mjs";
-import { n as normalizeMime } from "../../../../../mime-B5M9R53H.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import { t as MediaRepository } from "../../../../../media-DepNLhPq.mjs";
+import { n as normalizeMime } from "../../../../../mime-D1We9jUx.mjs";
 import { n as computeContentHash, t as MAX_CONTENT_HASH_BYTES } from "../../../../../hash-BJaeek87.mjs";
 import "../../../../../errors-B4f4It-2.mjs";
-import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../errors-8gJqv-XV.mjs";
 import { t as removeUploadAttempt } from "../../../../../upload-attempts-DPFC4COv.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
-import { a as requireOwnerPerm, o as requirePerm } from "../../../../../authorize-DPFBGbE6.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BCMgPxdn.mjs";
+import { a as requireOwnerPerm, o as requirePerm } from "../../../../../authorize-NJgp8kLI.mjs";
 import { ulid } from "ulidx";
 
 //#region src/astro/routes/api/media/[id]/upload.ts

package/dist/astro/routes/api/media/_id_/usage.mjs

@@ -1,40 +1,41 @@
-import "../../../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../dialect-helpers-B1XN2HGB.mjs";
+import "../../../../../config-Cs_AwWXI.mjs";
+import "../../../../../after-32yNRvd2.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../request-cache-C4CIo5ad.mjs";
-import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-D2NEXtgB.mjs";
-import "../../../../../media-Bws9f18T.mjs";
-import "../../../../../fts-manager-Beg3e4bI.mjs";
-import "../../../../../json-recordset-BUjxhr77.mjs";
-import "../../../../../collection-slugs-cache-e09QeJQt.mjs";
-import "../../../../../media-usage-work-CkLa5-nc.mjs";
-import "../../../../../capture-triggers-CT6dK9zd.mjs";
-import "../../../../../activation-Dim4YMM7.mjs";
-import "../../../../../registry-TUVaid9Z.mjs";
+import "../../../../../request-cache-5z2WzWmh.mjs";
+import "../../../../../url-DTfGDJhI.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import "../../../../../media-DepNLhPq.mjs";
+import "../../../../../fts-manager-6861qcwk.mjs";
+import "../../../../../json-recordset-D0WhN2UA.mjs";
+import "../../../../../collection-slugs-cache-DIrLjqH-.mjs";
+import "../../../../../media-usage-work-BCK2J-v_.mjs";
+import "../../../../../capture-triggers-BezAvWcB.mjs";
+import "../../../../../activation-CGlyigmg.mjs";
+import "../../../../../registry-B0-O575m.mjs";
 import "../../../../../hash-BJaeek87.mjs";
-import "../../../../../zod-generator-D0JKy94C.mjs";
+import "../../../../../zod-generator--nlM0930.mjs";
 import "../../../../../errors-B4f4It-2.mjs";
 import "../../../../../canonical-BudtH-Fx.mjs";
 import "../../../../../digest-DJ1tHCgy.mjs";
-import "../../../../../errors-BOYNdIo3.mjs";
-import "../../../../../content-repair-DNh5--x5.mjs";
+import "../../../../../errors-8gJqv-XV.mjs";
+import "../../../../../content-repair-Ukdxoq-R.mjs";
 import "../../../../../settings-Dd1uivmQ.mjs";
 import "../../../../../site-settings-DRHfX7bq.mjs";
-import { t as handleMediaUsageDetails } from "../../../../../media-usage-CF0WVcLO.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CVWeIOku.mjs";
-import { i as parseQuery, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
-import "../../../../../redirects-BEVSRMa2.mjs";
-import "../../../../../entry-lock-Df6-XhIu.mjs";
-import { Y as mediaUsageDetailsQuery } from "../../../../../media-1WC65OCB.mjs";
+import { t as handleMediaUsageDetails } from "../../../../../media-usage-X1_20MY-.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-BCMgPxdn.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../../parse-B_b6gZxG.mjs";
+import "../../../../../redirects-CyvvZrCJ.mjs";
+import "../../../../../entry-lock-CRVmruM0.mjs";
+import { Y as mediaUsageDetailsQuery } from "../../../../../media-BR4_t-Wd.mjs";
 import "../../../../../comments-yiRFx3w5.mjs";
-import "../../../../../byline-fields-BLXZnX7N.mjs";
-import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../byline-fields-CiR8FvvF.mjs";
+import "../../../../../menus-uEAxWAm1.mjs";
 import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import "../../../../../api-tokens-CdP49zVF.mjs";
-import { o as requirePerm } from "../../../../../authorize-DPFBGbE6.mjs";
-import { n as requireScope } from "../../../../../scopes-BU03K7Uo.mjs";
+import "../../../../../api-tokens-DqSlkDVI.mjs";
+import { o as requirePerm } from "../../../../../authorize-NJgp8kLI.mjs";
+import { n as requireScope } from "../../../../../scopes-DNaY7Ey0.mjs";
 
 //#region src/astro/routes/api/media/[id]/usage.ts
 const prerender = false;

package/dist/astro/routes/api/media/_id_/usage.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"usage.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/[id]/usage.ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaUsageDetails } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { mediaUsageDetailsQuery } from \"#api/schemas.js\";\nimport { requireScope } from \"#auth/scopes.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst mediaDenied = requirePerm(user, \"media:read\");\n\tif (mediaDenied) return mediaDenied;\n\tconst contentDenied = requirePerm(user, \"content:read_drafts\");\n\tif (contentDenied) return contentDenied;\n\tconst scopeDenied = requireScope(locals, \"admin\");\n\tif (scopeDenied) return scopeDenied;\n\n\tconst { id } = params;\n\tif (!id) return apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst query = parseQuery(new URL(request.url), mediaUsageDetailsQuery);\n\tif (isParseError(query)) return query;\n\n\treturn unwrapResult(await handleMediaUsageDetails(emdash.db, id, query));\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,cAAc,YAAY,MAAM,aAAa;AACnD,KAAI,YAAa,QAAO;CACxB,MAAM,gBAAgB,YAAY,MAAM,sBAAsB;AAC9D,KAAI,cAAe,QAAO;CAC1B,MAAM,cAAc,aAAa,QAAQ,QAAQ;AACjD,KAAI,YAAa,QAAO;CAExB,MAAM,EAAE,OAAO;AACf,KAAI,CAAC,GAAI,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AACrE,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,uBAAuB;AACtE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,IAAI,MAAM,CAAC"}
+{"version":3,"file":"usage.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/[id]/usage.ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaUsageDetails } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { mediaUsageDetailsQuery } from \"#api/schemas.js\";\nimport { requireScope } from \"#auth/scopes.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst mediaDenied = requirePerm(user, \"media:read\");\n\tif (mediaDenied) return mediaDenied;\n\tconst contentDenied = requirePerm(user, \"content:read_drafts\");\n\tif (contentDenied) return contentDenied;\n\tconst scopeDenied = requireScope(locals, \"admin\");\n\tif (scopeDenied) return scopeDenied;\n\n\tconst { id } = params;\n\tif (!id) return apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst query = parseQuery(new URL(request.url), mediaUsageDetailsQuery);\n\tif (isParseError(query)) return query;\n\n\treturn unwrapResult(await handleMediaUsageDetails(emdash.db, id, query));\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,cAAc,YAAY,MAAM,aAAa;AACnD,KAAI,YAAa,QAAO;CACxB,MAAM,gBAAgB,YAAY,MAAM,sBAAsB;AAC9D,KAAI,cAAe,QAAO;CAC1B,MAAM,cAAc,aAAa,QAAQ,QAAQ;AACjD,KAAI,YAAa,QAAO;CAExB,MAAM,EAAE,OAAO;AACf,KAAI,CAAC,GAAI,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AACrE,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,uBAAuB;AACtE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,QAAO,aAAa,MAAM,wBAAwB,OAAO,IAAI,IAAI,MAAM,CAAC"}

package/dist/astro/routes/api/media/_id_.mjs

@@ -1,38 +1,39 @@
-import "../../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../../config-CvmjJcVw.mjs";
+import "../../../../dialect-helpers-B1XN2HGB.mjs";
+import "../../../../config-Cs_AwWXI.mjs";
+import "../../../../after-32yNRvd2.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../request-cache-C4CIo5ad.mjs";
-import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-D2NEXtgB.mjs";
-import "../../../../media-Bws9f18T.mjs";
-import "../../../../fts-manager-Beg3e4bI.mjs";
-import "../../../../json-recordset-BUjxhr77.mjs";
-import "../../../../collection-slugs-cache-e09QeJQt.mjs";
-import "../../../../media-usage-work-CkLa5-nc.mjs";
-import "../../../../capture-triggers-CT6dK9zd.mjs";
-import "../../../../activation-Dim4YMM7.mjs";
-import "../../../../registry-TUVaid9Z.mjs";
+import "../../../../request-cache-5z2WzWmh.mjs";
+import "../../../../url-DTfGDJhI.mjs";
+import "../../../../types-DwhEvIVb.mjs";
+import "../../../../media-DepNLhPq.mjs";
+import "../../../../fts-manager-6861qcwk.mjs";
+import "../../../../json-recordset-D0WhN2UA.mjs";
+import "../../../../collection-slugs-cache-DIrLjqH-.mjs";
+import "../../../../media-usage-work-BCK2J-v_.mjs";
+import "../../../../capture-triggers-BezAvWcB.mjs";
+import "../../../../activation-CGlyigmg.mjs";
+import "../../../../registry-B0-O575m.mjs";
 import "../../../../hash-BJaeek87.mjs";
-import "../../../../zod-generator-D0JKy94C.mjs";
+import "../../../../zod-generator--nlM0930.mjs";
 import "../../../../errors-B4f4It-2.mjs";
 import "../../../../canonical-BudtH-Fx.mjs";
 import "../../../../digest-DJ1tHCgy.mjs";
-import "../../../../errors-BOYNdIo3.mjs";
-import "../../../../content-repair-DNh5--x5.mjs";
+import "../../../../errors-8gJqv-XV.mjs";
+import "../../../../content-repair-Ukdxoq-R.mjs";
 import "../../../../settings-Dd1uivmQ.mjs";
 import "../../../../site-settings-DRHfX7bq.mjs";
-import { a as handleMediaUsageSummaries } from "../../../../media-usage-CF0WVcLO.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CVWeIOku.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-DgQ2NABT.mjs";
-import "../../../../redirects-BEVSRMa2.mjs";
-import "../../../../entry-lock-Df6-XhIu.mjs";
-import { O as mediaUpdateBody, m as mediaGetQuery } from "../../../../media-1WC65OCB.mjs";
+import { a as handleMediaUsageSummaries } from "../../../../media-usage-X1_20MY-.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BCMgPxdn.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-B_b6gZxG.mjs";
+import "../../../../redirects-CyvvZrCJ.mjs";
+import "../../../../entry-lock-CRVmruM0.mjs";
+import { O as mediaUpdateBody, m as mediaGetQuery } from "../../../../media-BR4_t-Wd.mjs";
 import "../../../../comments-yiRFx3w5.mjs";
-import "../../../../byline-fields-BLXZnX7N.mjs";
-import "../../../../menus-BSzwObhV.mjs";
+import "../../../../byline-fields-CiR8FvvF.mjs";
+import "../../../../menus-uEAxWAm1.mjs";
 import "../../../../status-BFNdxzKc.mjs";
 import "../../../../api/schemas/index.mjs";
-import { a as requireOwnerPerm, o as requirePerm, t as canReadMediaUsageCount } from "../../../../authorize-DPFBGbE6.mjs";
+import { a as requireOwnerPerm, o as requirePerm, t as canReadMediaUsageCount } from "../../../../authorize-NJgp8kLI.mjs";
 
 //#region src/astro/routes/api/media/[id].ts
 const prerender = false;

package/dist/astro/routes/api/media/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/[id].ts"],"sourcesContent":["/**\n * Single media item endpoint\n *\n * GET /_emdash/api/media/:id - Get media item\n * PUT /_emdash/api/media/:id - Update media metadata\n * DELETE /_emdash/api/media/:id - Delete media item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { canReadMediaUsageCount, requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaUsageSummaries } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { mediaGetQuery, mediaUpdateBody } from \"#api/schemas.js\";\nexport const prerender = false;\n\n/**\n * Get media item\n */\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tconst readDenied = requirePerm(user, \"media:read\");\n\tif (readDenied) return readDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst query = parseQuery(new URL(request.url), mediaGetQuery);\n\tif (isParseError(query)) return query;\n\n\tconst result = await emdash.handleMediaGet(id);\n\tif (!result.success || query.includeUsage !== \"1\") return unwrapResult(result);\n\n\tconst includeCount = canReadMediaUsageCount(user, locals.tokenScopes);\n\tconst usageResult = await handleMediaUsageSummaries(emdash.db, [id], { includeCount });\n\tif (!usageResult.success) return unwrapResult(usageResult);\n\tconst usage = usageResult.data[id];\n\tif (!usage) return apiError(\"MEDIA_USAGE_READ_ERROR\", \"Failed to read media usage\", 500);\n\n\treturn apiSuccess({ item: { ...result.data.item, usage } });\n};\n\n/**\n * Update media metadata\n *\n * Authors can edit their own media; editors+ can edit any.\n */\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst editDenied = requirePerm(user, \"media:edit_own\");\n\tif (editDenied) return editDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaUpdate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can edit own, editors+ can edit any\n\t\tconst ownerDenied = requireOwnerPerm(user, media.authorId, \"media:edit_own\", \"media:edit_any\");\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\tconst body = await parseBody(request, mediaUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await emdash.handleMediaUpdate(id, {\n\t\t\talt: body.alt,\n\t\t\tcaption: body.caption,\n\t\t\twidth: body.width,\n\t\t\theight: body.height,\n\t\t\tfolderId: body.folderId,\n\t\t\tfocalX: body.focalX,\n\t\t\tfocalY: body.focalY,\n\t\t});\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update media\", \"MEDIA_UPDATE_ERROR\");\n\t}\n};\n\n/**\n * Delete media item\n *\n * Authors can delete their own media; editors+ can delete any.\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst deleteDenied = requirePerm(user, \"media:delete_own\");\n\tif (deleteDenied) return deleteDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaDelete) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check and storage key\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can delete own, editors+ can delete any\n\t\tconst ownerDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\tmedia.authorId,\n\t\t\t\"media:delete_own\",\n\t\t\t\"media:delete_any\",\n\t\t);\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\t// Storage deletion and site-settings cache invalidation happen in\n\t\t// `EmDashRuntime.handleMediaDelete` so the MCP tool inherits them.\n\t\tconst result = await emdash.handleMediaDelete(id);\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (\n\t\t\ttypeof result.data !== \"object\" ||\n\t\t\tresult.data === null ||\n\t\t\t!(\"storageDeleted\" in result.data) ||\n\t\t\ttypeof result.data.storageDeleted !== \"boolean\"\n\t\t) {\n\t\t\treturn apiError(\"MEDIA_DELETE_ERROR\", \"Failed to delete media\", 500);\n\t\t}\n\n\t\treturn apiSuccess({ deleted: true, storageDeleted: result.data.storageDeleted });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete media\", \"MEDIA_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAEf,MAAM,aAAa,YAAY,MAAM,aAAa;AAClD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,eACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,cAAc;AAC7D,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,SAAS,MAAM,OAAO,eAAe,GAAG;AAC9C,KAAI,CAAC,OAAO,WAAW,MAAM,iBAAiB,IAAK,QAAO,aAAa,OAAO;CAE9E,MAAM,eAAe,uBAAuB,MAAM,OAAO,YAAY;CACrE,MAAM,cAAc,MAAM,0BAA0B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;AACtF,KAAI,CAAC,YAAY,QAAS,QAAO,aAAa,YAAY;CAC1D,MAAM,QAAQ,YAAY,KAAK;AAC/B,KAAI,CAAC,MAAO,QAAO,SAAS,0BAA0B,8BAA8B,IAAI;AAExF,QAAO,WAAW,EAAE,MAAM;EAAE,GAAG,OAAO,KAAK;EAAM;EAAO,EAAE,CAAC;;;;;;;AAQ5D,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,aAAa,YAAY,MAAM,iBAAiB;AACtD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBAAiB,MAAM,MAAM,UAAU,kBAAkB,iBAAiB;AAC9F,MAAI,YAAa,QAAO;EAExB,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,MAAI,aAAa,KAAK,CAAE,QAAO;AAY/B,SAAO,aAVQ,MAAM,OAAO,kBAAkB,IAAI;GACjD,KAAK,KAAK;GACV,SAAS,KAAK;GACd,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,QAAQ,KAAK;GACb,CAAC,CAEyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB;;;;;;;;AAS3E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,eAAe,YAAY,MAAM,mBAAmB;AAC1D,KAAI,aAAc,QAAO;AAEzB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBACnB,MACA,MAAM,UACN,oBACA,mBACA;AACD,MAAI,YAAa,QAAO;EAIxB,MAAM,SAAS,MAAM,OAAO,kBAAkB,GAAG;AACjD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MACC,OAAO,OAAO,SAAS,YACvB,OAAO,SAAS,QAChB,EAAE,oBAAoB,OAAO,SAC7B,OAAO,OAAO,KAAK,mBAAmB,UAEtC,QAAO,SAAS,sBAAsB,0BAA0B,IAAI;AAGrE,SAAO,WAAW;GAAE,SAAS;GAAM,gBAAgB,OAAO,KAAK;GAAgB,CAAC;UACxE,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/media/[id].ts"],"sourcesContent":["/**\n * Single media item endpoint\n *\n * GET /_emdash/api/media/:id - Get media item\n * PUT /_emdash/api/media/:id - Update media metadata\n * DELETE /_emdash/api/media/:id - Delete media item\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { canReadMediaUsageCount, requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMediaUsageSummaries } from \"#api/handlers/media-usage.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { mediaGetQuery, mediaUpdateBody } from \"#api/schemas.js\";\nexport const prerender = false;\n\n/**\n * Get media item\n */\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tconst readDenied = requirePerm(user, \"media:read\");\n\tif (readDenied) return readDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst query = parseQuery(new URL(request.url), mediaGetQuery);\n\tif (isParseError(query)) return query;\n\n\tconst result = await emdash.handleMediaGet(id);\n\tif (!result.success || query.includeUsage !== \"1\") return unwrapResult(result);\n\n\tconst includeCount = canReadMediaUsageCount(user, locals.tokenScopes);\n\tconst usageResult = await handleMediaUsageSummaries(emdash.db, [id], { includeCount });\n\tif (!usageResult.success) return unwrapResult(usageResult);\n\tconst usage = usageResult.data[id];\n\tif (!usage) return apiError(\"MEDIA_USAGE_READ_ERROR\", \"Failed to read media usage\", 500);\n\n\treturn apiSuccess({ item: { ...result.data.item, usage } });\n};\n\n/**\n * Update media metadata\n *\n * Authors can edit their own media; editors+ can edit any.\n */\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst editDenied = requirePerm(user, \"media:edit_own\");\n\tif (editDenied) return editDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaUpdate) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can edit own, editors+ can edit any\n\t\tconst ownerDenied = requireOwnerPerm(user, media.authorId, \"media:edit_own\", \"media:edit_any\");\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\tconst body = await parseBody(request, mediaUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await emdash.handleMediaUpdate(id, {\n\t\t\talt: body.alt,\n\t\t\tcaption: body.caption,\n\t\t\twidth: body.width,\n\t\t\theight: body.height,\n\t\t\tfolderId: body.folderId,\n\t\t\tfocalX: body.focalX,\n\t\t\tfocalY: body.focalY,\n\t\t});\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update media\", \"MEDIA_UPDATE_ERROR\");\n\t}\n};\n\n/**\n * Delete media item\n *\n * Authors can delete their own media; editors+ can delete any.\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\t// Minimum permission gate — ownership checked below\n\tconst deleteDenied = requirePerm(user, \"media:delete_own\");\n\tif (deleteDenied) return deleteDenied;\n\n\tif (!id) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Media ID required\", 400);\n\t}\n\n\tif (!emdash?.handleMediaGet || !emdash?.handleMediaDelete) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fetch media item for ownership check and storage key\n\t\tconst getResult = await emdash.handleMediaGet(id);\n\t\tif (!getResult.success || !getResult.data?.item) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Media item not found\", 404);\n\t\t}\n\n\t\tconst media = getResult.data.item;\n\n\t\t// Ownership check: authors can delete own, editors+ can delete any\n\t\tconst ownerDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\tmedia.authorId,\n\t\t\t\"media:delete_own\",\n\t\t\t\"media:delete_any\",\n\t\t);\n\t\tif (ownerDenied) return ownerDenied;\n\n\t\t// Storage deletion and site-settings cache invalidation happen in\n\t\t// `EmDashRuntime.handleMediaDelete` so the MCP tool inherits them.\n\t\tconst result = await emdash.handleMediaDelete(id);\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (\n\t\t\ttypeof result.data !== \"object\" ||\n\t\t\tresult.data === null ||\n\t\t\t!(\"storageDeleted\" in result.data) ||\n\t\t\ttypeof result.data.storageDeleted !== \"boolean\"\n\t\t) {\n\t\t\treturn apiError(\"MEDIA_DELETE_ERROR\", \"Failed to delete media\", 500);\n\t\t}\n\n\t\treturn apiSuccess({ deleted: true, storageDeleted: result.data.storageDeleted });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete media\", \"MEDIA_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;;;;AAKzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAEf,MAAM,aAAa,YAAY,MAAM,aAAa;AAClD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,eACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,cAAc;AAC7D,KAAI,aAAa,MAAM,CAAE,QAAO;CAEhC,MAAM,SAAS,MAAM,OAAO,eAAe,GAAG;AAC9C,KAAI,CAAC,OAAO,WAAW,MAAM,iBAAiB,IAAK,QAAO,aAAa,OAAO;CAE9E,MAAM,eAAe,uBAAuB,MAAM,OAAO,YAAY;CACrE,MAAM,cAAc,MAAM,0BAA0B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;AACtF,KAAI,CAAC,YAAY,QAAS,QAAO,aAAa,YAAY;CAC1D,MAAM,QAAQ,YAAY,KAAK;AAC/B,KAAI,CAAC,MAAO,QAAO,SAAS,0BAA0B,8BAA8B,IAAI;AAExF,QAAO,WAAW,EAAE,MAAM;EAAE,GAAG,OAAO,KAAK;EAAM;EAAO,EAAE,CAAC;;;;;;;AAQ5D,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,aAAa,YAAY,MAAM,iBAAiB;AACtD,KAAI,WAAY,QAAO;AAEvB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBAAiB,MAAM,MAAM,UAAU,kBAAkB,iBAAiB;AAC9F,MAAI,YAAa,QAAO;EAExB,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,MAAI,aAAa,KAAK,CAAE,QAAO;AAY/B,SAAO,aAVQ,MAAM,OAAO,kBAAkB,IAAI;GACjD,KAAK,KAAK;GACV,SAAS,KAAK;GACd,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,QAAQ,KAAK;GACb,CAAC,CAEyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB;;;;;;;;AAS3E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;CAGf,MAAM,eAAe,YAAY,MAAM,mBAAmB;AAC1D,KAAI,aAAc,QAAO;AAEzB,KAAI,CAAC,GACJ,QAAO,SAAS,mBAAmB,qBAAqB,IAAI;AAG7D,KAAI,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,kBACvC,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAEH,MAAM,YAAY,MAAM,OAAO,eAAe,GAAG;AACjD,MAAI,CAAC,UAAU,WAAW,CAAC,UAAU,MAAM,KAC1C,QAAO,SAAS,aAAa,wBAAwB,IAAI;EAG1D,MAAM,QAAQ,UAAU,KAAK;EAG7B,MAAM,cAAc,iBACnB,MACA,MAAM,UACN,oBACA,mBACA;AACD,MAAI,YAAa,QAAO;EAIxB,MAAM,SAAS,MAAM,OAAO,kBAAkB,GAAG;AACjD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MACC,OAAO,OAAO,SAAS,YACvB,OAAO,SAAS,QAChB,EAAE,oBAAoB,OAAO,SAC7B,OAAO,OAAO,KAAK,mBAAmB,UAEtC,QAAO,SAAS,sBAAsB,0BAA0B,IAAI;AAGrE,SAAO,WAAW;GAAE,SAAS;GAAM,gBAAgB,OAAO,KAAK;GAAgB,CAAC;UACxE,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB"}

package/dist/astro/routes/api/media/asset/_id_/_filename_.mjs

@@ -1,10 +1,10 @@
 import "../../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../../types-D2NEXtgB.mjs";
-import { t as MediaRepository } from "../../../../../../media-Bws9f18T.mjs";
+import "../../../../../../types-DwhEvIVb.mjs";
+import { t as MediaRepository } from "../../../../../../media-DepNLhPq.mjs";
 import "../../../../../../errors-B4f4It-2.mjs";
-import "../../../../../../errors-BOYNdIo3.mjs";
-import { r as handleError, t as apiError } from "../../../../../../error-CVWeIOku.mjs";
-import { o as requirePerm } from "../../../../../../authorize-DPFBGbE6.mjs";
+import "../../../../../../errors-8gJqv-XV.mjs";
+import { r as handleError, t as apiError } from "../../../../../../error-BCMgPxdn.mjs";
+import { o as requirePerm } from "../../../../../../authorize-NJgp8kLI.mjs";
 
 //#region src/astro/routes/api/media/asset/[id]/[filename].ts
 const prerender = false;

package/dist/astro/routes/api/media/file/_...key_.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_...key_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"mappings":";;;cAmBa,SAAA;AAAA,cA4CA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"_...key_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"mappings":";;;cAqBa,SAAA;AAAA,cA4CA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/media/file/_...key_.mjs

@@ -1,16 +1,56 @@
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import { t as MediaRepository } from "../../../../../media-DepNLhPq.mjs";
 import "../../../../../errors-B4f4It-2.mjs";
 import "../../../../../canonical-BudtH-Fx.mjs";
-import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../errors-8gJqv-XV.mjs";
 import "../../../../../settings-Dd1uivmQ.mjs";
-import { r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
+import { r as handleError, t as apiError } from "../../../../../error-BCMgPxdn.mjs";
 import { n as resolveByteRange, t as parseRangeHeader } from "../../../../../range-CYfeXgGK.mjs";
 import { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL, isNotModified, validatorHeaders } from "../../../../../media/image-endpoint.mjs";
 import "../../../../../kinds-B_Qcl5pz.mjs";
 import "../../../../../paths-biDzFTY2.mjs";
 import { t as isRefusedStorageKey } from "../../../../../keys-CifIkT0N.mjs";
 
+//#region src/media/content-disposition.ts
+/**
+* Content-Disposition header construction for media downloads.
+*
+* The public media file route serves every non-inline type as an attachment.
+* Without a `filename` parameter the browser falls back to the last path
+* segment of the URL -- the storage key -- so a downloaded PDF lands in the
+* user's filesystem named after its ULID. These helpers build a header that
+* names the file the way the editor uploaded it.
+*/
+/**
+* Characters unsafe in a filename on one or more platforms, plus the quote and
+* backslash that would otherwise break out of the quoted `filename=` value.
+*/
+const UNSAFE_FILENAME_CHARS = /[\x00-\x1F\x7F"\\/<>:|?*]/g;
+/** Anything outside printable ASCII, carried by `filename*` instead. */
+const NON_ASCII = /[^\x20-\x7E]/g;
+/**
+* An ASCII-only, filesystem-safe rendering of `filename`, for the quoted
+* `filename=` parameter that older clients read.
+*/
+function toAsciiFilename(filename) {
+	const cleaned = filename.normalize("NFKD").replaceAll(UNSAFE_FILENAME_CHARS, "-").replaceAll(NON_ASCII, "").trim();
+	return cleaned.length > 0 ? cleaned : "download";
+}
+/**
+* Build a `Content-Disposition` value.
+*
+* Emits both `filename` (ASCII, quoted) and RFC 5987 `filename*` (UTF-8
+* percent-encoded) so a name with non-ASCII characters survives. Returns the
+* bare disposition when no filename is known, which is the pre-existing
+* behaviour for media with no database row.
+*/
+function contentDisposition(disposition, filename) {
+	if (!filename) return disposition;
+	return `${disposition}; filename="${toAsciiFilename(filename)}"; filename*=UTF-8''${encodeURIComponent(filename).replace(/['()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)}`;
+}
+
+//#endregion
 //#region src/astro/routes/api/media/file/[...key].ts
 const prerender = false;
 const MAX_KEY_DECODES = 3;
@@ -58,13 +98,14 @@ const GET = async ({ params, locals, request, cache }) => {
 	if (!key) return apiError("NOT_FOUND", "File not found", 404);
 	if (isPrivateMediaKey(key)) return apiError("NOT_FOUND", "File not found", 404);
 	if (!emdash?.storage) return apiError("NOT_CONFIGURED", "Storage not configured", 500);
+	let unusedBody;
 	try {
 		const range = request.headers.has("If-Range") ? null : parseRangeHeader(request.headers.get("Range"));
 		if (range && cache?.enabled) cache.set(false);
 		const result = range ? await emdash.storage.download(key, { range }) : await emdash.storage.download(key);
+		unusedBody = result.body;
 		const served = range ? result.range : void 0;
 		if (range && !served && result.size > 0 && !resolveByteRange(range, result.size)) {
-			await result.body.cancel().catch(() => void 0);
 			const response = apiError("RANGE_NOT_SATISFIABLE", "Range not satisfiable", 416);
 			response.headers.set("Content-Range", `bytes */${result.size}`);
 			return response;
@@ -86,25 +127,38 @@ const GET = async ({ params, locals, request, cache }) => {
 			"Content-Security-Policy": "sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'",
 			...validatorHeaders(result.size, result.lastModified)
 		};
-		if (SAFE_INLINE_TYPES.has(result.contentType)) headers["Content-Disposition"] = "inline";
-		else headers["Content-Disposition"] = "attachment";
+		const disposition = SAFE_INLINE_TYPES.has(result.contentType) ? "inline" : "attachment";
+		let filename = null;
+		if (disposition === "attachment") try {
+			filename = await new MediaRepository(emdash.db).findFilenameByStorageKey(key);
+		} catch {
+			filename = null;
+		}
+		headers["Content-Disposition"] = contentDisposition(disposition, filename);
+		const body = request.method === "HEAD" ? null : result.body;
 		if (served) {
 			const end = served.offset + served.length - 1;
 			headers["Content-Range"] = `bytes ${served.offset}-${end}/${result.size}`;
 			headers["Content-Length"] = String(served.length);
-			return new Response(result.body, {
+			const response = new Response(body, {
 				status: 206,
 				headers
 			});
+			if (body) unusedBody = void 0;
+			return response;
 		}
 		if (result.size) headers["Content-Length"] = String(result.size);
-		return new Response(result.body, {
+		const response = new Response(body, {
 			status: 200,
 			headers
 		});
+		if (body) unusedBody = void 0;
+		return response;
 	} catch (error) {
 		if (error instanceof Error && (error.message.includes("not found") || error.message.includes("NOT_FOUND"))) return apiError("NOT_FOUND", "File not found", 404);
 		return handleError(error, "Failed to serve file", "FILE_SERVE_ERROR");
+	} finally {
+		if (unusedBody && !unusedBody.locked) await unusedBody.cancel().catch(() => void 0);
 	}
 };
 

package/dist/astro/routes/api/media/file/_...key_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage, or a byte range of it\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport {\n\tIMMUTABLE_IMAGE_CACHE,\n\tMUTABLE_MEDIA_CACHE_CONTROL,\n\tisNotModified,\n\tvalidatorHeaders,\n} from \"#media/image-endpoint.js\";\n\nimport { parseRangeHeader, resolveByteRange } from \"../../../../../storage/range.js\";\nimport { isRefusedStorageKey } from \"../../../../../transfer/staging/keys.js\";\n\nexport const prerender = false;\n\nconst MAX_KEY_DECODES = 3;\n\n/**\n * Whether a key is, or percent-decodes to, a key this route must refuse.\n * Every decoding layer is checked because storage backends differ in whether\n * they decode keys; a key that is still encoded after the last layer, or\n * does not decode, is refused.\n */\nfunction isPrivateMediaKey(key: string): boolean {\n\tlet candidate = key;\n\tfor (let layer = 0; layer <= MAX_KEY_DECODES; layer++) {\n\t\tif (isRefusedStorageKey(candidate)) return true;\n\t\tlet decoded: string;\n\t\ttry {\n\t\t\tdecoded = decodeURIComponent(candidate);\n\t\t} catch {\n\t\t\treturn true;\n\t\t}\n\t\tif (decoded === candidate) return false;\n\t\tcandidate = decoded;\n\t}\n\treturn true;\n}\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals, request, cache }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\t// Backup archives and transfer staging share the storage bucket but hold\n\t// whole-site content; they must never be reachable through this public,\n\t// unauthenticated route.\n\tif (isPrivateMediaKey(key)) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\ttry {\n\t\t// Range requests that include If-Range are served as whole-file responses\n\t\t// because this route does not compare If-Range validators.\n\t\tconst range = request.headers.has(\"If-Range\")\n\t\t\t? null\n\t\t\t: parseRangeHeader(request.headers.get(\"Range\"));\n\t\t// The route cache keys entries by URL alone, so a cached partial\n\t\t// response would be served to requests for the whole file.\n\t\tif (range && cache?.enabled) cache.set(false);\n\t\tconst result = range\n\t\t\t? await emdash.storage.download(key, { range })\n\t\t\t: await emdash.storage.download(key);\n\t\tconst served = range ? result.range : undefined;\n\n\t\t// Adapters return the whole file for a range they don't serve, including\n\t\t// one past the end. A size of 0 may be unknown, so it rules nothing out.\n\t\tif (range && !served && result.size > 0 && !resolveByteRange(range, result.size)) {\n\t\t\tawait result.body.cancel().catch(() => undefined);\n\t\t\tconst response = apiError(\"RANGE_NOT_SATISFIABLE\", \"Range not satisfiable\", 416);\n\t\t\tresponse.headers.set(\"Content-Range\", `bytes */${result.size}`);\n\t\t\treturn response;\n\t\t}\n\n\t\tconst cacheControl = result.contentType.startsWith(\"image/\")\n\t\t\t? MUTABLE_MEDIA_CACHE_CONTROL\n\t\t\t: IMMUTABLE_IMAGE_CACHE;\n\n\t\tif (isNotModified(request, result.size, result.lastModified)) {\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 304,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\t\t\"Cache-Control\": cacheControl,\n\t\t\t\t\t...validatorHeaders(result.size, result.lastModified),\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": cacheControl,\n\t\t\t\"Accept-Ranges\": \"bytes\",\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t\t...validatorHeaders(result.size, result.lastModified),\n\t\t};\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tif (SAFE_INLINE_TYPES.has(result.contentType)) {\n\t\t\theaders[\"Content-Disposition\"] = \"inline\";\n\t\t} else {\n\t\t\theaders[\"Content-Disposition\"] = \"attachment\";\n\t\t}\n\n\t\tif (served) {\n\t\t\tconst end = served.offset + served.length - 1;\n\t\t\theaders[\"Content-Range\"] = `bytes ${served.offset}-${end}/${result.size}`;\n\t\t\theaders[\"Content-Length\"] = String(served.length);\n\t\t\treturn new Response(result.body, { status: 206, headers });\n\t\t}\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\treturn new Response(result.body, { status: 200, headers });\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAEzB,MAAM,kBAAkB;;;;;;;AAQxB,SAAS,kBAAkB,KAAsB;CAChD,IAAI,YAAY;AAChB,MAAK,IAAI,QAAQ,GAAG,SAAS,iBAAiB,SAAS;AACtD,MAAI,oBAAoB,UAAU,CAAE,QAAO;EAC3C,IAAI;AACJ,MAAI;AACH,aAAU,mBAAmB,UAAU;UAChC;AACP,UAAO;;AAER,MAAI,YAAY,UAAW,QAAO;AAClC,cAAY;;AAEb,QAAO;;;;;;AAOR,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,QAAQ,SAAS,YAAY;CAC1E,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAMpD,KAAI,kBAAkB,IAAI,CACzB,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;AAGjE,KAAI;EAGH,MAAM,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAC1C,OACA,iBAAiB,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAGjD,MAAI,SAAS,OAAO,QAAS,OAAM,IAAI,MAAM;EAC7C,MAAM,SAAS,QACZ,MAAM,OAAO,QAAQ,SAAS,KAAK,EAAE,OAAO,CAAC,GAC7C,MAAM,OAAO,QAAQ,SAAS,IAAI;EACrC,MAAM,SAAS,QAAQ,OAAO,QAAQ;AAItC,MAAI,SAAS,CAAC,UAAU,OAAO,OAAO,KAAK,CAAC,iBAAiB,OAAO,OAAO,KAAK,EAAE;AACjF,SAAM,OAAO,KAAK,QAAQ,CAAC,YAAY,OAAU;GACjD,MAAM,WAAW,SAAS,yBAAyB,yBAAyB,IAAI;AAChF,YAAS,QAAQ,IAAI,iBAAiB,WAAW,OAAO,OAAO;AAC/D,UAAO;;EAGR,MAAM,eAAe,OAAO,YAAY,WAAW,SAAS,GACzD,8BACA;AAEH,MAAI,cAAc,SAAS,OAAO,MAAM,OAAO,aAAa,CAC3D,QAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS;IACR,gBAAgB,OAAO;IACvB,iBAAiB;IACjB,GAAG,iBAAiB,OAAO,MAAM,OAAO,aAAa;IACrD;GACD,CAAC;EAGH,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB;GACjB,iBAAiB;GACjB,0BAA0B;GAG1B,2BACC;GACD,GAAG,iBAAiB,OAAO,MAAM,OAAO,aAAa;GACrD;AAID,MAAI,kBAAkB,IAAI,OAAO,YAAY,CAC5C,SAAQ,yBAAyB;MAEjC,SAAQ,yBAAyB;AAGlC,MAAI,QAAQ;GACX,MAAM,MAAM,OAAO,SAAS,OAAO,SAAS;AAC5C,WAAQ,mBAAmB,SAAS,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO;AACnE,WAAQ,oBAAoB,OAAO,OAAO,OAAO;AACjD,UAAO,IAAI,SAAS,OAAO,MAAM;IAAE,QAAQ;IAAK;IAAS,CAAC;;AAG3D,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;AAGhD,SAAO,IAAI,SAAS,OAAO,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;UAClD,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB"}
+{"version":3,"file":"_...key_.mjs","names":[],"sources":["../../../../../../src/media/content-disposition.ts","../../../../../../src/astro/routes/api/media/file/[...key].ts"],"sourcesContent":["/**\n * Content-Disposition header construction for media downloads.\n *\n * The public media file route serves every non-inline type as an attachment.\n * Without a `filename` parameter the browser falls back to the last path\n * segment of the URL -- the storage key -- so a downloaded PDF lands in the\n * user's filesystem named after its ULID. These helpers build a header that\n * names the file the way the editor uploaded it.\n */\n\n/**\n * Characters unsafe in a filename on one or more platforms, plus the quote and\n * backslash that would otherwise break out of the quoted `filename=` value.\n */\n// eslint-disable-next-line no-control-regex -- stripping control characters is the point\nconst UNSAFE_FILENAME_CHARS = /[\\x00-\\x1F\\x7F\"\\\\/<>:|?*]/g;\n\n/** Anything outside printable ASCII, carried by `filename*` instead. */\nconst NON_ASCII = /[^\\x20-\\x7E]/g;\n\n/**\n * An ASCII-only, filesystem-safe rendering of `filename`, for the quoted\n * `filename=` parameter that older clients read.\n */\nexport function toAsciiFilename(filename: string): string {\n\tconst cleaned = filename\n\t\t.normalize(\"NFKD\")\n\t\t.replaceAll(UNSAFE_FILENAME_CHARS, \"-\")\n\t\t.replaceAll(NON_ASCII, \"\")\n\t\t.trim();\n\treturn cleaned.length > 0 ? cleaned : \"download\";\n}\n\n/**\n * Build a `Content-Disposition` value.\n *\n * Emits both `filename` (ASCII, quoted) and RFC 5987 `filename*` (UTF-8\n * percent-encoded) so a name with non-ASCII characters survives. Returns the\n * bare disposition when no filename is known, which is the pre-existing\n * behaviour for media with no database row.\n */\nexport function contentDisposition(\n\tdisposition: \"inline\" | \"attachment\",\n\tfilename?: string | null,\n): string {\n\tif (!filename) return disposition;\n\tconst ascii = toAsciiFilename(filename);\n\t// encodeURIComponent leaves ' ( ) * unescaped, but RFC 5987 attr-char does\n\t// not allow them; a strict client would discard filename* and fall back to\n\t// the ASCII name. Percent-encode them too.\n\tconst encoded = encodeURIComponent(filename).replace(\n\t\t/['()*]/g,\n\t\t(c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n\t);\n\treturn `${disposition}; filename=\"${ascii}\"; filename*=UTF-8''${encoded}`;\n}\n","/**\n * Serve uploaded media files\n *\n * GET /_emdash/api/media/file/:key - Serve file from storage, or a byte range of it\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { MediaRepository } from \"#db/repositories/media.js\";\nimport { contentDisposition } from \"#media/content-disposition.js\";\nimport {\n\tIMMUTABLE_IMAGE_CACHE,\n\tMUTABLE_MEDIA_CACHE_CONTROL,\n\tisNotModified,\n\tvalidatorHeaders,\n} from \"#media/image-endpoint.js\";\n\nimport { parseRangeHeader, resolveByteRange } from \"../../../../../storage/range.js\";\nimport { isRefusedStorageKey } from \"../../../../../transfer/staging/keys.js\";\n\nexport const prerender = false;\n\nconst MAX_KEY_DECODES = 3;\n\n/**\n * Whether a key is, or percent-decodes to, a key this route must refuse.\n * Every decoding layer is checked because storage backends differ in whether\n * they decode keys; a key that is still encoded after the last layer, or\n * does not decode, is refused.\n */\nfunction isPrivateMediaKey(key: string): boolean {\n\tlet candidate = key;\n\tfor (let layer = 0; layer <= MAX_KEY_DECODES; layer++) {\n\t\tif (isRefusedStorageKey(candidate)) return true;\n\t\tlet decoded: string;\n\t\ttry {\n\t\t\tdecoded = decodeURIComponent(candidate);\n\t\t} catch {\n\t\t\treturn true;\n\t\t}\n\t\tif (decoded === candidate) return false;\n\t\tcandidate = decoded;\n\t}\n\treturn true;\n}\n\n/**\n * Content types that are safe to display inline (simple raster/vector images, video, audio).\n * Everything else gets Content-Disposition: attachment to prevent script execution.\n */\nconst SAFE_INLINE_TYPES = new Set([\n\t\"image/jpeg\",\n\t\"image/png\",\n\t\"image/gif\",\n\t\"image/webp\",\n\t\"image/avif\",\n\t\"image/x-icon\",\n\t\"video/mp4\",\n\t\"video/webm\",\n\t\"audio/mpeg\",\n\t\"audio/wav\",\n\t\"audio/ogg\",\n]);\n\nexport const GET: APIRoute = async ({ params, locals, request, cache }) => {\n\tconst { key } = params;\n\tconst { emdash } = locals;\n\n\tif (!key) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\t// Backup archives and transfer staging share the storage bucket but hold\n\t// whole-site content; they must never be reachable through this public,\n\t// unauthenticated route.\n\tif (isPrivateMediaKey(key)) {\n\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t}\n\n\tif (!emdash?.storage) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Storage not configured\", 500);\n\t}\n\n\t// An unread download retains its storage connection even for a bodyless response.\n\tlet unusedBody: ReadableStream<Uint8Array> | undefined;\n\ttry {\n\t\t// Range requests that include If-Range are served as whole-file responses\n\t\t// because this route does not compare If-Range validators.\n\t\tconst range = request.headers.has(\"If-Range\")\n\t\t\t? null\n\t\t\t: parseRangeHeader(request.headers.get(\"Range\"));\n\t\t// The route cache keys entries by URL alone, so a cached partial\n\t\t// response would be served to requests for the whole file.\n\t\tif (range && cache?.enabled) cache.set(false);\n\t\tconst result = range\n\t\t\t? await emdash.storage.download(key, { range })\n\t\t\t: await emdash.storage.download(key);\n\t\tunusedBody = result.body;\n\t\tconst served = range ? result.range : undefined;\n\n\t\t// Adapters return the whole file for a range they don't serve, including\n\t\t// one past the end. A size of 0 may be unknown, so it rules nothing out.\n\t\tif (range && !served && result.size > 0 && !resolveByteRange(range, result.size)) {\n\t\t\tconst response = apiError(\"RANGE_NOT_SATISFIABLE\", \"Range not satisfiable\", 416);\n\t\t\tresponse.headers.set(\"Content-Range\", `bytes */${result.size}`);\n\t\t\treturn response;\n\t\t}\n\n\t\tconst cacheControl = result.contentType.startsWith(\"image/\")\n\t\t\t? MUTABLE_MEDIA_CACHE_CONTROL\n\t\t\t: IMMUTABLE_IMAGE_CACHE;\n\n\t\tif (isNotModified(request, result.size, result.lastModified)) {\n\t\t\treturn new Response(null, {\n\t\t\t\tstatus: 304,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\t\t\"Cache-Control\": cacheControl,\n\t\t\t\t\t...validatorHeaders(result.size, result.lastModified),\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t\"Content-Type\": result.contentType,\n\t\t\t\"Cache-Control\": cacheControl,\n\t\t\t\"Accept-Ranges\": \"bytes\",\n\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t// Sandbox CSP on all user-uploaded content — prevents script execution\n\t\t\t// even for SVGs navigated to directly or content types that support scripting.\n\t\t\t\"Content-Security-Policy\":\n\t\t\t\t\"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'\",\n\t\t\t...validatorHeaders(result.size, result.lastModified),\n\t\t};\n\n\t\t// Safe image/media types can render inline; everything else (SVG, PDF,\n\t\t// HTML, JS, etc.) must be downloaded to prevent stored XSS.\n\t\tconst disposition = SAFE_INLINE_TYPES.has(result.contentType) ? \"inline\" : \"attachment\";\n\n\t\t// Name the download after the uploaded filename. Without this the\n\t\t// browser falls back to the last path segment of the URL -- the storage\n\t\t// key -- and every downloaded document is named after its ULID.\n\t\t// Skipped for inline types, where no filename is shown to anyone.\n\t\tlet filename: string | null = null;\n\t\tif (disposition === \"attachment\") {\n\t\t\t// A failed lookup must not fail the download: naming the file is a\n\t\t\t// nicety, and media with no row is served under the bare disposition.\n\t\t\ttry {\n\t\t\t\tfilename = await new MediaRepository(emdash.db).findFilenameByStorageKey(key);\n\t\t\t} catch {\n\t\t\t\tfilename = null;\n\t\t\t}\n\t\t}\n\t\theaders[\"Content-Disposition\"] = contentDisposition(disposition, filename);\n\n\t\tconst body = request.method === \"HEAD\" ? null : result.body;\n\n\t\tif (served) {\n\t\t\tconst end = served.offset + served.length - 1;\n\t\t\theaders[\"Content-Range\"] = `bytes ${served.offset}-${end}/${result.size}`;\n\t\t\theaders[\"Content-Length\"] = String(served.length);\n\t\t\tconst response = new Response(body, { status: 206, headers });\n\t\t\tif (body) unusedBody = undefined;\n\t\t\treturn response;\n\t\t}\n\n\t\tif (result.size) {\n\t\t\theaders[\"Content-Length\"] = String(result.size);\n\t\t}\n\n\t\tconst response = new Response(body, { status: 200, headers });\n\t\tif (body) unusedBody = undefined;\n\t\treturn response;\n\t} catch (error) {\n\t\t// Check if it's a \"not found\" error\n\t\tif (\n\t\t\terror instanceof Error &&\n\t\t\t(error.message.includes(\"not found\") || error.message.includes(\"NOT_FOUND\"))\n\t\t) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"File not found\", 404);\n\t\t}\n\t\treturn handleError(error, \"Failed to serve file\", \"FILE_SERVE_ERROR\");\n\t} finally {\n\t\tif (unusedBody && !unusedBody.locked) await unusedBody.cancel().catch(() => undefined);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAM,wBAAwB;;AAG9B,MAAM,YAAY;;;;;AAMlB,SAAgB,gBAAgB,UAA0B;CACzD,MAAM,UAAU,SACd,UAAU,OAAO,CACjB,WAAW,uBAAuB,IAAI,CACtC,WAAW,WAAW,GAAG,CACzB,MAAM;AACR,QAAO,QAAQ,SAAS,IAAI,UAAU;;;;;;;;;;AAWvC,SAAgB,mBACf,aACA,UACS;AACT,KAAI,CAAC,SAAU,QAAO;AAStB,QAAO,GAAG,YAAY,cARR,gBAAgB,SAAS,CAQG,sBAJ1B,mBAAmB,SAAS,CAAC,QAC5C,YACC,MAAM,IAAI,EAAE,WAAW,EAAE,CAAC,SAAS,GAAG,CAAC,aAAa,GACrD;;;;;AChCF,MAAa,YAAY;AAEzB,MAAM,kBAAkB;;;;;;;AAQxB,SAAS,kBAAkB,KAAsB;CAChD,IAAI,YAAY;AAChB,MAAK,IAAI,QAAQ,GAAG,SAAS,iBAAiB,SAAS;AACtD,MAAI,oBAAoB,UAAU,CAAE,QAAO;EAC3C,IAAI;AACJ,MAAI;AACH,aAAU,mBAAmB,UAAU;UAChC;AACP,UAAO;;AAER,MAAI,YAAY,UAAW,QAAO;AAClC,cAAY;;AAEb,QAAO;;;;;;AAOR,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,MAAa,MAAgB,OAAO,EAAE,QAAQ,QAAQ,SAAS,YAAY;CAC1E,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,IACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAMpD,KAAI,kBAAkB,IAAI,CACzB,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAGpD,KAAI,CAAC,QAAQ,QACZ,QAAO,SAAS,kBAAkB,0BAA0B,IAAI;CAIjE,IAAI;AACJ,KAAI;EAGH,MAAM,QAAQ,QAAQ,QAAQ,IAAI,WAAW,GAC1C,OACA,iBAAiB,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAGjD,MAAI,SAAS,OAAO,QAAS,OAAM,IAAI,MAAM;EAC7C,MAAM,SAAS,QACZ,MAAM,OAAO,QAAQ,SAAS,KAAK,EAAE,OAAO,CAAC,GAC7C,MAAM,OAAO,QAAQ,SAAS,IAAI;AACrC,eAAa,OAAO;EACpB,MAAM,SAAS,QAAQ,OAAO,QAAQ;AAItC,MAAI,SAAS,CAAC,UAAU,OAAO,OAAO,KAAK,CAAC,iBAAiB,OAAO,OAAO,KAAK,EAAE;GACjF,MAAM,WAAW,SAAS,yBAAyB,yBAAyB,IAAI;AAChF,YAAS,QAAQ,IAAI,iBAAiB,WAAW,OAAO,OAAO;AAC/D,UAAO;;EAGR,MAAM,eAAe,OAAO,YAAY,WAAW,SAAS,GACzD,8BACA;AAEH,MAAI,cAAc,SAAS,OAAO,MAAM,OAAO,aAAa,CAC3D,QAAO,IAAI,SAAS,MAAM;GACzB,QAAQ;GACR,SAAS;IACR,gBAAgB,OAAO;IACvB,iBAAiB;IACjB,GAAG,iBAAiB,OAAO,MAAM,OAAO,aAAa;IACrD;GACD,CAAC;EAGH,MAAM,UAAkC;GACvC,gBAAgB,OAAO;GACvB,iBAAiB;GACjB,iBAAiB;GACjB,0BAA0B;GAG1B,2BACC;GACD,GAAG,iBAAiB,OAAO,MAAM,OAAO,aAAa;GACrD;EAID,MAAM,cAAc,kBAAkB,IAAI,OAAO,YAAY,GAAG,WAAW;EAM3E,IAAI,WAA0B;AAC9B,MAAI,gBAAgB,aAGnB,KAAI;AACH,cAAW,MAAM,IAAI,gBAAgB,OAAO,GAAG,CAAC,yBAAyB,IAAI;UACtE;AACP,cAAW;;AAGb,UAAQ,yBAAyB,mBAAmB,aAAa,SAAS;EAE1E,MAAM,OAAO,QAAQ,WAAW,SAAS,OAAO,OAAO;AAEvD,MAAI,QAAQ;GACX,MAAM,MAAM,OAAO,SAAS,OAAO,SAAS;AAC5C,WAAQ,mBAAmB,SAAS,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO;AACnE,WAAQ,oBAAoB,OAAO,OAAO,OAAO;GACjD,MAAM,WAAW,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK;IAAS,CAAC;AAC7D,OAAI,KAAM,cAAa;AACvB,UAAO;;AAGR,MAAI,OAAO,KACV,SAAQ,oBAAoB,OAAO,OAAO,KAAK;EAGhD,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK;GAAS,CAAC;AAC7D,MAAI,KAAM,cAAa;AACvB,SAAO;UACC,OAAO;AAEf,MACC,iBAAiB,UAChB,MAAM,QAAQ,SAAS,YAAY,IAAI,MAAM,QAAQ,SAAS,YAAY,EAE3E,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAEpD,SAAO,YAAY,OAAO,wBAAwB,mBAAmB;WAC5D;AACT,MAAI,cAAc,CAAC,WAAW,OAAQ,OAAM,WAAW,QAAQ,CAAC,YAAY,OAAU"}

package/dist/astro/routes/api/media/folders/_id_.mjs

@@ -1,23 +1,23 @@
-import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../config-Cs_AwWXI.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../url-DTfGDJhI.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
 import "../../../../../errors-B4f4It-2.mjs";
-import "../../../../../errors-BOYNdIo3.mjs";
-import { a as handleMediaFolderUpdate, n as handleMediaFolderDelete, r as handleMediaFolderGet } from "../../../../../media-folders-Dn3C16B8.mjs";
+import "../../../../../errors-8gJqv-XV.mjs";
+import { a as handleMediaFolderUpdate, n as handleMediaFolderDelete, r as handleMediaFolderGet } from "../../../../../media-folders-CI0Wydfo.mjs";
 import "../../../../../settings-Dd1uivmQ.mjs";
 import "../../../../../site-settings-DRHfX7bq.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CVWeIOku.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
-import "../../../../../redirects-BEVSRMa2.mjs";
-import "../../../../../entry-lock-Df6-XhIu.mjs";
-import { c as mediaFolderBody, l as mediaFolderIdSchema } from "../../../../../media-1WC65OCB.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-BCMgPxdn.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-B_b6gZxG.mjs";
+import "../../../../../redirects-CyvvZrCJ.mjs";
+import "../../../../../entry-lock-CRVmruM0.mjs";
+import { c as mediaFolderBody, l as mediaFolderIdSchema } from "../../../../../media-BR4_t-Wd.mjs";
 import "../../../../../comments-yiRFx3w5.mjs";
-import "../../../../../byline-fields-BLXZnX7N.mjs";
-import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../byline-fields-CiR8FvvF.mjs";
+import "../../../../../menus-uEAxWAm1.mjs";
 import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { o as requirePerm } from "../../../../../authorize-DPFBGbE6.mjs";
+import { o as requirePerm } from "../../../../../authorize-NJgp8kLI.mjs";
 
 //#region src/astro/routes/api/media/folders/[id].ts
 const prerender = false;

package/dist/astro/routes/api/media/folders/index.mjs

@@ -1,23 +1,23 @@
-import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../config-Cs_AwWXI.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../url-DTfGDJhI.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
 import "../../../../../errors-B4f4It-2.mjs";
-import "../../../../../errors-BOYNdIo3.mjs";
-import { i as handleMediaFolderList, t as handleMediaFolderCreate } from "../../../../../media-folders-Dn3C16B8.mjs";
+import "../../../../../errors-8gJqv-XV.mjs";
+import { i as handleMediaFolderList, t as handleMediaFolderCreate } from "../../../../../media-folders-CI0Wydfo.mjs";
 import "../../../../../settings-Dd1uivmQ.mjs";
 import "../../../../../site-settings-DRHfX7bq.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CVWeIOku.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
-import "../../../../../redirects-BEVSRMa2.mjs";
-import "../../../../../entry-lock-Df6-XhIu.mjs";
-import { c as mediaFolderBody, u as mediaFolderListQuery } from "../../../../../media-1WC65OCB.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-BCMgPxdn.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-B_b6gZxG.mjs";
+import "../../../../../redirects-CyvvZrCJ.mjs";
+import "../../../../../entry-lock-CRVmruM0.mjs";
+import { c as mediaFolderBody, u as mediaFolderListQuery } from "../../../../../media-BR4_t-Wd.mjs";
 import "../../../../../comments-yiRFx3w5.mjs";
-import "../../../../../byline-fields-BLXZnX7N.mjs";
-import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../byline-fields-CiR8FvvF.mjs";
+import "../../../../../menus-uEAxWAm1.mjs";
 import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { o as requirePerm } from "../../../../../authorize-DPFBGbE6.mjs";
+import { o as requirePerm } from "../../../../../authorize-NJgp8kLI.mjs";
 
 //#region src/astro/routes/api/media/folders/index.ts
 const prerender = false;

package/dist/astro/routes/api/media/providers/_providerId_/_itemId_.mjs

@@ -1,9 +1,9 @@
 import "../../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../../types-D2NEXtgB.mjs";
+import "../../../../../../types-DwhEvIVb.mjs";
 import "../../../../../../errors-B4f4It-2.mjs";
-import "../../../../../../errors-BOYNdIo3.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CVWeIOku.mjs";
-import { o as requirePerm } from "../../../../../../authorize-DPFBGbE6.mjs";
+import "../../../../../../errors-8gJqv-XV.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BCMgPxdn.mjs";
+import { o as requirePerm } from "../../../../../../authorize-NJgp8kLI.mjs";
 
 //#region src/astro/routes/api/media/providers/[providerId]/[itemId].ts
 const prerender = false;