emdash 0.40.0 → 0.41.0

package/dist/mime-ChLqYwDk.mjs

@@ -1,36 +0,0 @@
-//#region src/media/mime.ts
-function normalizeMime(mime) {
-	return mime.split(";")[0].trim().toLowerCase();
-}
-function matchesMimeAllowlist(mime, allowList) {
-	const normalized = normalizeMime(mime);
-	for (const entry of allowList) {
-		if (!entry || !entry.includes("/")) continue;
-		const normalizedEntry = normalizeMime(entry);
-		if (normalizedEntry.endsWith("/")) {
-			if (normalized.startsWith(normalizedEntry)) return true;
-		} else if (normalized === normalizedEntry) return true;
-	}
-	return false;
-}
-/**
-* Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row
-* (raw JSON string). Returns null when the value is missing, malformed, or the
-* list is empty — callers treat that as "no field-specific constraint".
-*/
-function parseAllowedMimeTypes(rawValidation) {
-	if (!rawValidation) return null;
-	try {
-		const parsed = JSON.parse(rawValidation);
-		if (typeof parsed !== "object" || parsed === null) return null;
-		const list = parsed.allowedMimeTypes;
-		if (!Array.isArray(list) || list.length === 0) return null;
-		return list.filter((entry) => typeof entry === "string");
-	} catch {
-		return null;
-	}
-}
-
-//#endregion
-export { normalizeMime as n, parseAllowedMimeTypes as r, matchesMimeAllowlist as t };
-//# sourceMappingURL=mime-ChLqYwDk.mjs.map

package/dist/mime-ChLqYwDk.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"mime-ChLqYwDk.mjs","names":[],"sources":["../src/media/mime.ts"],"sourcesContent":["export function normalizeMime(mime: string): string {\n\treturn mime.split(\";\")[0].trim().toLowerCase();\n}\n\nexport function matchesMimeAllowlist(mime: string, allowList: readonly string[]): boolean {\n\tconst normalized = normalizeMime(mime);\n\tfor (const entry of allowList) {\n\t\tif (!entry || !entry.includes(\"/\")) continue;\n\t\tconst normalizedEntry = normalizeMime(entry);\n\t\tif (normalizedEntry.endsWith(\"/\")) {\n\t\t\tif (normalized.startsWith(normalizedEntry)) return true;\n\t\t} else if (normalized === normalizedEntry) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\nexport const EXTENSION_TO_MIME: Readonly<Record<string, string>> = {\n\t\".pdf\": \"application/pdf\",\n\t\".png\": \"image/png\",\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".gif\": \"image/gif\",\n\t\".webp\": \"image/webp\",\n\t\".avif\": \"image/avif\",\n\t\".svg\": \"image/svg+xml\",\n\t\".mp3\": \"audio/mpeg\",\n\t\".wav\": \"audio/wav\",\n\t\".mp4\": \"video/mp4\",\n\t\".webm\": \"video/webm\",\n\t\".zip\": \"application/zip\",\n\t\".tar\": \"application/x-tar\",\n\t\".gz\": \"application/gzip\",\n\t\".csv\": \"text/csv\",\n\t\".doc\": \"application/msword\",\n\t\".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n\t\".xls\": \"application/vnd.ms-excel\",\n\t\".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n\t\".txt\": \"text/plain\",\n\t\".rtf\": \"application/rtf\",\n\t\".vtt\": \"text/vtt\",\n\t\".srt\": \"application/x-subrip\",\n\t\".woff\": \"font/woff\",\n\t\".woff2\": \"font/woff2\",\n};\n\nconst VALID_MIME_RE = /^[a-z0-9][a-z0-9!#$&^_+\\-.]*\\/[a-z0-9!#$&^_+\\-.]*$/i;\n\nexport function expandExtensionShorthand(entry: string): string | null {\n\tconst trimmed = entry.trim();\n\tif (!trimmed) return null;\n\tif (trimmed.includes(\"/\")) return VALID_MIME_RE.test(trimmed) ? trimmed : null;\n\tif (trimmed.startsWith(\".\")) {\n\t\treturn EXTENSION_TO_MIME[trimmed.toLowerCase()] ?? null;\n\t}\n\treturn null;\n}\n\n/**\n * Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row\n * (raw JSON string). Returns null when the value is missing, malformed, or the\n * list is empty — callers treat that as \"no field-specific constraint\".\n */\nexport function parseAllowedMimeTypes(rawValidation: string | null | undefined): string[] | null {\n\tif (!rawValidation) return null;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(rawValidation);\n\t\tif (typeof parsed !== \"object\" || parsed === null) return null;\n\t\tconst list = (parsed as { allowedMimeTypes?: unknown }).allowedMimeTypes;\n\t\tif (!Array.isArray(list) || list.length === 0) return null;\n\t\treturn list.filter((entry): entry is string => typeof entry === \"string\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";AAAA,SAAgB,cAAc,MAAsB;AACnD,QAAO,KAAK,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa;;AAG/C,SAAgB,qBAAqB,MAAc,WAAuC;CACzF,MAAM,aAAa,cAAc,KAAK;AACtC,MAAK,MAAM,SAAS,WAAW;AAC9B,MAAI,CAAC,SAAS,CAAC,MAAM,SAAS,IAAI,CAAE;EACpC,MAAM,kBAAkB,cAAc,MAAM;AAC5C,MAAI,gBAAgB,SAAS,IAAI,EAChC;OAAI,WAAW,WAAW,gBAAgB,CAAE,QAAO;aACzC,eAAe,gBACzB,QAAO;;AAGT,QAAO;;;;;;;AAiDR,SAAgB,sBAAsB,eAA2D;AAChG,KAAI,CAAC,cAAe,QAAO;AAC3B,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,cAAc;AACjD,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;EAC1D,MAAM,OAAQ,OAA0C;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,WAAW,EAAG,QAAO;AACtD,SAAO,KAAK,QAAQ,UAA2B,OAAO,UAAU,SAAS;SAClE;AACP,SAAO"}

package/dist/mode-CCuKXUci.mjs

@@ -1,23 +0,0 @@
-//#region src/auth/mode.ts
-/**
-* Determine the active auth mode from config.
-*
-* Accepts `EmDashConfig` (or subtype) — checks for `auth` field via duck typing.
-*
-* @param config EmDash configuration
-* @returns The active auth mode
-*/
-function getAuthMode(config) {
-	const auth = config?.auth;
-	if (auth && "entrypoint" in auth && auth.entrypoint) return {
-		type: "external",
-		providerType: auth.type,
-		entrypoint: auth.entrypoint,
-		config: auth.config
-	};
-	return { type: "passkey" };
-}
-
-//#endregion
-export { getAuthMode as t };
-//# sourceMappingURL=mode-CCuKXUci.mjs.map

package/dist/mode-CCuKXUci.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"mode-CCuKXUci.mjs","names":[],"sources":["../src/auth/mode.ts"],"sourcesContent":["/**\n * Auth Mode Detection\n *\n * Determines which authentication provider is active based on config.\n * Supports both passkey (default) and external auth providers via AuthDescriptor.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\nimport type {\n\tAuthDescriptor,\n\tAuthProviderDescriptor,\n\tAuthRouteDescriptor,\n\tAuthResult,\n\tExternalAuthConfig,\n} from \"./types.js\";\n\nexport type {\n\tAuthDescriptor,\n\tAuthProviderDescriptor,\n\tAuthRouteDescriptor,\n\tAuthResult,\n\tExternalAuthConfig,\n};\n\n/**\n * Passkey auth mode (default)\n */\nexport interface PasskeyAuthMode {\n\ttype: \"passkey\";\n}\n\n/**\n * External auth provider mode (Cloudflare Access, etc.)\n */\nexport interface ExternalAuthMode {\n\ttype: \"external\";\n\t/** Provider type identifier (e.g., \"cloudflare-access\") */\n\tproviderType: string;\n\t/** Module to import for authentication */\n\tentrypoint: string;\n\t/** Provider-specific configuration */\n\tconfig: unknown;\n}\n\n/**\n * Union of all auth modes\n */\nexport type AuthMode = PasskeyAuthMode | ExternalAuthMode;\n\n/**\n * Extended config type with auth.\n *\n * This is the same as `EmDashConfig` with an optional `auth` field.\n * Kept for backwards compatibility — prefer `EmDashConfig` in new code\n * since `getAuthMode` now accepts `EmDashConfig` directly.\n */\nexport interface EmDashConfigWithAuth extends EmDashConfig {\n\tauth?: AuthDescriptor;\n}\n\n/**\n * Determine the active auth mode from config.\n *\n * Accepts `EmDashConfig` (or subtype) — checks for `auth` field via duck typing.\n *\n * @param config EmDash configuration\n * @returns The active auth mode\n */\nexport function getAuthMode(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): AuthMode {\n\tconst auth = config?.auth;\n\n\t// Check for AuthDescriptor (transparent external auth like Cloudflare Access)\n\tif (auth && \"entrypoint\" in auth && auth.entrypoint) {\n\t\treturn {\n\t\t\ttype: \"external\",\n\t\t\tproviderType: auth.type,\n\t\t\tentrypoint: auth.entrypoint,\n\t\t\tconfig: auth.config,\n\t\t};\n\t}\n\n\t// Default to passkey\n\treturn { type: \"passkey\" };\n}\n\n/**\n * Check if an external auth provider is active\n */\nexport function isExternalAuthEnabled(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): boolean {\n\treturn getAuthMode(config).type === \"external\";\n}\n\n/**\n * Get external auth config if enabled\n */\nexport function getExternalAuthConfig(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): ExternalAuthMode | null {\n\tconst mode = getAuthMode(config);\n\tif (mode.type === \"external\") {\n\t\treturn mode;\n\t}\n\treturn null;\n}\n"],"mappings":";;;;;;;;;AAoEA,SAAgB,YACf,QACW;CACX,MAAM,OAAO,QAAQ;AAGrB,KAAI,QAAQ,gBAAgB,QAAQ,KAAK,WACxC,QAAO;EACN,MAAM;EACN,cAAc,KAAK;EACnB,YAAY,KAAK;EACjB,QAAQ,KAAK;EACb;AAIF,QAAO,EAAE,MAAM,WAAW"}

package/dist/node-sqlite-compat-CONMsl-x.mjs

@@ -1,46 +0,0 @@
-import { DatabaseSync } from "node:sqlite";
-
-//#region src/db/node-sqlite-compat.ts
-function openNodeSqliteDatabase(path, options = {}) {
-	const database = new DatabaseSync(path, { readOnly: options.readOnly });
-	try {
-		database.exec("PRAGMA busy_timeout = 5000");
-		database.exec("PRAGMA foreign_keys = ON");
-		database.exec("PRAGMA cache_size = -16000");
-		if (options.journalMode === "wal" && !options.readOnly) database.exec("PRAGMA journal_mode = WAL");
-		if (database.prepare("PRAGMA journal_mode").get()?.["journal_mode"] === "wal") database.exec("PRAGMA synchronous = NORMAL");
-	} catch (error) {
-		try {
-			database.close();
-		} catch {
-			throw new Error("SQLite setup failed and the connection could not be closed", { cause: error });
-		}
-		throw error;
-	}
-	return {
-		close: () => database.close(),
-		prepare(sql) {
-			const statement = database.prepare(sql);
-			return {
-				reader: statement.columns().length > 0,
-				all: (parameters) => statement.all(...toBindings(parameters)),
-				run: (parameters) => statement.run(...toBindings(parameters)),
-				iterate: (parameters) => statement.iterate(...toBindings(parameters))
-			};
-		}
-	};
-}
-function toBindings(parameters) {
-	return parameters.map((value) => {
-		if (value === null || typeof value === "string" || typeof value === "number") return value;
-		if (typeof value === "bigint") return value;
-		if (typeof value === "boolean") return value ? 1 : 0;
-		if (value === void 0) return null;
-		if (value instanceof Uint8Array) return value;
-		throw new TypeError(`Cannot bind ${Object.prototype.toString.call(value)} to SQLite`);
-	});
-}
-
-//#endregion
-export { openNodeSqliteDatabase as t };
-//# sourceMappingURL=node-sqlite-compat-CONMsl-x.mjs.map

package/dist/node-sqlite-compat-CONMsl-x.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"node-sqlite-compat-CONMsl-x.mjs","names":[],"sources":["../src/db/node-sqlite-compat.ts"],"sourcesContent":["import { DatabaseSync } from \"node:sqlite\";\n\nexport interface NodeSqliteCompatDatabase {\n\tclose(): void;\n\tprepare(sql: string): NodeSqliteCompatStatement;\n}\n\nexport interface NodeSqliteCompatStatement {\n\treadonly reader: boolean;\n\tall(parameters: ReadonlyArray<unknown>): unknown[];\n\trun(parameters: ReadonlyArray<unknown>): {\n\t\tchanges: number | bigint;\n\t\tlastInsertRowid: number | bigint;\n\t};\n\titerate(parameters: ReadonlyArray<unknown>): IterableIterator<unknown>;\n}\n\nexport interface NodeSqliteOpenOptions {\n\tjournalMode?: \"wal\";\n\treadOnly?: boolean;\n}\n\ntype SqliteBinding = null | number | bigint | string | Uint8Array;\n\nexport function openNodeSqliteDatabase(\n\tpath: string,\n\toptions: NodeSqliteOpenOptions = {},\n): NodeSqliteCompatDatabase {\n\tconst database = new DatabaseSync(path, { readOnly: options.readOnly });\n\n\ttry {\n\t\tdatabase.exec(\"PRAGMA busy_timeout = 5000\");\n\t\tdatabase.exec(\"PRAGMA foreign_keys = ON\");\n\t\t// Negative cache_size values are kibibytes.\n\t\tdatabase.exec(\"PRAGMA cache_size = -16000\");\n\t\tif (options.journalMode === \"wal\" && !options.readOnly) {\n\t\t\tdatabase.exec(\"PRAGMA journal_mode = WAL\");\n\t\t}\n\t\tconst journalMode = database.prepare(\"PRAGMA journal_mode\").get()?.[\"journal_mode\"];\n\t\tif (journalMode === \"wal\") {\n\t\t\tdatabase.exec(\"PRAGMA synchronous = NORMAL\");\n\t\t}\n\t} catch (error) {\n\t\ttry {\n\t\t\tdatabase.close();\n\t\t} catch {\n\t\t\tthrow new Error(\"SQLite setup failed and the connection could not be closed\", {\n\t\t\t\tcause: error,\n\t\t\t});\n\t\t}\n\t\tthrow error;\n\t}\n\n\treturn {\n\t\tclose: () => database.close(),\n\t\tprepare(sql) {\n\t\t\tconst statement = database.prepare(sql);\n\t\t\treturn {\n\t\t\t\treader: statement.columns().length > 0,\n\t\t\t\tall: (parameters) => statement.all(...toBindings(parameters)),\n\t\t\t\trun: (parameters) => statement.run(...toBindings(parameters)),\n\t\t\t\titerate: (parameters) => statement.iterate(...toBindings(parameters)),\n\t\t\t};\n\t\t},\n\t};\n}\n\nfunction toBindings(parameters: ReadonlyArray<unknown>): SqliteBinding[] {\n\treturn parameters.map((value) => {\n\t\tif (value === null || typeof value === \"string\" || typeof value === \"number\") {\n\t\t\treturn value;\n\t\t}\n\t\tif (typeof value === \"bigint\") return value;\n\t\tif (typeof value === \"boolean\") return value ? 1 : 0;\n\t\tif (value === undefined) return null;\n\t\tif (value instanceof Uint8Array) return value;\n\t\tthrow new TypeError(`Cannot bind ${Object.prototype.toString.call(value)} to SQLite`);\n\t});\n}\n"],"mappings":";;;AAwBA,SAAgB,uBACf,MACA,UAAiC,EAAE,EACR;CAC3B,MAAM,WAAW,IAAI,aAAa,MAAM,EAAE,UAAU,QAAQ,UAAU,CAAC;AAEvE,KAAI;AACH,WAAS,KAAK,6BAA6B;AAC3C,WAAS,KAAK,2BAA2B;AAEzC,WAAS,KAAK,6BAA6B;AAC3C,MAAI,QAAQ,gBAAgB,SAAS,CAAC,QAAQ,SAC7C,UAAS,KAAK,4BAA4B;AAG3C,MADoB,SAAS,QAAQ,sBAAsB,CAAC,KAAK,GAAG,oBAChD,MACnB,UAAS,KAAK,8BAA8B;UAErC,OAAO;AACf,MAAI;AACH,YAAS,OAAO;UACT;AACP,SAAM,IAAI,MAAM,8DAA8D,EAC7E,OAAO,OACP,CAAC;;AAEH,QAAM;;AAGP,QAAO;EACN,aAAa,SAAS,OAAO;EAC7B,QAAQ,KAAK;GACZ,MAAM,YAAY,SAAS,QAAQ,IAAI;AACvC,UAAO;IACN,QAAQ,UAAU,SAAS,CAAC,SAAS;IACrC,MAAM,eAAe,UAAU,IAAI,GAAG,WAAW,WAAW,CAAC;IAC7D,MAAM,eAAe,UAAU,IAAI,GAAG,WAAW,WAAW,CAAC;IAC7D,UAAU,eAAe,UAAU,QAAQ,GAAG,WAAW,WAAW,CAAC;IACrE;;EAEF;;AAGF,SAAS,WAAW,YAAqD;AACxE,QAAO,WAAW,KAAK,UAAU;AAChC,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,SACnE,QAAO;AAER,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,IAAI;AACnD,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,iBAAiB,WAAY,QAAO;AACxC,QAAM,IAAI,UAAU,eAAe,OAAO,UAAU,SAAS,KAAK,MAAM,CAAC,YAAY;GACpF"}

package/dist/normalize-CO2P8-iE.mjs

@@ -1,191 +0,0 @@
-import { n as normalizeFocalPoint } from "./focal-point-Gr34o-4o.mjs";
-
-//#region src/media/normalize.ts
-/**
-* Media Value Normalization
-*
-* Normalizes media field values into a consistent shape regardless of
-* creation path (seed scripts, media picker, WP import, URL input).
-*
-* Called at content create/update time when a media provider is available,
-* filling in missing dimensions, storageKey, mimeType, and filename from
-* the provider's `get()` method.
-*/
-const INTERNAL_MEDIA_PREFIX = "/_emdash/api/media/file/";
-const URL_PATTERN = /^https?:\/\//;
-function normalizeLegacyExternalMediaValue(value) {
-	if (value.provider !== "external-url") return value;
-	const src = value.src ?? value.previewUrl;
-	return {
-		...value,
-		provider: "external",
-		...src === void 0 ? {} : { src }
-	};
-}
-/**
-* Normalize a media field value into a consistent MediaValue shape.
-*
-* - `null`/`undefined` → `null`
-* - Bare URL string → `{ provider: "external", id: "", src: url }`
-* - Bare internal media URL → resolved via local provider's `get()`
-* - Bare local media ID → resolved via local provider's `get()`
-* - Object with `provider` + `id` → enriched with missing fields from provider
-*/
-async function normalizeMediaValue(value, getProvider) {
-	if (value == null) return null;
-	if (typeof value === "string") return normalizeStringUrl(value, getProvider);
-	if (!isRecord(value)) return null;
-	if (!("id" in value) && !("src" in value)) return null;
-	const parsed = normalizeLegacyExternalMediaValue(recordToMediaValue(value));
-	const provider = parsed.provider || "local";
-	const id = parsed.id;
-	if (provider === "external") return parsed;
-	const result = {
-		...parsed,
-		provider
-	};
-	if (provider === "local") delete result.src;
-	const needsDimensions = result.width == null || result.height == null;
-	const needsStorageKey = provider === "local" && !result.meta?.storageKey;
-	const needsFileInfo = !result.mimeType || !result.filename;
-	const needsLqip = (result.mimeType ?? "").startsWith("image/") && (result.blurhash == null || result.dominantColor == null);
-	if (!(needsDimensions || needsStorageKey || needsFileInfo || needsLqip) || !id) return result;
-	const mediaProvider = getProvider(provider);
-	if (!mediaProvider?.get) return result;
-	let providerItem;
-	try {
-		providerItem = await mediaProvider.get(id);
-	} catch {
-		return result;
-	}
-	if (!providerItem) return result;
-	return mergeProviderData(result, providerItem);
-}
-async function normalizeStringUrl(url, getProvider) {
-	if (url.startsWith(INTERNAL_MEDIA_PREFIX)) return resolveInternalUrl(url, getProvider);
-	if (URL_PATTERN.test(url)) return Promise.resolve({
-		provider: "external",
-		id: "",
-		src: url
-	});
-	const localMedia = await resolveLocalId(url, getProvider);
-	if (localMedia) return localMedia;
-	return {
-		provider: "external",
-		id: "",
-		src: url
-	};
-}
-async function resolveInternalUrl(url, getProvider) {
-	const storageKey = url.slice(24);
-	const localProvider = getProvider("local");
-	if (!localProvider?.get) return {
-		provider: "external",
-		id: "",
-		src: url
-	};
-	let item;
-	try {
-		item = await localProvider.get(storageKey);
-	} catch {
-		return {
-			provider: "external",
-			id: "",
-			src: url
-		};
-	}
-	if (!item) return {
-		provider: "external",
-		id: "",
-		src: url
-	};
-	const focalPoint = normalizeFocalPoint(item.focalX, item.focalY);
-	return {
-		provider: "local",
-		id: item.id,
-		filename: item.filename,
-		mimeType: item.mimeType,
-		width: item.width,
-		height: item.height,
-		...focalPoint,
-		blurhash: item.blurhash,
-		dominantColor: item.dominantColor,
-		alt: item.alt,
-		meta: item.meta
-	};
-}
-async function resolveLocalId(id, getProvider) {
-	const localProvider = getProvider("local");
-	if (!localProvider?.get) return null;
-	let item;
-	try {
-		item = await localProvider.get(id);
-	} catch {
-		return null;
-	}
-	if (!item) return null;
-	const focalPoint = normalizeFocalPoint(item.focalX, item.focalY);
-	return {
-		provider: "local",
-		id: item.id,
-		filename: item.filename,
-		mimeType: item.mimeType,
-		width: item.width,
-		height: item.height,
-		...focalPoint,
-		blurhash: item.blurhash,
-		dominantColor: item.dominantColor,
-		alt: item.alt,
-		meta: item.meta
-	};
-}
-/**
-* Merge provider data into an existing MediaValue, preserving caller-supplied fields.
-* Caller `alt` takes priority over provider `alt` (per-usage, not per-image).
-*/
-function mergeProviderData(existing, item) {
-	const result = { ...existing };
-	if (result.width == null && item.width != null) result.width = item.width;
-	if (result.height == null && item.height != null) result.height = item.height;
-	if (result.blurhash == null && item.blurhash != null) result.blurhash = item.blurhash;
-	if (result.dominantColor == null && item.dominantColor != null) result.dominantColor = item.dominantColor;
-	if (!result.filename && item.filename) result.filename = item.filename;
-	if (!result.mimeType && item.mimeType) result.mimeType = item.mimeType;
-	if (!result.alt && item.alt) result.alt = item.alt;
-	if (item.meta) result.meta = {
-		...item.meta,
-		...result.meta
-	};
-	return result;
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Extract known MediaValue fields from a runtime-checked record.
-* Avoids unsafe `as MediaValue` cast by reading each property explicitly.
-*/
-function recordToMediaValue(obj) {
-	const result = { id: typeof obj.id === "string" ? obj.id : "" };
-	if (typeof obj.provider === "string") result.provider = obj.provider;
-	if (typeof obj.src === "string") result.src = obj.src;
-	if (typeof obj.previewUrl === "string") result.previewUrl = obj.previewUrl;
-	if (typeof obj.filename === "string") result.filename = obj.filename;
-	if (typeof obj.mimeType === "string") result.mimeType = obj.mimeType;
-	if (typeof obj.width === "number") result.width = obj.width;
-	if (typeof obj.height === "number") result.height = obj.height;
-	const focalPoint = normalizeFocalPoint(obj.focalX, obj.focalY);
-	if (focalPoint) {
-		result.focalX = focalPoint.focalX;
-		result.focalY = focalPoint.focalY;
-	}
-	if (typeof obj.blurhash === "string") result.blurhash = obj.blurhash;
-	if (typeof obj.dominantColor === "string") result.dominantColor = obj.dominantColor;
-	if (typeof obj.alt === "string") result.alt = obj.alt;
-	if (isRecord(obj.meta)) result.meta = obj.meta;
-	return result;
-}
-
-//#endregion
-export { normalizeMediaValue as n, INTERNAL_MEDIA_PREFIX as t };
-//# sourceMappingURL=normalize-CO2P8-iE.mjs.map

package/dist/normalize-CO2P8-iE.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"normalize-CO2P8-iE.mjs","names":[],"sources":["../src/media/normalize.ts"],"sourcesContent":["/**\n * Media Value Normalization\n *\n * Normalizes media field values into a consistent shape regardless of\n * creation path (seed scripts, media picker, WP import, URL input).\n *\n * Called at content create/update time when a media provider is available,\n * filling in missing dimensions, storageKey, mimeType, and filename from\n * the provider's `get()` method.\n */\n\nimport { normalizeFocalPoint } from \"./focal-point.js\";\nimport type { MediaProvider, MediaProviderItem, MediaValue } from \"./types.js\";\n\nexport const INTERNAL_MEDIA_PREFIX = \"/_emdash/api/media/file/\";\nconst URL_PATTERN = /^https?:\\/\\//;\n\nexport function normalizeLegacyExternalMediaValue(value: MediaValue): MediaValue {\n\tif (value.provider !== \"external-url\") return value;\n\tconst src = value.src ?? value.previewUrl;\n\treturn {\n\t\t...value,\n\t\tprovider: \"external\",\n\t\t...(src === undefined ? {} : { src }),\n\t};\n}\n\n/**\n * Normalize a media field value into a consistent MediaValue shape.\n *\n * - `null`/`undefined` → `null`\n * - Bare URL string → `{ provider: \"external\", id: \"\", src: url }`\n * - Bare internal media URL → resolved via local provider's `get()`\n * - Bare local media ID → resolved via local provider's `get()`\n * - Object with `provider` + `id` → enriched with missing fields from provider\n */\nexport async function normalizeMediaValue(\n\tvalue: unknown,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue | null> {\n\tif (value == null) return null;\n\n\t// Bare string URL\n\tif (typeof value === \"string\") {\n\t\treturn normalizeStringUrl(value, getProvider);\n\t}\n\n\t// Not an object — can't normalize\n\tif (!isRecord(value)) return null;\n\n\t// Must have at least an id to be a valid media value\n\tif (!(\"id\" in value) && !(\"src\" in value)) return null;\n\n\tconst parsed = normalizeLegacyExternalMediaValue(recordToMediaValue(value));\n\tconst provider = parsed.provider || \"local\";\n\tconst id = parsed.id;\n\n\t// External URLs — return as-is, no server-side dimension detection\n\tif (provider === \"external\") {\n\t\treturn parsed;\n\t}\n\n\t// Build the base value from the input\n\tconst result: MediaValue = { ...parsed, provider };\n\n\t// For local media, strip `src` — it's derived at display time from storageKey\n\tif (provider === \"local\") {\n\t\tdelete result.src;\n\t}\n\n\t// Determine if we need to call the provider\n\tconst needsDimensions = result.width == null || result.height == null;\n\tconst needsStorageKey = provider === \"local\" && !result.meta?.storageKey;\n\tconst needsFileInfo = !result.mimeType || !result.filename;\n\t// LQIP placeholders are immutable facts of the bytes: if an image record is\n\t// missing them, the provider may have gained them since (e.g. content saved\n\t// before LQIP backfill ran, or the row's blurhash was populated later). Pull\n\t// them on every image lookup so the LQIP backfill in mergeProviderData runs.\n\tconst needsLqip =\n\t\t(result.mimeType ?? \"\").startsWith(\"image/\") &&\n\t\t(result.blurhash == null || result.dominantColor == null);\n\tconst needsLookup = needsDimensions || needsStorageKey || needsFileInfo || needsLqip;\n\n\tif (!needsLookup || !id) return result;\n\n\t// Try to enrich from provider\n\tconst mediaProvider = getProvider(provider);\n\tif (!mediaProvider?.get) return result;\n\n\tlet providerItem: MediaProviderItem | null;\n\ttry {\n\t\tproviderItem = await mediaProvider.get(id);\n\t} catch {\n\t\treturn result;\n\t}\n\n\tif (!providerItem) return result;\n\n\treturn mergeProviderData(result, providerItem);\n}\n\nasync function normalizeStringUrl(\n\turl: string,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue | null> {\n\t// Internal media URL — try to resolve via local provider\n\tif (url.startsWith(INTERNAL_MEDIA_PREFIX)) {\n\t\treturn resolveInternalUrl(url, getProvider);\n\t}\n\n\t// External HTTP(S) URL\n\tif (URL_PATTERN.test(url)) {\n\t\treturn Promise.resolve({\n\t\t\tprovider: \"external\",\n\t\t\tid: \"\",\n\t\t\tsrc: url,\n\t\t});\n\t}\n\n\tconst localMedia = await resolveLocalId(url, getProvider);\n\tif (localMedia) return localMedia;\n\n\t// Unrecognized string — preserve legacy behavior and treat as external\n\treturn {\n\t\tprovider: \"external\",\n\t\tid: \"\",\n\t\tsrc: url,\n\t};\n}\n\nasync function resolveInternalUrl(\n\turl: string,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue> {\n\tconst storageKey = url.slice(INTERNAL_MEDIA_PREFIX.length);\n\tconst localProvider = getProvider(\"local\");\n\n\tif (!localProvider?.get) {\n\t\treturn { provider: \"external\", id: \"\", src: url };\n\t}\n\n\tlet item: MediaProviderItem | null;\n\ttry {\n\t\titem = await localProvider.get(storageKey);\n\t} catch {\n\t\treturn { provider: \"external\", id: \"\", src: url };\n\t}\n\n\tif (!item) {\n\t\treturn { provider: \"external\", id: \"\", src: url };\n\t}\n\n\tconst focalPoint = normalizeFocalPoint(item.focalX, item.focalY);\n\treturn {\n\t\tprovider: \"local\",\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\t...focalPoint,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tmeta: item.meta,\n\t};\n}\n\nasync function resolveLocalId(\n\tid: string,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue | null> {\n\tconst localProvider = getProvider(\"local\");\n\n\tif (!localProvider?.get) return null;\n\n\tlet item: MediaProviderItem | null;\n\ttry {\n\t\titem = await localProvider.get(id);\n\t} catch {\n\t\treturn null;\n\t}\n\n\tif (!item) return null;\n\n\tconst focalPoint = normalizeFocalPoint(item.focalX, item.focalY);\n\treturn {\n\t\tprovider: \"local\",\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\t...focalPoint,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tmeta: item.meta,\n\t};\n}\n\n/**\n * Merge provider data into an existing MediaValue, preserving caller-supplied fields.\n * Caller `alt` takes priority over provider `alt` (per-usage, not per-image).\n */\nfunction mergeProviderData(existing: MediaValue, item: MediaProviderItem): MediaValue {\n\tconst result = { ...existing };\n\n\t// Fill missing dimensions\n\tif (result.width == null && item.width != null) result.width = item.width;\n\tif (result.height == null && item.height != null) result.height = item.height;\n\n\t// Fill missing LQIP placeholders (immutable facts of the bytes; caller wins)\n\tif (result.blurhash == null && item.blurhash != null) result.blurhash = item.blurhash;\n\tif (result.dominantColor == null && item.dominantColor != null) {\n\t\tresult.dominantColor = item.dominantColor;\n\t}\n\n\t// Fill missing file info\n\tif (!result.filename && item.filename) result.filename = item.filename;\n\tif (!result.mimeType && item.mimeType) result.mimeType = item.mimeType;\n\n\t// Fill missing alt (provider alt is fallback, not override)\n\tif (!result.alt && item.alt) result.alt = item.alt;\n\n\t// Fill missing meta (merge, don't replace)\n\tif (item.meta) {\n\t\tresult.meta = { ...item.meta, ...result.meta };\n\t}\n\n\treturn result;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Extract known MediaValue fields from a runtime-checked record.\n * Avoids unsafe `as MediaValue` cast by reading each property explicitly.\n */\nfunction recordToMediaValue(obj: Record<string, unknown>): MediaValue {\n\tconst result: MediaValue = {\n\t\tid: typeof obj.id === \"string\" ? obj.id : \"\",\n\t};\n\tif (typeof obj.provider === \"string\") result.provider = obj.provider;\n\tif (typeof obj.src === \"string\") result.src = obj.src;\n\tif (typeof obj.previewUrl === \"string\") result.previewUrl = obj.previewUrl;\n\tif (typeof obj.filename === \"string\") result.filename = obj.filename;\n\tif (typeof obj.mimeType === \"string\") result.mimeType = obj.mimeType;\n\tif (typeof obj.width === \"number\") result.width = obj.width;\n\tif (typeof obj.height === \"number\") result.height = obj.height;\n\tconst focalPoint = normalizeFocalPoint(obj.focalX, obj.focalY);\n\tif (focalPoint) {\n\t\tresult.focalX = focalPoint.focalX;\n\t\tresult.focalY = focalPoint.focalY;\n\t}\n\tif (typeof obj.blurhash === \"string\") result.blurhash = obj.blurhash;\n\tif (typeof obj.dominantColor === \"string\") result.dominantColor = obj.dominantColor;\n\tif (typeof obj.alt === \"string\") result.alt = obj.alt;\n\tif (isRecord(obj.meta)) result.meta = obj.meta;\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;AAcA,MAAa,wBAAwB;AACrC,MAAM,cAAc;AAEpB,SAAgB,kCAAkC,OAA+B;AAChF,KAAI,MAAM,aAAa,eAAgB,QAAO;CAC9C,MAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,QAAO;EACN,GAAG;EACH,UAAU;EACV,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;EACpC;;;;;;;;;;;AAYF,eAAsB,oBACrB,OACA,aAC6B;AAC7B,KAAI,SAAS,KAAM,QAAO;AAG1B,KAAI,OAAO,UAAU,SACpB,QAAO,mBAAmB,OAAO,YAAY;AAI9C,KAAI,CAAC,SAAS,MAAM,CAAE,QAAO;AAG7B,KAAI,EAAE,QAAQ,UAAU,EAAE,SAAS,OAAQ,QAAO;CAElD,MAAM,SAAS,kCAAkC,mBAAmB,MAAM,CAAC;CAC3E,MAAM,WAAW,OAAO,YAAY;CACpC,MAAM,KAAK,OAAO;AAGlB,KAAI,aAAa,WAChB,QAAO;CAIR,MAAM,SAAqB;EAAE,GAAG;EAAQ;EAAU;AAGlD,KAAI,aAAa,QAChB,QAAO,OAAO;CAIf,MAAM,kBAAkB,OAAO,SAAS,QAAQ,OAAO,UAAU;CACjE,MAAM,kBAAkB,aAAa,WAAW,CAAC,OAAO,MAAM;CAC9D,MAAM,gBAAgB,CAAC,OAAO,YAAY,CAAC,OAAO;CAKlD,MAAM,aACJ,OAAO,YAAY,IAAI,WAAW,SAAS,KAC3C,OAAO,YAAY,QAAQ,OAAO,iBAAiB;AAGrD,KAAI,EAFgB,mBAAmB,mBAAmB,iBAAiB,cAEvD,CAAC,GAAI,QAAO;CAGhC,MAAM,gBAAgB,YAAY,SAAS;AAC3C,KAAI,CAAC,eAAe,IAAK,QAAO;CAEhC,IAAI;AACJ,KAAI;AACH,iBAAe,MAAM,cAAc,IAAI,GAAG;SACnC;AACP,SAAO;;AAGR,KAAI,CAAC,aAAc,QAAO;AAE1B,QAAO,kBAAkB,QAAQ,aAAa;;AAG/C,eAAe,mBACd,KACA,aAC6B;AAE7B,KAAI,IAAI,WAAW,sBAAsB,CACxC,QAAO,mBAAmB,KAAK,YAAY;AAI5C,KAAI,YAAY,KAAK,IAAI,CACxB,QAAO,QAAQ,QAAQ;EACtB,UAAU;EACV,IAAI;EACJ,KAAK;EACL,CAAC;CAGH,MAAM,aAAa,MAAM,eAAe,KAAK,YAAY;AACzD,KAAI,WAAY,QAAO;AAGvB,QAAO;EACN,UAAU;EACV,IAAI;EACJ,KAAK;EACL;;AAGF,eAAe,mBACd,KACA,aACsB;CACtB,MAAM,aAAa,IAAI,MAAM,GAA6B;CAC1D,MAAM,gBAAgB,YAAY,QAAQ;AAE1C,KAAI,CAAC,eAAe,IACnB,QAAO;EAAE,UAAU;EAAY,IAAI;EAAI,KAAK;EAAK;CAGlD,IAAI;AACJ,KAAI;AACH,SAAO,MAAM,cAAc,IAAI,WAAW;SACnC;AACP,SAAO;GAAE,UAAU;GAAY,IAAI;GAAI,KAAK;GAAK;;AAGlD,KAAI,CAAC,KACJ,QAAO;EAAE,UAAU;EAAY,IAAI;EAAI,KAAK;EAAK;CAGlD,MAAM,aAAa,oBAAoB,KAAK,QAAQ,KAAK,OAAO;AAChE,QAAO;EACN,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,GAAG;EACH,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,MAAM,KAAK;EACX;;AAGF,eAAe,eACd,IACA,aAC6B;CAC7B,MAAM,gBAAgB,YAAY,QAAQ;AAE1C,KAAI,CAAC,eAAe,IAAK,QAAO;CAEhC,IAAI;AACJ,KAAI;AACH,SAAO,MAAM,cAAc,IAAI,GAAG;SAC3B;AACP,SAAO;;AAGR,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,aAAa,oBAAoB,KAAK,QAAQ,KAAK,OAAO;AAChE,QAAO;EACN,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,GAAG;EACH,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,MAAM,KAAK;EACX;;;;;;AAOF,SAAS,kBAAkB,UAAsB,MAAqC;CACrF,MAAM,SAAS,EAAE,GAAG,UAAU;AAG9B,KAAI,OAAO,SAAS,QAAQ,KAAK,SAAS,KAAM,QAAO,QAAQ,KAAK;AACpE,KAAI,OAAO,UAAU,QAAQ,KAAK,UAAU,KAAM,QAAO,SAAS,KAAK;AAGvE,KAAI,OAAO,YAAY,QAAQ,KAAK,YAAY,KAAM,QAAO,WAAW,KAAK;AAC7E,KAAI,OAAO,iBAAiB,QAAQ,KAAK,iBAAiB,KACzD,QAAO,gBAAgB,KAAK;AAI7B,KAAI,CAAC,OAAO,YAAY,KAAK,SAAU,QAAO,WAAW,KAAK;AAC9D,KAAI,CAAC,OAAO,YAAY,KAAK,SAAU,QAAO,WAAW,KAAK;AAG9D,KAAI,CAAC,OAAO,OAAO,KAAK,IAAK,QAAO,MAAM,KAAK;AAG/C,KAAI,KAAK,KACR,QAAO,OAAO;EAAE,GAAG,KAAK;EAAM,GAAG,OAAO;EAAM;AAG/C,QAAO;;AAGR,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;AAO5E,SAAS,mBAAmB,KAA0C;CACrE,MAAM,SAAqB,EAC1B,IAAI,OAAO,IAAI,OAAO,WAAW,IAAI,KAAK,IAC1C;AACD,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,QAAQ,SAAU,QAAO,MAAM,IAAI;AAClD,KAAI,OAAO,IAAI,eAAe,SAAU,QAAO,aAAa,IAAI;AAChE,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,UAAU,SAAU,QAAO,QAAQ,IAAI;AACtD,KAAI,OAAO,IAAI,WAAW,SAAU,QAAO,SAAS,IAAI;CACxD,MAAM,aAAa,oBAAoB,IAAI,QAAQ,IAAI,OAAO;AAC9D,KAAI,YAAY;AACf,SAAO,SAAS,WAAW;AAC3B,SAAO,SAAS,WAAW;;AAE5B,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,kBAAkB,SAAU,QAAO,gBAAgB,IAAI;AACtE,KAAI,OAAO,IAAI,QAAQ,SAAU,QAAO,MAAM,IAAI;AAClD,KAAI,SAAS,IAAI,KAAK,CAAE,QAAO,OAAO,IAAI;AAC1C,QAAO"}

package/dist/oauth-authorization-DlMIL5_h.mjs

@@ -1,274 +0,0 @@
-import { t as withTransaction } from "./transaction-BcJO4Tmc.mjs";
-import { i as generatePrefixedToken, o as hashApiToken, s as isValidScope, t as TOKEN_PREFIXES } from "./api-tokens-CE1ECIg0.mjs";
-import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "./oauth-clients-Djq9r_KP.mjs";
-import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-vue9a64A.mjs";
-import { clampScopes, computeS256Challenge, secureCompare } from "@emdash-cms/auth";
-import { generateCodeVerifier } from "arctic";
-
-//#region src/api/handlers/oauth-authorization.ts
-/**
-* OAuth 2.1 Authorization Code + PKCE handlers.
-*
-* Implements the server side of the authorization code grant for MCP clients
-* (Claude Desktop, VS Code, etc.) per the MCP authorization spec (draft).
-*
-* Uses arctic for PKCE challenge generation and @emdash-cms/auth for token
-* utilities. Token infrastructure is shared with the device flow.
-*/
-/** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */
-const AUTH_CODE_TTL_SECONDS = 600;
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 3600;
-/** Refresh token TTL: 90 days */
-const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
-function expiresAt(seconds) {
-	return new Date(Date.now() + seconds * 1e3).toISOString();
-}
-/**
-* Validate and normalize scopes. Returns validated scope list.
-*/
-function normalizeScopes(requested) {
-	if (!requested) return [];
-	return requested.split(" ").filter(Boolean).filter(isValidScope);
-}
-/**
-* Process an authorization request after the user approves consent.
-*
-* Generates an authorization code, stores it with the PKCE challenge,
-* and returns the redirect URL with the code appended.
-*
-* Scopes are clamped to the user's role to prevent scope escalation.
-*/
-async function handleAuthorizationApproval(db, userId, userRole, params) {
-	try {
-		if (params.response_type !== "code") return {
-			success: false,
-			error: {
-				code: "UNSUPPORTED_RESPONSE_TYPE",
-				message: "Only response_type=code is supported"
-			}
-		};
-		const uriError = validateRedirectUri(params.redirect_uri);
-		if (uriError) return {
-			success: false,
-			error: {
-				code: "INVALID_REDIRECT_URI",
-				message: uriError
-			}
-		};
-		const client = await lookupOAuthClient(db, params.client_id);
-		if (!client) return {
-			success: false,
-			error: {
-				code: "INVALID_CLIENT",
-				message: "Unknown client_id"
-			}
-		};
-		const clientUriError = validateClientRedirectUri(params.redirect_uri, client.redirectUris);
-		if (clientUriError) return {
-			success: false,
-			error: {
-				code: "INVALID_REDIRECT_URI",
-				message: clientUriError
-			}
-		};
-		if (params.code_challenge_method !== "S256") return {
-			success: false,
-			error: {
-				code: "INVALID_REQUEST",
-				message: "Only S256 code_challenge_method is supported"
-			}
-		};
-		if (!params.code_challenge) return {
-			success: false,
-			error: {
-				code: "INVALID_REQUEST",
-				message: "code_challenge is required"
-			}
-		};
-		const userScopes = clampScopes(normalizeScopes(params.scope), userRole);
-		const clientScopes = client.scopes;
-		const scopes = clientScopes?.length ? userScopes.filter((s) => clientScopes.includes(s)) : userScopes;
-		if (scopes.length === 0) return {
-			success: false,
-			error: {
-				code: "INVALID_SCOPE",
-				message: "No valid scopes requested"
-			}
-		};
-		const code = generateCodeVerifier();
-		const codeHash = hashApiToken(code);
-		await db.insertInto("_emdash_authorization_codes").values({
-			code_hash: codeHash,
-			client_id: params.client_id,
-			redirect_uri: params.redirect_uri,
-			user_id: userId,
-			scopes: JSON.stringify(scopes),
-			code_challenge: params.code_challenge,
-			code_challenge_method: params.code_challenge_method,
-			resource: params.resource ?? null,
-			expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
-		}).execute();
-		const redirectUrl = new URL(params.redirect_uri);
-		redirectUrl.searchParams.set("code", code);
-		if (params.state) redirectUrl.searchParams.set("state", params.state);
-		return {
-			success: true,
-			data: { redirect_url: redirectUrl.toString() }
-		};
-	} catch (error) {
-		console.error("Authorization error:", error);
-		return {
-			success: false,
-			error: {
-				code: "AUTHORIZATION_ERROR",
-				message: "Failed to process authorization"
-			}
-		};
-	}
-}
-/**
-* Exchange an authorization code for access + refresh tokens.
-*
-* Validates the code, verifies PKCE, and issues tokens using the same
-* infrastructure as the device flow (ec_oat_*, ec_ort_*).
-*/
-async function handleAuthorizationCodeExchange(db, params) {
-	try {
-		if (params.grant_type !== "authorization_code") return {
-			success: false,
-			error: {
-				code: "unsupported_grant_type",
-				message: "Invalid grant_type"
-			}
-		};
-		const codeHash = hashApiToken(params.code);
-		const row = await db.deleteFrom("_emdash_authorization_codes").where("code_hash", "=", codeHash).returningAll().executeTakeFirst();
-		if (!row) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "Invalid authorization code"
-			}
-		};
-		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "Authorization code expired"
-			}
-		};
-		if (row.redirect_uri !== params.redirect_uri) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "redirect_uri mismatch"
-			}
-		};
-		if (row.client_id !== params.client_id) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "client_id mismatch"
-			}
-		};
-		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "PKCE verification failed"
-			}
-		};
-		if (row.resource && params.resource && row.resource !== params.resource) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "resource mismatch"
-			}
-		};
-		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
-		if (!userInfo) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User not found"
-			}
-		};
-		if (userInfo.disabled) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User account is disabled"
-			}
-		};
-		let scopes = clampScopes(JSON.parse(row.scopes), userInfo.role);
-		const client = await lookupOAuthClient(db, row.client_id);
-		if (client?.scopes?.length) scopes = scopes.filter((s) => client.scopes.includes(s));
-		if (scopes.length === 0) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User role no longer supports any of the requested scopes"
-			}
-		};
-		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
-		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
-		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
-		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
-		await withTransaction(db, async (trx) => {
-			await trx.insertInto("_emdash_oauth_tokens").values({
-				token_hash: accessToken.hash,
-				token_type: "access",
-				user_id: row.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "mcp",
-				expires_at: accessExpires,
-				refresh_token_hash: refreshToken.hash,
-				client_id: row.client_id
-			}).execute();
-			await trx.insertInto("_emdash_oauth_tokens").values({
-				token_hash: refreshToken.hash,
-				token_type: "refresh",
-				user_id: row.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "mcp",
-				expires_at: refreshExpires,
-				refresh_token_hash: null,
-				client_id: row.client_id
-			}).execute();
-		});
-		return {
-			success: true,
-			data: {
-				access_token: accessToken.raw,
-				refresh_token: refreshToken.raw,
-				token_type: "Bearer",
-				expires_in: ACCESS_TOKEN_TTL_SECONDS,
-				scope: scopes.join(" ")
-			}
-		};
-	} catch (error) {
-		console.error("Token exchange error:", error);
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_EXCHANGE_ERROR",
-				message: "Failed to exchange authorization code"
-			}
-		};
-	}
-}
-/**
-* Build the authorization denied redirect URL.
-*/
-function buildDeniedRedirect(redirectUri, state) {
-	const url = new URL(redirectUri);
-	url.searchParams.set("error", "access_denied");
-	url.searchParams.set("error_description", "The user denied the authorization request");
-	if (state) url.searchParams.set("state", state);
-	return url.toString();
-}
-
-//#endregion
-export { handleAuthorizationApproval as n, handleAuthorizationCodeExchange as r, buildDeniedRedirect as t };
-//# sourceMappingURL=oauth-authorization-DlMIL5_h.mjs.map