next-blogpanel 1.0.0

package/dist/api/categories.cjs

@@ -0,0 +1,82 @@
+'use strict';
+
+var chunkV7QPRX4A_cjs = require('../chunk-V7QPRX4A.cjs');
+var chunkDWNMHQ4I_cjs = require('../chunk-DWNMHQ4I.cjs');
+var chunkXLYTATRQ_cjs = require('../chunk-XLYTATRQ.cjs');
+
+// src/api/categories.ts
+async function GET(request) {
+  try {
+    const params = chunkDWNMHQ4I_cjs.getSearchParams(request);
+    if (params.slug) {
+      const category = await chunkXLYTATRQ_cjs.getCategoryBySlug(params.slug);
+      if (!category) return chunkDWNMHQ4I_cjs.jsonError("NOT_FOUND", "Category not found", 404);
+      return chunkDWNMHQ4I_cjs.jsonSuccess(category);
+    }
+    const categories = await chunkXLYTATRQ_cjs.listCategories();
+    return chunkDWNMHQ4I_cjs.jsonSuccess(categories);
+  } catch (error) {
+    console.error("[blogpanel] GET /categories error:", error);
+    return chunkDWNMHQ4I_cjs.jsonError("INTERNAL_ERROR", "Failed to fetch categories", 500);
+  }
+}
+async function POST(request) {
+  try {
+    const authError = await chunkDWNMHQ4I_cjs.requireAuth(request);
+    if (authError) return authError;
+    const body = await request.json();
+    const parsed = chunkV7QPRX4A_cjs.CreateCategorySchema.safeParse(body);
+    if (!parsed.success) {
+      const errors = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+      return chunkDWNMHQ4I_cjs.jsonError("VALIDATION_ERROR", errors.join("; "));
+    }
+    const category = await chunkXLYTATRQ_cjs.createCategory(parsed.data);
+    return chunkDWNMHQ4I_cjs.jsonSuccess(category, void 0, 201);
+  } catch (error) {
+    console.error("[blogpanel] POST /categories error:", error);
+    return chunkDWNMHQ4I_cjs.jsonError("INTERNAL_ERROR", "Failed to create category", 500);
+  }
+}
+async function PUT(request) {
+  try {
+    const authError = await chunkDWNMHQ4I_cjs.requireAuth(request);
+    if (authError) return authError;
+    const params = chunkDWNMHQ4I_cjs.getSearchParams(request);
+    const id = params.id;
+    if (!id) return chunkDWNMHQ4I_cjs.jsonError("MISSING_ID", "Category ID is required");
+    const body = await request.json();
+    const parsed = chunkV7QPRX4A_cjs.UpdateCategorySchema.safeParse(body);
+    if (!parsed.success) {
+      const errors = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+      return chunkDWNMHQ4I_cjs.jsonError("VALIDATION_ERROR", errors.join("; "));
+    }
+    const category = await chunkXLYTATRQ_cjs.updateCategory(id, parsed.data);
+    if (!category) return chunkDWNMHQ4I_cjs.jsonError("NOT_FOUND", "Category not found", 404);
+    return chunkDWNMHQ4I_cjs.jsonSuccess(category);
+  } catch (error) {
+    console.error("[blogpanel] PUT /categories error:", error);
+    return chunkDWNMHQ4I_cjs.jsonError("INTERNAL_ERROR", "Failed to update category", 500);
+  }
+}
+async function DELETE(request) {
+  try {
+    const authError = await chunkDWNMHQ4I_cjs.requireAuth(request);
+    if (authError) return authError;
+    const params = chunkDWNMHQ4I_cjs.getSearchParams(request);
+    const id = params.id;
+    if (!id) return chunkDWNMHQ4I_cjs.jsonError("MISSING_ID", "Category ID is required");
+    const deleted = await chunkXLYTATRQ_cjs.deleteCategory(id);
+    if (!deleted) return chunkDWNMHQ4I_cjs.jsonError("NOT_FOUND", "Category not found", 404);
+    return chunkDWNMHQ4I_cjs.jsonSuccess({ deleted: true });
+  } catch (error) {
+    console.error("[blogpanel] DELETE /categories error:", error);
+    return chunkDWNMHQ4I_cjs.jsonError("INTERNAL_ERROR", "Failed to delete category", 500);
+  }
+}
+
+exports.DELETE = DELETE;
+exports.GET = GET;
+exports.POST = POST;
+exports.PUT = PUT;
+//# sourceMappingURL=categories.cjs.map
+//# sourceMappingURL=categories.cjs.map

package/dist/api/categories.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/categories.ts"],"names":["getSearchParams","getCategoryBySlug","jsonError","jsonSuccess","listCategories","requireAuth","CreateCategorySchema","createCategory","UpdateCategorySchema","updateCategory","deleteCategory"],"mappings":";;;;;;;AAUA,eAAsB,IAAI,OAAA,EAAkB;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAASA,kCAAgB,OAAO,CAAA;AAEtC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,MAAM,QAAA,GAAW,MAAMC,mCAAA,CAAkB,MAAA,CAAO,IAAI,CAAA;AACpD,MAAA,IAAI,CAAC,QAAA,EAAU,OAAOC,2BAAA,CAAU,WAAA,EAAa,sBAAsB,GAAG,CAAA;AACtE,MAAA,OAAOC,8BAAY,QAAQ,CAAA;AAAA,IAC7B;AAEA,IAAA,MAAM,UAAA,GAAa,MAAMC,gCAAA,EAAe;AACxC,IAAA,OAAOD,8BAAY,UAAU,CAAA;AAAA,EAC/B,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,sCAAsC,KAAK,CAAA;AACzD,IAAA,OAAOD,2BAAA,CAAU,gBAAA,EAAkB,4BAAA,EAA8B,GAAG,CAAA;AAAA,EACtE;AACF;AAEA,eAAsB,KAAK,OAAA,EAAkB;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAMG,6BAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,IAAA,MAAM,MAAA,GAASC,sCAAA,CAAqB,SAAA,CAAU,IAAI,CAAA;AAElD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACjF,MAAA,OAAOJ,2BAAA,CAAU,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAMK,gCAAA,CAAe,MAAA,CAAO,IAAI,CAAA;AACjD,IAAA,OAAOJ,6BAAA,CAAY,QAAA,EAAU,KAAA,CAAA,EAAW,GAAG,CAAA;AAAA,EAC7C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,KAAK,CAAA;AAC1D,IAAA,OAAOD,2BAAA,CAAU,gBAAA,EAAkB,2BAAA,EAA6B,GAAG,CAAA;AAAA,EACrE;AACF;AAEA,eAAsB,IAAI,OAAA,EAAkB;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAMG,6BAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,MAAA,GAASL,kCAAgB,OAAO,CAAA;AACtC,IAAA,MAAM,KAAK,MAAA,CAAO,EAAA;AAClB,IAAA,IAAI,CAAC,EAAA,EAAI,OAAOE,2BAAA,CAAU,cAAc,yBAAyB,CAAA;AAEjE,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,IAAA,MAAM,MAAA,GAASM,sCAAA,CAAqB,SAAA,CAAU,IAAI,CAAA;AAElD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACjF,MAAA,OAAON,2BAAA,CAAU,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAMO,gCAAA,CAAe,EAAA,EAAI,OAAO,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,QAAA,EAAU,OAAOP,2BAAA,CAAU,WAAA,EAAa,sBAAsB,GAAG,CAAA;AAEtE,IAAA,OAAOC,8BAAY,QAAQ,CAAA;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,sCAAsC,KAAK,CAAA;AACzD,IAAA,OAAOD,2BAAA,CAAU,gBAAA,EAAkB,2BAAA,EAA6B,GAAG,CAAA;AAAA,EACrE;AACF;AAEA,eAAsB,OAAO,OAAA,EAAkB;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAMG,6BAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,MAAA,GAASL,kCAAgB,OAAO,CAAA;AACtC,IAAA,MAAM,KAAK,MAAA,CAAO,EAAA;AAClB,IAAA,IAAI,CAAC,EAAA,EAAI,OAAOE,2BAAA,CAAU,cAAc,yBAAyB,CAAA;AAEjE,IAAA,MAAM,OAAA,GAAU,MAAMQ,gCAAA,CAAe,EAAE,CAAA;AACvC,IAAA,IAAI,CAAC,OAAA,EAAS,OAAOR,2BAAA,CAAU,WAAA,EAAa,sBAAsB,GAAG,CAAA;AAErE,IAAA,OAAOC,6BAAA,CAAY,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA;AAAA,EACtC,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,yCAAyC,KAAK,CAAA;AAC5D,IAAA,OAAOD,2BAAA,CAAU,gBAAA,EAAkB,2BAAA,EAA6B,GAAG,CAAA;AAAA,EACrE;AACF","file":"categories.cjs","sourcesContent":["import {\n  listCategories,\n  getCategoryBySlug,\n  createCategory,\n  updateCategory,\n  deleteCategory,\n} from '../lib/db';\nimport { CreateCategorySchema, UpdateCategorySchema } from '../lib/types';\nimport { jsonSuccess, jsonError, requireAuth, getSearchParams } from './middleware';\n\nexport async function GET(request: Request) {\n  try {\n    const params = getSearchParams(request);\n\n    if (params.slug) {\n      const category = await getCategoryBySlug(params.slug);\n      if (!category) return jsonError('NOT_FOUND', 'Category not found', 404);\n      return jsonSuccess(category);\n    }\n\n    const categories = await listCategories();\n    return jsonSuccess(categories);\n  } catch (error) {\n    console.error('[blogpanel] GET /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to fetch categories', 500);\n  }\n}\n\nexport async function POST(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const body = await request.json();\n    const parsed = CreateCategorySchema.safeParse(body);\n\n    if (!parsed.success) {\n      const errors = parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`);\n      return jsonError('VALIDATION_ERROR', errors.join('; '));\n    }\n\n    const category = await createCategory(parsed.data);\n    return jsonSuccess(category, undefined, 201);\n  } catch (error) {\n    console.error('[blogpanel] POST /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to create category', 500);\n  }\n}\n\nexport async function PUT(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const params = getSearchParams(request);\n    const id = params.id;\n    if (!id) return jsonError('MISSING_ID', 'Category ID is required');\n\n    const body = await request.json();\n    const parsed = UpdateCategorySchema.safeParse(body);\n\n    if (!parsed.success) {\n      const errors = parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`);\n      return jsonError('VALIDATION_ERROR', errors.join('; '));\n    }\n\n    const category = await updateCategory(id, parsed.data);\n    if (!category) return jsonError('NOT_FOUND', 'Category not found', 404);\n\n    return jsonSuccess(category);\n  } catch (error) {\n    console.error('[blogpanel] PUT /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to update category', 500);\n  }\n}\n\nexport async function DELETE(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const params = getSearchParams(request);\n    const id = params.id;\n    if (!id) return jsonError('MISSING_ID', 'Category ID is required');\n\n    const deleted = await deleteCategory(id);\n    if (!deleted) return jsonError('NOT_FOUND', 'Category not found', 404);\n\n    return jsonSuccess({ deleted: true });\n  } catch (error) {\n    console.error('[blogpanel] DELETE /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to delete category', 500);\n  }\n}\n"]}

package/dist/api/categories.d.cts

@@ -0,0 +1,27 @@
+import * as next_server from 'next/server';
+import { A as ApiErrorResponse } from '../types-CgrBuig-.cjs';
+import 'zod';
+import 'mongodb';
+
+declare function GET(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function POST(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function PUT(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function DELETE(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+
+export { DELETE, GET, POST, PUT };

package/dist/api/categories.d.ts

@@ -0,0 +1,27 @@
+import * as next_server from 'next/server';
+import { A as ApiErrorResponse } from '../types-CgrBuig-.js';
+import 'zod';
+import 'mongodb';
+
+declare function GET(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function POST(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function PUT(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function DELETE(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+
+export { DELETE, GET, POST, PUT };

package/dist/api/categories.js

@@ -0,0 +1,77 @@
+import { CreateCategorySchema, UpdateCategorySchema } from '../chunk-QLBTOCT3.js';
+import { getSearchParams, jsonError, jsonSuccess, requireAuth } from '../chunk-JBP3G4QJ.js';
+import { getCategoryBySlug, listCategories, createCategory, updateCategory, deleteCategory } from '../chunk-6PZ772NQ.js';
+
+// src/api/categories.ts
+async function GET(request) {
+  try {
+    const params = getSearchParams(request);
+    if (params.slug) {
+      const category = await getCategoryBySlug(params.slug);
+      if (!category) return jsonError("NOT_FOUND", "Category not found", 404);
+      return jsonSuccess(category);
+    }
+    const categories = await listCategories();
+    return jsonSuccess(categories);
+  } catch (error) {
+    console.error("[blogpanel] GET /categories error:", error);
+    return jsonError("INTERNAL_ERROR", "Failed to fetch categories", 500);
+  }
+}
+async function POST(request) {
+  try {
+    const authError = await requireAuth(request);
+    if (authError) return authError;
+    const body = await request.json();
+    const parsed = CreateCategorySchema.safeParse(body);
+    if (!parsed.success) {
+      const errors = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+      return jsonError("VALIDATION_ERROR", errors.join("; "));
+    }
+    const category = await createCategory(parsed.data);
+    return jsonSuccess(category, void 0, 201);
+  } catch (error) {
+    console.error("[blogpanel] POST /categories error:", error);
+    return jsonError("INTERNAL_ERROR", "Failed to create category", 500);
+  }
+}
+async function PUT(request) {
+  try {
+    const authError = await requireAuth(request);
+    if (authError) return authError;
+    const params = getSearchParams(request);
+    const id = params.id;
+    if (!id) return jsonError("MISSING_ID", "Category ID is required");
+    const body = await request.json();
+    const parsed = UpdateCategorySchema.safeParse(body);
+    if (!parsed.success) {
+      const errors = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+      return jsonError("VALIDATION_ERROR", errors.join("; "));
+    }
+    const category = await updateCategory(id, parsed.data);
+    if (!category) return jsonError("NOT_FOUND", "Category not found", 404);
+    return jsonSuccess(category);
+  } catch (error) {
+    console.error("[blogpanel] PUT /categories error:", error);
+    return jsonError("INTERNAL_ERROR", "Failed to update category", 500);
+  }
+}
+async function DELETE(request) {
+  try {
+    const authError = await requireAuth(request);
+    if (authError) return authError;
+    const params = getSearchParams(request);
+    const id = params.id;
+    if (!id) return jsonError("MISSING_ID", "Category ID is required");
+    const deleted = await deleteCategory(id);
+    if (!deleted) return jsonError("NOT_FOUND", "Category not found", 404);
+    return jsonSuccess({ deleted: true });
+  } catch (error) {
+    console.error("[blogpanel] DELETE /categories error:", error);
+    return jsonError("INTERNAL_ERROR", "Failed to delete category", 500);
+  }
+}
+
+export { DELETE, GET, POST, PUT };
+//# sourceMappingURL=categories.js.map
+//# sourceMappingURL=categories.js.map

package/dist/api/categories.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/categories.ts"],"names":[],"mappings":";;;;;AAUA,eAAsB,IAAI,OAAA,EAAkB;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AAEtC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB,MAAA,CAAO,IAAI,CAAA;AACpD,MAAA,IAAI,CAAC,QAAA,EAAU,OAAO,SAAA,CAAU,WAAA,EAAa,sBAAsB,GAAG,CAAA;AACtE,MAAA,OAAO,YAAY,QAAQ,CAAA;AAAA,IAC7B;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AACxC,IAAA,OAAO,YAAY,UAAU,CAAA;AAAA,EAC/B,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,sCAAsC,KAAK,CAAA;AACzD,IAAA,OAAO,SAAA,CAAU,gBAAA,EAAkB,4BAAA,EAA8B,GAAG,CAAA;AAAA,EACtE;AACF;AAEA,eAAsB,KAAK,OAAA,EAAkB;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,WAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,SAAA,CAAU,IAAI,CAAA;AAElD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACjF,MAAA,OAAO,SAAA,CAAU,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,MAAA,CAAO,IAAI,CAAA;AACjD,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,KAAA,CAAA,EAAW,GAAG,CAAA;AAAA,EAC7C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,KAAK,CAAA;AAC1D,IAAA,OAAO,SAAA,CAAU,gBAAA,EAAkB,2BAAA,EAA6B,GAAG,CAAA;AAAA,EACrE;AACF;AAEA,eAAsB,IAAI,OAAA,EAAkB;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,WAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AACtC,IAAA,MAAM,KAAK,MAAA,CAAO,EAAA;AAClB,IAAA,IAAI,CAAC,EAAA,EAAI,OAAO,SAAA,CAAU,cAAc,yBAAyB,CAAA;AAEjE,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,SAAA,CAAU,IAAI,CAAA;AAElD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACjF,MAAA,OAAO,SAAA,CAAU,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,EAAA,EAAI,OAAO,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,SAAA,CAAU,WAAA,EAAa,sBAAsB,GAAG,CAAA;AAEtE,IAAA,OAAO,YAAY,QAAQ,CAAA;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,sCAAsC,KAAK,CAAA;AACzD,IAAA,OAAO,SAAA,CAAU,gBAAA,EAAkB,2BAAA,EAA6B,GAAG,CAAA;AAAA,EACrE;AACF;AAEA,eAAsB,OAAO,OAAA,EAAkB;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,WAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AACtC,IAAA,MAAM,KAAK,MAAA,CAAO,EAAA;AAClB,IAAA,IAAI,CAAC,EAAA,EAAI,OAAO,SAAA,CAAU,cAAc,yBAAyB,CAAA;AAEjE,IAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,EAAE,CAAA;AACvC,IAAA,IAAI,CAAC,OAAA,EAAS,OAAO,SAAA,CAAU,WAAA,EAAa,sBAAsB,GAAG,CAAA;AAErE,IAAA,OAAO,WAAA,CAAY,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA;AAAA,EACtC,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,yCAAyC,KAAK,CAAA;AAC5D,IAAA,OAAO,SAAA,CAAU,gBAAA,EAAkB,2BAAA,EAA6B,GAAG,CAAA;AAAA,EACrE;AACF","file":"categories.js","sourcesContent":["import {\n  listCategories,\n  getCategoryBySlug,\n  createCategory,\n  updateCategory,\n  deleteCategory,\n} from '../lib/db';\nimport { CreateCategorySchema, UpdateCategorySchema } from '../lib/types';\nimport { jsonSuccess, jsonError, requireAuth, getSearchParams } from './middleware';\n\nexport async function GET(request: Request) {\n  try {\n    const params = getSearchParams(request);\n\n    if (params.slug) {\n      const category = await getCategoryBySlug(params.slug);\n      if (!category) return jsonError('NOT_FOUND', 'Category not found', 404);\n      return jsonSuccess(category);\n    }\n\n    const categories = await listCategories();\n    return jsonSuccess(categories);\n  } catch (error) {\n    console.error('[blogpanel] GET /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to fetch categories', 500);\n  }\n}\n\nexport async function POST(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const body = await request.json();\n    const parsed = CreateCategorySchema.safeParse(body);\n\n    if (!parsed.success) {\n      const errors = parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`);\n      return jsonError('VALIDATION_ERROR', errors.join('; '));\n    }\n\n    const category = await createCategory(parsed.data);\n    return jsonSuccess(category, undefined, 201);\n  } catch (error) {\n    console.error('[blogpanel] POST /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to create category', 500);\n  }\n}\n\nexport async function PUT(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const params = getSearchParams(request);\n    const id = params.id;\n    if (!id) return jsonError('MISSING_ID', 'Category ID is required');\n\n    const body = await request.json();\n    const parsed = UpdateCategorySchema.safeParse(body);\n\n    if (!parsed.success) {\n      const errors = parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`);\n      return jsonError('VALIDATION_ERROR', errors.join('; '));\n    }\n\n    const category = await updateCategory(id, parsed.data);\n    if (!category) return jsonError('NOT_FOUND', 'Category not found', 404);\n\n    return jsonSuccess(category);\n  } catch (error) {\n    console.error('[blogpanel] PUT /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to update category', 500);\n  }\n}\n\nexport async function DELETE(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const params = getSearchParams(request);\n    const id = params.id;\n    if (!id) return jsonError('MISSING_ID', 'Category ID is required');\n\n    const deleted = await deleteCategory(id);\n    if (!deleted) return jsonError('NOT_FOUND', 'Category not found', 404);\n\n    return jsonSuccess({ deleted: true });\n  } catch (error) {\n    console.error('[blogpanel] DELETE /categories error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to delete category', 500);\n  }\n}\n"]}

package/dist/api/media-file.cjs

@@ -0,0 +1,46 @@
+'use strict';
+
+var chunk4GK22Q3R_cjs = require('../chunk-4GK22Q3R.cjs');
+var chunkXLYTATRQ_cjs = require('../chunk-XLYTATRQ.cjs');
+var mongodb = require('mongodb');
+var stream = require('stream');
+
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "Content-Security-Policy": "default-src 'none'; sandbox"
+};
+async function GET(_request, context) {
+  const { key } = await context.params;
+  const objectKey = key.join("/");
+  const db = await chunkXLYTATRQ_cjs.getDb();
+  const bucket = new mongodb.GridFSBucket(db, { bucketName: chunk4GK22Q3R_cjs.GRIDFS_BUCKET });
+  const files = await bucket.find({ filename: objectKey }).limit(1).toArray();
+  const file = files[0];
+  if (!file) {
+    return new Response("Not found", {
+      status: 404,
+      headers: {
+        "Content-Type": "text/plain; charset=utf-8",
+        ...SECURITY_HEADERS
+      }
+    });
+  }
+  const contentType = file.contentType || "application/octet-stream";
+  const stream$1 = stream.Readable.toWeb(
+    bucket.openDownloadStream(file._id)
+  );
+  return new Response(stream$1, {
+    status: 200,
+    headers: {
+      "Content-Type": contentType,
+      "Content-Length": String(file.length),
+      "Cache-Control": "public, max-age=31536000, immutable",
+      "Content-Disposition": "inline",
+      ...SECURITY_HEADERS
+    }
+  });
+}
+
+exports.GET = GET;
+//# sourceMappingURL=media-file.cjs.map
+//# sourceMappingURL=media-file.cjs.map

package/dist/api/media-file.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/media-file.ts"],"names":["getDb","GridFSBucket","GRIDFS_BUCKET","stream","Readable"],"mappings":";;;;;;;AAyBA,IAAM,gBAAA,GAA2C;AAAA,EAC/C,wBAAA,EAA0B,SAAA;AAAA,EAC1B,yBAAA,EAA2B;AAC7B,CAAA;AAEA,eAAsB,GAAA,CACpB,UACA,OAAA,EACmB;AACnB,EAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,OAAA,CAAQ,MAAA;AAC9B,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAE9B,EAAA,MAAM,EAAA,GAAK,MAAMA,uBAAA,EAAM;AACvB,EAAA,MAAM,SAAS,IAAIC,oBAAA,CAAa,IAAI,EAAE,UAAA,EAAYC,iCAAe,CAAA;AAEjE,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,CAAK,EAAE,QAAA,EAAU,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,OAAA,EAAQ;AAC1E,EAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,IAAI,SAAS,WAAA,EAAa;AAAA,MAC/B,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,2BAAA;AAAA,QAChB,GAAG;AAAA;AACL,KACD,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,IAAe,0BAAA;AAexC,EAAA,MAAMC,WAASC,eAAA,CAAS,KAAA;AAAA,IACtB,MAAA,CAAO,kBAAA,CAAmB,IAAA,CAAK,GAAG;AAAA,GACpC;AAEA,EAAA,OAAO,IAAI,SAASD,QAAA,EAAQ;AAAA,IAC1B,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,WAAA;AAAA,MAChB,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA;AAAA,MACpC,eAAA,EAAiB,qCAAA;AAAA,MACjB,qBAAA,EAAuB,QAAA;AAAA,MACvB,GAAG;AAAA;AACL,GACD,CAAA;AACH","file":"media-file.cjs","sourcesContent":["import { GridFSBucket } from 'mongodb';\nimport { Readable } from 'node:stream';\nimport { getDb } from '../lib/db';\nimport { GRIDFS_BUCKET } from '../lib/storage';\n\n/**\n * Public, unauthenticated read route for GridFS-backed media.\n *\n * Images are public assets referenced from published posts, so this route has\n * no auth check by design — every *other* media operation stays behind\n * requireAuth. Do not \"fix\" this by adding requireAuth; it would break every\n * <img> on the public blog.\n *\n * Because objects are served from the application's own origin (unlike R2,\n * which serves from a separate host), an uploaded SVG carrying <script> would\n * otherwise be same-origin stored XSS. The CSP and nosniff headers below\n * neutralise script execution without dropping SVG support. They must be\n * present on every response this route returns — including error paths like\n * 404 — not just the 200: a 404 body is currently a fixed literal, but the\n * moment someone edits it to include the requested key (e.g. `Not found:\n * ${objectKey}`), it becomes attacker-controlled content served from this\n * same origin. Sharing this one constant across every response path is what\n * keeps that future edit harmless instead of turning it into a fresh\n * stored-XSS opportunity.\n */\nconst SECURITY_HEADERS: Record<string, string> = {\n  'X-Content-Type-Options': 'nosniff',\n  'Content-Security-Policy': \"default-src 'none'; sandbox\",\n};\n\nexport async function GET(\n  _request: Request,\n  context: { params: Promise<{ key: string[] }> }\n): Promise<Response> {\n  const { key } = await context.params;\n  const objectKey = key.join('/');\n\n  const db = await getDb();\n  const bucket = new GridFSBucket(db, { bucketName: GRIDFS_BUCKET });\n\n  const files = await bucket.find({ filename: objectKey }).limit(1).toArray();\n  const file = files[0];\n  if (!file) {\n    return new Response('Not found', {\n      status: 404,\n      headers: {\n        'Content-Type': 'text/plain; charset=utf-8',\n        ...SECURITY_HEADERS,\n      },\n    });\n  }\n\n  const contentType = file.contentType || 'application/octet-stream';\n\n  // bucket.openDownloadStream() returns a Node.js Readable (a\n  // GridFSBucketReadStream), not a web ReadableStream — they are different\n  // objects with different interfaces. Response bodies require a web\n  // ReadableStream, so Readable.toWeb() performs the actual conversion\n  // (rather than just asserting one type is the other). It also wires the\n  // resulting stream's cancel() back to the source Readable's destroy(), so\n  // if the HTTP client disconnects mid-download, the underlying GridFS\n  // cursor is released instead of leaking. The `as unknown as ReadableStream`\n  // below is only needed because @types/node's `stream/web` ReadableStream\n  // and lib.dom's ReadableStream are two structurally-incompatible\n  // declarations of the same real runtime type — it casts an actual\n  // ReadableStream instance across that declaration gap, not a Readable\n  // pretending to be one.\n  const stream = Readable.toWeb(\n    bucket.openDownloadStream(file._id)\n  ) as unknown as ReadableStream;\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': contentType,\n      'Content-Length': String(file.length),\n      'Cache-Control': 'public, max-age=31536000, immutable',\n      'Content-Disposition': 'inline',\n      ...SECURITY_HEADERS,\n    },\n  });\n}\n"]}

package/dist/api/media-file.d.cts

@@ -0,0 +1,7 @@
+declare function GET(_request: Request, context: {
+    params: Promise<{
+        key: string[];
+    }>;
+}): Promise<Response>;
+
+export { GET };

package/dist/api/media-file.d.ts

@@ -0,0 +1,7 @@
+declare function GET(_request: Request, context: {
+    params: Promise<{
+        key: string[];
+    }>;
+}): Promise<Response>;
+
+export { GET };

package/dist/api/media-file.js

@@ -0,0 +1,44 @@
+import { GRIDFS_BUCKET } from '../chunk-JDP4DIHI.js';
+import { getDb } from '../chunk-6PZ772NQ.js';
+import { GridFSBucket } from 'mongodb';
+import { Readable } from 'stream';
+
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "Content-Security-Policy": "default-src 'none'; sandbox"
+};
+async function GET(_request, context) {
+  const { key } = await context.params;
+  const objectKey = key.join("/");
+  const db = await getDb();
+  const bucket = new GridFSBucket(db, { bucketName: GRIDFS_BUCKET });
+  const files = await bucket.find({ filename: objectKey }).limit(1).toArray();
+  const file = files[0];
+  if (!file) {
+    return new Response("Not found", {
+      status: 404,
+      headers: {
+        "Content-Type": "text/plain; charset=utf-8",
+        ...SECURITY_HEADERS
+      }
+    });
+  }
+  const contentType = file.contentType || "application/octet-stream";
+  const stream = Readable.toWeb(
+    bucket.openDownloadStream(file._id)
+  );
+  return new Response(stream, {
+    status: 200,
+    headers: {
+      "Content-Type": contentType,
+      "Content-Length": String(file.length),
+      "Cache-Control": "public, max-age=31536000, immutable",
+      "Content-Disposition": "inline",
+      ...SECURITY_HEADERS
+    }
+  });
+}
+
+export { GET };
+//# sourceMappingURL=media-file.js.map
+//# sourceMappingURL=media-file.js.map

package/dist/api/media-file.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/media-file.ts"],"names":[],"mappings":";;;;;AAyBA,IAAM,gBAAA,GAA2C;AAAA,EAC/C,wBAAA,EAA0B,SAAA;AAAA,EAC1B,yBAAA,EAA2B;AAC7B,CAAA;AAEA,eAAsB,GAAA,CACpB,UACA,OAAA,EACmB;AACnB,EAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,OAAA,CAAQ,MAAA;AAC9B,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAE9B,EAAA,MAAM,EAAA,GAAK,MAAM,KAAA,EAAM;AACvB,EAAA,MAAM,SAAS,IAAI,YAAA,CAAa,IAAI,EAAE,UAAA,EAAY,eAAe,CAAA;AAEjE,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,CAAK,EAAE,QAAA,EAAU,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,OAAA,EAAQ;AAC1E,EAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,IAAI,SAAS,WAAA,EAAa;AAAA,MAC/B,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,2BAAA;AAAA,QAChB,GAAG;AAAA;AACL,KACD,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,IAAe,0BAAA;AAexC,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA;AAAA,IACtB,MAAA,CAAO,kBAAA,CAAmB,IAAA,CAAK,GAAG;AAAA,GACpC;AAEA,EAAA,OAAO,IAAI,SAAS,MAAA,EAAQ;AAAA,IAC1B,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,WAAA;AAAA,MAChB,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA;AAAA,MACpC,eAAA,EAAiB,qCAAA;AAAA,MACjB,qBAAA,EAAuB,QAAA;AAAA,MACvB,GAAG;AAAA;AACL,GACD,CAAA;AACH","file":"media-file.js","sourcesContent":["import { GridFSBucket } from 'mongodb';\nimport { Readable } from 'node:stream';\nimport { getDb } from '../lib/db';\nimport { GRIDFS_BUCKET } from '../lib/storage';\n\n/**\n * Public, unauthenticated read route for GridFS-backed media.\n *\n * Images are public assets referenced from published posts, so this route has\n * no auth check by design — every *other* media operation stays behind\n * requireAuth. Do not \"fix\" this by adding requireAuth; it would break every\n * <img> on the public blog.\n *\n * Because objects are served from the application's own origin (unlike R2,\n * which serves from a separate host), an uploaded SVG carrying <script> would\n * otherwise be same-origin stored XSS. The CSP and nosniff headers below\n * neutralise script execution without dropping SVG support. They must be\n * present on every response this route returns — including error paths like\n * 404 — not just the 200: a 404 body is currently a fixed literal, but the\n * moment someone edits it to include the requested key (e.g. `Not found:\n * ${objectKey}`), it becomes attacker-controlled content served from this\n * same origin. Sharing this one constant across every response path is what\n * keeps that future edit harmless instead of turning it into a fresh\n * stored-XSS opportunity.\n */\nconst SECURITY_HEADERS: Record<string, string> = {\n  'X-Content-Type-Options': 'nosniff',\n  'Content-Security-Policy': \"default-src 'none'; sandbox\",\n};\n\nexport async function GET(\n  _request: Request,\n  context: { params: Promise<{ key: string[] }> }\n): Promise<Response> {\n  const { key } = await context.params;\n  const objectKey = key.join('/');\n\n  const db = await getDb();\n  const bucket = new GridFSBucket(db, { bucketName: GRIDFS_BUCKET });\n\n  const files = await bucket.find({ filename: objectKey }).limit(1).toArray();\n  const file = files[0];\n  if (!file) {\n    return new Response('Not found', {\n      status: 404,\n      headers: {\n        'Content-Type': 'text/plain; charset=utf-8',\n        ...SECURITY_HEADERS,\n      },\n    });\n  }\n\n  const contentType = file.contentType || 'application/octet-stream';\n\n  // bucket.openDownloadStream() returns a Node.js Readable (a\n  // GridFSBucketReadStream), not a web ReadableStream — they are different\n  // objects with different interfaces. Response bodies require a web\n  // ReadableStream, so Readable.toWeb() performs the actual conversion\n  // (rather than just asserting one type is the other). It also wires the\n  // resulting stream's cancel() back to the source Readable's destroy(), so\n  // if the HTTP client disconnects mid-download, the underlying GridFS\n  // cursor is released instead of leaking. The `as unknown as ReadableStream`\n  // below is only needed because @types/node's `stream/web` ReadableStream\n  // and lib.dom's ReadableStream are two structurally-incompatible\n  // declarations of the same real runtime type — it casts an actual\n  // ReadableStream instance across that declaration gap, not a Readable\n  // pretending to be one.\n  const stream = Readable.toWeb(\n    bucket.openDownloadStream(file._id)\n  ) as unknown as ReadableStream;\n\n  return new Response(stream, {\n    status: 200,\n    headers: {\n      'Content-Type': contentType,\n      'Content-Length': String(file.length),\n      'Cache-Control': 'public, max-age=31536000, immutable',\n      'Content-Disposition': 'inline',\n      ...SECURITY_HEADERS,\n    },\n  });\n}\n"]}

package/dist/api/media.cjs

@@ -0,0 +1,180 @@
+'use strict';
+
+var chunkFPGVR2BX_cjs = require('../chunk-FPGVR2BX.cjs');
+var chunk4GK22Q3R_cjs = require('../chunk-4GK22Q3R.cjs');
+var chunkDWNMHQ4I_cjs = require('../chunk-DWNMHQ4I.cjs');
+var chunkXLYTATRQ_cjs = require('../chunk-XLYTATRQ.cjs');
+
+// src/api/media.ts
+async function GET(request) {
+  try {
+    const authError = await chunkDWNMHQ4I_cjs.requireAuth(request);
+    if (authError) return authError;
+    const params = chunkDWNMHQ4I_cjs.getSearchParams(request);
+    const result = await chunkXLYTATRQ_cjs.listMedia({
+      page: chunkDWNMHQ4I_cjs.parseIntParam(params.page, 1),
+      limit: chunkDWNMHQ4I_cjs.parseIntParam(params.limit, 20),
+      mimeType: params.mimeType
+    });
+    const page = chunkDWNMHQ4I_cjs.parseIntParam(params.page, 1);
+    const limit = chunkDWNMHQ4I_cjs.parseIntParam(params.limit, 20);
+    return chunkDWNMHQ4I_cjs.jsonSuccess(result.media, {
+      page,
+      limit,
+      total: result.total,
+      totalPages: Math.ceil(result.total / limit)
+    });
+  } catch (error) {
+    console.error("[blogpanel] GET /media error:", error);
+    return chunkDWNMHQ4I_cjs.jsonError("INTERNAL_ERROR", "Failed to fetch media", 500);
+  }
+}
+async function POST(request) {
+  try {
+    const authError = await chunkDWNMHQ4I_cjs.requireAuth(request);
+    if (authError) return authError;
+    const formData = await request.formData();
+    const file = formData.get("file");
+    if (!file) {
+      return chunkDWNMHQ4I_cjs.jsonError("MISSING_FILE", "File is required");
+    }
+    const config = chunkXLYTATRQ_cjs.getConfig();
+    const { maxUploadSize, maxImageSize } = config.editor;
+    if (file.size > maxUploadSize) {
+      return chunkDWNMHQ4I_cjs.jsonError(
+        "FILE_TOO_LARGE",
+        `File must be under ${Math.round(maxUploadSize / 1024 / 1024)}MB`,
+        413
+      );
+    }
+    const allowedTypes = [
+      "image/jpeg",
+      "image/png",
+      "image/gif",
+      "image/webp",
+      "image/svg+xml",
+      "image/avif"
+    ];
+    if (!allowedTypes.includes(file.type)) {
+      return chunkDWNMHQ4I_cjs.jsonError("INVALID_TYPE", `Allowed types: ${allowedTypes.join(", ")}`);
+    }
+    if (file.type === "image/svg+xml" && file.size > maxImageSize) {
+      return chunkDWNMHQ4I_cjs.jsonError(
+        "FILE_TOO_LARGE",
+        `SVG must be under ${Math.round(maxImageSize / 1024 / 1024)}MB`,
+        413
+      );
+    }
+    const buffer = Buffer.from(await file.arrayBuffer());
+    const storage = chunk4GK22Q3R_cjs.getStorageProvider();
+    const isImage = file.type.startsWith("image/") && file.type !== "image/svg+xml";
+    let uploadResult;
+    let width;
+    let height;
+    let uploadedKeys;
+    if (isImage) {
+      try {
+        const processed = await chunkFPGVR2BX_cjs.processImage(buffer, file.name, storage);
+        uploadResult = processed.original;
+        width = processed.width;
+        height = processed.height;
+        uploadedKeys = processed.uploadedKeys;
+      } catch (error) {
+        if (error instanceof chunkFPGVR2BX_cjs.ImageTooLargeError) {
+          return chunkDWNMHQ4I_cjs.jsonError(
+            "IMAGE_TOO_LARGE",
+            `Could not compress this image below ${Math.round(error.limitBytes / 1024 / 1024)}MB (best achieved ${Math.round(error.achievedBytes / 1024)}KB). Try a smaller image.`,
+            422
+          );
+        }
+        throw error;
+      }
+    } else {
+      uploadResult = await storage.upload(buffer, file.name, file.type);
+      uploadedKeys = [uploadResult.key];
+    }
+    let media;
+    try {
+      media = await chunkXLYTATRQ_cjs.createMedia({
+        filename: uploadResult.key.split("/").pop() || file.name,
+        originalName: file.name,
+        mimeType: uploadResult.contentType,
+        size: uploadResult.size,
+        width,
+        height,
+        storageKey: uploadResult.key,
+        provider: storage.name,
+        url: uploadResult.url,
+        alt: formData.get("alt") || "",
+        caption: formData.get("caption") || "",
+        createdAt: /* @__PURE__ */ new Date()
+      });
+    } catch (error) {
+      await chunk4GK22Q3R_cjs.rollbackUploads(storage, uploadedKeys, "createMedia failed after upload");
+      throw error;
+    }
+    return chunkDWNMHQ4I_cjs.jsonSuccess(media, void 0, 201);
+  } catch (error) {
+    console.error("[blogpanel] POST /media error:", error);
+    if (error instanceof chunkXLYTATRQ_cjs.ConfigNotInstalledError) {
+      return chunkDWNMHQ4I_cjs.jsonError("CONFIG_NOT_INSTALLED", error.message, 500);
+    }
+    if (error instanceof chunk4GK22Q3R_cjs.StorageProviderNotRegisteredError) {
+      return chunkDWNMHQ4I_cjs.jsonError("STORAGE_PROVIDER_NOT_REGISTERED", error.message, 500);
+    }
+    return chunkDWNMHQ4I_cjs.jsonError("INTERNAL_ERROR", "Failed to upload media", 500);
+  }
+}
+async function DELETE(request) {
+  try {
+    const authError = await chunkDWNMHQ4I_cjs.requireAuth(request);
+    if (authError) return authError;
+    const params = chunkDWNMHQ4I_cjs.getSearchParams(request);
+    const id = params.id;
+    if (!id) return chunkDWNMHQ4I_cjs.jsonError("MISSING_ID", "Media ID is required");
+    const existing = await chunkXLYTATRQ_cjs.getMediaById(id);
+    if (!existing) return chunkDWNMHQ4I_cjs.jsonError("NOT_FOUND", "Media not found", 404);
+    let storage;
+    try {
+      storage = existing.provider ? chunk4GK22Q3R_cjs.getStorageProviderByName(existing.provider) : chunk4GK22Q3R_cjs.getStorageProvider();
+    } catch (error) {
+      if (error instanceof chunk4GK22Q3R_cjs.StorageProviderNotRegisteredError) {
+        const source = existing.provider ? `media ${id} records provider='${error.providerName}'` : `media ${id} predates the provider field, so the backend came from BLOGPANEL_STORAGE, which names '${error.providerName}'`;
+        console.error(
+          `[blogpanel] DELETE /media refused: ${source}, which is not registered in this runtime (key=${existing.storageKey}). The database record was left intact.`,
+          error
+        );
+        return chunkDWNMHQ4I_cjs.jsonError("STORAGE_PROVIDER_NOT_REGISTERED", error.message, 500);
+      }
+      throw error;
+    }
+    const media = await chunkXLYTATRQ_cjs.deleteMedia(id);
+    if (!media) return chunkDWNMHQ4I_cjs.jsonError("NOT_FOUND", "Media not found", 404);
+    let storageDeleted = true;
+    await storage.delete(media.storageKey).catch((err) => {
+      storageDeleted = false;
+      console.error(
+        `[blogpanel] Failed to delete stored object (provider=${storage.name}, key=${media.storageKey}):`,
+        err
+      );
+    });
+    return chunkDWNMHQ4I_cjs.jsonSuccess({
+      deleted: true,
+      storageDeleted,
+      storageKey: media.storageKey,
+      provider: storage.name,
+      ...storageDeleted ? {} : {
+        warning: `The database record was removed, but the stored file could not be deleted from ${storage.name} and may require manual cleanup.`
+      }
+    });
+  } catch (error) {
+    console.error("[blogpanel] DELETE /media error:", error);
+    return chunkDWNMHQ4I_cjs.jsonError("INTERNAL_ERROR", "Failed to delete media", 500);
+  }
+}
+
+exports.DELETE = DELETE;
+exports.GET = GET;
+exports.POST = POST;
+//# sourceMappingURL=media.cjs.map
+//# sourceMappingURL=media.cjs.map

package/dist/api/media.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/media.ts"],"names":["requireAuth","getSearchParams","listMedia","parseIntParam","jsonSuccess","jsonError","getConfig","getStorageProvider","processImage","ImageTooLargeError","createMedia","rollbackUploads","ConfigNotInstalledError","StorageProviderNotRegisteredError","getMediaById","getStorageProviderByName","deleteMedia"],"mappings":";;;;;;;;AAkBA,eAAsB,IAAI,OAAA,EAAkB;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAMA,6BAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,MAAA,GAASC,kCAAgB,OAAO,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,MAAMC,2BAAA,CAAU;AAAA,MAC7B,IAAA,EAAMC,+BAAA,CAAc,MAAA,CAAO,IAAA,EAAM,CAAC,CAAA;AAAA,MAClC,KAAA,EAAOA,+BAAA,CAAc,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA;AAAA,MACrC,UAAU,MAAA,CAAO;AAAA,KAClB,CAAA;AAED,IAAA,MAAM,IAAA,GAAOA,+BAAA,CAAc,MAAA,CAAO,IAAA,EAAM,CAAC,CAAA;AACzC,IAAA,MAAM,KAAA,GAAQA,+BAAA,CAAc,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA;AAE5C,IAAA,OAAOC,6BAAA,CAAY,OAAO,KAAA,EAAO;AAAA,MAC/B,IAAA;AAAA,MACA,KAAA;AAAA,MACA,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,UAAA,EAAY,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAQ,KAAK;AAAA,KAC3C,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,iCAAiC,KAAK,CAAA;AACpD,IAAA,OAAOC,2BAAA,CAAU,gBAAA,EAAkB,uBAAA,EAAyB,GAAG,CAAA;AAAA,EACjE;AACF;AAEA,eAAsB,KAAK,OAAA,EAAkB;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAML,6BAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,QAAA,EAAS;AACxC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AAEhC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAOK,2BAAA,CAAU,gBAAgB,kBAAkB,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,SAASC,2BAAA,EAAU;AACzB,IAAA,MAAM,EAAE,aAAA,EAAe,YAAA,EAAa,GAAI,MAAA,CAAO,MAAA;AAE/C,IAAA,IAAI,IAAA,CAAK,OAAO,aAAA,EAAe;AAC7B,MAAA,OAAOD,2BAAA;AAAA,QACL,gBAAA;AAAA,QACA,sBAAsB,IAAA,CAAK,KAAA,CAAM,aAAA,GAAgB,IAAA,GAAO,IAAI,CAAC,CAAA,EAAA,CAAA;AAAA,QAC7D;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,YAAA;AAAA,MACA,WAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AACrC,MAAA,OAAOA,4BAAU,cAAA,EAAgB,CAAA,eAAA,EAAkB,aAAa,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IAC9E;AAGA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,eAAA,IAAmB,IAAA,CAAK,OAAO,YAAA,EAAc;AAC7D,MAAA,OAAOA,2BAAA;AAAA,QACL,gBAAA;AAAA,QACA,qBAAqB,IAAA,CAAK,KAAA,CAAM,YAAA,GAAe,IAAA,GAAO,IAAI,CAAC,CAAA,EAAA,CAAA;AAAA,QAC3D;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,MAAM,IAAA,CAAK,aAAa,CAAA;AACnD,IAAA,MAAM,UAAUE,oCAAA,EAAmB;AAEnC,IAAA,MAAM,UAAU,IAAA,CAAK,IAAA,CAAK,WAAW,QAAQ,CAAA,IAAK,KAAK,IAAA,KAAS,eAAA;AAChE,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,YAAA;AAEJ,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAI;AACF,QAAA,MAAM,YAAY,MAAMC,8BAAA,CAAa,MAAA,EAAQ,IAAA,CAAK,MAAM,OAAO,CAAA;AAC/D,QAAA,YAAA,GAAe,SAAA,CAAU,QAAA;AACzB,QAAA,KAAA,GAAQ,SAAA,CAAU,KAAA;AAClB,QAAA,MAAA,GAAS,SAAA,CAAU,MAAA;AACnB,QAAA,YAAA,GAAe,SAAA,CAAU,YAAA;AAAA,MAC3B,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,iBAAiBC,oCAAA,EAAoB;AACvC,UAAA,OAAOJ,2BAAA;AAAA,YACL,iBAAA;AAAA,YACA,CAAA,oCAAA,EAAuC,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,aAAa,IAAA,GAAO,IAAI,CAAC,CAAA,kBAAA,EAC7D,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,aAAA,GAAgB,IAAI,CAAC,CAAA,yBAAA,CAAA;AAAA,YAC1D;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA,MAAO;AACL,MAAA,YAAA,GAAe,MAAM,OAAA,CAAQ,MAAA,CAAO,QAAQ,IAAA,CAAK,IAAA,EAAM,KAAK,IAAI,CAAA;AAChE,MAAA,YAAA,GAAe,CAAC,aAAa,GAAG,CAAA;AAAA,IAClC;AAEA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,MAAMK,6BAAA,CAAY;AAAA,QACxB,QAAA,EAAU,aAAa,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,MAAS,IAAA,CAAK,IAAA;AAAA,QACpD,cAAc,IAAA,CAAK,IAAA;AAAA,QACnB,UAAU,YAAA,CAAa,WAAA;AAAA,QACvB,MAAM,YAAA,CAAa,IAAA;AAAA,QACnB,KAAA;AAAA,QACA,MAAA;AAAA,QACA,YAAY,YAAA,CAAa,GAAA;AAAA,QACzB,UAAU,OAAA,CAAQ,IAAA;AAAA,QAClB,KAAK,YAAA,CAAa,GAAA;AAAA,QAClB,GAAA,EAAM,QAAA,CAAS,GAAA,CAAI,KAAK,CAAA,IAAgB,EAAA;AAAA,QACxC,OAAA,EAAU,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA,IAAgB,EAAA;AAAA,QAChD,SAAA,sBAAe,IAAA;AAAK,OACrB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AAId,MAAA,MAAMC,iCAAA,CAAgB,OAAA,EAAS,YAAA,EAAc,iCAAiC,CAAA;AAC9E,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAOP,6BAAA,CAAY,KAAA,EAAO,KAAA,CAAA,EAAW,GAAG,CAAA;AAAA,EAC1C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,kCAAkC,KAAK,CAAA;AAQrD,IAAA,IAAI,iBAAiBQ,yCAAA,EAAyB;AAC5C,MAAA,OAAOP,2BAAA,CAAU,sBAAA,EAAwB,KAAA,CAAM,OAAA,EAAS,GAAG,CAAA;AAAA,IAC7D;AAMA,IAAA,IAAI,iBAAiBQ,mDAAA,EAAmC;AACtD,MAAA,OAAOR,2BAAA,CAAU,iCAAA,EAAmC,KAAA,CAAM,OAAA,EAAS,GAAG,CAAA;AAAA,IACxE;AAEA,IAAA,OAAOA,2BAAA,CAAU,gBAAA,EAAkB,wBAAA,EAA0B,GAAG,CAAA;AAAA,EAClE;AACF;AAEA,eAAsB,OAAO,OAAA,EAAkB;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAML,6BAAA,CAAY,OAAO,CAAA;AAC3C,IAAA,IAAI,WAAW,OAAO,SAAA;AAEtB,IAAA,MAAM,MAAA,GAASC,kCAAgB,OAAO,CAAA;AACtC,IAAA,MAAM,KAAK,MAAA,CAAO,EAAA;AAClB,IAAA,IAAI,CAAC,EAAA,EAAI,OAAOI,2BAAA,CAAU,cAAc,sBAAsB,CAAA;AAmB9D,IAAA,MAAM,QAAA,GAAW,MAAMS,8BAAA,CAAa,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU,OAAOT,2BAAA,CAAU,WAAA,EAAa,mBAAmB,GAAG,CAAA;AAEnE,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,SAAS,QAAA,GACfU,0CAAA,CAAyB,QAAA,CAAS,QAAQ,IAC1CR,oCAAA,EAAmB;AAAA,IACzB,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiBM,mDAAA,EAAmC;AAMtD,QAAA,MAAM,MAAA,GAAS,QAAA,CAAS,QAAA,GACpB,CAAA,MAAA,EAAS,EAAE,CAAA,mBAAA,EAAsB,KAAA,CAAM,YAAY,CAAA,CAAA,CAAA,GACnD,CAAA,MAAA,EAAS,EAAE,CAAA,uFAAA,EACwB,MAAM,YAAY,CAAA,CAAA,CAAA;AAEzD,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,CAAA,mCAAA,EAAsC,MAAM,CAAA,+CAAA,EACrB,QAAA,CAAS,UAAU,CAAA,uCAAA,CAAA;AAAA,UAC1C;AAAA,SACF;AACA,QAAA,OAAOR,2BAAA,CAAU,iCAAA,EAAmC,KAAA,CAAM,OAAA,EAAS,GAAG,CAAA;AAAA,MACxE;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAMW,6BAAA,CAAY,EAAE,CAAA;AAClC,IAAA,IAAI,CAAC,KAAA,EAAO,OAAOX,2BAAA,CAAU,WAAA,EAAa,mBAAmB,GAAG,CAAA;AAEhE,IAAA,IAAI,cAAA,GAAiB,IAAA;AACrB,IAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,CAAM,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AACpD,MAAA,cAAA,GAAiB,KAAA;AAQjB,MAAA,OAAA,CAAQ,KAAA;AAAA,QACN,CAAA,qDAAA,EAAwD,OAAA,CAAQ,IAAI,CAAA,MAAA,EAC3D,MAAM,UAAU,CAAA,EAAA,CAAA;AAAA,QACzB;AAAA,OACF;AAAA,IACF,CAAC,CAAA;AAWD,IAAA,OAAOD,6BAAA,CAAY;AAAA,MACjB,OAAA,EAAS,IAAA;AAAA,MACT,cAAA;AAAA,MACA,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,UAAU,OAAA,CAAQ,IAAA;AAAA,MAClB,GAAI,cAAA,GACA,EAAC,GACD;AAAA,QACE,OAAA,EACE,CAAA,+EAAA,EACQ,OAAA,CAAQ,IAAI,CAAA,gCAAA;AAAA;AACxB,KACL,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,IAAA,OAAOC,2BAAA,CAAU,gBAAA,EAAkB,wBAAA,EAA0B,GAAG,CAAA;AAAA,EAClE;AACF","file":"media.cjs","sourcesContent":["import { createMedia, deleteMedia, getMediaById, listMedia } from '../lib/db';\nimport {\n  getStorageProvider,\n  getStorageProviderByName,\n  rollbackUploads,\n  StorageProviderNotRegisteredError,\n} from '../lib/storage';\nimport type { StorageProvider } from '../lib/storage';\nimport { processImage, ImageTooLargeError } from '../lib/image';\nimport { getConfig, ConfigNotInstalledError } from '../lib/config';\nimport {\n  jsonSuccess,\n  jsonError,\n  requireAuth,\n  getSearchParams,\n  parseIntParam,\n} from './middleware';\n\nexport async function GET(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const params = getSearchParams(request);\n    const result = await listMedia({\n      page: parseIntParam(params.page, 1),\n      limit: parseIntParam(params.limit, 20),\n      mimeType: params.mimeType,\n    });\n\n    const page = parseIntParam(params.page, 1);\n    const limit = parseIntParam(params.limit, 20);\n\n    return jsonSuccess(result.media, {\n      page,\n      limit,\n      total: result.total,\n      totalPages: Math.ceil(result.total / limit),\n    });\n  } catch (error) {\n    console.error('[blogpanel] GET /media error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to fetch media', 500);\n  }\n}\n\nexport async function POST(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const formData = await request.formData();\n    const file = formData.get('file') as File | null;\n\n    if (!file) {\n      return jsonError('MISSING_FILE', 'File is required');\n    }\n\n    const config = getConfig();\n    const { maxUploadSize, maxImageSize } = config.editor;\n\n    if (file.size > maxUploadSize) {\n      return jsonError(\n        'FILE_TOO_LARGE',\n        `File must be under ${Math.round(maxUploadSize / 1024 / 1024)}MB`,\n        413\n      );\n    }\n\n    const allowedTypes = [\n      'image/jpeg',\n      'image/png',\n      'image/gif',\n      'image/webp',\n      'image/svg+xml',\n      'image/avif',\n    ];\n    if (!allowedTypes.includes(file.type)) {\n      return jsonError('INVALID_TYPE', `Allowed types: ${allowedTypes.join(', ')}`);\n    }\n\n    // SVG bypasses the compression ladder — sharp cannot usefully shrink it.\n    if (file.type === 'image/svg+xml' && file.size > maxImageSize) {\n      return jsonError(\n        'FILE_TOO_LARGE',\n        `SVG must be under ${Math.round(maxImageSize / 1024 / 1024)}MB`,\n        413\n      );\n    }\n\n    const buffer = Buffer.from(await file.arrayBuffer());\n    const storage = getStorageProvider();\n\n    const isImage = file.type.startsWith('image/') && file.type !== 'image/svg+xml';\n    let uploadResult;\n    let width: number | undefined;\n    let height: number | undefined;\n    let uploadedKeys: string[];\n\n    if (isImage) {\n      try {\n        const processed = await processImage(buffer, file.name, storage);\n        uploadResult = processed.original;\n        width = processed.width;\n        height = processed.height;\n        uploadedKeys = processed.uploadedKeys;\n      } catch (error) {\n        if (error instanceof ImageTooLargeError) {\n          return jsonError(\n            'IMAGE_TOO_LARGE',\n            `Could not compress this image below ${Math.round(error.limitBytes / 1024 / 1024)}MB ` +\n              `(best achieved ${Math.round(error.achievedBytes / 1024)}KB). Try a smaller image.`,\n            422\n          );\n        }\n        throw error;\n      }\n    } else {\n      uploadResult = await storage.upload(buffer, file.name, file.type);\n      uploadedKeys = [uploadResult.key];\n    }\n\n    let media;\n    try {\n      media = await createMedia({\n        filename: uploadResult.key.split('/').pop() || file.name,\n        originalName: file.name,\n        mimeType: uploadResult.contentType,\n        size: uploadResult.size,\n        width,\n        height,\n        storageKey: uploadResult.key,\n        provider: storage.name,\n        url: uploadResult.url,\n        alt: (formData.get('alt') as string) || '',\n        caption: (formData.get('caption') as string) || '',\n        createdAt: new Date(),\n      });\n    } catch (error) {\n      // Every object above already landed in storage; without this, a failed\n      // DB write leaves them orphaned exactly like an unhandled derivative\n      // failure would — nothing will ever reference them again.\n      await rollbackUploads(storage, uploadedKeys, 'createMedia failed after upload');\n      throw error;\n    }\n\n    return jsonSuccess(media, undefined, 201);\n  } catch (error) {\n    console.error('[blogpanel] POST /media error:', error);\n\n    // A missing runtime config is an installation mistake with an exact fix,\n    // and this endpoint is authenticated, so pass the message through instead\n    // of flattening it to \"Failed to upload media\" — otherwise the developer\n    // has to go digging in the server log to find out what to do. Matched by\n    // class, not by a message-prefix check: a prefix check silently stops\n    // working the moment the message wording changes for any reason.\n    if (error instanceof ConfigNotInstalledError) {\n      return jsonError('CONFIG_NOT_INSTALLED', error.message, 500);\n    }\n\n    // Same treatment, same reasoning: BLOGPANEL_STORAGE naming a provider this\n    // runtime never registered is an installation mistake with an exact fix,\n    // and nothing was written, so say what to do rather than \"Failed to upload\n    // media\".\n    if (error instanceof StorageProviderNotRegisteredError) {\n      return jsonError('STORAGE_PROVIDER_NOT_REGISTERED', error.message, 500);\n    }\n\n    return jsonError('INTERNAL_ERROR', 'Failed to upload media', 500);\n  }\n}\n\nexport async function DELETE(request: Request) {\n  try {\n    const authError = await requireAuth(request);\n    if (authError) return authError;\n\n    const params = getSearchParams(request);\n    const id = params.id;\n    if (!id) return jsonError('MISSING_ID', 'Media ID is required');\n\n    // Resolve the backend BEFORE the row is removed.\n    //\n    // Delete from whichever backend actually holds it — not whichever backend\n    // is currently configured. Those can diverge after a storage migration\n    // (e.g. GridFS -> R2), and generateKey() produces identically-shaped keys\n    // on every provider, so asking the wrong one to delete a key \"succeeds\"\n    // by silently finding nothing. `provider` is absent only on documents\n    // that predate the field and somehow escaped migration.\n    //\n    // Resolution can now fail — `provider` is a free-form string naming a\n    // registered custom backend, and this process may not have registered it\n    // (a provider removed from the setup module, a rename, a typo). Doing the\n    // lookup first means that failure is fully recoverable: the row is still\n    // there, the request 500s with an actionable message, and retrying after\n    // registering the provider deletes the object properly. Resolving after\n    // the delete would destroy the only record of which backend held the\n    // object and what its key was.\n    const existing = await getMediaById(id);\n    if (!existing) return jsonError('NOT_FOUND', 'Media not found', 404);\n\n    let storage: StorageProvider;\n    try {\n      storage = existing.provider\n        ? getStorageProviderByName(existing.provider)\n        : getStorageProvider();\n    } catch (error) {\n      if (error instanceof StorageProviderNotRegisteredError) {\n        // Attribute the unresolvable name to where it actually came from. On\n        // the legacy path the document has no `provider`, so the throw\n        // originates in getStorageProvider() reading BLOGPANEL_STORAGE — not\n        // from the document — and saying \"the document records it\" would send\n        // an operator looking for a field that is not there.\n        const source = existing.provider\n          ? `media ${id} records provider='${error.providerName}'`\n          : `media ${id} predates the provider field, so the backend came from ` +\n            `BLOGPANEL_STORAGE, which names '${error.providerName}'`;\n\n        console.error(\n          `[blogpanel] DELETE /media refused: ${source}, which is not registered in ` +\n            `this runtime (key=${existing.storageKey}). The database record was left intact.`,\n          error\n        );\n        return jsonError('STORAGE_PROVIDER_NOT_REGISTERED', error.message, 500);\n      }\n      throw error;\n    }\n\n    const media = await deleteMedia(id);\n    if (!media) return jsonError('NOT_FOUND', 'Media not found', 404);\n\n    let storageDeleted = true;\n    await storage.delete(media.storageKey).catch((err) => {\n      storageDeleted = false;\n      // The DB row is already gone by this point, so a failure here leaves\n      // the object permanently unreachable through the UI — log enough detail\n      // for an operator to clean it up by hand rather than letting this\n      // disappear into a generic message. Uses storage.name (the provider\n      // actually resolved and attempted), not media.provider directly — when\n      // `provider` is absent and the fallback itself fails, media.provider\n      // would print as \"unknown\" even though a concrete provider was tried.\n      console.error(\n        `[blogpanel] Failed to delete stored object (provider=${storage.name}, ` +\n          `key=${media.storageKey}):`,\n        err\n      );\n    });\n\n    // The DB half of this operation genuinely succeeded — the row is gone,\n    // the item will never appear in the media library again — so this stays\n    // HTTP 200 rather than a false 500 even when storageDeleted is false.\n    // But collapsing that into a flat `{ deleted: true }` would tell the\n    // caller the object was fully removed when it is, in fact, still sitting\n    // in storage: unreferenced by any row, invisible to every UI path that\n    // could otherwise clean it up, and still counted against quota. The\n    // response has to be able to say that out loud rather than let a caller\n    // assume full success from a 200.\n    return jsonSuccess({\n      deleted: true,\n      storageDeleted,\n      storageKey: media.storageKey,\n      provider: storage.name,\n      ...(storageDeleted\n        ? {}\n        : {\n            warning:\n              `The database record was removed, but the stored file could not be deleted ` +\n              `from ${storage.name} and may require manual cleanup.`,\n          }),\n    });\n  } catch (error) {\n    console.error('[blogpanel] DELETE /media error:', error);\n    return jsonError('INTERNAL_ERROR', 'Failed to delete media', 500);\n  }\n}\n"]}

package/dist/api/media.d.cts

@@ -0,0 +1,22 @@
+import * as next_server from 'next/server';
+import { A as ApiErrorResponse } from '../types-CgrBuig-.cjs';
+import 'zod';
+import 'mongodb';
+
+declare function GET(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function POST(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+declare function DELETE(request: Request): Promise<next_server.NextResponse<ApiErrorResponse> | next_server.NextResponse<{
+    success: boolean;
+    data: unknown;
+    meta: Record<string, unknown> | undefined;
+}>>;
+
+export { DELETE, GET, POST };