emdash 0.34.0 → 0.35.0

package/dist/db/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/db/adapters.ts"],"sourcesContent":["/**\n * Database Adapter Functions\n *\n * These run at config time (astro.config.mjs) and return serializable descriptors.\n * The actual dialect is created at runtime by loading the entrypoint.\n *\n * @example\n * ```ts\n * // astro.config.mjs\n * import emdash from \"emdash/astro\";\n * import { sqlite } from \"emdash/db\";\n *\n * export default defineConfig({\n *   integrations: [\n *     emdash({\n *       database: sqlite({ url: \"file:./data.db\" }),\n *     }),\n *   ],\n * });\n * ```\n */\n\n/**\n * Dialect family identifier.\n * Used at runtime to select dialect-specific SQL fragments.\n */\nexport type DatabaseDialectType = \"sqlite\" | \"postgres\";\n\nexport type CollectionDeletionGuardInput =\n\t| {\n\t\t\taction: \"fence\";\n\t\t\tcollectionId: string;\n\t\t\tcollectionSlug: string;\n\t\t\tleaseToken: string;\n\t\t\tforceDelete: boolean;\n\t  }\n\t| {\n\t\t\taction: \"drop\";\n\t\t\tcollectionId: string;\n\t\t\tcollectionSlug: string;\n\t\t\tleaseToken: string;\n\t  };\n\nexport type CollectionDeletionGuardResult =\n\t| { outcome: \"fenced\" }\n\t| { outcome: \"has_content\" }\n\t| { outcome: \"stale\" }\n\t| { outcome: \"dropped\" };\n\nexport type ExecuteCollectionDeletionGuard = (\n\tconfig: unknown,\n\tinput: CollectionDeletionGuardInput,\n) => Promise<CollectionDeletionGuardResult>;\n\n/**\n * Database descriptor - serializable config for virtual modules\n */\nexport interface DatabaseDescriptor {\n\tentrypoint: string;\n\tconfig: unknown;\n\ttype: DatabaseDialectType;\n\t/**\n\t * When true, the adapter's runtime entrypoint MUST export a named\n\t * `createRequestScopedDb` function matching the signature declared in\n\t * `virtual:emdash/dialect`. The virtual-module generator re-exports it\n\t * by name, so a missing export becomes a build-time bundler error.\n\t *\n\t * The function is called once per request and decides — based on its own\n\t * runtime config (e.g. whether the user opted into D1 sessions) — whether\n\t * to return a per-request Kysely or null. Use this for features like D1\n\t * read-replica sessions, bookmark cookies, or any per-request DB handle.\n\t *\n\t * When false or absent, the generator emits a stub that returns null and\n\t * the middleware takes its default (singleton) path.\n\t */\n\tsupportsRequestScope?: boolean;\n\t/**\n\t * When true, request middleware resolves the last content-namespace\n\t * invalidation timestamp and passes it to `createRequestScopedDb`.\n\t *\n\t * Keep this unset unless request routing depends on that timestamp: reading\n\t * it may require an object-cache backend round trip.\n\t */\n\tneedsLastContentWriteAt?: boolean;\n\t/**\n\t * When true, the adapter's runtime entrypoint MUST export a named\n\t * `createCoalescingDialect` function. The runtime uses this fresh dialect\n\t * only for its cold-start read batch.\n\t *\n\t * When false or absent, the virtual module exports `undefined` without\n\t * inspecting an optional entrypoint export.\n\t */\n\tsupportsCoalescing?: boolean;\n\t/** The runtime entrypoint exports the deletion-specific atomic guard. */\n\tsupportsCollectionDeletionGuard?: boolean;\n}\n\nexport interface SqliteConfig {\n\t/**\n\t * Database URL (e.g., \"file:./data.db\")\n\t */\n\turl: string;\n}\n\nexport interface LibsqlConfig {\n\t/**\n\t * Database URL (e.g., \"file:./data.db\" or \"libsql://...\")\n\t */\n\turl: string;\n\t/**\n\t * Auth token for remote libSQL\n\t */\n\tauthToken?: string;\n}\n\n/**\n * SQLite database adapter (better-sqlite3)\n *\n * For local development and Node.js deployments.\n *\n * @example\n * ```ts\n * database: sqlite({ url: \"file:./data.db\" })\n * ```\n */\nexport function sqlite(config: SqliteConfig): DatabaseDescriptor {\n\treturn {\n\t\tentrypoint: \"emdash/db/sqlite\",\n\t\tconfig,\n\t\ttype: \"sqlite\",\n\t};\n}\n\n/**\n * libSQL database adapter (Turso)\n *\n * For Turso hosted databases or local libSQL.\n *\n * @example\n * ```ts\n * database: libsql({\n *   url: \"libsql://my-db.turso.io\",\n *   authToken: process.env.TURSO_AUTH_TOKEN,\n * })\n * ```\n */\nexport function libsql(config: LibsqlConfig): DatabaseDescriptor {\n\treturn {\n\t\tentrypoint: \"emdash/db/libsql\",\n\t\tconfig,\n\t\ttype: \"sqlite\",\n\t};\n}\n\n/**\n * PostgreSQL connection configuration\n */\nexport interface PostgresConfig {\n\tconnectionString?: string;\n\thost?: string;\n\tport?: number;\n\tdatabase?: string;\n\tuser?: string;\n\tpassword?: string;\n\tssl?: boolean;\n\tpool?: { min?: number; max?: number };\n}\n\n/**\n * PostgreSQL database adapter\n *\n * For PostgreSQL deployments with connection pooling.\n *\n * @example\n * ```ts\n * database: postgres({ connectionString: process.env.DATABASE_URL })\n * ```\n */\nexport function postgres(config: PostgresConfig): DatabaseDescriptor {\n\treturn {\n\t\tentrypoint: \"emdash/db/postgres\",\n\t\tconfig,\n\t\ttype: \"postgres\",\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;AA6HA,SAAgB,OAAO,QAA0C;AAChE,QAAO;EACN,YAAY;EACZ;EACA,MAAM;EACN;;;;;;;;;;;;;;;AAgBF,SAAgB,OAAO,QAA0C;AAChE,QAAO;EACN,YAAY;EACZ;EACA,MAAM;EACN;;;;;;;;;;;;AA2BF,SAAgB,SAAS,QAA4C;AACpE,QAAO;EACN,YAAY;EACZ;EACA,MAAM;EACN"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/db/adapters.ts"],"sourcesContent":["/**\n * Database Adapter Functions\n *\n * These run at config time (astro.config.mjs) and return serializable descriptors.\n * The actual dialect is created at runtime by loading the entrypoint.\n *\n * @example\n * ```ts\n * // astro.config.mjs\n * import emdash from \"emdash/astro\";\n * import { sqlite } from \"emdash/db\";\n *\n * export default defineConfig({\n *   integrations: [\n *     emdash({\n *       database: sqlite({ url: \"file:./data.db\" }),\n *     }),\n *   ],\n * });\n * ```\n */\n\n/**\n * Dialect family identifier.\n * Used at runtime to select dialect-specific SQL fragments.\n */\nexport type DatabaseDialectType = \"sqlite\" | \"postgres\";\n\nexport type CollectionDeletionGuardInput =\n\t| {\n\t\t\taction: \"fence\";\n\t\t\tcollectionId: string;\n\t\t\tcollectionSlug: string;\n\t\t\tleaseToken: string;\n\t\t\tforceDelete: boolean;\n\t  }\n\t| {\n\t\t\taction: \"drop\";\n\t\t\tcollectionId: string;\n\t\t\tcollectionSlug: string;\n\t\t\tleaseToken: string;\n\t  };\n\nexport type CollectionDeletionGuardResult =\n\t| { outcome: \"fenced\" }\n\t| { outcome: \"has_content\" }\n\t| { outcome: \"stale\" }\n\t| { outcome: \"dropped\" };\n\nexport type ExecuteCollectionDeletionGuard = (\n\tconfig: unknown,\n\tinput: CollectionDeletionGuardInput,\n) => Promise<CollectionDeletionGuardResult>;\n\nconst ENVIRONMENT_VARIABLE_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nfunction migrationEnvironmentVariable(\n\tvalue: string | undefined,\n\tfallback: string,\n\toptionName: string,\n): string {\n\tconst name = value ?? fallback;\n\tif (!ENVIRONMENT_VARIABLE_PATTERN.test(name)) {\n\t\tthrow new Error(`${optionName} must be a valid environment variable name.`);\n\t}\n\treturn name;\n}\n\n/**\n * Database descriptor - serializable config for virtual modules\n */\nexport interface DatabaseDescriptor {\n\tentrypoint: string;\n\tconfig: unknown;\n\ttype: DatabaseDialectType;\n\t/** Deployment migration capability with configuration safe for a build artifact. */\n\tmigrations?: {\n\t\tentrypoint: string;\n\t\tmanifestConfig: unknown;\n\t};\n\t/**\n\t * When true, the adapter's runtime entrypoint MUST export a named\n\t * `createRequestScopedDb` function matching the signature declared in\n\t * `virtual:emdash/dialect`. The virtual-module generator re-exports it\n\t * by name, so a missing export becomes a build-time bundler error.\n\t *\n\t * The function is called once per request and decides — based on its own\n\t * runtime config (e.g. whether the user opted into D1 sessions) — whether\n\t * to return a per-request Kysely or null. Use this for features like D1\n\t * read-replica sessions, bookmark cookies, or any per-request DB handle.\n\t *\n\t * When false or absent, the generator emits a stub that returns null and\n\t * the middleware takes its default (singleton) path.\n\t */\n\tsupportsRequestScope?: boolean;\n\t/**\n\t * When true, request middleware resolves the last content-namespace\n\t * invalidation timestamp and passes it to `createRequestScopedDb`.\n\t *\n\t * Keep this unset unless request routing depends on that timestamp: reading\n\t * it may require an object-cache backend round trip.\n\t */\n\tneedsLastContentWriteAt?: boolean;\n\t/**\n\t * When true, the adapter's runtime entrypoint MUST export a named\n\t * `createCoalescingDialect` function. The runtime uses this fresh dialect\n\t * only for its cold-start read batch.\n\t *\n\t * When false or absent, the virtual module exports `undefined` without\n\t * inspecting an optional entrypoint export.\n\t */\n\tsupportsCoalescing?: boolean;\n\t/** The runtime entrypoint exports the deletion-specific atomic guard. */\n\tsupportsCollectionDeletionGuard?: boolean;\n}\n\nexport interface SqliteConfig {\n\t/**\n\t * Database URL (e.g., \"file:./data.db\")\n\t */\n\turl: string;\n}\n\nexport interface LibsqlConfig {\n\t/**\n\t * Database URL (e.g., \"file:./data.db\" or \"libsql://...\")\n\t */\n\turl: string;\n\t/**\n\t * Auth token for remote libSQL\n\t */\n\tauthToken?: string;\n\tmigrationAuthTokenEnv?: string;\n}\n\n/**\n * SQLite database adapter (better-sqlite3)\n *\n * For local development and Node.js deployments.\n *\n * @example\n * ```ts\n * database: sqlite({ url: \"file:./data.db\" })\n * ```\n */\nexport function sqlite(config: SqliteConfig): DatabaseDescriptor {\n\treturn {\n\t\tentrypoint: \"emdash/db/sqlite\",\n\t\tconfig,\n\t\ttype: \"sqlite\",\n\t\tmigrations: {\n\t\t\tentrypoint: \"emdash/db/sqlite-migrations\",\n\t\t\tmanifestConfig: { url: config.url },\n\t\t},\n\t};\n}\n\n/**\n * libSQL database adapter (Turso)\n *\n * For Turso hosted databases or local libSQL.\n *\n * @example\n * ```ts\n * database: libsql({\n *   url: \"libsql://my-db.turso.io\",\n *   authToken: process.env.TURSO_AUTH_TOKEN,\n * })\n * ```\n */\nexport function libsql(config: LibsqlConfig): DatabaseDescriptor {\n\tconst { migrationAuthTokenEnv, ...runtimeConfig } = config;\n\treturn {\n\t\tentrypoint: \"emdash/db/libsql\",\n\t\tconfig: runtimeConfig,\n\t\ttype: \"sqlite\",\n\t\tmigrations: {\n\t\t\tentrypoint: \"emdash/db/libsql-migrations\",\n\t\t\tmanifestConfig: {\n\t\t\t\turl: config.url,\n\t\t\t\tauthTokenEnv: migrationEnvironmentVariable(\n\t\t\t\t\tmigrationAuthTokenEnv,\n\t\t\t\t\t\"TURSO_AUTH_TOKEN\",\n\t\t\t\t\t\"migrationAuthTokenEnv\",\n\t\t\t\t),\n\t\t\t},\n\t\t},\n\t};\n}\n\n/**\n * PostgreSQL connection configuration\n */\nexport interface PostgresConfig {\n\tconnectionString?: string;\n\thost?: string;\n\tport?: number;\n\tdatabase?: string;\n\tuser?: string;\n\tpassword?: string;\n\tssl?: boolean;\n\tpool?: { min?: number; max?: number };\n\tmigrationConnectionStringEnv?: string;\n}\n\n/**\n * PostgreSQL database adapter\n *\n * For PostgreSQL deployments with connection pooling.\n *\n * @example\n * ```ts\n * database: postgres({ connectionString: process.env.DATABASE_URL })\n * ```\n */\nexport function postgres(config: PostgresConfig): DatabaseDescriptor {\n\tconst { migrationConnectionStringEnv, ...runtimeConfig } = config;\n\treturn {\n\t\tentrypoint: \"emdash/db/postgres\",\n\t\tconfig: runtimeConfig,\n\t\ttype: \"postgres\",\n\t\tmigrations: {\n\t\t\tentrypoint: \"emdash/db/postgres-migrations\",\n\t\t\tmanifestConfig: {\n\t\t\t\tconnectionStringEnv: migrationEnvironmentVariable(\n\t\t\t\t\tmigrationConnectionStringEnv,\n\t\t\t\t\t\"DATABASE_URL\",\n\t\t\t\t\t\"migrationConnectionStringEnv\",\n\t\t\t\t),\n\t\t\t},\n\t\t},\n\t};\n}\n"],"mappings":";;;;;AAsDA,MAAM,+BAA+B;AAErC,SAAS,6BACR,OACA,UACA,YACS;CACT,MAAM,OAAO,SAAS;AACtB,KAAI,CAAC,6BAA6B,KAAK,KAAK,CAC3C,OAAM,IAAI,MAAM,GAAG,WAAW,6CAA6C;AAE5E,QAAO;;;;;;;;;;;;AAgFR,SAAgB,OAAO,QAA0C;AAChE,QAAO;EACN,YAAY;EACZ;EACA,MAAM;EACN,YAAY;GACX,YAAY;GACZ,gBAAgB,EAAE,KAAK,OAAO,KAAK;GACnC;EACD;;;;;;;;;;;;;;;AAgBF,SAAgB,OAAO,QAA0C;CAChE,MAAM,EAAE,uBAAuB,GAAG,kBAAkB;AACpD,QAAO;EACN,YAAY;EACZ,QAAQ;EACR,MAAM;EACN,YAAY;GACX,YAAY;GACZ,gBAAgB;IACf,KAAK,OAAO;IACZ,cAAc,6BACb,uBACA,oBACA,wBACA;IACD;GACD;EACD;;;;;;;;;;;;AA4BF,SAAgB,SAAS,QAA4C;CACpE,MAAM,EAAE,8BAA8B,GAAG,kBAAkB;AAC3D,QAAO;EACN,YAAY;EACZ,QAAQ;EACR,MAAM;EACN,YAAY;GACX,YAAY;GACZ,gBAAgB,EACf,qBAAqB,6BACpB,8BACA,gBACA,+BACA,EACD;GACD;EACD"}

package/dist/db/libsql-migrations.d.mts

@@ -0,0 +1,11 @@
+import { i as MigrationExecutorFactoryContext, n as MigrationExecutor } from "../protocol-DjsJHTlK.mjs";
+
+//#region src/db/libsql-migrations.d.ts
+interface LibsqlMigrationManifestConfig {
+  url: string;
+  authTokenEnv: string;
+}
+declare function createMigrationExecutor(manifestConfig: LibsqlMigrationManifestConfig, context: MigrationExecutorFactoryContext): Promise<MigrationExecutor>;
+//#endregion
+export { LibsqlMigrationManifestConfig, createMigrationExecutor };
+//# sourceMappingURL=libsql-migrations.d.mts.map

package/dist/db/libsql-migrations.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"libsql-migrations.d.mts","names":[],"sources":["../../src/db/libsql-migrations.ts"],"mappings":";;;UAQiB,6BAAA;EAChB,GAAA;EACA,YAAA;AAAA;AAAA,iBA4CqB,uBAAA,CACrB,cAAA,EAAgB,6BAAA,EAChB,OAAA,EAAS,+BAAA,GACP,OAAA,CAAQ,iBAAA"}

package/dist/db/libsql-migrations.mjs

@@ -0,0 +1,57 @@
+import "../runner-C1T11CfC.mjs";
+import "../dialect-helpers-BSbfaO3F.mjs";
+import "../config-C3EBstHi.mjs";
+import "../identity-Ys6Dlc9C.mjs";
+import { t as createDirectMigrationExecutor } from "../direct-executor-CDXeJCSs.mjs";
+import { n as requireMigrationEnvironment, t as createMigrationTarget } from "../target-DixqqV5i.mjs";
+import { createDialect } from "./libsql.mjs";
+import { pathToFileURL } from "node:url";
+import { resolve } from "node:path";
+
+//#region src/db/libsql-migrations.ts
+function resolveLibsqlUrl(url, projectRoot) {
+	if (typeof url !== "string" || url.length === 0) throw new Error("libSQL migration URL is missing.");
+	if (url.startsWith("file:")) {
+		const configuredPath = url.slice(5);
+		if (configuredPath.length === 0) throw new Error("libSQL migration URL is invalid.");
+		const fileUrl = pathToFileURL(resolve(projectRoot, configuredPath));
+		return {
+			connectionUrl: fileUrl.href,
+			label: fileUrl.href,
+			identity: [fileUrl.protocol, fileUrl.pathname],
+			requiresAuthToken: false
+		};
+	}
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error("libSQL migration URL is invalid.");
+	}
+	if (parsed.username || parsed.password) throw new Error("libSQL migration URL must not contain credentials.");
+	return {
+		connectionUrl: url,
+		label: `${parsed.protocol}//${parsed.host}${parsed.pathname}`,
+		identity: [
+			parsed.protocol,
+			parsed.host,
+			parsed.pathname
+		],
+		requiresAuthToken: true
+	};
+}
+async function createMigrationExecutor(manifestConfig, context) {
+	const resolvedUrl = resolveLibsqlUrl(manifestConfig.url, context.projectRoot);
+	const authToken = resolvedUrl.requiresAuthToken ? requireMigrationEnvironment(manifestConfig.authTokenEnv, context.env) : void 0;
+	return createDirectMigrationExecutor({
+		target: await createMigrationTarget("libsql", resolvedUrl.label, resolvedUrl.identity),
+		createDialect: () => createDialect({
+			url: resolvedUrl.connectionUrl,
+			authToken
+		})
+	});
+}
+
+//#endregion
+export { createMigrationExecutor };
+//# sourceMappingURL=libsql-migrations.mjs.map

package/dist/db/libsql-migrations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"libsql-migrations.mjs","names":[],"sources":["../../src/db/libsql-migrations.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n\nimport { createDirectMigrationExecutor } from \"../migrations/direct-executor.js\";\nimport type { MigrationExecutor, MigrationExecutorFactoryContext } from \"../migrations/protocol.js\";\nimport { createMigrationTarget, requireMigrationEnvironment } from \"../migrations/target.js\";\nimport { createDialect } from \"./libsql.js\";\n\nexport interface LibsqlMigrationManifestConfig {\n\turl: string;\n\tauthTokenEnv: string;\n}\n\ninterface ResolvedLibsqlUrl {\n\tconnectionUrl: string;\n\tlabel: string;\n\tidentity: string[];\n\trequiresAuthToken: boolean;\n}\n\nfunction resolveLibsqlUrl(url: unknown, projectRoot: string): ResolvedLibsqlUrl {\n\tif (typeof url !== \"string\" || url.length === 0) {\n\t\tthrow new Error(\"libSQL migration URL is missing.\");\n\t}\n\tif (url.startsWith(\"file:\")) {\n\t\tconst configuredPath = url.slice(5);\n\t\tif (configuredPath.length === 0) throw new Error(\"libSQL migration URL is invalid.\");\n\t\tconst fileUrl = pathToFileURL(resolve(projectRoot, configuredPath));\n\t\treturn {\n\t\t\tconnectionUrl: fileUrl.href,\n\t\t\tlabel: fileUrl.href,\n\t\t\tidentity: [fileUrl.protocol, fileUrl.pathname],\n\t\t\trequiresAuthToken: false,\n\t\t};\n\t}\n\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new Error(\"libSQL migration URL is invalid.\");\n\t}\n\tif (parsed.username || parsed.password) {\n\t\tthrow new Error(\"libSQL migration URL must not contain credentials.\");\n\t}\n\tconst label = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;\n\treturn {\n\t\tconnectionUrl: url,\n\t\tlabel,\n\t\tidentity: [parsed.protocol, parsed.host, parsed.pathname],\n\t\trequiresAuthToken: true,\n\t};\n}\n\nexport async function createMigrationExecutor(\n\tmanifestConfig: LibsqlMigrationManifestConfig,\n\tcontext: MigrationExecutorFactoryContext,\n): Promise<MigrationExecutor> {\n\tconst resolvedUrl = resolveLibsqlUrl(manifestConfig.url, context.projectRoot);\n\tconst authToken = resolvedUrl.requiresAuthToken\n\t\t? requireMigrationEnvironment(manifestConfig.authTokenEnv, context.env)\n\t\t: undefined;\n\tconst target = await createMigrationTarget(\"libsql\", resolvedUrl.label, resolvedUrl.identity);\n\treturn createDirectMigrationExecutor({\n\t\ttarget,\n\t\tcreateDialect: () =>\n\t\t\tcreateDialect({\n\t\t\t\turl: resolvedUrl.connectionUrl,\n\t\t\t\tauthToken,\n\t\t\t}),\n\t});\n}\n"],"mappings":";;;;;;;;;;;AAoBA,SAAS,iBAAiB,KAAc,aAAwC;AAC/E,KAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAC7C,OAAM,IAAI,MAAM,mCAAmC;AAEpD,KAAI,IAAI,WAAW,QAAQ,EAAE;EAC5B,MAAM,iBAAiB,IAAI,MAAM,EAAE;AACnC,MAAI,eAAe,WAAW,EAAG,OAAM,IAAI,MAAM,mCAAmC;EACpF,MAAM,UAAU,cAAc,QAAQ,aAAa,eAAe,CAAC;AACnE,SAAO;GACN,eAAe,QAAQ;GACvB,OAAO,QAAQ;GACf,UAAU,CAAC,QAAQ,UAAU,QAAQ,SAAS;GAC9C,mBAAmB;GACnB;;CAGF,IAAI;AACJ,KAAI;AACH,WAAS,IAAI,IAAI,IAAI;SACd;AACP,QAAM,IAAI,MAAM,mCAAmC;;AAEpD,KAAI,OAAO,YAAY,OAAO,SAC7B,OAAM,IAAI,MAAM,qDAAqD;AAGtE,QAAO;EACN,eAAe;EACf,OAHa,GAAG,OAAO,SAAS,IAAI,OAAO,OAAO,OAAO;EAIzD,UAAU;GAAC,OAAO;GAAU,OAAO;GAAM,OAAO;GAAS;EACzD,mBAAmB;EACnB;;AAGF,eAAsB,wBACrB,gBACA,SAC6B;CAC7B,MAAM,cAAc,iBAAiB,eAAe,KAAK,QAAQ,YAAY;CAC7E,MAAM,YAAY,YAAY,oBAC3B,4BAA4B,eAAe,cAAc,QAAQ,IAAI,GACrE;AAEH,QAAO,8BAA8B;EACpC,QAFc,MAAM,sBAAsB,UAAU,YAAY,OAAO,YAAY,SAAS;EAG5F,qBACC,cAAc;GACb,KAAK,YAAY;GACjB;GACA,CAAC;EACH,CAAC"}

package/dist/db/libsql.d.mts

@@ -1,4 +1,4 @@
-import { o as LibsqlConfig } from "../adapters-34EN2eXO.mjs";
+import { o as LibsqlConfig } from "../adapters-Bb1vG41D.mjs";
 import { Dialect } from "kysely";
 
 //#region src/db/libsql.d.ts

package/dist/db/postgres-migrations.d.mts

@@ -0,0 +1,10 @@
+import { i as MigrationExecutorFactoryContext, n as MigrationExecutor } from "../protocol-DjsJHTlK.mjs";
+
+//#region src/db/postgres-migrations.d.ts
+interface PostgresMigrationManifestConfig {
+  connectionStringEnv: string;
+}
+declare function createMigrationExecutor(manifestConfig: PostgresMigrationManifestConfig, context: MigrationExecutorFactoryContext): Promise<MigrationExecutor>;
+//#endregion
+export { PostgresMigrationManifestConfig, createMigrationExecutor };
+//# sourceMappingURL=postgres-migrations.d.mts.map

package/dist/db/postgres-migrations.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-migrations.d.mts","names":[],"sources":["../../src/db/postgres-migrations.ts"],"mappings":";;;UAKiB,+BAAA;EAChB,mBAAA;AAAA;AAAA,iBA8BqB,uBAAA,CACrB,cAAA,EAAgB,+BAAA,EAChB,OAAA,EAAS,+BAAA,GACP,OAAA,CAAQ,iBAAA"}

package/dist/db/postgres-migrations.mjs

@@ -0,0 +1,47 @@
+import "../runner-C1T11CfC.mjs";
+import "../dialect-helpers-BSbfaO3F.mjs";
+import "../config-C3EBstHi.mjs";
+import "../identity-Ys6Dlc9C.mjs";
+import { t as createDirectMigrationExecutor } from "../direct-executor-CDXeJCSs.mjs";
+import { n as requireMigrationEnvironment, t as createMigrationTarget } from "../target-DixqqV5i.mjs";
+import { createDialect } from "./postgres.mjs";
+
+//#region src/db/postgres-migrations.ts
+function parseTargetIdentity(connectionString) {
+	let parsed;
+	try {
+		parsed = new URL(connectionString);
+	} catch {
+		throw new Error("PostgreSQL migration connection string is invalid.");
+	}
+	if (parsed.protocol !== "postgres:" && parsed.protocol !== "postgresql:") throw new Error("PostgreSQL migration connection string is invalid.");
+	const database = parsed.pathname.slice(1);
+	if (!parsed.hostname || !database) throw new Error("PostgreSQL migration connection string must identify a host and database.");
+	return {
+		host: parsed.hostname,
+		port: parsed.port || "5432",
+		database
+	};
+}
+async function createMigrationExecutor(manifestConfig, context) {
+	const connectionString = requireMigrationEnvironment(context.overrides?.databaseUrlEnv ?? manifestConfig.connectionStringEnv, context.env);
+	const identity = parseTargetIdentity(connectionString);
+	return createDirectMigrationExecutor({
+		target: await createMigrationTarget("postgres", `${identity.host}:${identity.port}/${identity.database}`, [
+			identity.host,
+			identity.port,
+			identity.database
+		]),
+		createDialect: () => createDialect({
+			connectionString,
+			pool: {
+				min: 0,
+				max: 1
+			}
+		})
+	});
+}
+
+//#endregion
+export { createMigrationExecutor };
+//# sourceMappingURL=postgres-migrations.mjs.map

package/dist/db/postgres-migrations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-migrations.mjs","names":[],"sources":["../../src/db/postgres-migrations.ts"],"sourcesContent":["import { createDirectMigrationExecutor } from \"../migrations/direct-executor.js\";\nimport type { MigrationExecutor, MigrationExecutorFactoryContext } from \"../migrations/protocol.js\";\nimport { createMigrationTarget, requireMigrationEnvironment } from \"../migrations/target.js\";\nimport { createDialect } from \"./postgres.js\";\n\nexport interface PostgresMigrationManifestConfig {\n\tconnectionStringEnv: string;\n}\n\ninterface PostgresTargetIdentity {\n\thost: string;\n\tport: string;\n\tdatabase: string;\n}\n\nfunction parseTargetIdentity(connectionString: string): PostgresTargetIdentity {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(connectionString);\n\t} catch {\n\t\tthrow new Error(\"PostgreSQL migration connection string is invalid.\");\n\t}\n\tif (parsed.protocol !== \"postgres:\" && parsed.protocol !== \"postgresql:\") {\n\t\tthrow new Error(\"PostgreSQL migration connection string is invalid.\");\n\t}\n\tconst database = parsed.pathname.slice(1);\n\tif (!parsed.hostname || !database) {\n\t\tthrow new Error(\"PostgreSQL migration connection string must identify a host and database.\");\n\t}\n\treturn {\n\t\thost: parsed.hostname,\n\t\tport: parsed.port || \"5432\",\n\t\tdatabase,\n\t};\n}\n\nexport async function createMigrationExecutor(\n\tmanifestConfig: PostgresMigrationManifestConfig,\n\tcontext: MigrationExecutorFactoryContext,\n): Promise<MigrationExecutor> {\n\tconst connectionStringEnv =\n\t\tcontext.overrides?.databaseUrlEnv ?? manifestConfig.connectionStringEnv;\n\tconst connectionString = requireMigrationEnvironment(connectionStringEnv, context.env);\n\tconst identity = parseTargetIdentity(connectionString);\n\tconst label = `${identity.host}:${identity.port}/${identity.database}`;\n\tconst target = await createMigrationTarget(\"postgres\", label, [\n\t\tidentity.host,\n\t\tidentity.port,\n\t\tidentity.database,\n\t]);\n\treturn createDirectMigrationExecutor({\n\t\ttarget,\n\t\tcreateDialect: () =>\n\t\t\tcreateDialect({\n\t\t\t\tconnectionString,\n\t\t\t\tpool: { min: 0, max: 1 },\n\t\t\t}),\n\t});\n}\n"],"mappings":";;;;;;;;;AAeA,SAAS,oBAAoB,kBAAkD;CAC9E,IAAI;AACJ,KAAI;AACH,WAAS,IAAI,IAAI,iBAAiB;SAC3B;AACP,QAAM,IAAI,MAAM,qDAAqD;;AAEtE,KAAI,OAAO,aAAa,eAAe,OAAO,aAAa,cAC1D,OAAM,IAAI,MAAM,qDAAqD;CAEtE,MAAM,WAAW,OAAO,SAAS,MAAM,EAAE;AACzC,KAAI,CAAC,OAAO,YAAY,CAAC,SACxB,OAAM,IAAI,MAAM,4EAA4E;AAE7F,QAAO;EACN,MAAM,OAAO;EACb,MAAM,OAAO,QAAQ;EACrB;EACA;;AAGF,eAAsB,wBACrB,gBACA,SAC6B;CAG7B,MAAM,mBAAmB,4BADxB,QAAQ,WAAW,kBAAkB,eAAe,qBACqB,QAAQ,IAAI;CACtF,MAAM,WAAW,oBAAoB,iBAAiB;AAOtD,QAAO,8BAA8B;EACpC,QANc,MAAM,sBAAsB,YAD7B,GAAG,SAAS,KAAK,GAAG,SAAS,KAAK,GAAG,SAAS,YACE;GAC7D,SAAS;GACT,SAAS;GACT,SAAS;GACT,CAAC;EAGD,qBACC,cAAc;GACb;GACA,MAAM;IAAE,KAAK;IAAG,KAAK;IAAG;GACxB,CAAC;EACH,CAAC"}

package/dist/db/postgres.d.mts

@@ -1,4 +1,4 @@
-import { s as PostgresConfig } from "../adapters-34EN2eXO.mjs";
+import { s as PostgresConfig } from "../adapters-Bb1vG41D.mjs";
 import { PostgresDialect } from "kysely";
 
 //#region src/db/postgres.d.ts

package/dist/db/sqlite-migrations.d.mts

@@ -0,0 +1,10 @@
+import { i as MigrationExecutorFactoryContext, n as MigrationExecutor } from "../protocol-DjsJHTlK.mjs";
+
+//#region src/db/sqlite-migrations.d.ts
+interface SqliteMigrationManifestConfig {
+  url: string;
+}
+declare function createMigrationExecutor(manifestConfig: SqliteMigrationManifestConfig, context: MigrationExecutorFactoryContext): Promise<MigrationExecutor>;
+//#endregion
+export { SqliteMigrationManifestConfig, createMigrationExecutor };
+//# sourceMappingURL=sqlite-migrations.d.mts.map

package/dist/db/sqlite-migrations.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-migrations.d.mts","names":[],"sources":["../../src/db/sqlite-migrations.ts"],"mappings":";;;UAOiB,6BAAA;EAChB,GAAA;AAAA;AAAA,iBAkBqB,uBAAA,CACrB,cAAA,EAAgB,6BAAA,EAChB,OAAA,EAAS,+BAAA,GACP,OAAA,CAAQ,iBAAA"}

package/dist/db/sqlite-migrations.mjs

@@ -0,0 +1,28 @@
+import "../runner-C1T11CfC.mjs";
+import "../dialect-helpers-BSbfaO3F.mjs";
+import "../config-C3EBstHi.mjs";
+import "../identity-Ys6Dlc9C.mjs";
+import { createDialect } from "./sqlite.mjs";
+import { t as createDirectMigrationExecutor } from "../direct-executor-CDXeJCSs.mjs";
+import { t as createMigrationTarget } from "../target-DixqqV5i.mjs";
+import { isAbsolute, resolve } from "node:path";
+
+//#region src/db/sqlite-migrations.ts
+function resolveDatabasePath(manifestConfig, context) {
+	const configuredUrl = context.overrides?.database ?? manifestConfig.url;
+	if (typeof configuredUrl !== "string" || configuredUrl.length === 0) throw new Error("SQLite migration database path is missing.");
+	const path = configuredUrl.startsWith("file:") ? configuredUrl.slice(5) : configuredUrl;
+	if (path.length === 0) throw new Error("SQLite migration database path is missing.");
+	return isAbsolute(path) ? resolve(path) : resolve(context.projectRoot, path);
+}
+async function createMigrationExecutor(manifestConfig, context) {
+	const databasePath = resolveDatabasePath(manifestConfig, context);
+	return createDirectMigrationExecutor({
+		target: await createMigrationTarget("sqlite", databasePath, [databasePath]),
+		createDialect: () => createDialect({ url: databasePath })
+	});
+}
+
+//#endregion
+export { createMigrationExecutor };
+//# sourceMappingURL=sqlite-migrations.mjs.map

package/dist/db/sqlite-migrations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-migrations.mjs","names":[],"sources":["../../src/db/sqlite-migrations.ts"],"sourcesContent":["import { isAbsolute, resolve } from \"node:path\";\n\nimport { createDirectMigrationExecutor } from \"../migrations/direct-executor.js\";\nimport type { MigrationExecutor, MigrationExecutorFactoryContext } from \"../migrations/protocol.js\";\nimport { createMigrationTarget } from \"../migrations/target.js\";\nimport { createDialect } from \"./sqlite.js\";\n\nexport interface SqliteMigrationManifestConfig {\n\turl: string;\n}\n\nfunction resolveDatabasePath(\n\tmanifestConfig: SqliteMigrationManifestConfig,\n\tcontext: MigrationExecutorFactoryContext,\n): string {\n\tconst configuredUrl = context.overrides?.database ?? manifestConfig.url;\n\tif (typeof configuredUrl !== \"string\" || configuredUrl.length === 0) {\n\t\tthrow new Error(\"SQLite migration database path is missing.\");\n\t}\n\tconst path = configuredUrl.startsWith(\"file:\") ? configuredUrl.slice(5) : configuredUrl;\n\tif (path.length === 0) {\n\t\tthrow new Error(\"SQLite migration database path is missing.\");\n\t}\n\treturn isAbsolute(path) ? resolve(path) : resolve(context.projectRoot, path);\n}\n\nexport async function createMigrationExecutor(\n\tmanifestConfig: SqliteMigrationManifestConfig,\n\tcontext: MigrationExecutorFactoryContext,\n): Promise<MigrationExecutor> {\n\tconst databasePath = resolveDatabasePath(manifestConfig, context);\n\tconst target = await createMigrationTarget(\"sqlite\", databasePath, [databasePath]);\n\treturn createDirectMigrationExecutor({\n\t\ttarget,\n\t\tcreateDialect: () => createDialect({ url: databasePath }),\n\t});\n}\n"],"mappings":";;;;;;;;;;AAWA,SAAS,oBACR,gBACA,SACS;CACT,MAAM,gBAAgB,QAAQ,WAAW,YAAY,eAAe;AACpE,KAAI,OAAO,kBAAkB,YAAY,cAAc,WAAW,EACjE,OAAM,IAAI,MAAM,6CAA6C;CAE9D,MAAM,OAAO,cAAc,WAAW,QAAQ,GAAG,cAAc,MAAM,EAAE,GAAG;AAC1E,KAAI,KAAK,WAAW,EACnB,OAAM,IAAI,MAAM,6CAA6C;AAE9D,QAAO,WAAW,KAAK,GAAG,QAAQ,KAAK,GAAG,QAAQ,QAAQ,aAAa,KAAK;;AAG7E,eAAsB,wBACrB,gBACA,SAC6B;CAC7B,MAAM,eAAe,oBAAoB,gBAAgB,QAAQ;AAEjE,QAAO,8BAA8B;EACpC,QAFc,MAAM,sBAAsB,UAAU,cAAc,CAAC,aAAa,CAAC;EAGjF,qBAAqB,cAAc,EAAE,KAAK,cAAc,CAAC;EACzD,CAAC"}

package/dist/db/sqlite.d.mts

@@ -1,4 +1,4 @@
-import { c as SqliteConfig } from "../adapters-34EN2eXO.mjs";
+import { c as SqliteConfig } from "../adapters-Bb1vG41D.mjs";
 import { Dialect } from "kysely";
 
 //#region src/db/sqlite.d.ts

package/dist/{deferred-tasks-BMsa9F64.d.mts → deferred-tasks-SDWxrgzJ.d.mts}

@@ -6,4 +6,4 @@ interface DeferredTaskTracker {
 }
 //#endregion
 export { DeferredTaskTracker as t };
-//# sourceMappingURL=deferred-tasks-BMsa9F64.d.mts.map
+//# sourceMappingURL=deferred-tasks-SDWxrgzJ.d.mts.map

package/dist/{deferred-tasks-BMsa9F64.d.mts.map → deferred-tasks-SDWxrgzJ.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"deferred-tasks-BMsa9F64.d.mts","names":[],"sources":["../src/deferred-tasks.ts"],"mappings":";UAAiB,mBAAA;EAChB,OAAA,EAAS,OAAA;EACT,KAAA,IAAS,OAAA,EAAS,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;EACvC,MAAA;AAAA"}
+{"version":3,"file":"deferred-tasks-SDWxrgzJ.d.mts","names":[],"sources":["../src/deferred-tasks.ts"],"mappings":";UAAiB,mBAAA;EAChB,OAAA,EAAS,OAAA;EACT,KAAA,IAAS,OAAA,EAAS,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;EACvC,MAAA;AAAA"}

package/dist/{device-flow-CaioYGK3.mjs → device-flow-C0GdD_z8.mjs}

@@ -1,7 +1,7 @@
 import { t as withTransaction } from "./transaction-NQj4VJ7Z.mjs";
-import { a as hashApiToken, o as isValidScope, r as generatePrefixedToken, t as TOKEN_PREFIXES } from "./api-tokens-CyTsLszZ.mjs";
-import { o as lookupOAuthClient } from "./oauth-clients-C_DNqtRu.mjs";
-import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-BxfZizdk.mjs";
+import { a as hashApiToken, o as isValidScope, r as generatePrefixedToken, t as TOKEN_PREFIXES } from "./api-tokens-rIXC6LdE.mjs";
+import { o as lookupOAuthClient } from "./oauth-clients-CvI0nHMJ.mjs";
+import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-C5SQwGYC.mjs";
 import { clampScopes } from "@emdash-cms/auth";
 import { generateCodeVerifier } from "arctic";
 
@@ -463,4 +463,4 @@ async function handleTokenRevoke(db, input) {
 
 //#endregion
 export { handleTokenRevoke as a, handleTokenRefresh as i, handleDeviceCodeRequest as n, handleDeviceTokenExchange as r, handleDeviceAuthorize as t };
-//# sourceMappingURL=device-flow-CaioYGK3.mjs.map
+//# sourceMappingURL=device-flow-C0GdD_z8.mjs.map

package/dist/{device-flow-CaioYGK3.mjs.map → device-flow-C0GdD_z8.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"device-flow-CaioYGK3.mjs","names":[],"sources":["../src/api/handlers/device-flow.ts"],"sourcesContent":["/**\n * OAuth Device Flow handlers (RFC 8628).\n *\n * EmDash acts as an OAuth 2.0 authorization server. The CLI requests\n * a device code, displays a URL + user code, and polls for a token.\n * The user opens a browser, logs in, enters the code, and the CLI gets\n * an access + refresh token pair.\n *\n * Uses arctic for code generation and @emdash-cms/auth for token utilities.\n */\n\nimport { clampScopes } from \"@emdash-cms/auth\";\nimport type { RoleLevel } from \"@emdash-cms/auth\";\nimport { generateCodeVerifier } from \"arctic\";\nimport type { Kysely } from \"kysely\";\n\nimport {\n\tgeneratePrefixedToken,\n\thashApiToken,\n\tisValidScope,\n\tTOKEN_PREFIXES,\n} from \"../../auth/api-tokens.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { lookupOAuthClient } from \"./oauth-clients.js\";\nimport { lookupUserRoleAndStatus } from \"./oauth-user-lookup.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Device codes expire after 15 minutes */\nconst DEVICE_CODE_TTL_SECONDS = 15 * 60;\n\n/** Default polling interval in seconds */\nconst DEFAULT_INTERVAL = 5;\n\n/** RFC 8628 §3.5: interval increase on slow_down */\nconst SLOW_DOWN_INCREMENT = 5;\n\n/** Maximum slow_down interval cap (seconds) */\nconst MAX_SLOW_DOWN_INTERVAL = 60;\n\n/** Access token TTL: 1 hour */\nconst ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\n/** Refresh token TTL: 90 days */\nconst REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\n/** Default scopes for CLI login */\nconst DEFAULT_SCOPES = [\n\t\"content:read\",\n\t\"content:write\",\n\t\"media:read\",\n\t\"media:write\",\n\t\"schema:read\",\n] as const;\n\n/** Pattern to normalize user codes (strip hyphens) */\nconst HYPHEN_PATTERN = /-/g;\n\n/** Characters for user codes (uppercase, no ambiguous chars like 0/O, 1/I) */\nconst USER_CODE_CHARS = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface DeviceCodeResponse {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri: string;\n\texpires_in: number;\n\tinterval: number;\n}\n\nexport interface TokenResponse {\n\taccess_token: string;\n\trefresh_token: string;\n\ttoken_type: \"Bearer\";\n\texpires_in: number;\n\tscope: string;\n}\n\n// RFC 8628 error codes\nexport type DeviceFlowError =\n\t| \"authorization_pending\"\n\t| \"slow_down\"\n\t| \"expired_token\"\n\t| \"access_denied\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Generate a short human-readable user code (XXXX-XXXX) */\nfunction generateUserCode(): string {\n\tconst bytes = new Uint8Array(8);\n\tcrypto.getRandomValues(bytes);\n\tconst chars = Array.from(bytes, (b) => USER_CODE_CHARS[b % USER_CODE_CHARS.length]).join(\"\");\n\treturn `${chars.slice(0, 4)}-${chars.slice(4, 8)}`;\n}\n\n/** Get an ISO datetime string offset from now */\nfunction expiresAt(seconds: number): string {\n\treturn new Date(Date.now() + seconds * 1000).toISOString();\n}\n\n/** Validate and normalize scopes. Returns validated scope list. */\nfunction normalizeScopes(requested?: string[]): string[] {\n\tif (!requested || requested.length === 0) {\n\t\treturn [...DEFAULT_SCOPES];\n\t}\n\treturn requested.filter(isValidScope);\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * POST /oauth/device/code\n *\n * Issue a device code + user code. The CLI displays the user code\n * and tells the user to open the verification URI.\n */\nexport async function handleDeviceCodeRequest(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tclient_id?: string;\n\t\tscope?: string;\n\t},\n\tverificationUri: string,\n): Promise<ApiResult<DeviceCodeResponse>> {\n\ttry {\n\t\t// Note: client_id is accepted but not validated against _emdash_oauth_clients\n\t\t// because the CLI uses a well-known built-in client ID (\"emdash-cli\") that\n\t\t// isn't stored in the DB. Full client_id validation + scope clamping for the\n\t\t// device flow is tracked as a follow-up.\n\n\t\t// Parse and validate scopes\n\t\tconst requestedScopes = input.scope ? input.scope.split(\" \").filter(Boolean) : [];\n\t\tconst scopes = normalizeScopes(requestedScopes);\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_SCOPE\", message: \"No valid scopes requested\" },\n\t\t\t};\n\t\t}\n\n\t\tconst deviceCode = generateCodeVerifier();\n\t\tconst userCode = generateUserCode();\n\t\tconst expires = expiresAt(DEVICE_CODE_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_device_codes\")\n\t\t\t.values({\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tstatus: \"pending\",\n\t\t\t\texpires_at: expires,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tverification_uri: verificationUri,\n\t\t\t\texpires_in: DEVICE_CODE_TTL_SECONDS,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"DEVICE_CODE_ERROR\",\n\t\t\t\tmessage: \"Failed to create device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/token\n *\n * CLI polls this endpoint with the device_code. Returns:\n * - 200 with tokens if authorized\n * - 400 with error \"authorization_pending\" while waiting\n * - 400 with error \"slow_down\" if polling too fast\n * - 400 with error \"expired_token\" if the code expired\n * - 400 with error \"access_denied\" if the user denied\n */\nexport async function handleDeviceTokenExchange(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tdevice_code: string;\n\t\tgrant_type: string;\n\t},\n): Promise<\n\tApiResult<TokenResponse> & { deviceFlowError?: DeviceFlowError; deviceFlowInterval?: number }\n> {\n\ttry {\n\t\t// Validate grant_type\n\t\tif (input.grant_type !== \"urn:ietf:params:oauth:grant-type:device_code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\t// Look up the device code\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t\t.selectAll()\n\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code\" },\n\t\t\t};\n\t\t}\n\n\t\tconst now = new Date();\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < now) {\n\t\t\t// Clean up expired code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"expired_token\",\n\t\t\t\terror: { code: \"expired_token\", message: \"The device code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check status\n\t\tif (row.status === \"denied\") {\n\t\t\t// Clean up denied code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"access_denied\",\n\t\t\t\terror: { code: \"access_denied\", message: \"The user denied the request\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status === \"pending\") {\n\t\t\t// RFC 8628 §3.5: slow_down enforcement during polling phase.\n\t\t\t// Only applies while waiting for authorization — once authorized,\n\t\t\t// the final exchange proceeds without throttling.\n\t\t\tif (row.last_polled_at) {\n\t\t\t\tconst lastPolled = new Date(row.last_polled_at);\n\t\t\t\tconst elapsedSeconds = (now.getTime() - lastPolled.getTime()) / 1000;\n\n\t\t\t\tif (elapsedSeconds < row.interval) {\n\t\t\t\t\t// Too fast — increase interval by 5s per RFC 8628 §3.5, capped at 60s\n\t\t\t\t\tconst newInterval = Math.min(row.interval + SLOW_DOWN_INCREMENT, MAX_SLOW_DOWN_INTERVAL);\n\t\t\t\t\tawait db\n\t\t\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t\t\t.set({\n\t\t\t\t\t\t\tinterval: newInterval,\n\t\t\t\t\t\t\tlast_polled_at: now.toISOString(),\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t\t\t.execute();\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\tdeviceFlowError: \"slow_down\",\n\t\t\t\t\t\tdeviceFlowInterval: newInterval,\n\t\t\t\t\t\terror: { code: \"slow_down\", message: \"Polling too fast\" },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Update last_polled_at for future slow_down checks\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ last_polled_at: now.toISOString() })\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"authorization_pending\",\n\t\t\t\terror: { code: \"authorization_pending\", message: \"Authorization pending\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status !== \"authorized\" || !row.user_id) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code state\" },\n\t\t\t};\n\t\t}\n\n\t\t// Generate tokens before consuming the device code so that if\n\t\t// generation fails, the code is still available for retry.\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\t\tconst refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);\n\t\tconst refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);\n\n\t\t// Atomically consume the device code and create tokens in a single\n\t\t// transaction. DELETE...RETURNING prevents TOCTOU: two concurrent\n\t\t// requests race on the DELETE, only one gets a row back. Wrapping\n\t\t// in a transaction ensures the code isn't consumed if token storage fails.\n\t\tconst result = await withTransaction(db, async (trx) => {\n\t\t\tconst consumed = await trx\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.where(\"status\", \"=\", \"authorized\")\n\t\t\t\t.returningAll()\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!consumed) return null;\n\n\t\t\tif (!consumed.user_id) return null;\n\n\t\t\tconst scopes = JSON.parse(consumed.scopes) as string[];\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\t\ttoken_type: \"access\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: accessExpires,\n\t\t\t\t\trefresh_token_hash: refreshToken.hash,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: refreshToken.hash,\n\t\t\t\t\ttoken_type: \"refresh\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: refreshExpires,\n\t\t\t\t\trefresh_token_hash: null,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\treturn { scopes };\n\t\t});\n\n\t\tif (!result) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Device code already consumed\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: refreshToken.raw,\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: result.scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_EXCHANGE_ERROR\",\n\t\t\t\tmessage: \"Failed to exchange device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/authorize\n *\n * The user submits the user_code after logging in via the browser.\n * This authorizes the device code, allowing the CLI to exchange it for tokens.\n *\n * Scopes are clamped to the user's role at this point. The stored scopes\n * are replaced with the intersection of requested scopes and the scopes\n * the user's role permits. This prevents scope escalation.\n */\nexport async function handleDeviceAuthorize(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tuserRole: RoleLevel,\n\tinput: {\n\t\tuser_code: string;\n\t\taction?: \"approve\" | \"deny\";\n\t},\n): Promise<ApiResult<{ authorized: boolean }>> {\n\ttry {\n\t\t// Normalize user code (strip hyphens, uppercase)\n\t\tconst normalizedCode = input.user_code.replace(HYPHEN_PATTERN, \"\").toUpperCase();\n\n\t\t// Look up the device code by user_code\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t\t.selectAll()\n\t\t\t.where(\"status\", \"=\", \"pending\")\n\t\t\t.execute();\n\n\t\t// Find the matching code (strip hyphens for comparison)\n\t\tconst match = row.find(\n\t\t\t(r) => r.user_code.replace(HYPHEN_PATTERN, \"\").toUpperCase() === normalizedCode,\n\t\t);\n\n\t\tif (!match) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CODE\", message: \"Invalid or expired code\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(match.expires_at) < new Date()) {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"EXPIRED_CODE\", message: \"This code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\tconst action = input.action ?? \"approve\";\n\n\t\tif (action === \"deny\") {\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ status: \"denied\" })\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn { success: true, data: { authorized: false } };\n\t\t}\n\n\t\t// Clamp requested scopes to those the user's role permits.\n\t\t// effective_scopes = requested_scopes ∩ scopesForRole(user.role)\n\t\tconst requestedScopes = JSON.parse(match.scopes) as string[];\n\t\tconst effectiveScopes = clampScopes(requestedScopes, userRole);\n\n\t\tif (effectiveScopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INSUFFICIENT_ROLE\",\n\t\t\t\t\tmessage: \"Your role does not permit any of the requested scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Approve: set user_id, status, and clamped scopes\n\t\tawait db\n\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t.set({\n\t\t\t\tstatus: \"authorized\",\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(effectiveScopes),\n\t\t\t})\n\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t.execute();\n\n\t\treturn { success: true, data: { authorized: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORIZE_ERROR\",\n\t\t\t\tmessage: \"Failed to authorize device\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/refresh\n *\n * Exchange a refresh token for a new access token.\n * The refresh token itself is not rotated (per spec: optional rotation).\n */\nexport async function handleTokenRefresh(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\trefresh_token: string;\n\t\tgrant_type: string;\n\t},\n): Promise<ApiResult<TokenResponse>> {\n\ttry {\n\t\tif (input.grant_type !== \"refresh_token\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\tif (!input.refresh_token.startsWith(TOKEN_PREFIXES.OAUTH_REFRESH)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token format\" },\n\t\t\t};\n\t\t}\n\n\t\tconst refreshHash = hashApiToken(input.refresh_token);\n\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.selectAll()\n\t\t\t.where(\"token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"refresh\")\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < new Date()) {\n\t\t\t// Clean up expired refresh token and its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Refresh token expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// SEC-42: Revalidate user role before issuing new access token.\n\t\t// SEC-43: Reject refresh if user is disabled or deleted.\n\t\tconst userInfo = await lookupUserRoleAndStatus(db, row.user_id);\n\t\tif (!userInfo) {\n\t\t\t// User no longer exists — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (userInfo.disabled) {\n\t\t\t// User is disabled — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User account is disabled\" },\n\t\t\t};\n\t\t}\n\n\t\t// Revalidate stored scopes against the user's current role.\n\t\t// A demoted user's refresh token may carry stale elevated scopes.\n\t\tconst storedScopes = JSON.parse(row.scopes) as string[];\n\t\tlet scopes = clampScopes(storedScopes, userInfo.role);\n\n\t\t// SEC-41: Intersect with the client's registered scopes (if any).\n\t\t// Same check as the approval path — a client registered with limited\n\t\t// scopes should never receive elevated scopes on refresh, even if the\n\t\t// user's role would allow them.\n\t\tif (row.client_id) {\n\t\t\tconst client = await lookupOAuthClient(db, row.client_id);\n\t\t\tif (client?.scopes?.length) {\n\t\t\t\tscopes = scopes.filter((s: string) => client.scopes!.includes(s));\n\t\t\t}\n\t\t}\n\n\t\tif (scopes.length === 0) {\n\t\t\t// User's role no longer supports any of the token's scopes — revoke\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_GRANT\",\n\t\t\t\t\tmessage: \"User role no longer supports any of the token's scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Delete old access tokens for this refresh token\n\t\tawait db\n\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t\t.execute();\n\n\t\t// Generate new access token\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t.values({\n\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\ttoken_type: \"access\",\n\t\t\t\tuser_id: row.user_id,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tclient_type: row.client_type,\n\t\t\t\texpires_at: accessExpires,\n\t\t\t\trefresh_token_hash: refreshHash,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: input.refresh_token, // Return same refresh token\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REFRESH_ERROR\",\n\t\t\t\tmessage: \"Failed to refresh token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/revoke\n *\n * Revoke an access or refresh token. If a refresh token is revoked,\n * also revoke all associated access tokens.\n *\n * Per RFC 7009, this endpoint always returns 200 (even for invalid tokens).\n */\nexport async function handleTokenRevoke(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\ttoken: string;\n\t},\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst hash = hashApiToken(input.token);\n\n\t\t// Look up the token\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.select([\"token_hash\", \"token_type\", \"refresh_token_hash\"])\n\t\t\t.where(\"token_hash\", \"=\", hash)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\t// Per RFC 7009: always 200, even for invalid tokens\n\t\t\treturn { success: true, data: { revoked: true } };\n\t\t}\n\n\t\tif (row.token_type === \"refresh\") {\n\t\t\t// Revoke refresh token and all its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"refresh_token_hash\", \"=\", hash).execute();\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t} else {\n\t\t\t// Revoke just the access token\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke token\",\n\t\t\t},\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,MAAM,0BAA0B;;AAGhC,MAAM,mBAAmB;;AAGzB,MAAM,sBAAsB;;AAG5B,MAAM,yBAAyB;;AAG/B,MAAM,2BAA2B;;AAGjC,MAAM,4BAA4B,OAAU,KAAK;;AAGjD,MAAM,iBAAiB;CACtB;CACA;CACA;CACA;CACA;CACA;;AAGD,MAAM,iBAAiB;;AAGvB,MAAM,kBAAkB;;AAkCxB,SAAS,mBAA2B;CACnC,MAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,QAAO,gBAAgB,MAAM;CAC7B,MAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,gBAAgB,IAAI,IAAwB,CAAC,KAAK,GAAG;AAC5F,QAAO,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,MAAM,GAAG,EAAE;;;AAIjD,SAAS,UAAU,SAAyB;AAC3C,QAAO,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,IAAK,CAAC,aAAa;;;AAI3D,SAAS,gBAAgB,WAAgC;AACxD,KAAI,CAAC,aAAa,UAAU,WAAW,EACtC,QAAO,CAAC,GAAG,eAAe;AAE3B,QAAO,UAAU,OAAO,aAAa;;;;;;;;AAatC,eAAsB,wBACrB,IACA,OAIA,iBACyC;AACzC,KAAI;EAQH,MAAM,SAAS,gBADS,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ,GAAG,EAAE,CAClC;AAE/C,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAGF,MAAM,aAAa,sBAAsB;EACzC,MAAM,WAAW,kBAAkB;EACnC,MAAM,UAAU,UAAU,wBAAwB;AAElD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,aAAa;GACb,WAAW;GACX,QAAQ,KAAK,UAAU,OAAO;GAC9B,QAAQ;GACR,YAAY;GACZ,UAAU;GACV,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,aAAa;IACb,WAAW;IACX,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAcH,eAAsB,0BACrB,IACA,OAMC;AACD,KAAI;AAEH,MAAI,MAAM,eAAe,+CACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;EAIF,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAuB;GAChE;EAGF,MAAM,sBAAM,IAAI,MAAM;AAGtB,MAAI,IAAI,KAAK,IAAI,WAAW,GAAG,KAAK;AAEnC,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAIF,MAAI,IAAI,WAAW,UAAU;AAE5B,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAGF,MAAI,IAAI,WAAW,WAAW;AAI7B,OAAI,IAAI,gBAAgB;IACvB,MAAM,aAAa,IAAI,KAAK,IAAI,eAAe;AAG/C,SAFwB,IAAI,SAAS,GAAG,WAAW,SAAS,IAAI,MAE3C,IAAI,UAAU;KAElC,MAAM,cAAc,KAAK,IAAI,IAAI,WAAW,qBAAqB,uBAAuB;AACxF,WAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;MACJ,UAAU;MACV,gBAAgB,IAAI,aAAa;MACjC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,YAAO;MACN,SAAS;MACT,iBAAiB;MACjB,oBAAoB;MACpB,OAAO;OAAE,MAAM;OAAa,SAAS;OAAoB;MACzD;;;AAKH,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC,CAC1C,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAyB,SAAS;KAAyB;IAC1E;;AAGF,MAAI,IAAI,WAAW,gBAAgB,CAAC,IAAI,QACvC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAKF,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;EACzD,MAAM,eAAe,sBAAsB,eAAe,cAAc;EACxE,MAAM,iBAAiB,UAAU,0BAA0B;EAM3D,MAAM,SAAS,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACvD,MAAM,WAAW,MAAM,IACrB,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,MAAM,UAAU,KAAK,aAAa,CAClC,cAAc,CACd,kBAAkB;AAEpB,OAAI,CAAC,SAAU,QAAO;AAEtB,OAAI,CAAC,SAAS,QAAS,QAAO;GAE9B,MAAM,SAAS,KAAK,MAAM,SAAS,OAAO;AAE1C,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,YAAY;IACxB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB,aAAa;IACjC,CAAC,CACD,SAAS;AAEX,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,aAAa;IACzB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,CAAC,CACD,SAAS;AAEX,UAAO,EAAE,QAAQ;IAChB;AAEF,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,aAAa;IAC5B,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,OAAO,KAAK,IAAI;IAC9B;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAcH,eAAsB,sBACrB,IACA,QACA,UACA,OAI8C;AAC9C,KAAI;EAEH,MAAM,iBAAiB,MAAM,UAAU,QAAQ,gBAAgB,GAAG,CAAC,aAAa;EAUhF,MAAM,SAPM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,UAAU,KAAK,UAAU,CAC/B,SAAS,EAGO,MAChB,MAAM,EAAE,UAAU,QAAQ,gBAAgB,GAAG,CAAC,aAAa,KAAK,eACjE;AAED,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAA2B;GACnE;AAIF,MAAI,IAAI,KAAK,MAAM,WAAW,mBAAG,IAAI,MAAM,EAAE;AAC5C,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAgB,SAAS;KAAyB;IACjE;;AAKF,OAFe,MAAM,UAAU,eAEhB,QAAQ;AACtB,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,QAAQ,UAAU,CAAC,CACzB,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IAAE,SAAS;IAAM,MAAM,EAAE,YAAY,OAAO;IAAE;;EAMtD,MAAM,kBAAkB,YADA,KAAK,MAAM,MAAM,OAAO,EACK,SAAS;AAE9D,MAAI,gBAAgB,WAAW,EAC9B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAIF,QAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;GACJ,QAAQ;GACR,SAAS;GACT,QAAQ,KAAK,UAAU,gBAAgB;GACvC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,YAAY,MAAM;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,mBACrB,IACA,OAIoC;AACpC,KAAI;AACH,MAAI,MAAM,eAAe,gBACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;AAGF,MAAI,CAAC,MAAM,cAAc,WAAW,eAAe,cAAc,CAChE,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;EAGF,MAAM,cAAc,aAAa,MAAM,cAAc;EAErD,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,cAAc,KAAK,YAAY,CACrC,MAAM,cAAc,KAAK,UAAU,CACnC,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAyB;GAClE;AAIF,MAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,EAAE;AAE1C,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAyB;IAClE;;EAKF,MAAM,WAAW,MAAM,wBAAwB,IAAI,IAAI,QAAQ;AAC/D,MAAI,CAAC,UAAU;AAEd,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAkB;IAC3D;;AAGF,MAAI,SAAS,UAAU;AAEtB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA4B;IACrE;;EAMF,IAAI,SAAS,YADQ,KAAK,MAAM,IAAI,OAAO,EACJ,SAAS,KAAK;AAMrD,MAAI,IAAI,WAAW;GAClB,MAAM,SAAS,MAAM,kBAAkB,IAAI,IAAI,UAAU;AACzD,OAAI,QAAQ,QAAQ,OACnB,UAAS,OAAO,QAAQ,MAAc,OAAO,OAAQ,SAAS,EAAE,CAAC;;AAInE,MAAI,OAAO,WAAW,GAAG;AAExB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AACX,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;AAIF,QAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,MAAM,cAAc,KAAK,SAAS,CAClC,SAAS;EAGX,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;AAEzD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,YAAY,YAAY;GACxB,YAAY;GACZ,SAAS,IAAI;GACb,QAAQ,KAAK,UAAU,OAAO;GAC9B,aAAa,IAAI;GACjB,YAAY;GACZ,oBAAoB;GACpB,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,MAAM;IACrB,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,KAAK,IAAI;IACvB;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;AAYH,eAAsB,kBACrB,IACA,OAG2C;AAC3C,KAAI;EACH,MAAM,OAAO,aAAa,MAAM,MAAM;EAGtC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;GAAC;GAAc;GAAc;GAAqB,CAAC,CAC1D,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,MAAI,CAAC,IAEJ,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;AAGlD,MAAI,IAAI,eAAe,WAAW;AAEjC,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,sBAAsB,KAAK,KAAK,CAAC,SAAS;AAC5F,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;QAGpF,OAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;AAGrF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD"}
+{"version":3,"file":"device-flow-C0GdD_z8.mjs","names":[],"sources":["../src/api/handlers/device-flow.ts"],"sourcesContent":["/**\n * OAuth Device Flow handlers (RFC 8628).\n *\n * EmDash acts as an OAuth 2.0 authorization server. The CLI requests\n * a device code, displays a URL + user code, and polls for a token.\n * The user opens a browser, logs in, enters the code, and the CLI gets\n * an access + refresh token pair.\n *\n * Uses arctic for code generation and @emdash-cms/auth for token utilities.\n */\n\nimport { clampScopes } from \"@emdash-cms/auth\";\nimport type { RoleLevel } from \"@emdash-cms/auth\";\nimport { generateCodeVerifier } from \"arctic\";\nimport type { Kysely } from \"kysely\";\n\nimport {\n\tgeneratePrefixedToken,\n\thashApiToken,\n\tisValidScope,\n\tTOKEN_PREFIXES,\n} from \"../../auth/api-tokens.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { lookupOAuthClient } from \"./oauth-clients.js\";\nimport { lookupUserRoleAndStatus } from \"./oauth-user-lookup.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Device codes expire after 15 minutes */\nconst DEVICE_CODE_TTL_SECONDS = 15 * 60;\n\n/** Default polling interval in seconds */\nconst DEFAULT_INTERVAL = 5;\n\n/** RFC 8628 §3.5: interval increase on slow_down */\nconst SLOW_DOWN_INCREMENT = 5;\n\n/** Maximum slow_down interval cap (seconds) */\nconst MAX_SLOW_DOWN_INTERVAL = 60;\n\n/** Access token TTL: 1 hour */\nconst ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\n/** Refresh token TTL: 90 days */\nconst REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\n/** Default scopes for CLI login */\nconst DEFAULT_SCOPES = [\n\t\"content:read\",\n\t\"content:write\",\n\t\"media:read\",\n\t\"media:write\",\n\t\"schema:read\",\n] as const;\n\n/** Pattern to normalize user codes (strip hyphens) */\nconst HYPHEN_PATTERN = /-/g;\n\n/** Characters for user codes (uppercase, no ambiguous chars like 0/O, 1/I) */\nconst USER_CODE_CHARS = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface DeviceCodeResponse {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri: string;\n\texpires_in: number;\n\tinterval: number;\n}\n\nexport interface TokenResponse {\n\taccess_token: string;\n\trefresh_token: string;\n\ttoken_type: \"Bearer\";\n\texpires_in: number;\n\tscope: string;\n}\n\n// RFC 8628 error codes\nexport type DeviceFlowError =\n\t| \"authorization_pending\"\n\t| \"slow_down\"\n\t| \"expired_token\"\n\t| \"access_denied\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Generate a short human-readable user code (XXXX-XXXX) */\nfunction generateUserCode(): string {\n\tconst bytes = new Uint8Array(8);\n\tcrypto.getRandomValues(bytes);\n\tconst chars = Array.from(bytes, (b) => USER_CODE_CHARS[b % USER_CODE_CHARS.length]).join(\"\");\n\treturn `${chars.slice(0, 4)}-${chars.slice(4, 8)}`;\n}\n\n/** Get an ISO datetime string offset from now */\nfunction expiresAt(seconds: number): string {\n\treturn new Date(Date.now() + seconds * 1000).toISOString();\n}\n\n/** Validate and normalize scopes. Returns validated scope list. */\nfunction normalizeScopes(requested?: string[]): string[] {\n\tif (!requested || requested.length === 0) {\n\t\treturn [...DEFAULT_SCOPES];\n\t}\n\treturn requested.filter(isValidScope);\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * POST /oauth/device/code\n *\n * Issue a device code + user code. The CLI displays the user code\n * and tells the user to open the verification URI.\n */\nexport async function handleDeviceCodeRequest(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tclient_id?: string;\n\t\tscope?: string;\n\t},\n\tverificationUri: string,\n): Promise<ApiResult<DeviceCodeResponse>> {\n\ttry {\n\t\t// Note: client_id is accepted but not validated against _emdash_oauth_clients\n\t\t// because the CLI uses a well-known built-in client ID (\"emdash-cli\") that\n\t\t// isn't stored in the DB. Full client_id validation + scope clamping for the\n\t\t// device flow is tracked as a follow-up.\n\n\t\t// Parse and validate scopes\n\t\tconst requestedScopes = input.scope ? input.scope.split(\" \").filter(Boolean) : [];\n\t\tconst scopes = normalizeScopes(requestedScopes);\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_SCOPE\", message: \"No valid scopes requested\" },\n\t\t\t};\n\t\t}\n\n\t\tconst deviceCode = generateCodeVerifier();\n\t\tconst userCode = generateUserCode();\n\t\tconst expires = expiresAt(DEVICE_CODE_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_device_codes\")\n\t\t\t.values({\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tstatus: \"pending\",\n\t\t\t\texpires_at: expires,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tverification_uri: verificationUri,\n\t\t\t\texpires_in: DEVICE_CODE_TTL_SECONDS,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"DEVICE_CODE_ERROR\",\n\t\t\t\tmessage: \"Failed to create device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/token\n *\n * CLI polls this endpoint with the device_code. Returns:\n * - 200 with tokens if authorized\n * - 400 with error \"authorization_pending\" while waiting\n * - 400 with error \"slow_down\" if polling too fast\n * - 400 with error \"expired_token\" if the code expired\n * - 400 with error \"access_denied\" if the user denied\n */\nexport async function handleDeviceTokenExchange(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tdevice_code: string;\n\t\tgrant_type: string;\n\t},\n): Promise<\n\tApiResult<TokenResponse> & { deviceFlowError?: DeviceFlowError; deviceFlowInterval?: number }\n> {\n\ttry {\n\t\t// Validate grant_type\n\t\tif (input.grant_type !== \"urn:ietf:params:oauth:grant-type:device_code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\t// Look up the device code\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t\t.selectAll()\n\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code\" },\n\t\t\t};\n\t\t}\n\n\t\tconst now = new Date();\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < now) {\n\t\t\t// Clean up expired code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"expired_token\",\n\t\t\t\terror: { code: \"expired_token\", message: \"The device code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check status\n\t\tif (row.status === \"denied\") {\n\t\t\t// Clean up denied code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"access_denied\",\n\t\t\t\terror: { code: \"access_denied\", message: \"The user denied the request\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status === \"pending\") {\n\t\t\t// RFC 8628 §3.5: slow_down enforcement during polling phase.\n\t\t\t// Only applies while waiting for authorization — once authorized,\n\t\t\t// the final exchange proceeds without throttling.\n\t\t\tif (row.last_polled_at) {\n\t\t\t\tconst lastPolled = new Date(row.last_polled_at);\n\t\t\t\tconst elapsedSeconds = (now.getTime() - lastPolled.getTime()) / 1000;\n\n\t\t\t\tif (elapsedSeconds < row.interval) {\n\t\t\t\t\t// Too fast — increase interval by 5s per RFC 8628 §3.5, capped at 60s\n\t\t\t\t\tconst newInterval = Math.min(row.interval + SLOW_DOWN_INCREMENT, MAX_SLOW_DOWN_INTERVAL);\n\t\t\t\t\tawait db\n\t\t\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t\t\t.set({\n\t\t\t\t\t\t\tinterval: newInterval,\n\t\t\t\t\t\t\tlast_polled_at: now.toISOString(),\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t\t\t.execute();\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\tdeviceFlowError: \"slow_down\",\n\t\t\t\t\t\tdeviceFlowInterval: newInterval,\n\t\t\t\t\t\terror: { code: \"slow_down\", message: \"Polling too fast\" },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Update last_polled_at for future slow_down checks\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ last_polled_at: now.toISOString() })\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"authorization_pending\",\n\t\t\t\terror: { code: \"authorization_pending\", message: \"Authorization pending\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status !== \"authorized\" || !row.user_id) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code state\" },\n\t\t\t};\n\t\t}\n\n\t\t// Generate tokens before consuming the device code so that if\n\t\t// generation fails, the code is still available for retry.\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\t\tconst refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);\n\t\tconst refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);\n\n\t\t// Atomically consume the device code and create tokens in a single\n\t\t// transaction. DELETE...RETURNING prevents TOCTOU: two concurrent\n\t\t// requests race on the DELETE, only one gets a row back. Wrapping\n\t\t// in a transaction ensures the code isn't consumed if token storage fails.\n\t\tconst result = await withTransaction(db, async (trx) => {\n\t\t\tconst consumed = await trx\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.where(\"status\", \"=\", \"authorized\")\n\t\t\t\t.returningAll()\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!consumed) return null;\n\n\t\t\tif (!consumed.user_id) return null;\n\n\t\t\tconst scopes = JSON.parse(consumed.scopes) as string[];\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\t\ttoken_type: \"access\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: accessExpires,\n\t\t\t\t\trefresh_token_hash: refreshToken.hash,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: refreshToken.hash,\n\t\t\t\t\ttoken_type: \"refresh\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: refreshExpires,\n\t\t\t\t\trefresh_token_hash: null,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\treturn { scopes };\n\t\t});\n\n\t\tif (!result) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Device code already consumed\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: refreshToken.raw,\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: result.scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_EXCHANGE_ERROR\",\n\t\t\t\tmessage: \"Failed to exchange device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/authorize\n *\n * The user submits the user_code after logging in via the browser.\n * This authorizes the device code, allowing the CLI to exchange it for tokens.\n *\n * Scopes are clamped to the user's role at this point. The stored scopes\n * are replaced with the intersection of requested scopes and the scopes\n * the user's role permits. This prevents scope escalation.\n */\nexport async function handleDeviceAuthorize(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tuserRole: RoleLevel,\n\tinput: {\n\t\tuser_code: string;\n\t\taction?: \"approve\" | \"deny\";\n\t},\n): Promise<ApiResult<{ authorized: boolean }>> {\n\ttry {\n\t\t// Normalize user code (strip hyphens, uppercase)\n\t\tconst normalizedCode = input.user_code.replace(HYPHEN_PATTERN, \"\").toUpperCase();\n\n\t\t// Look up the device code by user_code\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t\t.selectAll()\n\t\t\t.where(\"status\", \"=\", \"pending\")\n\t\t\t.execute();\n\n\t\t// Find the matching code (strip hyphens for comparison)\n\t\tconst match = row.find(\n\t\t\t(r) => r.user_code.replace(HYPHEN_PATTERN, \"\").toUpperCase() === normalizedCode,\n\t\t);\n\n\t\tif (!match) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CODE\", message: \"Invalid or expired code\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(match.expires_at) < new Date()) {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"EXPIRED_CODE\", message: \"This code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\tconst action = input.action ?? \"approve\";\n\n\t\tif (action === \"deny\") {\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ status: \"denied\" })\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn { success: true, data: { authorized: false } };\n\t\t}\n\n\t\t// Clamp requested scopes to those the user's role permits.\n\t\t// effective_scopes = requested_scopes ∩ scopesForRole(user.role)\n\t\tconst requestedScopes = JSON.parse(match.scopes) as string[];\n\t\tconst effectiveScopes = clampScopes(requestedScopes, userRole);\n\n\t\tif (effectiveScopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INSUFFICIENT_ROLE\",\n\t\t\t\t\tmessage: \"Your role does not permit any of the requested scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Approve: set user_id, status, and clamped scopes\n\t\tawait db\n\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t.set({\n\t\t\t\tstatus: \"authorized\",\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(effectiveScopes),\n\t\t\t})\n\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t.execute();\n\n\t\treturn { success: true, data: { authorized: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORIZE_ERROR\",\n\t\t\t\tmessage: \"Failed to authorize device\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/refresh\n *\n * Exchange a refresh token for a new access token.\n * The refresh token itself is not rotated (per spec: optional rotation).\n */\nexport async function handleTokenRefresh(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\trefresh_token: string;\n\t\tgrant_type: string;\n\t},\n): Promise<ApiResult<TokenResponse>> {\n\ttry {\n\t\tif (input.grant_type !== \"refresh_token\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\tif (!input.refresh_token.startsWith(TOKEN_PREFIXES.OAUTH_REFRESH)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token format\" },\n\t\t\t};\n\t\t}\n\n\t\tconst refreshHash = hashApiToken(input.refresh_token);\n\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.selectAll()\n\t\t\t.where(\"token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"refresh\")\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < new Date()) {\n\t\t\t// Clean up expired refresh token and its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Refresh token expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// SEC-42: Revalidate user role before issuing new access token.\n\t\t// SEC-43: Reject refresh if user is disabled or deleted.\n\t\tconst userInfo = await lookupUserRoleAndStatus(db, row.user_id);\n\t\tif (!userInfo) {\n\t\t\t// User no longer exists — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (userInfo.disabled) {\n\t\t\t// User is disabled — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User account is disabled\" },\n\t\t\t};\n\t\t}\n\n\t\t// Revalidate stored scopes against the user's current role.\n\t\t// A demoted user's refresh token may carry stale elevated scopes.\n\t\tconst storedScopes = JSON.parse(row.scopes) as string[];\n\t\tlet scopes = clampScopes(storedScopes, userInfo.role);\n\n\t\t// SEC-41: Intersect with the client's registered scopes (if any).\n\t\t// Same check as the approval path — a client registered with limited\n\t\t// scopes should never receive elevated scopes on refresh, even if the\n\t\t// user's role would allow them.\n\t\tif (row.client_id) {\n\t\t\tconst client = await lookupOAuthClient(db, row.client_id);\n\t\t\tif (client?.scopes?.length) {\n\t\t\t\tscopes = scopes.filter((s: string) => client.scopes!.includes(s));\n\t\t\t}\n\t\t}\n\n\t\tif (scopes.length === 0) {\n\t\t\t// User's role no longer supports any of the token's scopes — revoke\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_GRANT\",\n\t\t\t\t\tmessage: \"User role no longer supports any of the token's scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Delete old access tokens for this refresh token\n\t\tawait db\n\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t\t.execute();\n\n\t\t// Generate new access token\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t.values({\n\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\ttoken_type: \"access\",\n\t\t\t\tuser_id: row.user_id,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tclient_type: row.client_type,\n\t\t\t\texpires_at: accessExpires,\n\t\t\t\trefresh_token_hash: refreshHash,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: input.refresh_token, // Return same refresh token\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REFRESH_ERROR\",\n\t\t\t\tmessage: \"Failed to refresh token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/revoke\n *\n * Revoke an access or refresh token. If a refresh token is revoked,\n * also revoke all associated access tokens.\n *\n * Per RFC 7009, this endpoint always returns 200 (even for invalid tokens).\n */\nexport async function handleTokenRevoke(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\ttoken: string;\n\t},\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst hash = hashApiToken(input.token);\n\n\t\t// Look up the token\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.select([\"token_hash\", \"token_type\", \"refresh_token_hash\"])\n\t\t\t.where(\"token_hash\", \"=\", hash)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\t// Per RFC 7009: always 200, even for invalid tokens\n\t\t\treturn { success: true, data: { revoked: true } };\n\t\t}\n\n\t\tif (row.token_type === \"refresh\") {\n\t\t\t// Revoke refresh token and all its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"refresh_token_hash\", \"=\", hash).execute();\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t} else {\n\t\t\t// Revoke just the access token\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke token\",\n\t\t\t},\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,MAAM,0BAA0B;;AAGhC,MAAM,mBAAmB;;AAGzB,MAAM,sBAAsB;;AAG5B,MAAM,yBAAyB;;AAG/B,MAAM,2BAA2B;;AAGjC,MAAM,4BAA4B,OAAU,KAAK;;AAGjD,MAAM,iBAAiB;CACtB;CACA;CACA;CACA;CACA;CACA;;AAGD,MAAM,iBAAiB;;AAGvB,MAAM,kBAAkB;;AAkCxB,SAAS,mBAA2B;CACnC,MAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,QAAO,gBAAgB,MAAM;CAC7B,MAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,gBAAgB,IAAI,IAAwB,CAAC,KAAK,GAAG;AAC5F,QAAO,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,MAAM,GAAG,EAAE;;;AAIjD,SAAS,UAAU,SAAyB;AAC3C,QAAO,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,IAAK,CAAC,aAAa;;;AAI3D,SAAS,gBAAgB,WAAgC;AACxD,KAAI,CAAC,aAAa,UAAU,WAAW,EACtC,QAAO,CAAC,GAAG,eAAe;AAE3B,QAAO,UAAU,OAAO,aAAa;;;;;;;;AAatC,eAAsB,wBACrB,IACA,OAIA,iBACyC;AACzC,KAAI;EAQH,MAAM,SAAS,gBADS,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ,GAAG,EAAE,CAClC;AAE/C,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAGF,MAAM,aAAa,sBAAsB;EACzC,MAAM,WAAW,kBAAkB;EACnC,MAAM,UAAU,UAAU,wBAAwB;AAElD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,aAAa;GACb,WAAW;GACX,QAAQ,KAAK,UAAU,OAAO;GAC9B,QAAQ;GACR,YAAY;GACZ,UAAU;GACV,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,aAAa;IACb,WAAW;IACX,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAcH,eAAsB,0BACrB,IACA,OAMC;AACD,KAAI;AAEH,MAAI,MAAM,eAAe,+CACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;EAIF,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAuB;GAChE;EAGF,MAAM,sBAAM,IAAI,MAAM;AAGtB,MAAI,IAAI,KAAK,IAAI,WAAW,GAAG,KAAK;AAEnC,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAIF,MAAI,IAAI,WAAW,UAAU;AAE5B,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAGF,MAAI,IAAI,WAAW,WAAW;AAI7B,OAAI,IAAI,gBAAgB;IACvB,MAAM,aAAa,IAAI,KAAK,IAAI,eAAe;AAG/C,SAFwB,IAAI,SAAS,GAAG,WAAW,SAAS,IAAI,MAE3C,IAAI,UAAU;KAElC,MAAM,cAAc,KAAK,IAAI,IAAI,WAAW,qBAAqB,uBAAuB;AACxF,WAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;MACJ,UAAU;MACV,gBAAgB,IAAI,aAAa;MACjC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,YAAO;MACN,SAAS;MACT,iBAAiB;MACjB,oBAAoB;MACpB,OAAO;OAAE,MAAM;OAAa,SAAS;OAAoB;MACzD;;;AAKH,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC,CAC1C,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAyB,SAAS;KAAyB;IAC1E;;AAGF,MAAI,IAAI,WAAW,gBAAgB,CAAC,IAAI,QACvC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAKF,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;EACzD,MAAM,eAAe,sBAAsB,eAAe,cAAc;EACxE,MAAM,iBAAiB,UAAU,0BAA0B;EAM3D,MAAM,SAAS,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACvD,MAAM,WAAW,MAAM,IACrB,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,MAAM,UAAU,KAAK,aAAa,CAClC,cAAc,CACd,kBAAkB;AAEpB,OAAI,CAAC,SAAU,QAAO;AAEtB,OAAI,CAAC,SAAS,QAAS,QAAO;GAE9B,MAAM,SAAS,KAAK,MAAM,SAAS,OAAO;AAE1C,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,YAAY;IACxB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB,aAAa;IACjC,CAAC,CACD,SAAS;AAEX,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,aAAa;IACzB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,CAAC,CACD,SAAS;AAEX,UAAO,EAAE,QAAQ;IAChB;AAEF,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,aAAa;IAC5B,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,OAAO,KAAK,IAAI;IAC9B;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAcH,eAAsB,sBACrB,IACA,QACA,UACA,OAI8C;AAC9C,KAAI;EAEH,MAAM,iBAAiB,MAAM,UAAU,QAAQ,gBAAgB,GAAG,CAAC,aAAa;EAUhF,MAAM,SAPM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,UAAU,KAAK,UAAU,CAC/B,SAAS,EAGO,MAChB,MAAM,EAAE,UAAU,QAAQ,gBAAgB,GAAG,CAAC,aAAa,KAAK,eACjE;AAED,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAA2B;GACnE;AAIF,MAAI,IAAI,KAAK,MAAM,WAAW,mBAAG,IAAI,MAAM,EAAE;AAC5C,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAgB,SAAS;KAAyB;IACjE;;AAKF,OAFe,MAAM,UAAU,eAEhB,QAAQ;AACtB,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,QAAQ,UAAU,CAAC,CACzB,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IAAE,SAAS;IAAM,MAAM,EAAE,YAAY,OAAO;IAAE;;EAMtD,MAAM,kBAAkB,YADA,KAAK,MAAM,MAAM,OAAO,EACK,SAAS;AAE9D,MAAI,gBAAgB,WAAW,EAC9B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAIF,QAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;GACJ,QAAQ;GACR,SAAS;GACT,QAAQ,KAAK,UAAU,gBAAgB;GACvC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,YAAY,MAAM;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,mBACrB,IACA,OAIoC;AACpC,KAAI;AACH,MAAI,MAAM,eAAe,gBACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;AAGF,MAAI,CAAC,MAAM,cAAc,WAAW,eAAe,cAAc,CAChE,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;EAGF,MAAM,cAAc,aAAa,MAAM,cAAc;EAErD,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,cAAc,KAAK,YAAY,CACrC,MAAM,cAAc,KAAK,UAAU,CACnC,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAyB;GAClE;AAIF,MAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,EAAE;AAE1C,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAyB;IAClE;;EAKF,MAAM,WAAW,MAAM,wBAAwB,IAAI,IAAI,QAAQ;AAC/D,MAAI,CAAC,UAAU;AAEd,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAkB;IAC3D;;AAGF,MAAI,SAAS,UAAU;AAEtB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA4B;IACrE;;EAMF,IAAI,SAAS,YADQ,KAAK,MAAM,IAAI,OAAO,EACJ,SAAS,KAAK;AAMrD,MAAI,IAAI,WAAW;GAClB,MAAM,SAAS,MAAM,kBAAkB,IAAI,IAAI,UAAU;AACzD,OAAI,QAAQ,QAAQ,OACnB,UAAS,OAAO,QAAQ,MAAc,OAAO,OAAQ,SAAS,EAAE,CAAC;;AAInE,MAAI,OAAO,WAAW,GAAG;AAExB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AACX,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;AAIF,QAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,MAAM,cAAc,KAAK,SAAS,CAClC,SAAS;EAGX,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;AAEzD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,YAAY,YAAY;GACxB,YAAY;GACZ,SAAS,IAAI;GACb,QAAQ,KAAK,UAAU,OAAO;GAC9B,aAAa,IAAI;GACjB,YAAY;GACZ,oBAAoB;GACpB,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,MAAM;IACrB,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,KAAK,IAAI;IACvB;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;AAYH,eAAsB,kBACrB,IACA,OAG2C;AAC3C,KAAI;EACH,MAAM,OAAO,aAAa,MAAM,MAAM;EAGtC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;GAAC;GAAc;GAAc;GAAqB,CAAC,CAC1D,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,MAAI,CAAC,IAEJ,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;AAGlD,MAAI,IAAI,eAAe,WAAW;AAEjC,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,sBAAsB,KAAK,KAAK,CAAC,SAAS;AAC5F,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;QAGpF,OAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;AAGrF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD"}

package/dist/direct-executor-CDXeJCSs.mjs

@@ -0,0 +1,85 @@
+import { i as getExactMigrationStatus, s as runMigrations } from "./runner-C1T11CfC.mjs";
+import { r as getI18nConfig, s as setI18nConfig } from "./config-C3EBstHi.mjs";
+import { r as getCoreMigrationIdentity } from "./identity-Ys6Dlc9C.mjs";
+import { Kysely } from "kysely";
+
+//#region src/migrations/direct-executor.ts
+function createReport(target, status, executed) {
+	return {
+		target,
+		knownApplied: [...status.knownApplied],
+		pending: [...status.pending],
+		unknownApplied: [...status.unknownApplied],
+		executed: [...executed]
+	};
+}
+async function verifyRequest(request) {
+	const identity = await getCoreMigrationIdentity();
+	if (request.artifact.emdashVersion !== identity.emdashVersion || request.artifact.migrationSetFingerprint !== identity.fingerprint) throw new Error("Migration artifact does not match the loaded EmDash version and migration registry.");
+}
+async function executeRequest(db, target, request) {
+	const initialStatus = await getExactMigrationStatus(db);
+	if (request.action === "check") return createReport(target, initialStatus, []);
+	if (initialStatus.unknownApplied.length > 0) throw new Error(`Cannot apply migrations with unknown applied migrations: ${initialStatus.unknownApplied.join(", ")}`);
+	if (initialStatus.pending.length === 0) return createReport(target, initialStatus, []);
+	const result = await runMigrations(db);
+	return createReport(target, await getExactMigrationStatus(db), result.applied);
+}
+function createDirectMigrationExecutor(options) {
+	const target = Object.freeze({ ...options.target });
+	let used = false;
+	let disposed = false;
+	let activeDb;
+	let closePromise;
+	const closeActiveDb = () => {
+		if (!activeDb) return Promise.resolve();
+		closePromise ??= activeDb.destroy();
+		return closePromise;
+	};
+	return {
+		target,
+		async execute(request) {
+			if (disposed) throw new Error("Migration executor has been disposed.");
+			if (used) throw new Error("Migration executors are single-use.");
+			used = true;
+			if (request.action !== "check" && request.action !== "apply") throw new Error("Unsupported migration action.");
+			await verifyRequest(request);
+			const db = new Kysely({ dialect: await options.createDialect() });
+			activeDb = db;
+			if (disposed) {
+				await closeActiveDb();
+				throw new Error("Migration executor has been disposed.");
+			}
+			const previousI18n = getI18nConfig();
+			let executionFailed = false;
+			let executionError;
+			let report;
+			setI18nConfig(request.i18n);
+			try {
+				report = await executeRequest(db, target, request);
+			} catch (error) {
+				executionFailed = true;
+				executionError = error;
+			} finally {
+				setI18nConfig(previousI18n);
+				try {
+					await closeActiveDb();
+				} catch {
+					console.error("[migrations] Database close failed.");
+					closePromise = Promise.resolve();
+				}
+			}
+			if (executionFailed) throw executionError;
+			if (!report) throw new Error("Migration execution did not produce a report.");
+			return report;
+		},
+		dispose() {
+			disposed = true;
+			return closeActiveDb();
+		}
+	};
+}
+
+//#endregion
+export { createDirectMigrationExecutor as t };
+//# sourceMappingURL=direct-executor-CDXeJCSs.mjs.map

package/dist/direct-executor-CDXeJCSs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-executor-CDXeJCSs.mjs","names":[],"sources":["../src/migrations/direct-executor.ts"],"sourcesContent":["import { type Dialect, Kysely } from \"kysely\";\n\nimport {\n\tgetExactMigrationStatus,\n\trunMigrations,\n\ttype ExactMigrationStatus,\n} from \"../database/migrations/runner.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getI18nConfig, setI18nConfig } from \"../i18n/config.js\";\nimport { getCoreMigrationIdentity } from \"./identity.js\";\nimport type {\n\tMigrationExecutor,\n\tMigrationReport,\n\tMigrationRequest,\n\tMigrationTarget,\n} from \"./protocol.js\";\n\nexport interface DirectMigrationExecutorOptions {\n\ttarget: MigrationTarget;\n\tcreateDialect: () => Dialect | Promise<Dialect>;\n}\n\nfunction createReport(\n\ttarget: MigrationTarget,\n\tstatus: ExactMigrationStatus,\n\texecuted: readonly string[],\n): MigrationReport {\n\treturn {\n\t\ttarget,\n\t\tknownApplied: [...status.knownApplied],\n\t\tpending: [...status.pending],\n\t\tunknownApplied: [...status.unknownApplied],\n\t\texecuted: [...executed],\n\t};\n}\n\nasync function verifyRequest(request: MigrationRequest): Promise<void> {\n\tconst identity = await getCoreMigrationIdentity();\n\tif (\n\t\trequest.artifact.emdashVersion !== identity.emdashVersion ||\n\t\trequest.artifact.migrationSetFingerprint !== identity.fingerprint\n\t) {\n\t\tthrow new Error(\n\t\t\t\"Migration artifact does not match the loaded EmDash version and migration registry.\",\n\t\t);\n\t}\n}\n\nasync function executeRequest(\n\tdb: Kysely<Database>,\n\ttarget: MigrationTarget,\n\trequest: MigrationRequest,\n): Promise<MigrationReport> {\n\tconst initialStatus = await getExactMigrationStatus(db);\n\tif (request.action === \"check\") {\n\t\treturn createReport(target, initialStatus, []);\n\t}\n\n\tif (initialStatus.unknownApplied.length > 0) {\n\t\tthrow new Error(\n\t\t\t`Cannot apply migrations with unknown applied migrations: ${initialStatus.unknownApplied.join(\", \")}`,\n\t\t);\n\t}\n\tif (initialStatus.pending.length === 0) {\n\t\treturn createReport(target, initialStatus, []);\n\t}\n\n\tconst result = await runMigrations(db);\n\tconst finalStatus = await getExactMigrationStatus(db);\n\treturn createReport(target, finalStatus, result.applied);\n}\n\nexport function createDirectMigrationExecutor(\n\toptions: DirectMigrationExecutorOptions,\n): MigrationExecutor {\n\tconst target = Object.freeze({ ...options.target });\n\tlet used = false;\n\tlet disposed = false;\n\tlet activeDb: Kysely<Database> | undefined;\n\tlet closePromise: Promise<void> | undefined;\n\n\tconst closeActiveDb = (): Promise<void> => {\n\t\tif (!activeDb) return Promise.resolve();\n\t\tclosePromise ??= activeDb.destroy();\n\t\treturn closePromise;\n\t};\n\n\treturn {\n\t\ttarget,\n\t\tasync execute(request) {\n\t\t\tif (disposed) {\n\t\t\t\tthrow new Error(\"Migration executor has been disposed.\");\n\t\t\t}\n\t\t\tif (used) {\n\t\t\t\tthrow new Error(\"Migration executors are single-use.\");\n\t\t\t}\n\t\t\tused = true;\n\n\t\t\tif (request.action !== \"check\" && request.action !== \"apply\") {\n\t\t\t\tthrow new Error(\"Unsupported migration action.\");\n\t\t\t}\n\t\t\tawait verifyRequest(request);\n\n\t\t\tconst dialect = await options.createDialect();\n\t\t\tconst db = new Kysely<Database>({ dialect });\n\t\t\tactiveDb = db;\n\t\t\tif (disposed) {\n\t\t\t\tawait closeActiveDb();\n\t\t\t\tthrow new Error(\"Migration executor has been disposed.\");\n\t\t\t}\n\t\t\tconst previousI18n = getI18nConfig();\n\t\t\tlet executionFailed = false;\n\t\t\tlet executionError: unknown;\n\t\t\tlet report: MigrationReport | undefined;\n\t\t\tsetI18nConfig(request.i18n);\n\n\t\t\ttry {\n\t\t\t\treport = await executeRequest(db, target, request);\n\t\t\t} catch (error) {\n\t\t\t\texecutionFailed = true;\n\t\t\t\texecutionError = error;\n\t\t\t} finally {\n\t\t\t\tsetI18nConfig(previousI18n);\n\t\t\t\ttry {\n\t\t\t\t\tawait closeActiveDb();\n\t\t\t\t} catch {\n\t\t\t\t\tconsole.error(\"[migrations] Database close failed.\");\n\t\t\t\t\tclosePromise = Promise.resolve();\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (executionFailed) throw executionError;\n\t\t\tif (!report) throw new Error(\"Migration execution did not produce a report.\");\n\t\t\treturn report;\n\t\t},\n\t\tdispose() {\n\t\t\tdisposed = true;\n\t\t\treturn closeActiveDb();\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;AAsBA,SAAS,aACR,QACA,QACA,UACkB;AAClB,QAAO;EACN;EACA,cAAc,CAAC,GAAG,OAAO,aAAa;EACtC,SAAS,CAAC,GAAG,OAAO,QAAQ;EAC5B,gBAAgB,CAAC,GAAG,OAAO,eAAe;EAC1C,UAAU,CAAC,GAAG,SAAS;EACvB;;AAGF,eAAe,cAAc,SAA0C;CACtE,MAAM,WAAW,MAAM,0BAA0B;AACjD,KACC,QAAQ,SAAS,kBAAkB,SAAS,iBAC5C,QAAQ,SAAS,4BAA4B,SAAS,YAEtD,OAAM,IAAI,MACT,sFACA;;AAIH,eAAe,eACd,IACA,QACA,SAC2B;CAC3B,MAAM,gBAAgB,MAAM,wBAAwB,GAAG;AACvD,KAAI,QAAQ,WAAW,QACtB,QAAO,aAAa,QAAQ,eAAe,EAAE,CAAC;AAG/C,KAAI,cAAc,eAAe,SAAS,EACzC,OAAM,IAAI,MACT,4DAA4D,cAAc,eAAe,KAAK,KAAK,GACnG;AAEF,KAAI,cAAc,QAAQ,WAAW,EACpC,QAAO,aAAa,QAAQ,eAAe,EAAE,CAAC;CAG/C,MAAM,SAAS,MAAM,cAAc,GAAG;AAEtC,QAAO,aAAa,QADA,MAAM,wBAAwB,GAAG,EACZ,OAAO,QAAQ;;AAGzD,SAAgB,8BACf,SACoB;CACpB,MAAM,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CACnD,IAAI,OAAO;CACX,IAAI,WAAW;CACf,IAAI;CACJ,IAAI;CAEJ,MAAM,sBAAqC;AAC1C,MAAI,CAAC,SAAU,QAAO,QAAQ,SAAS;AACvC,mBAAiB,SAAS,SAAS;AACnC,SAAO;;AAGR,QAAO;EACN;EACA,MAAM,QAAQ,SAAS;AACtB,OAAI,SACH,OAAM,IAAI,MAAM,wCAAwC;AAEzD,OAAI,KACH,OAAM,IAAI,MAAM,sCAAsC;AAEvD,UAAO;AAEP,OAAI,QAAQ,WAAW,WAAW,QAAQ,WAAW,QACpD,OAAM,IAAI,MAAM,gCAAgC;AAEjD,SAAM,cAAc,QAAQ;GAG5B,MAAM,KAAK,IAAI,OAAiB,EAAE,SADlB,MAAM,QAAQ,eAAe,EACF,CAAC;AAC5C,cAAW;AACX,OAAI,UAAU;AACb,UAAM,eAAe;AACrB,UAAM,IAAI,MAAM,wCAAwC;;GAEzD,MAAM,eAAe,eAAe;GACpC,IAAI,kBAAkB;GACtB,IAAI;GACJ,IAAI;AACJ,iBAAc,QAAQ,KAAK;AAE3B,OAAI;AACH,aAAS,MAAM,eAAe,IAAI,QAAQ,QAAQ;YAC1C,OAAO;AACf,sBAAkB;AAClB,qBAAiB;aACR;AACT,kBAAc,aAAa;AAC3B,QAAI;AACH,WAAM,eAAe;YACd;AACP,aAAQ,MAAM,sCAAsC;AACpD,oBAAe,QAAQ,SAAS;;;AAIlC,OAAI,gBAAiB,OAAM;AAC3B,OAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,gDAAgD;AAC7E,UAAO;;EAER,UAAU;AACT,cAAW;AACX,UAAO,eAAe;;EAEvB"}

package/dist/{escape-C_aLKP3H.mjs → escape-DUY2r2Zs.mjs}

@@ -6,4 +6,4 @@ function escapeHtml(str) {
 
 //#endregion
 export { escapeHtml as t };
-//# sourceMappingURL=escape-C_aLKP3H.mjs.map
+//# sourceMappingURL=escape-DUY2r2Zs.mjs.map

package/dist/{escape-C_aLKP3H.mjs.map → escape-DUY2r2Zs.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"escape-C_aLKP3H.mjs","names":[],"sources":["../src/api/escape.ts"],"sourcesContent":["/** HTML-escape a string to prevent XSS when interpolated into HTML/JS */\nexport function escapeHtml(str: string): string {\n\treturn str\n\t\t.replaceAll(\"&\", \"&amp;\")\n\t\t.replaceAll(\"<\", \"&lt;\")\n\t\t.replaceAll(\">\", \"&gt;\")\n\t\t.replaceAll('\"', \"&quot;\")\n\t\t.replaceAll(\"'\", \"&#x27;\");\n}\n"],"mappings":";;AACA,SAAgB,WAAW,KAAqB;AAC/C,QAAO,IACL,WAAW,KAAK,QAAQ,CACxB,WAAW,KAAK,OAAO,CACvB,WAAW,KAAK,OAAO,CACvB,WAAW,MAAK,SAAS,CACzB,WAAW,KAAK,SAAS"}
+{"version":3,"file":"escape-DUY2r2Zs.mjs","names":[],"sources":["../src/api/escape.ts"],"sourcesContent":["/** HTML-escape a string to prevent XSS when interpolated into HTML/JS */\nexport function escapeHtml(str: string): string {\n\treturn str\n\t\t.replaceAll(\"&\", \"&amp;\")\n\t\t.replaceAll(\"<\", \"&lt;\")\n\t\t.replaceAll(\">\", \"&gt;\")\n\t\t.replaceAll('\"', \"&quot;\")\n\t\t.replaceAll(\"'\", \"&#x27;\");\n}\n"],"mappings":";;AACA,SAAgB,WAAW,KAAqB;AAC/C,QAAO,IACL,WAAW,KAAK,QAAQ,CACxB,WAAW,KAAK,OAAO,CACvB,WAAW,KAAK,OAAO,CACvB,WAAW,MAAK,SAAS,CACzB,WAAW,KAAK,SAAS"}

package/dist/{field-defs-cache-hg6QkjV9.mjs → field-defs-cache-BzwBlJrR.mjs}

@@ -1,4 +1,4 @@
-import { o as __exportAll } from "./runner-BiDvq5dv.mjs";
+import { c as __exportAll } from "./runner-C1T11CfC.mjs";
 import { t as after } from "./after-CBU2vkoO.mjs";
 import { getRequestContext } from "./request-context.mjs";
 import { r as requestCached } from "./request-cache-BSUptuJR.mjs";
@@ -74,4 +74,4 @@ async function getBylineFieldDefs(db) {
 
 //#endregion
 export { getBylineFieldDefs as n, field_defs_cache_exports as t };
-//# sourceMappingURL=field-defs-cache-hg6QkjV9.mjs.map
+//# sourceMappingURL=field-defs-cache-BzwBlJrR.mjs.map