dineway 0.2.33 → 0.2.35

package/dist/{menus-CpuR4Qkm.mjs → menus-5liJusbp.mjs}

@@ -1,17 +1,26 @@
-import { a as __exportAll } from "./runner-DJiRFyLI.mjs";
-import { n as getI18nConfig } from "./config-CVssduLe.mjs";
-import { c as invalidateMenuObjectCache } from "./object-cache-D51qOseS.mjs";
-import { t as withTransaction } from "./transaction-BGQgnwUi.mjs";
+import { c as __exportAll } from "./runner-CVeq0266.mjs";
+import { AtomicWriteConflict, atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { n as getI18nConfig } from "./config-XW5tMrH8.mjs";
+import { c as invalidateMenuObjectCache } from "./object-cache-BGjIlY9s.mjs";
+import { sql } from "kysely";
 import { ulid } from "ulidx";
 
 //#region src/database/repositories/menu.ts
 /**
-* Thrown from inside a repository transaction when the menu the caller
-* resolved earlier has since been deleted. Handlers translate this to a
-* `NOT_FOUND` API response. Necessary because D1 disables FK enforcement
-* (so `ON DELETE CASCADE` won't fire), and an unchecked `setItems` would
-* happily insert items whose `menu_id` no longer exists, leaving orphans.
+* Menu repository
+*
+* Owns every SQL touch for `_dineway_menus` and `_dineway_menu_items`, plus the
+* row→entity mapping. Matches the architecture used by every other resource
+* (content, taxonomies, redirects, comments, media): handlers stay thin and
+* orchestrate; the repository is the single place where snake_case DB columns
+* become camelCase entities (and vice versa).
+*
+* i18n: menus are per-locale. `(name, locale)` is unique. Translations of the
+* same menu share a `translation_group` ULID. Menu item `reference_id` stores
+* the referenced content's translation_group (not a specific row id) so a
+* single menu item survives content translations.
 */
+/** The resolved menu disappeared before its atomic mutation could commit. */
 var MenuGoneError = class extends Error {
 	constructor(menuId) {
 		super(`Menu ${menuId} was deleted while being modified`);
@@ -136,45 +145,40 @@ var MenuRepository = class {
 	*/
 	async create(input) {
 		const id = ulid();
-		let translationGroup = id;
-		let sourceMenuId = null;
-		if (input.translationOf) {
-			const source = await this.findById(input.translationOf);
-			if (!source) throw new Error("Source menu for translation not found");
-			translationGroup = source.translationGroup ?? source.id;
-			sourceMenuId = source.id;
-		}
-		await withTransaction(this.db, async (trx) => {
-			await trx.insertInto("_dineway_menus").values({
-				id,
-				name: input.name,
-				label: input.label,
+		const source = input.translationOf ? await this.db.selectFrom("_dineway_menus").selectAll().where("id", "=", input.translationOf).executeTakeFirst() : null;
+		if (input.translationOf && !source) throw new Error("Source menu for translation not found");
+		const checks = source ? [rowUnchanged("_dineway_menus", source)] : [];
+		const statements = [this.db.insertInto("_dineway_menus").values({
+			id,
+			name: input.name,
+			label: input.label,
+			...input.locale !== void 0 ? { locale: input.locale } : {},
+			translation_group: source?.translation_group ?? source?.id ?? id
+		}).compile()];
+		if (source) {
+			const items = await this.snapshotItems(source.id);
+			checks.push(...items.checks);
+			const idMap = new Map(items.rows.map((item) => [item.id, ulid()]));
+			for (const item of orderParentsFirst(items.rows)) statements.push(this.db.insertInto("_dineway_menu_items").values({
+				id: idMap.get(item.id),
+				menu_id: id,
+				parent_id: item.parent_id ? idMap.get(item.parent_id) : null,
+				sort_order: item.sort_order,
+				type: item.type,
+				reference_collection: item.reference_collection,
+				reference_id: item.reference_id,
+				custom_url: item.custom_url,
+				label: item.label,
+				title_attr: item.title_attr,
+				target: item.target,
+				css_classes: item.css_classes,
 				...input.locale !== void 0 ? { locale: input.locale } : {},
-				translation_group: translationGroup
-			}).execute();
-			if (sourceMenuId) {
-				const sourceItems = await trx.selectFrom("_dineway_menu_items").selectAll().where("menu_id", "=", sourceMenuId).orderBy("sort_order", "asc").execute();
-				if (sourceItems.length > 0) {
-					const idMap = /* @__PURE__ */ new Map();
-					for (const item of sourceItems) idMap.set(item.id, ulid());
-					await trx.insertInto("_dineway_menu_items").values(sourceItems.map((item) => ({
-						id: idMap.get(item.id),
-						menu_id: id,
-						parent_id: item.parent_id ? idMap.get(item.parent_id) ?? null : null,
-						sort_order: item.sort_order,
-						type: item.type,
-						reference_collection: item.reference_collection,
-						reference_id: item.reference_id,
-						custom_url: item.custom_url,
-						label: item.label,
-						title_attr: item.title_attr,
-						target: item.target,
-						css_classes: item.css_classes,
-						...input.locale !== void 0 ? { locale: input.locale } : {},
-						translation_group: item.translation_group ?? item.id
-					}))).execute();
-				}
-			}
+				translation_group: item.translation_group ?? item.id
+			}).compile());
+		}
+		await atomicBatch(this.db, {
+			checks,
+			statements
 		});
 		invalidateMenuObjectCache();
 		const created = await this.findById(id);
@@ -191,17 +195,13 @@ var MenuRepository = class {
 		}
 		return await this.findById(id);
 	}
-	/**
-	* Delete a menu. Items are deleted explicitly first because D1 disables
-	* FK enforcement at the database level, so `ON DELETE CASCADE` declared in
-	* migration 005 cannot be relied on. On SQLite/Postgres the cascade also
-	* fires, making the explicit delete a no-op there.
-	*/
+	/** Delete the menu and its items in one commit. */
 	async delete(id) {
-		if (!await this.findById(id)) return false;
-		await withTransaction(this.db, async (trx) => {
-			await trx.deleteFrom("_dineway_menu_items").where("menu_id", "=", id).execute();
-			await trx.deleteFrom("_dineway_menus").where("id", "=", id).execute();
+		const existing = await this.db.selectFrom("_dineway_menus").selectAll().where("id", "=", id).executeTakeFirst();
+		if (!existing) return false;
+		await atomicBatch(this.db, {
+			checks: [rowUnchanged("_dineway_menus", existing)],
+			statements: [this.db.deleteFrom("_dineway_menu_items").where("menu_id", "=", id).compile(), this.db.deleteFrom("_dineway_menus").where("id", "=", id).compile()]
 		});
 		invalidateMenuObjectCache();
 		return true;
@@ -294,34 +294,39 @@ var MenuRepository = class {
 	* Returns the count of inserted items (matches the existing handler API).
 	*/
 	async setItems(menuId, locale, items) {
-		await withTransaction(this.db, async (trx) => {
-			if (!await trx.selectFrom("_dineway_menus").select("id").where("id", "=", menuId).executeTakeFirst()) throw new MenuGoneError(menuId);
-			await trx.deleteFrom("_dineway_menu_items").where("menu_id", "=", menuId).execute();
-			const insertedIds = [];
-			for (let i = 0; i < items.length; i++) {
-				const item = items[i];
-				if (!item) continue;
-				const id = ulid();
-				const parentId = item.parentIndex !== void 0 ? insertedIds[item.parentIndex] ?? null : null;
-				await trx.insertInto("_dineway_menu_items").values({
-					id,
-					menu_id: menuId,
-					parent_id: parentId,
-					sort_order: i,
-					type: item.type,
-					reference_collection: item.referenceCollection ?? null,
-					reference_id: item.referenceId ?? null,
-					custom_url: item.customUrl ?? null,
-					label: item.label,
-					title_attr: item.titleAttr ?? null,
-					target: item.target ?? null,
-					css_classes: item.cssClasses ?? null,
-					locale
-				}).execute();
-				insertedIds.push(id);
-			}
-			await trx.updateTable("_dineway_menus").set({ updated_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", menuId).execute();
-		});
+		const menu = await this.db.selectFrom("_dineway_menus").selectAll().where("id", "=", menuId).executeTakeFirst();
+		if (!menu) throw new MenuGoneError(menuId);
+		const previous = await this.snapshotItems(menuId);
+		const statements = [this.db.deleteFrom("_dineway_menu_items").where("menu_id", "=", menuId).compile()];
+		const ids = items.map(() => ulid());
+		for (const [index, item] of items.entries()) {
+			if (item.parentIndex !== void 0 && (!Number.isInteger(item.parentIndex) || item.parentIndex < 0 || item.parentIndex >= index)) throw new Error("Menu parents must reference an earlier item");
+			statements.push(this.db.insertInto("_dineway_menu_items").values({
+				id: ids[index],
+				menu_id: menuId,
+				parent_id: item.parentIndex !== void 0 ? ids[item.parentIndex] : null,
+				sort_order: index,
+				type: item.type,
+				reference_collection: item.referenceCollection ?? null,
+				reference_id: item.referenceId ?? null,
+				custom_url: item.customUrl ?? null,
+				label: item.label,
+				title_attr: item.titleAttr ?? null,
+				target: item.target ?? null,
+				css_classes: item.cssClasses ?? null,
+				locale
+			}).compile());
+		}
+		statements.push(this.db.updateTable("_dineway_menus").set({ updated_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", menuId).compile());
+		try {
+			await atomicBatch(this.db, {
+				checks: [rowUnchanged("_dineway_menus", menu), ...previous.checks],
+				statements
+			});
+		} catch (error) {
+			if (error instanceof AtomicWriteConflict && !await this.findById(menuId)) throw new MenuGoneError(menuId);
+			throw error;
+		}
 		invalidateMenuObjectCache();
 		return { itemCount: items.length };
 	}
@@ -330,16 +335,59 @@ var MenuRepository = class {
 	* malicious payload cannot move foreign items into this menu's siblings.
 	*/
 	async reorderItems(menuId, items) {
-		invalidateMenuObjectCache();
-		return withTransaction(this.db, async (trx) => {
-			for (const item of items) await trx.updateTable("_dineway_menu_items").set({
+		const snapshot = await this.snapshotItems(menuId);
+		const rows = new Map(snapshot.rows.map((row) => [row.id, row]));
+		const statements = [];
+		for (const item of items) {
+			const row = rows.get(item.id);
+			if (!row) continue;
+			rows.set(item.id, {
+				...row,
 				parent_id: item.parentId,
 				sort_order: item.sortOrder
-			}).where("id", "=", item.id).where("menu_id", "=", menuId).execute();
-			return (await trx.selectFrom("_dineway_menu_items").selectAll().where("menu_id", "=", menuId).orderBy("sort_order", "asc").execute()).map(rowToMenuItem);
+			});
+			statements.push(this.db.updateTable("_dineway_menu_items").set({
+				parent_id: item.parentId,
+				sort_order: item.sortOrder
+			}).where("id", "=", item.id).where("menu_id", "=", menuId).compile());
+		}
+		orderParentsFirst([...rows.values()]);
+		await atomicBatch(this.db, {
+			checks: snapshot.checks,
+			statements
 		});
+		invalidateMenuObjectCache();
+		return this.findItems(menuId);
+	}
+	async snapshotItems(menuId) {
+		const rows = await this.db.selectFrom("_dineway_menu_items").selectAll().where("menu_id", "=", menuId).orderBy("sort_order", "asc").execute();
+		return {
+			rows,
+			checks: [sql`(SELECT COUNT(*) FROM _dineway_menu_items WHERE menu_id = ${menuId}) = ${rows.length}`, ...rows.map((row) => rowUnchanged("_dineway_menu_items", row))]
+		};
 	}
 };
+function orderParentsFirst(items) {
+	const remaining = new Map(items.map((item) => [item.id, item]));
+	const visited = /* @__PURE__ */ new Set();
+	const visiting = /* @__PURE__ */ new Set();
+	const ordered = [];
+	const visit = (item) => {
+		if (visited.has(item.id)) return;
+		if (visiting.has(item.id)) throw new Error("Menu parent links contain a cycle");
+		visiting.add(item.id);
+		if (item.parent_id) {
+			const parent = remaining.get(item.parent_id);
+			if (!parent) throw new Error("Menu parent must belong to the same menu");
+			visit(parent);
+		}
+		visiting.delete(item.id);
+		visited.add(item.id);
+		ordered.push(item);
+	};
+	for (const item of items) visit(item);
+	return ordered;
+}
 
 //#endregion
 //#region src/api/handlers/menus.ts

package/dist/migrations-C7YXse7V.mjs

@@ -0,0 +1,76 @@
+import { o as assertD1Migrations } from "./runner-CVeq0266.mjs";
+import { n as d1Database } from "./d1-binding-D6HZa3ks.mjs";
+import { Migrator } from "kysely";
+
+//#region src/plugins/migrations.ts
+const LEADING_AT = /^@/;
+var StaticPluginMigrationProvider = class {
+	constructor(migrations) {
+		this.migrations = migrations;
+	}
+	async getMigrations() {
+		return this.migrations;
+	}
+};
+/**
+* Run migrations contributed by configured trusted native plugins.
+*
+* Each plugin receives isolated Kysely migration and lock tables. This keeps migration history valid
+* when another plugin is removed and lets different plugins safely reuse local migration names.
+*/
+async function runPluginMigrations(db, plugins) {
+	const applied = [];
+	for (const plugin of [...plugins].toSorted((left, right) => left.id.localeCompare(right.id))) {
+		if (Object.keys(plugin.migrations).length === 0) continue;
+		const tables = pluginMigrationTableNames(plugin.id);
+		if (d1Database(db)) {
+			await assertD1Migrations(db, tables.migrations, Object.keys(plugin.migrations));
+			applied.push({
+				pluginId: plugin.id,
+				applied: []
+			});
+			continue;
+		}
+		const { error, results } = await new Migrator({
+			db,
+			provider: new StaticPluginMigrationProvider(plugin.migrations),
+			migrationTableName: tables.migrations,
+			migrationLockTableName: tables.lock
+		}).migrateToLatest();
+		const successful = results?.filter((result) => result.status === "Success").map((result) => result.migrationName) ?? [];
+		if (error) {
+			const failed = results?.find((result) => result.status === "Error")?.migrationName;
+			throw new Error(`Plugin migration failed for ${plugin.id}${failed ? ` (${failed})` : ""}: ${errorMessage(error)}`, { cause: error });
+		}
+		applied.push({
+			pluginId: plugin.id,
+			applied: successful
+		});
+	}
+	return applied;
+}
+function pluginMigrationTableNames(pluginId) {
+	const slug = pluginId.replace(LEADING_AT, "").replaceAll("/", "_").replaceAll("-", "_").slice(0, 20);
+	const suffix = fnv1a(pluginId);
+	return {
+		migrations: `_dineway_plugin_migration_${slug}_${suffix}`,
+		lock: `_dineway_plugin_migration_lock_${slug}_${suffix}`
+	};
+}
+function fnv1a(value) {
+	let hash = 2166136261;
+	for (let index = 0; index < value.length; index++) {
+		hash ^= value.charCodeAt(index);
+		hash = Math.imul(hash, 16777619);
+	}
+	return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function errorMessage(error) {
+	if (!(error instanceof Error)) return JSON.stringify(error);
+	if (error.message) return error.message;
+	if (error.cause instanceof Error && error.cause.message) return error.cause.message;
+	return "unknown error";
+}
+
+//#endregion
+export { runPluginMigrations as n, pluginMigrationTableNames as t };

package/dist/oauth-authority-DOjME4Hh.mjs

@@ -0,0 +1,43 @@
+import { rowUnchanged } from "./database/batch.mjs";
+import { sql } from "kysely";
+import { toRoleLevel } from "@dineway-ai/auth";
+
+//#region src/api/handlers/oauth-authority.ts
+/** Keep token permissions tied to the same account and client state through commit. */
+async function readTokenAuthority(db, userId, clientId) {
+	const user = await db.selectFrom("users").select([
+		"id",
+		"role",
+		"disabled"
+	]).where("id", "=", userId).executeTakeFirst();
+	const client = clientId ? await db.selectFrom("_dineway_oauth_clients").select([
+		"id",
+		"redirect_uris",
+		"scopes"
+	]).where("id", "=", clientId).executeTakeFirst() : void 0;
+	const checks = user ? [rowUnchanged("users", user)] : [];
+	if (client) checks.push(rowUnchanged("_dineway_oauth_clients", client));
+	else if (clientId) checks.push(sql`NOT EXISTS (SELECT 1 FROM _dineway_oauth_clients WHERE id = ${clientId})`);
+	return {
+		user: user ? {
+			role: toRoleLevel(user.role),
+			disabled: user.disabled === 1
+		} : null,
+		client: client ? {
+			scopes: client.scopes ? parseStringList(client.scopes) : null,
+			redirectUris: parseStringList(client.redirect_uris)
+		} : null,
+		checks
+	};
+}
+function parseStringList(value) {
+	const parsed = JSON.parse(value);
+	if (!Array.isArray(parsed)) throw new Error("Invalid stored OAuth client configuration");
+	return parsed.map((item) => {
+		if (typeof item !== "string") throw new Error("Invalid stored OAuth client configuration");
+		return item;
+	});
+}
+
+//#endregion
+export { readTokenAuthority as t };

package/dist/{oauth-authorization-Jf5e3azH.mjs → oauth-authorization-B_mmz7O2.mjs}

@@ -1,9 +1,11 @@
-import { t as withTransaction } from "./transaction-BGQgnwUi.mjs";
-import { a as hashApiToken, n as TOKEN_PREFIXES, r as generatePrefixedToken, t as ALL_VALID_SCOPES } from "./api-tokens-CmT83Bgj.mjs";
-import { a as filterExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-B9x8delL.mjs";
-import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "./oauth-clients-tovQ4D4h.mjs";
-import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-B451pZmd.mjs";
-import { clampScopes, computeS256Challenge, secureCompare } from "@dineway-ai/auth";
+import { AtomicWriteConflict, atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { r as currentIsoTimestampValue } from "./dialect-helpers-C6xtO-Ui.mjs";
+import { a as hashApiToken, n as TOKEN_PREFIXES, r as generatePrefixedToken, t as ALL_VALID_SCOPES } from "./api-tokens-DA18zxza.mjs";
+import { a as filterExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-fzJHB3ZI.mjs";
+import { c as validateRedirectUri, s as validateClientRedirectUri } from "./oauth-clients-Cr4pdIAE.mjs";
+import { t as readTokenAuthority } from "./oauth-authority-DOjME4Hh.mjs";
+import { sql } from "kysely";
+import { clampScopes, computeS256Challenge, secureCompare, toRoleLevel } from "@dineway-ai/auth";
 import { generateCodeVerifier } from "arctic";
 
 //#region src/api/handlers/oauth-authorization.ts
@@ -58,7 +60,15 @@ async function handleAuthorizationApproval(db, userId, userRole, params) {
 				message: uriError
 			}
 		};
-		const client = await lookupOAuthClient(db, params.client_id);
+		const authority = await readTokenAuthority(db, userId, params.client_id);
+		if (!authority.user || authority.user.disabled) return {
+			success: false,
+			error: {
+				code: "FORBIDDEN",
+				message: "User account is unavailable"
+			}
+		};
+		const client = authority.client;
 		if (!client) return {
 			success: false,
 			error: {
@@ -96,7 +106,7 @@ async function handleAuthorizationApproval(db, userId, userRole, params) {
 				message: getExperimentalSiteContextWorkflowScopesDisabledMessage()
 			}
 		};
-		const userScopes = clampScopes(normalizeScopes(requestedScopes), userRole, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
+		const userScopes = clampScopes(normalizeScopes(requestedScopes), toRoleLevel(Math.min(userRole, authority.user.role)), { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
 		const clientScopes = client.scopes;
 		const scopes = clientScopes?.length ? userScopes.filter((s) => clientScopes.includes(s)) : userScopes;
 		if (scopes.length === 0) return {
@@ -108,17 +118,20 @@ async function handleAuthorizationApproval(db, userId, userRole, params) {
 		};
 		const code = generateCodeVerifier();
 		const codeHash = hashApiToken(code);
-		await db.insertInto("_dineway_authorization_codes").values({
-			code_hash: codeHash,
-			client_id: params.client_id,
-			redirect_uri: params.redirect_uri,
-			user_id: userId,
-			scopes: JSON.stringify(scopes),
-			code_challenge: params.code_challenge,
-			code_challenge_method: params.code_challenge_method,
-			resource: params.resource ?? null,
-			expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
-		}).execute();
+		await atomicBatch(db, {
+			checks: authority.checks,
+			statements: [db.insertInto("_dineway_authorization_codes").values({
+				code_hash: codeHash,
+				client_id: params.client_id,
+				redirect_uri: params.redirect_uri,
+				user_id: userId,
+				scopes: JSON.stringify(scopes),
+				code_challenge: params.code_challenge,
+				code_challenge_method: params.code_challenge_method,
+				resource: params.resource ?? null,
+				expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
+			}).compile()]
+		});
 		const redirectUrl = new URL(params.redirect_uri);
 		redirectUrl.searchParams.set("code", code);
 		if (params.state) redirectUrl.searchParams.set("state", params.state);
@@ -153,7 +166,7 @@ async function handleAuthorizationCodeExchange(db, params) {
 			}
 		};
 		const codeHash = hashApiToken(params.code);
-		const row = await db.deleteFrom("_dineway_authorization_codes").where("code_hash", "=", codeHash).returningAll().executeTakeFirst();
+		const row = await db.selectFrom("_dineway_authorization_codes").selectAll().where("code_hash", "=", codeHash).executeTakeFirst();
 		if (!row) return {
 			success: false,
 			error: {
@@ -161,91 +174,62 @@ async function handleAuthorizationCodeExchange(db, params) {
 				message: "Invalid authorization code"
 			}
 		};
-		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "Authorization code expired"
-			}
-		};
-		if (row.redirect_uri !== params.redirect_uri) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "redirect_uri mismatch"
-			}
-		};
-		if (row.client_id !== params.client_id) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "client_id mismatch"
-			}
-		};
-		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "PKCE verification failed"
-			}
-		};
-		if (row.resource && params.resource && row.resource !== params.resource) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "resource mismatch"
-			}
-		};
-		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
-		if (!userInfo) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User not found"
-			}
-		};
-		if (userInfo.disabled) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User account is disabled"
-			}
+		const rejectCode = async (message) => {
+			await db.deleteFrom("_dineway_authorization_codes").where("code_hash", "=", codeHash).execute();
+			return {
+				success: false,
+				error: {
+					code: "invalid_grant",
+					message
+				}
+			};
 		};
+		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return rejectCode("Authorization code expired");
+		if (row.redirect_uri !== params.redirect_uri) return rejectCode("redirect_uri mismatch");
+		if (row.client_id !== params.client_id) return rejectCode("client_id mismatch");
+		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return rejectCode("PKCE verification failed");
+		if (row.resource && params.resource && row.resource !== params.resource) return rejectCode("resource mismatch");
+		const authority = await readTokenAuthority(db, row.user_id, row.client_id);
+		const userInfo = authority.user;
+		if (!userInfo) return rejectCode("User not found");
+		if (userInfo.disabled) return rejectCode("User account is disabled");
 		let scopes = clampScopes(filterExperimentalSiteContextWorkflowScopes(JSON.parse(row.scopes)), userInfo.role, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
-		const client = await lookupOAuthClient(db, row.client_id);
+		const client = authority.client;
 		if (client?.scopes?.length) scopes = scopes.filter((scope) => client.scopes.includes(scope));
-		if (scopes.length === 0) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User role no longer supports any of the requested scopes"
-			}
-		};
+		if (scopes.length === 0 || !client || !client.redirectUris.includes(row.redirect_uri)) return rejectCode("User role no longer supports any of the requested scopes");
 		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
 		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
 		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
 		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
-		await withTransaction(db, async (trx) => {
-			await trx.insertInto("_dineway_oauth_tokens").values({
-				token_hash: accessToken.hash,
-				token_type: "access",
-				user_id: row.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "mcp",
-				expires_at: accessExpires,
-				refresh_token_hash: refreshToken.hash,
-				client_id: row.client_id
-			}).execute();
-			await trx.insertInto("_dineway_oauth_tokens").values({
-				token_hash: refreshToken.hash,
-				token_type: "refresh",
-				user_id: row.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "mcp",
-				expires_at: refreshExpires,
-				refresh_token_hash: null,
-				client_id: row.client_id
-			}).execute();
+		await atomicBatch(db, {
+			checks: [
+				rowUnchanged("_dineway_authorization_codes", row),
+				...authority.checks,
+				sql`EXISTS (SELECT 1 FROM _dineway_authorization_codes WHERE code_hash = ${codeHash} AND expires_at > ${currentIsoTimestampValue(db)})`
+			],
+			statements: [
+				db.deleteFrom("_dineway_authorization_codes").where("code_hash", "=", codeHash).compile(),
+				db.insertInto("_dineway_oauth_tokens").values({
+					token_hash: accessToken.hash,
+					token_type: "access",
+					user_id: row.user_id,
+					scopes: JSON.stringify(scopes),
+					client_type: "mcp",
+					expires_at: accessExpires,
+					refresh_token_hash: refreshToken.hash,
+					client_id: row.client_id
+				}).compile(),
+				db.insertInto("_dineway_oauth_tokens").values({
+					token_hash: refreshToken.hash,
+					token_type: "refresh",
+					user_id: row.user_id,
+					scopes: JSON.stringify(scopes),
+					client_type: "mcp",
+					expires_at: refreshExpires,
+					refresh_token_hash: null,
+					client_id: row.client_id
+				}).compile()
+			]
 		});
 		return {
 			success: true,
@@ -258,6 +242,13 @@ async function handleAuthorizationCodeExchange(db, params) {
 			}
 		};
 	} catch (error) {
+		if (error instanceof AtomicWriteConflict) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Authorization code or account permissions changed"
+			}
+		};
 		console.error("Token exchange error:", error);
 		return {
 			success: false,

package/dist/{oauth-clients-tovQ4D4h.mjs → oauth-clients-Cr4pdIAE.mjs}

@@ -1,5 +1,5 @@
-import { s as validateScopes } from "./api-tokens-CmT83Bgj.mjs";
-import { o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-B9x8delL.mjs";
+import { s as validateScopes } from "./api-tokens-DA18zxza.mjs";
+import { o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-fzJHB3ZI.mjs";
 
 //#region src/api/oauth/redirect-uri.ts
 /**

package/dist/object-cache/memory.d.mts

@@ -1,4 +1,4 @@
-import { t as CreateObjectCacheBackendFn } from "../types-CU3Wn2HC.mjs";
+import { t as CreateObjectCacheBackendFn } from "../types-DNPP-eu4.mjs";
 
 //#region src/object-cache/memory.d.ts
 /**

package/dist/{object-cache-D51qOseS.mjs → object-cache-BGjIlY9s.mjs}

@@ -1,5 +1,5 @@
 import { getRequestContext } from "./request-context.mjs";
-import { t as after } from "./after-BfniwgIf.mjs";
+import { t as after } from "./after-BVaUn7bK.mjs";
 
 //#region src/object-cache/codec.ts
 /**