emdash 0.40.1 → 0.41.0

package/dist/device-flow-OcSqE9uY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow-OcSqE9uY.mjs","names":[],"sources":["../src/api/handlers/device-flow.ts"],"sourcesContent":["/**\n * OAuth Device Flow handlers (RFC 8628).\n *\n * EmDash acts as an OAuth 2.0 authorization server. The CLI requests\n * a device code, displays a URL + user code, and polls for a token.\n * The user opens a browser, logs in, enters the code, and the CLI gets\n * an access + refresh token pair.\n *\n * Uses arctic for code generation and @emdash-cms/auth for token utilities.\n */\n\nimport { clampScopes } from \"@emdash-cms/auth\";\nimport type { RoleLevel } from \"@emdash-cms/auth\";\nimport { generateCodeVerifier } from \"arctic\";\nimport type { Kysely, Selectable } from \"kysely\";\n\nimport {\n\tgeneratePrefixedToken,\n\thashApiToken,\n\tisValidScope,\n\tTOKEN_PREFIXES,\n} from \"../../auth/api-tokens.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database, DeviceCodeTable } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { lookupOAuthClient } from \"./oauth-clients.js\";\nimport { lookupUserRoleAndStatus } from \"./oauth-user-lookup.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Device codes expire after 15 minutes */\nconst DEVICE_CODE_TTL_SECONDS = 15 * 60;\n\n/** Default polling interval in seconds */\nconst DEFAULT_INTERVAL = 5;\n\n/** RFC 8628 §3.5: interval increase on slow_down */\nconst SLOW_DOWN_INCREMENT = 5;\n\n/** Maximum slow_down interval cap (seconds) */\nconst MAX_SLOW_DOWN_INTERVAL = 60;\n\n/** Access token TTL: 1 hour */\nconst ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\n/** Refresh token TTL: 90 days */\nconst REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\n/** Default scopes for CLI login */\nconst DEFAULT_SCOPES = [\n\t\"content:read\",\n\t\"content:write\",\n\t\"media:read\",\n\t\"media:write\",\n\t\"schema:read\",\n] as const;\n\n/** Pattern to normalize user codes (strip hyphens) */\nconst HYPHEN_PATTERN = /-/g;\n\n/** Characters for user codes (uppercase, no ambiguous chars like 0/O, 1/I) */\nconst USER_CODE_CHARS = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface DeviceCodeResponse {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri: string;\n\texpires_in: number;\n\tinterval: number;\n}\n\nexport interface TokenResponse {\n\taccess_token: string;\n\trefresh_token: string;\n\ttoken_type: \"Bearer\";\n\texpires_in: number;\n\tscope: string;\n}\n\n// RFC 8628 error codes\nexport type DeviceFlowError =\n\t| \"authorization_pending\"\n\t| \"slow_down\"\n\t| \"expired_token\"\n\t| \"access_denied\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Generate a short human-readable user code (XXXX-XXXX) */\nfunction generateUserCode(): string {\n\tconst bytes = new Uint8Array(8);\n\tcrypto.getRandomValues(bytes);\n\tconst chars = Array.from(bytes, (b) => USER_CODE_CHARS[b % USER_CODE_CHARS.length]).join(\"\");\n\treturn `${chars.slice(0, 4)}-${chars.slice(4, 8)}`;\n}\n\n/** Get an ISO datetime string offset from now */\nfunction expiresAt(seconds: number): string {\n\treturn new Date(Date.now() + seconds * 1000).toISOString();\n}\n\n/** Validate and normalize scopes. Returns validated scope list. */\nfunction normalizeScopes(requested?: string[]): string[] {\n\tif (!requested || requested.length === 0) {\n\t\treturn [...DEFAULT_SCOPES];\n\t}\n\treturn [...new Set(requested.filter(isValidScope))];\n}\n\n/**\n * Scopes an approval by a user with `role` would grant:\n * requested_scopes ∩ scopesForRole(role). Approval and the approval-page\n * lookup must agree, so both go through here.\n */\nfunction grantableScopes(requested: string[], role: RoleLevel): string[] {\n\treturn clampScopes(requested, role);\n}\n\n/** Find a pending device code by user code, ignoring hyphens and case. Does not check expiry. */\nasync function findPendingDeviceCode(\n\tdb: Kysely<Database>,\n\tuserCode: string,\n): Promise<Selectable<DeviceCodeTable> | undefined> {\n\tconst chars = userCode.replace(HYPHEN_PATTERN, \"\").toUpperCase();\n\tif (chars.length !== 8) return undefined;\n\n\t// Stored codes always have the generateUserCode() shape.\n\treturn db\n\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t.selectAll()\n\t\t.where(\"user_code\", \"=\", `${chars.slice(0, 4)}-${chars.slice(4)}`)\n\t\t.where(\"status\", \"=\", \"pending\")\n\t\t.executeTakeFirst();\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * POST /oauth/device/code\n *\n * Issue a device code + user code. The CLI displays the user code\n * and tells the user to open the verification URI.\n */\nexport async function handleDeviceCodeRequest(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tclient_id?: string;\n\t\tscope?: string;\n\t},\n\tverificationUri: string,\n): Promise<ApiResult<DeviceCodeResponse>> {\n\ttry {\n\t\t// Note: client_id is accepted but not validated against _emdash_oauth_clients\n\t\t// because the CLI uses a well-known built-in client ID (\"emdash-cli\") that\n\t\t// isn't stored in the DB. Full client_id validation + scope clamping for the\n\t\t// device flow is tracked as a follow-up.\n\n\t\t// Parse and validate scopes\n\t\tconst requestedScopes = input.scope ? input.scope.split(\" \").filter(Boolean) : [];\n\t\tconst scopes = normalizeScopes(requestedScopes);\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_SCOPE\", message: \"No valid scopes requested\" },\n\t\t\t};\n\t\t}\n\n\t\tconst deviceCode = generateCodeVerifier();\n\t\tconst userCode = generateUserCode();\n\t\tconst expires = expiresAt(DEVICE_CODE_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_device_codes\")\n\t\t\t.values({\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tstatus: \"pending\",\n\t\t\t\texpires_at: expires,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tdevice_code: deviceCode,\n\t\t\t\tuser_code: userCode,\n\t\t\t\tverification_uri: verificationUri,\n\t\t\t\texpires_in: DEVICE_CODE_TTL_SECONDS,\n\t\t\t\tinterval: DEFAULT_INTERVAL,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"DEVICE_CODE_ERROR\",\n\t\t\t\tmessage: \"Failed to create device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/token\n *\n * CLI polls this endpoint with the device_code. Returns:\n * - 200 with tokens if authorized\n * - 400 with error \"authorization_pending\" while waiting\n * - 400 with error \"slow_down\" if polling too fast\n * - 400 with error \"expired_token\" if the code expired\n * - 400 with error \"access_denied\" if the user denied\n */\nexport async function handleDeviceTokenExchange(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tdevice_code: string;\n\t\tgrant_type: string;\n\t},\n): Promise<\n\tApiResult<TokenResponse> & { deviceFlowError?: DeviceFlowError; deviceFlowInterval?: number }\n> {\n\ttry {\n\t\t// Validate grant_type\n\t\tif (input.grant_type !== \"urn:ietf:params:oauth:grant-type:device_code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\t// Look up the device code\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_device_codes\")\n\t\t\t.selectAll()\n\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code\" },\n\t\t\t};\n\t\t}\n\n\t\tconst now = new Date();\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < now) {\n\t\t\t// Clean up expired code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"expired_token\",\n\t\t\t\terror: { code: \"expired_token\", message: \"The device code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check status\n\t\tif (row.status === \"denied\") {\n\t\t\t// Clean up denied code\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"access_denied\",\n\t\t\t\terror: { code: \"access_denied\", message: \"The user denied the request\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status === \"pending\") {\n\t\t\t// RFC 8628 §3.5: slow_down enforcement during polling phase.\n\t\t\t// Only applies while waiting for authorization — once authorized,\n\t\t\t// the final exchange proceeds without throttling.\n\t\t\tif (row.last_polled_at) {\n\t\t\t\tconst lastPolled = new Date(row.last_polled_at);\n\t\t\t\tconst elapsedSeconds = (now.getTime() - lastPolled.getTime()) / 1000;\n\n\t\t\t\tif (elapsedSeconds < row.interval) {\n\t\t\t\t\t// Too fast — increase interval by 5s per RFC 8628 §3.5, capped at 60s\n\t\t\t\t\tconst newInterval = Math.min(row.interval + SLOW_DOWN_INCREMENT, MAX_SLOW_DOWN_INTERVAL);\n\t\t\t\t\tawait db\n\t\t\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t\t\t.set({\n\t\t\t\t\t\t\tinterval: newInterval,\n\t\t\t\t\t\t\tlast_polled_at: now.toISOString(),\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t\t\t.execute();\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\tdeviceFlowError: \"slow_down\",\n\t\t\t\t\t\tdeviceFlowInterval: newInterval,\n\t\t\t\t\t\terror: { code: \"slow_down\", message: \"Polling too fast\" },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Update last_polled_at for future slow_down checks\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ last_polled_at: now.toISOString() })\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tdeviceFlowError: \"authorization_pending\",\n\t\t\t\terror: { code: \"authorization_pending\", message: \"Authorization pending\" },\n\t\t\t};\n\t\t}\n\n\t\tif (row.status !== \"authorized\" || !row.user_id) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid device code state\" },\n\t\t\t};\n\t\t}\n\n\t\t// Generate tokens before consuming the device code so that if\n\t\t// generation fails, the code is still available for retry.\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\t\tconst refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);\n\t\tconst refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);\n\n\t\t// Atomically consume the device code and create tokens in a single\n\t\t// transaction. DELETE...RETURNING prevents TOCTOU: two concurrent\n\t\t// requests race on the DELETE, only one gets a row back. Wrapping\n\t\t// in a transaction ensures the code isn't consumed if token storage fails.\n\t\tconst result = await withTransaction(db, async (trx) => {\n\t\t\tconst consumed = await trx\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", input.device_code)\n\t\t\t\t.where(\"status\", \"=\", \"authorized\")\n\t\t\t\t.returningAll()\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!consumed) return null;\n\n\t\t\tif (!consumed.user_id) return null;\n\n\t\t\tconst scopes = JSON.parse(consumed.scopes) as string[];\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\t\ttoken_type: \"access\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: accessExpires,\n\t\t\t\t\trefresh_token_hash: refreshToken.hash,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: refreshToken.hash,\n\t\t\t\t\ttoken_type: \"refresh\",\n\t\t\t\t\tuser_id: consumed.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"cli\",\n\t\t\t\t\texpires_at: refreshExpires,\n\t\t\t\t\trefresh_token_hash: null,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\treturn { scopes };\n\t\t});\n\n\t\tif (!result) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Device code already consumed\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: refreshToken.raw,\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: result.scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_EXCHANGE_ERROR\",\n\t\t\t\tmessage: \"Failed to exchange device code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * GET /oauth/device/authorize\n *\n * Returns the scopes a pending device code requested, and the subset an\n * approval by this user would grant, so the approval page can show them\n * before the user approves. Reveals nothing else about the device code.\n */\nexport async function handleDeviceCodeLookup(\n\tdb: Kysely<Database>,\n\tuserRole: RoleLevel,\n\tinput: { user_code: string },\n): Promise<ApiResult<{ requestedScopes: string[]; grantedScopes: string[] }>> {\n\ttry {\n\t\tconst match = await findPendingDeviceCode(db, input.user_code);\n\n\t\tif (!match) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CODE\", message: \"Invalid or expired code\" },\n\t\t\t};\n\t\t}\n\n\t\tif (new Date(match.expires_at) < new Date()) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"EXPIRED_CODE\", message: \"This code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\tconst requestedScopes = JSON.parse(match.scopes) as string[];\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { requestedScopes, grantedScopes: grantableScopes(requestedScopes, userRole) },\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: { code: \"DEVICE_CODE_LOOKUP_ERROR\", message: \"Failed to look up device code\" },\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/device/authorize\n *\n * The user submits the user_code after logging in via the browser.\n * This authorizes the device code, allowing the CLI to exchange it for tokens.\n *\n * Scopes are clamped to the user's role at this point. The stored scopes\n * are replaced with the intersection of requested scopes and the scopes\n * the user's role permits. This prevents scope escalation.\n */\nexport async function handleDeviceAuthorize(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tuserRole: RoleLevel,\n\tinput: {\n\t\tuser_code: string;\n\t\taction?: \"approve\" | \"deny\";\n\t},\n): Promise<ApiResult<{ authorized: boolean }>> {\n\ttry {\n\t\tconst match = await findPendingDeviceCode(db, input.user_code);\n\n\t\tif (!match) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_CODE\", message: \"Invalid or expired code\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(match.expires_at) < new Date()) {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_device_codes\")\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"EXPIRED_CODE\", message: \"This code has expired\" },\n\t\t\t};\n\t\t}\n\n\t\tconst action = input.action ?? \"approve\";\n\n\t\tif (action === \"deny\") {\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t\t.set({ status: \"denied\" })\n\t\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t\t.execute();\n\n\t\t\treturn { success: true, data: { authorized: false } };\n\t\t}\n\n\t\tconst effectiveScopes = grantableScopes(JSON.parse(match.scopes) as string[], userRole);\n\n\t\tif (effectiveScopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INSUFFICIENT_ROLE\",\n\t\t\t\t\tmessage: \"Your role does not permit any of the requested scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Approve: set user_id, status, and clamped scopes\n\t\tawait db\n\t\t\t.updateTable(\"_emdash_device_codes\")\n\t\t\t.set({\n\t\t\t\tstatus: \"authorized\",\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(effectiveScopes),\n\t\t\t})\n\t\t\t.where(\"device_code\", \"=\", match.device_code)\n\t\t\t.execute();\n\n\t\treturn { success: true, data: { authorized: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORIZE_ERROR\",\n\t\t\t\tmessage: \"Failed to authorize device\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/refresh\n *\n * Exchange a refresh token for a new access token.\n * The refresh token itself is not rotated (per spec: optional rotation).\n */\nexport async function handleTokenRefresh(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\trefresh_token: string;\n\t\tgrant_type: string;\n\t},\n): Promise<ApiResult<TokenResponse>> {\n\ttry {\n\t\tif (input.grant_type !== \"refresh_token\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"UNSUPPORTED_GRANT_TYPE\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\tif (!input.refresh_token.startsWith(TOKEN_PREFIXES.OAUTH_REFRESH)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token format\" },\n\t\t\t};\n\t\t}\n\n\t\tconst refreshHash = hashApiToken(input.refresh_token);\n\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.selectAll()\n\t\t\t.where(\"token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"refresh\")\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Invalid refresh token\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < new Date()) {\n\t\t\t// Clean up expired refresh token and its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"Refresh token expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// SEC-42: Revalidate user role before issuing new access token.\n\t\t// SEC-43: Reject refresh if user is disabled or deleted.\n\t\tconst userInfo = await lookupUserRoleAndStatus(db, row.user_id);\n\t\tif (!userInfo) {\n\t\t\t// User no longer exists — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (userInfo.disabled) {\n\t\t\t// User is disabled — revoke all their tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", row.user_id).execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_GRANT\", message: \"User account is disabled\" },\n\t\t\t};\n\t\t}\n\n\t\t// Revalidate stored scopes against the user's current role.\n\t\t// A demoted user's refresh token may carry stale elevated scopes.\n\t\tconst storedScopes = JSON.parse(row.scopes) as string[];\n\t\tlet scopes = clampScopes(storedScopes, userInfo.role);\n\n\t\t// SEC-41: Intersect with the client's registered scopes (if any).\n\t\t// Same check as the approval path — a client registered with limited\n\t\t// scopes should never receive elevated scopes on refresh, even if the\n\t\t// user's role would allow them.\n\t\tif (row.client_id) {\n\t\t\tconst client = await lookupOAuthClient(db, row.client_id);\n\t\t\tif (client?.scopes?.length) {\n\t\t\t\tscopes = scopes.filter((s: string) => client.scopes!.includes(s));\n\t\t\t}\n\t\t}\n\n\t\tif (scopes.length === 0) {\n\t\t\t// User's role no longer supports any of the token's scopes — revoke\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", refreshHash).execute();\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t\t.execute();\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_GRANT\",\n\t\t\t\t\tmessage: \"User role no longer supports any of the token's scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Delete old access tokens for this refresh token\n\t\tawait db\n\t\t\t.deleteFrom(\"_emdash_oauth_tokens\")\n\t\t\t.where(\"refresh_token_hash\", \"=\", refreshHash)\n\t\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t\t.execute();\n\n\t\t// Generate new access token\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t.values({\n\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\ttoken_type: \"access\",\n\t\t\t\tuser_id: row.user_id,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tclient_type: row.client_type,\n\t\t\t\texpires_at: accessExpires,\n\t\t\t\trefresh_token_hash: refreshHash,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: input.refresh_token, // Return same refresh token\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REFRESH_ERROR\",\n\t\t\t\tmessage: \"Failed to refresh token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * POST /oauth/token/revoke\n *\n * Revoke an access or refresh token. If a refresh token is revoked,\n * also revoke all associated access tokens.\n *\n * Per RFC 7009, this endpoint always returns 200 (even for invalid tokens).\n */\nexport async function handleTokenRevoke(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\ttoken: string;\n\t},\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst hash = hashApiToken(input.token);\n\n\t\t// Look up the token\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t\t.select([\"token_hash\", \"token_type\", \"refresh_token_hash\"])\n\t\t\t.where(\"token_hash\", \"=\", hash)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\t// Per RFC 7009: always 200, even for invalid tokens\n\t\t\treturn { success: true, data: { revoked: true } };\n\t\t}\n\n\t\tif (row.token_type === \"refresh\") {\n\t\t\t// Revoke refresh token and all its access tokens\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"refresh_token_hash\", \"=\", hash).execute();\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t} else {\n\t\t\t// Revoke just the access token\n\t\t\tawait db.deleteFrom(\"_emdash_oauth_tokens\").where(\"token_hash\", \"=\", hash).execute();\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke token\",\n\t\t\t},\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,MAAM,0BAA0B;;AAGhC,MAAM,mBAAmB;;AAGzB,MAAM,sBAAsB;;AAG5B,MAAM,yBAAyB;;AAG/B,MAAM,2BAA2B;;AAGjC,MAAM,4BAA4B,OAAU,KAAK;;AAGjD,MAAM,iBAAiB;CACtB;CACA;CACA;CACA;CACA;CACA;;AAGD,MAAM,iBAAiB;;AAGvB,MAAM,kBAAkB;;AAkCxB,SAAS,mBAA2B;CACnC,MAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,QAAO,gBAAgB,MAAM;CAC7B,MAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,gBAAgB,IAAI,IAAwB,CAAC,KAAK,GAAG;AAC5F,QAAO,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,MAAM,GAAG,EAAE;;;AAIjD,SAAS,UAAU,SAAyB;AAC3C,QAAO,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,IAAK,CAAC,aAAa;;;AAI3D,SAAS,gBAAgB,WAAgC;AACxD,KAAI,CAAC,aAAa,UAAU,WAAW,EACtC,QAAO,CAAC,GAAG,eAAe;AAE3B,QAAO,CAAC,GAAG,IAAI,IAAI,UAAU,OAAO,aAAa,CAAC,CAAC;;;;;;;AAQpD,SAAS,gBAAgB,WAAqB,MAA2B;AACxE,QAAO,YAAY,WAAW,KAAK;;;AAIpC,eAAe,sBACd,IACA,UACmD;CACnD,MAAM,QAAQ,SAAS,QAAQ,gBAAgB,GAAG,CAAC,aAAa;AAChE,KAAI,MAAM,WAAW,EAAG,QAAO;AAG/B,QAAO,GACL,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,aAAa,KAAK,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,MAAM,EAAE,GAAG,CACjE,MAAM,UAAU,KAAK,UAAU,CAC/B,kBAAkB;;;;;;;;AAarB,eAAsB,wBACrB,IACA,OAIA,iBACyC;AACzC,KAAI;EAQH,MAAM,SAAS,gBADS,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ,GAAG,EAAE,CAClC;AAE/C,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAGF,MAAM,aAAa,sBAAsB;EACzC,MAAM,WAAW,kBAAkB;EACnC,MAAM,UAAU,UAAU,wBAAwB;AAElD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,aAAa;GACb,WAAW;GACX,QAAQ,KAAK,UAAU,OAAO;GAC9B,QAAQ;GACR,YAAY;GACZ,UAAU;GACV,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,aAAa;IACb,WAAW;IACX,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;;;AAcH,eAAsB,0BACrB,IACA,OAMC;AACD,KAAI;AAEH,MAAI,MAAM,eAAe,+CACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;EAIF,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAuB;GAChE;EAGF,MAAM,sBAAM,IAAI,MAAM;AAGtB,MAAI,IAAI,KAAK,IAAI,WAAW,GAAG,KAAK;AAEnC,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAIF,MAAI,IAAI,WAAW,UAAU;AAE5B,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA+B;IACxE;;AAGF,MAAI,IAAI,WAAW,WAAW;AAI7B,OAAI,IAAI,gBAAgB;IACvB,MAAM,aAAa,IAAI,KAAK,IAAI,eAAe;AAG/C,SAFwB,IAAI,SAAS,GAAG,WAAW,SAAS,IAAI,MAE3C,IAAI,UAAU;KAElC,MAAM,cAAc,KAAK,IAAI,IAAI,WAAW,qBAAqB,uBAAuB;AACxF,WAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;MACJ,UAAU;MACV,gBAAgB,IAAI,aAAa;MACjC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,YAAO;MACN,SAAS;MACT,iBAAiB;MACjB,oBAAoB;MACpB,OAAO;OAAE,MAAM;OAAa,SAAS;OAAoB;MACzD;;;AAKH,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC,CAC1C,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,iBAAiB;IACjB,OAAO;KAAE,MAAM;KAAyB,SAAS;KAAyB;IAC1E;;AAGF,MAAI,IAAI,WAAW,gBAAgB,CAAC,IAAI,QACvC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAKF,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;EACzD,MAAM,eAAe,sBAAsB,eAAe,cAAc;EACxE,MAAM,iBAAiB,UAAU,0BAA0B;EAM3D,MAAM,SAAS,MAAM,gBAAgB,IAAI,OAAO,QAAQ;GACvD,MAAM,WAAW,MAAM,IACrB,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,MAAM,UAAU,KAAK,aAAa,CAClC,cAAc,CACd,kBAAkB;AAEpB,OAAI,CAAC,SAAU,QAAO;AAEtB,OAAI,CAAC,SAAS,QAAS,QAAO;GAE9B,MAAM,SAAS,KAAK,MAAM,SAAS,OAAO;AAE1C,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,YAAY;IACxB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB,aAAa;IACjC,CAAC,CACD,SAAS;AAEX,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,aAAa;IACzB,YAAY;IACZ,SAAS,SAAS;IAClB,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,CAAC,CACD,SAAS;AAEX,UAAO,EAAE,QAAQ;IAChB;AAEF,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,aAAa;IAC5B,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,OAAO,KAAK,IAAI;IAC9B;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;AAWH,eAAsB,uBACrB,IACA,UACA,OAC6E;AAC7E,KAAI;EACH,MAAM,QAAQ,MAAM,sBAAsB,IAAI,MAAM,UAAU;AAE9D,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAA2B;GACnE;AAGF,MAAI,IAAI,KAAK,MAAM,WAAW,mBAAG,IAAI,MAAM,CAC1C,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAAyB;GACjE;EAGF,MAAM,kBAAkB,KAAK,MAAM,MAAM,OAAO;AAEhD,SAAO;GACN,SAAS;GACT,MAAM;IAAE;IAAiB,eAAe,gBAAgB,iBAAiB,SAAS;IAAE;GACpF;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA4B,SAAS;IAAiC;GACrF;;;;;;;;;;;;;AAcH,eAAsB,sBACrB,IACA,QACA,UACA,OAI8C;AAC9C,KAAI;EACH,MAAM,QAAQ,MAAM,sBAAsB,IAAI,MAAM,UAAU;AAE9D,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAgB,SAAS;IAA2B;GACnE;AAIF,MAAI,IAAI,KAAK,MAAM,WAAW,mBAAG,IAAI,MAAM,EAAE;AAC5C,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAgB,SAAS;KAAyB;IACjE;;AAKF,OAFe,MAAM,UAAU,eAEhB,QAAQ;AACtB,SAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI,EAAE,QAAQ,UAAU,CAAC,CACzB,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,UAAO;IAAE,SAAS;IAAM,MAAM,EAAE,YAAY,OAAO;IAAE;;EAGtD,MAAM,kBAAkB,gBAAgB,KAAK,MAAM,MAAM,OAAO,EAAc,SAAS;AAEvF,MAAI,gBAAgB,WAAW,EAC9B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAIF,QAAM,GACJ,YAAY,uBAAuB,CACnC,IAAI;GACJ,QAAQ;GACR,SAAS;GACT,QAAQ,KAAK,UAAU,gBAAgB;GACvC,CAAC,CACD,MAAM,eAAe,KAAK,MAAM,YAAY,CAC5C,SAAS;AAEX,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,YAAY,MAAM;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,mBACrB,IACA,OAIoC;AACpC,KAAI;AACH,MAAI,MAAM,eAAe,gBACxB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;AAGF,MAAI,CAAC,MAAM,cAAc,WAAW,eAAe,cAAc,CAChE,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAgC;GACzE;EAGF,MAAM,cAAc,aAAa,MAAM,cAAc;EAErD,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,cAAc,KAAK,YAAY,CACrC,MAAM,cAAc,KAAK,UAAU,CACnC,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAyB;GAClE;AAIF,MAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,EAAE;AAE1C,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AAEX,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAyB;IAClE;;EAKF,MAAM,WAAW,MAAM,wBAAwB,IAAI,IAAI,QAAQ;AAC/D,MAAI,CAAC,UAAU;AAEd,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAkB;IAC3D;;AAGF,MAAI,SAAS,UAAU;AAEtB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,SAAS;AACxF,UAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM;KAAiB,SAAS;KAA4B;IACrE;;EAMF,IAAI,SAAS,YADQ,KAAK,MAAM,IAAI,OAAO,EACJ,SAAS,KAAK;AAMrD,MAAI,IAAI,WAAW;GAClB,MAAM,SAAS,MAAM,kBAAkB,IAAI,IAAI,UAAU;AACzD,OAAI,QAAQ,QAAQ,OACnB,UAAS,OAAO,QAAQ,MAAc,OAAO,OAAQ,SAAS,EAAE,CAAC;;AAInE,MAAI,OAAO,WAAW,GAAG;AAExB,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,YAAY,CAAC,SAAS;AAC3F,SAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,SAAS;AACX,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;AAIF,QAAM,GACJ,WAAW,uBAAuB,CAClC,MAAM,sBAAsB,KAAK,YAAY,CAC7C,MAAM,cAAc,KAAK,SAAS,CAClC,SAAS;EAGX,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;AAEzD,QAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;GACP,YAAY,YAAY;GACxB,YAAY;GACZ,SAAS,IAAI;GACb,QAAQ,KAAK,UAAU,OAAO;GAC9B,aAAa,IAAI;GACjB,YAAY;GACZ,oBAAoB;GACpB,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,MAAM;IACrB,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,KAAK,IAAI;IACvB;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;;;AAYH,eAAsB,kBACrB,IACA,OAG2C;AAC3C,KAAI;EACH,MAAM,OAAO,aAAa,MAAM,MAAM;EAGtC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;GAAC;GAAc;GAAc;GAAqB,CAAC,CAC1D,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,MAAI,CAAC,IAEJ,QAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;AAGlD,MAAI,IAAI,eAAe,WAAW;AAEjC,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,sBAAsB,KAAK,KAAK,CAAC,SAAS;AAC5F,SAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;QAGpF,OAAM,GAAG,WAAW,uBAAuB,CAAC,MAAM,cAAc,KAAK,KAAK,CAAC,SAAS;AAGrF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD"}

package/dist/digest-DVZ--cE9.mjs

@@ -0,0 +1,194 @@
+import { n as canonicalJson } from "./canonical-CcSuuTlH.mjs";
+import { SHA256 } from "@oslojs/crypto/sha2";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+
+//#region src/transfer/format/digest.ts
+/**
+* SHA-256 hashing and the digests that identify packages, plans, receipts,
+* and verified target state.
+*
+* Digest rules (formatVersion "1"):
+* - `packageDigest = "sha256:" + hex(sha256(utf8(canonicalJson(manifest))))`
+* - `planDigest = "sha256:" + hex(sha256(utf8(canonicalJson(plan))))` over the
+*   complete {@link SiteImportPlan} including its `decisions`, `packageDigest`
+*   and `target.siteId`, so a plan cannot be replayed against another package
+*   or target.
+* - `receiptDigest` covers the receipt with its `receiptDigest` property
+*   removed.
+* - A record's hash is the hex SHA-256 of its canonical JSON (the NDJSON line
+*   without its newline).
+* - A chunk's logical hash is
+*   `hex(sha256(utf8(canonicalJson([[id, recordSha256], …]))))` over the
+*   records of one package record chunk, in chunk order, each record in its
+*   predicted target form (after declared transformations).
+* - `logicalDigest = "sha256:" + hex(sha256(utf8(canonicalJson(chunks))))`
+*   where `chunks` is `[[kind, seq, chunkLogicalSha256], …]` for every record
+*   chunk in package order (kinds in `RECORD_KINDS` order, then `seq`).
+*   `principal` chunks are excluded because principals are never written to
+*   a target. The two-level shape lets verification run in bounded steps and
+*   persist one hash per chunk instead of an in-progress hash state.
+*/
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+function isSha256Hex(value) {
+	return typeof value === "string" && SHA256_HEX_PATTERN.test(value);
+}
+function isSha256Digest(value) {
+	return typeof value === "string" && SHA256_DIGEST_PATTERN.test(value);
+}
+function toSha256Digest(hex) {
+	if (!isSha256Hex(hex)) throw new TypeError("Expected a lowercase hex SHA-256");
+	return `sha256:${hex}`;
+}
+function isDigestStreamConstructor(value) {
+	return typeof value === "function";
+}
+function isNodeCreateHash(value) {
+	return typeof value === "function";
+}
+function getDigestStream() {
+	const candidate = typeof globalThis.crypto === "object" ? Reflect.get(globalThis.crypto, "DigestStream") : void 0;
+	return isDigestStreamConstructor(candidate) ? candidate : void 0;
+}
+function isNodeRuntime() {
+	const processLike = Reflect.get(globalThis, "process");
+	if (typeof processLike !== "object" || processLike === null) return false;
+	const versions = Reflect.get(processLike, "versions");
+	return typeof versions === "object" && versions !== null && typeof Reflect.get(versions, "node") === "string";
+}
+let nodeCreateHash;
+function loadNodeCreateHash() {
+	nodeCreateHash ??= (async () => {
+		if (!isNodeRuntime()) return null;
+		try {
+			const nodeCrypto = await import("node:crypto");
+			return isNodeCreateHash(nodeCrypto.createHash) ? nodeCrypto.createHash : null;
+		} catch {
+			return null;
+		}
+	})();
+	return nodeCreateHash;
+}
+async function preferredBackend() {
+	if (getDigestStream()) return "digest-stream";
+	if (await loadNodeCreateHash()) return "node";
+	return "oslo";
+}
+var DigestStreamHasher = class {
+	backend = "digest-stream";
+	#stream;
+	#writer;
+	#failure;
+	constructor(DigestStream) {
+		this.#stream = new DigestStream("SHA-256");
+		this.#writer = this.#stream.getWriter();
+	}
+	update(chunk) {
+		this.#writer.write(chunk.slice()).catch((error) => {
+			this.#failure ??= error;
+		});
+	}
+	async digest() {
+		await this.#writer.close();
+		if (this.#failure !== void 0) throw this.#failure;
+		return encodeHexLowerCase(new Uint8Array(await this.#stream.digest));
+	}
+};
+var NodeHasher = class {
+	backend = "node";
+	#hash;
+	constructor(createHash) {
+		this.#hash = createHash("sha256");
+	}
+	update(chunk) {
+		this.#hash.update(chunk);
+	}
+	async digest() {
+		return this.#hash.digest("hex");
+	}
+};
+var OsloHasher = class {
+	backend = "oslo";
+	#hash = new SHA256();
+	update(chunk) {
+		this.#hash.update(chunk);
+	}
+	async digest() {
+		return encodeHexLowerCase(this.#hash.digest());
+	}
+};
+async function createSha256(options = {}) {
+	switch (options.backend ?? await preferredBackend()) {
+		case "digest-stream": {
+			const DigestStream = getDigestStream();
+			if (!DigestStream) throw new Error("crypto.DigestStream is not available");
+			return new DigestStreamHasher(DigestStream);
+		}
+		case "node": {
+			const createHash = await loadNodeCreateHash();
+			if (!createHash) throw new Error("node:crypto is not available");
+			return new NodeHasher(createHash);
+		}
+		case "oslo": return new OsloHasher();
+	}
+}
+const encoder = new TextEncoder();
+async function sha256Hex(data) {
+	const bytes = typeof data === "string" ? encoder.encode(data) : data;
+	const hasher = await createSha256();
+	hasher.update(bytes);
+	return hasher.digest();
+}
+/** `"sha256:" + hex(sha256(utf8(canonicalJson(value))))`. */
+async function canonicalDigest(value) {
+	return toSha256Digest(await sha256Hex(canonicalJson(value)));
+}
+/** Hex SHA-256 of a record's canonical JSON (its NDJSON line without the newline). */
+async function recordSha256(record) {
+	return sha256Hex(canonicalJson(record));
+}
+function packageDigest(manifest) {
+	return canonicalDigest(manifest);
+}
+function planDigest(plan) {
+	return canonicalDigest(plan);
+}
+/** Digest over a receipt without its own `receiptDigest` property. */
+function receiptDigest(receipt) {
+	const { receiptDigest: _ignored, ...rest } = receipt;
+	return canonicalDigest(rest);
+}
+/** Hex logical hash of one record chunk from its `[id, recordSha256]` pairs in chunk order. */
+async function chunkLogicalSha256(records) {
+	for (const [, sha] of records) if (!isSha256Hex(sha)) throw new TypeError("Expected a lowercase hex SHA-256");
+	return sha256Hex(canonicalJson(records.map(([id, sha]) => [id, sha])));
+}
+/** `logicalDigest` from `[kind, seq, chunkLogicalSha256]` tuples in package order. */
+async function logicalDigest(chunks) {
+	for (const [, , sha] of chunks) if (!isSha256Hex(sha)) throw new TypeError("Expected a lowercase hex SHA-256");
+	return canonicalDigest(chunks.map(([kind, seq, sha]) => [
+		kind,
+		seq,
+		sha
+	]));
+}
+/**
+* Pass-through stream that feeds every chunk to `hasher` and counts bytes.
+* Throws inside the stream as soon as more than `maxBytes` flow through.
+*/
+function createHashingStream(hasher, options = {}) {
+	let total = 0;
+	return {
+		stream: new TransformStream({ transform(chunk, controller) {
+			total += chunk.byteLength;
+			if (options.maxBytes !== void 0 && total > options.maxBytes) throw options.onLimitExceeded?.() ?? /* @__PURE__ */ new RangeError("Stream exceeded its declared size");
+			hasher.update(chunk);
+			controller.enqueue(chunk);
+		} }),
+		bytes: () => total
+	};
+}
+
+//#endregion
+export { isSha256Digest as a, planDigest as c, sha256Hex as d, toSha256Digest as f, createSha256 as i, receiptDigest as l, chunkLogicalSha256 as n, logicalDigest as o, createHashingStream as r, packageDigest as s, canonicalDigest as t, recordSha256 as u };
+//# sourceMappingURL=digest-DVZ--cE9.mjs.map

package/dist/digest-DVZ--cE9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest-DVZ--cE9.mjs","names":["#stream","#writer","#failure","#hash"],"sources":["../src/transfer/format/digest.ts"],"sourcesContent":["/**\n * SHA-256 hashing and the digests that identify packages, plans, receipts,\n * and verified target state.\n *\n * Digest rules (formatVersion \"1\"):\n * - `packageDigest = \"sha256:\" + hex(sha256(utf8(canonicalJson(manifest))))`\n * - `planDigest = \"sha256:\" + hex(sha256(utf8(canonicalJson(plan))))` over the\n *   complete {@link SiteImportPlan} including its `decisions`, `packageDigest`\n *   and `target.siteId`, so a plan cannot be replayed against another package\n *   or target.\n * - `receiptDigest` covers the receipt with its `receiptDigest` property\n *   removed.\n * - A record's hash is the hex SHA-256 of its canonical JSON (the NDJSON line\n *   without its newline).\n * - A chunk's logical hash is\n *   `hex(sha256(utf8(canonicalJson([[id, recordSha256], …]))))` over the\n *   records of one package record chunk, in chunk order, each record in its\n *   predicted target form (after declared transformations).\n * - `logicalDigest = \"sha256:\" + hex(sha256(utf8(canonicalJson(chunks))))`\n *   where `chunks` is `[[kind, seq, chunkLogicalSha256], …]` for every record\n *   chunk in package order (kinds in `RECORD_KINDS` order, then `seq`).\n *   `principal` chunks are excluded because principals are never written to\n *   a target. The two-level shape lets verification run in bounded steps and\n *   persist one hash per chunk instead of an in-progress hash state.\n */\n\nimport { SHA256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\n\nimport { canonicalJson } from \"./canonical.js\";\n\nexport type Sha256Digest = `sha256:${string}`;\n\nconst SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;\nconst SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;\n\nexport function isSha256Hex(value: unknown): value is string {\n\treturn typeof value === \"string\" && SHA256_HEX_PATTERN.test(value);\n}\n\nexport function isSha256Digest(value: unknown): value is Sha256Digest {\n\treturn typeof value === \"string\" && SHA256_DIGEST_PATTERN.test(value);\n}\n\nexport function toSha256Digest(hex: string): Sha256Digest {\n\tif (!isSha256Hex(hex)) throw new TypeError(\"Expected a lowercase hex SHA-256\");\n\treturn `sha256:${hex}`;\n}\n\nexport function sha256HexOf(digest: Sha256Digest): string {\n\tif (!isSha256Digest(digest)) throw new TypeError(\"Expected a sha256: digest\");\n\treturn digest.slice(\"sha256:\".length);\n}\n\n/** Incremental SHA-256. `update` never retains the chunk after it returns. */\nexport interface Sha256Hasher {\n\treadonly backend: Sha256Backend;\n\tupdate(chunk: Uint8Array): void;\n\t/** Lowercase hex digest. The hasher must not be used afterwards. */\n\tdigest(): Promise<string>;\n}\n\nexport type Sha256Backend = \"digest-stream\" | \"node\" | \"oslo\";\n\ninterface DigestStreamLike extends WritableStream<ArrayBufferView | ArrayBuffer> {\n\treadonly digest: Promise<ArrayBuffer>;\n}\n\ntype DigestStreamConstructor = new (algorithm: string) => DigestStreamLike;\n\ninterface NodeHash {\n\tupdate(data: Uint8Array): unknown;\n\tdigest(encoding: \"hex\"): string;\n}\n\ntype NodeCreateHash = (algorithm: string) => NodeHash;\n\nfunction isDigestStreamConstructor(value: unknown): value is DigestStreamConstructor {\n\treturn typeof value === \"function\";\n}\n\nfunction isNodeCreateHash(value: unknown): value is NodeCreateHash {\n\treturn typeof value === \"function\";\n}\n\nfunction getDigestStream(): DigestStreamConstructor | undefined {\n\tconst candidate: unknown =\n\t\ttypeof globalThis.crypto === \"object\"\n\t\t\t? Reflect.get(globalThis.crypto, \"DigestStream\")\n\t\t\t: undefined;\n\treturn isDigestStreamConstructor(candidate) ? candidate : undefined;\n}\n\nfunction isNodeRuntime(): boolean {\n\tconst processLike: unknown = Reflect.get(globalThis, \"process\");\n\tif (typeof processLike !== \"object\" || processLike === null) return false;\n\tconst versions: unknown = Reflect.get(processLike, \"versions\");\n\treturn (\n\t\ttypeof versions === \"object\" &&\n\t\tversions !== null &&\n\t\ttypeof Reflect.get(versions, \"node\") === \"string\"\n\t);\n}\n\nlet nodeCreateHash: Promise<NodeCreateHash | null> | undefined;\n\nfunction loadNodeCreateHash(): Promise<NodeCreateHash | null> {\n\tnodeCreateHash ??= (async () => {\n\t\tif (!isNodeRuntime()) return null;\n\t\ttry {\n\t\t\tconst nodeCrypto: { createHash?: unknown } = await import(\"node:crypto\");\n\t\t\treturn isNodeCreateHash(nodeCrypto.createHash) ? nodeCrypto.createHash : null;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t})();\n\treturn nodeCreateHash;\n}\n\nasync function preferredBackend(): Promise<Sha256Backend> {\n\tif (getDigestStream()) return \"digest-stream\";\n\tif (await loadNodeCreateHash()) return \"node\";\n\treturn \"oslo\";\n}\n\nclass DigestStreamHasher implements Sha256Hasher {\n\treadonly backend = \"digest-stream\";\n\treadonly #stream: DigestStreamLike;\n\treadonly #writer: WritableStreamDefaultWriter<ArrayBufferView | ArrayBuffer>;\n\t#failure: unknown;\n\n\tconstructor(DigestStream: DigestStreamConstructor) {\n\t\tthis.#stream = new DigestStream(\"SHA-256\");\n\t\tthis.#writer = this.#stream.getWriter();\n\t}\n\n\tupdate(chunk: Uint8Array): void {\n\t\t// DigestStream consumes its input asynchronously; copy so the caller\n\t\t// may reuse its buffer as soon as update() returns.\n\t\tthis.#writer.write(chunk.slice()).catch((error: unknown) => {\n\t\t\tthis.#failure ??= error;\n\t\t});\n\t}\n\n\tasync digest(): Promise<string> {\n\t\tawait this.#writer.close();\n\t\tif (this.#failure !== undefined) throw this.#failure;\n\t\treturn encodeHexLowerCase(new Uint8Array(await this.#stream.digest));\n\t}\n}\n\nclass NodeHasher implements Sha256Hasher {\n\treadonly backend = \"node\";\n\treadonly #hash: NodeHash;\n\n\tconstructor(createHash: NodeCreateHash) {\n\t\tthis.#hash = createHash(\"sha256\");\n\t}\n\n\tupdate(chunk: Uint8Array): void {\n\t\tthis.#hash.update(chunk);\n\t}\n\n\tasync digest(): Promise<string> {\n\t\treturn this.#hash.digest(\"hex\");\n\t}\n}\n\nclass OsloHasher implements Sha256Hasher {\n\treadonly backend = \"oslo\";\n\treadonly #hash = new SHA256();\n\n\tupdate(chunk: Uint8Array): void {\n\t\tthis.#hash.update(chunk);\n\t}\n\n\tasync digest(): Promise<string> {\n\t\treturn encodeHexLowerCase(this.#hash.digest());\n\t}\n}\n\n/**\n * Backends usable in this runtime, most preferred first: `crypto.DigestStream`\n * (workerd), `node:crypto`, then the pure-JS oslo implementation.\n */\nexport async function availableSha256Backends(): Promise<Sha256Backend[]> {\n\tconst backends: Sha256Backend[] = [];\n\tif (getDigestStream()) backends.push(\"digest-stream\");\n\tif (await loadNodeCreateHash()) backends.push(\"node\");\n\tbackends.push(\"oslo\");\n\treturn backends;\n}\n\nexport async function createSha256(\n\toptions: { backend?: Sha256Backend } = {},\n): Promise<Sha256Hasher> {\n\tconst backend = options.backend ?? (await preferredBackend());\n\tswitch (backend) {\n\t\tcase \"digest-stream\": {\n\t\t\tconst DigestStream = getDigestStream();\n\t\t\tif (!DigestStream) throw new Error(\"crypto.DigestStream is not available\");\n\t\t\treturn new DigestStreamHasher(DigestStream);\n\t\t}\n\t\tcase \"node\": {\n\t\t\tconst createHash = await loadNodeCreateHash();\n\t\t\tif (!createHash) throw new Error(\"node:crypto is not available\");\n\t\t\treturn new NodeHasher(createHash);\n\t\t}\n\t\tcase \"oslo\":\n\t\t\treturn new OsloHasher();\n\t}\n}\n\nconst encoder = new TextEncoder();\n\nexport async function sha256Hex(data: Uint8Array | string): Promise<string> {\n\tconst bytes = typeof data === \"string\" ? encoder.encode(data) : data;\n\tconst hasher = await createSha256();\n\thasher.update(bytes);\n\treturn hasher.digest();\n}\n\n/** `\"sha256:\" + hex(sha256(utf8(canonicalJson(value))))`. */\nexport async function canonicalDigest(value: unknown): Promise<Sha256Digest> {\n\treturn toSha256Digest(await sha256Hex(canonicalJson(value)));\n}\n\n/** Hex SHA-256 of a record's canonical JSON (its NDJSON line without the newline). */\nexport async function recordSha256(record: unknown): Promise<string> {\n\treturn sha256Hex(canonicalJson(record));\n}\n\nexport function packageDigest(manifest: unknown): Promise<Sha256Digest> {\n\treturn canonicalDigest(manifest);\n}\n\nexport function planDigest(plan: unknown): Promise<Sha256Digest> {\n\treturn canonicalDigest(plan);\n}\n\n/** Digest over a receipt without its own `receiptDigest` property. */\nexport function receiptDigest(receipt: Record<string, unknown>): Promise<Sha256Digest> {\n\tconst { receiptDigest: _ignored, ...rest } = receipt;\n\treturn canonicalDigest(rest);\n}\n\n/** Hex logical hash of one record chunk from its `[id, recordSha256]` pairs in chunk order. */\nexport async function chunkLogicalSha256(\n\trecords: ReadonlyArray<readonly [id: string, recordSha256: string]>,\n): Promise<string> {\n\tfor (const [, sha] of records) {\n\t\tif (!isSha256Hex(sha)) throw new TypeError(\"Expected a lowercase hex SHA-256\");\n\t}\n\treturn sha256Hex(canonicalJson(records.map(([id, sha]) => [id, sha])));\n}\n\n/** `logicalDigest` from `[kind, seq, chunkLogicalSha256]` tuples in package order. */\nexport async function logicalDigest(\n\tchunks: ReadonlyArray<readonly [kind: string, seq: number, chunkLogicalSha256: string]>,\n): Promise<Sha256Digest> {\n\tfor (const [, , sha] of chunks) {\n\t\tif (!isSha256Hex(sha)) throw new TypeError(\"Expected a lowercase hex SHA-256\");\n\t}\n\treturn canonicalDigest(chunks.map(([kind, seq, sha]) => [kind, seq, sha]));\n}\n\n/**\n * Pass-through stream that feeds every chunk to `hasher` and counts bytes.\n * Throws inside the stream as soon as more than `maxBytes` flow through.\n */\nexport function createHashingStream(\n\thasher: Sha256Hasher,\n\toptions: { maxBytes?: number; onLimitExceeded?: () => unknown } = {},\n): { stream: TransformStream<Uint8Array, Uint8Array>; bytes: () => number } {\n\tlet total = 0;\n\tconst stream = new TransformStream<Uint8Array, Uint8Array>({\n\t\ttransform(chunk, controller) {\n\t\t\ttotal += chunk.byteLength;\n\t\t\tif (options.maxBytes !== undefined && total > options.maxBytes) {\n\t\t\t\tthrow options.onLimitExceeded?.() ?? new RangeError(\"Stream exceeded its declared size\");\n\t\t\t}\n\t\t\thasher.update(chunk);\n\t\t\tcontroller.enqueue(chunk);\n\t\t},\n\t});\n\treturn { stream, bytes: () => total };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAE9B,SAAgB,YAAY,OAAiC;AAC5D,QAAO,OAAO,UAAU,YAAY,mBAAmB,KAAK,MAAM;;AAGnE,SAAgB,eAAe,OAAuC;AACrE,QAAO,OAAO,UAAU,YAAY,sBAAsB,KAAK,MAAM;;AAGtE,SAAgB,eAAe,KAA2B;AACzD,KAAI,CAAC,YAAY,IAAI,CAAE,OAAM,IAAI,UAAU,mCAAmC;AAC9E,QAAO,UAAU;;AA+BlB,SAAS,0BAA0B,OAAkD;AACpF,QAAO,OAAO,UAAU;;AAGzB,SAAS,iBAAiB,OAAyC;AAClE,QAAO,OAAO,UAAU;;AAGzB,SAAS,kBAAuD;CAC/D,MAAM,YACL,OAAO,WAAW,WAAW,WAC1B,QAAQ,IAAI,WAAW,QAAQ,eAAe,GAC9C;AACJ,QAAO,0BAA0B,UAAU,GAAG,YAAY;;AAG3D,SAAS,gBAAyB;CACjC,MAAM,cAAuB,QAAQ,IAAI,YAAY,UAAU;AAC/D,KAAI,OAAO,gBAAgB,YAAY,gBAAgB,KAAM,QAAO;CACpE,MAAM,WAAoB,QAAQ,IAAI,aAAa,WAAW;AAC9D,QACC,OAAO,aAAa,YACpB,aAAa,QACb,OAAO,QAAQ,IAAI,UAAU,OAAO,KAAK;;AAI3C,IAAI;AAEJ,SAAS,qBAAqD;AAC7D,qBAAoB,YAAY;AAC/B,MAAI,CAAC,eAAe,CAAE,QAAO;AAC7B,MAAI;GACH,MAAM,aAAuC,MAAM,OAAO;AAC1D,UAAO,iBAAiB,WAAW,WAAW,GAAG,WAAW,aAAa;UAClE;AACP,UAAO;;KAEL;AACJ,QAAO;;AAGR,eAAe,mBAA2C;AACzD,KAAI,iBAAiB,CAAE,QAAO;AAC9B,KAAI,MAAM,oBAAoB,CAAE,QAAO;AACvC,QAAO;;AAGR,IAAM,qBAAN,MAAiD;CAChD,AAAS,UAAU;CACnB,CAASA;CACT,CAASC;CACT;CAEA,YAAY,cAAuC;AAClD,QAAKD,SAAU,IAAI,aAAa,UAAU;AAC1C,QAAKC,SAAU,MAAKD,OAAQ,WAAW;;CAGxC,OAAO,OAAyB;AAG/B,QAAKC,OAAQ,MAAM,MAAM,OAAO,CAAC,CAAC,OAAO,UAAmB;AAC3D,SAAKC,YAAa;IACjB;;CAGH,MAAM,SAA0B;AAC/B,QAAM,MAAKD,OAAQ,OAAO;AAC1B,MAAI,MAAKC,YAAa,OAAW,OAAM,MAAKA;AAC5C,SAAO,mBAAmB,IAAI,WAAW,MAAM,MAAKF,OAAQ,OAAO,CAAC;;;AAItE,IAAM,aAAN,MAAyC;CACxC,AAAS,UAAU;CACnB,CAASG;CAET,YAAY,YAA4B;AACvC,QAAKA,OAAQ,WAAW,SAAS;;CAGlC,OAAO,OAAyB;AAC/B,QAAKA,KAAM,OAAO,MAAM;;CAGzB,MAAM,SAA0B;AAC/B,SAAO,MAAKA,KAAM,OAAO,MAAM;;;AAIjC,IAAM,aAAN,MAAyC;CACxC,AAAS,UAAU;CACnB,CAASA,OAAQ,IAAI,QAAQ;CAE7B,OAAO,OAAyB;AAC/B,QAAKA,KAAM,OAAO,MAAM;;CAGzB,MAAM,SAA0B;AAC/B,SAAO,mBAAmB,MAAKA,KAAM,QAAQ,CAAC;;;AAgBhD,eAAsB,aACrB,UAAuC,EAAE,EACjB;AAExB,SADgB,QAAQ,WAAY,MAAM,kBAAkB,EAC5D;EACC,KAAK,iBAAiB;GACrB,MAAM,eAAe,iBAAiB;AACtC,OAAI,CAAC,aAAc,OAAM,IAAI,MAAM,uCAAuC;AAC1E,UAAO,IAAI,mBAAmB,aAAa;;EAE5C,KAAK,QAAQ;GACZ,MAAM,aAAa,MAAM,oBAAoB;AAC7C,OAAI,CAAC,WAAY,OAAM,IAAI,MAAM,+BAA+B;AAChE,UAAO,IAAI,WAAW,WAAW;;EAElC,KAAK,OACJ,QAAO,IAAI,YAAY;;;AAI1B,MAAM,UAAU,IAAI,aAAa;AAEjC,eAAsB,UAAU,MAA4C;CAC3E,MAAM,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,KAAK,GAAG;CAChE,MAAM,SAAS,MAAM,cAAc;AACnC,QAAO,OAAO,MAAM;AACpB,QAAO,OAAO,QAAQ;;;AAIvB,eAAsB,gBAAgB,OAAuC;AAC5E,QAAO,eAAe,MAAM,UAAU,cAAc,MAAM,CAAC,CAAC;;;AAI7D,eAAsB,aAAa,QAAkC;AACpE,QAAO,UAAU,cAAc,OAAO,CAAC;;AAGxC,SAAgB,cAAc,UAA0C;AACvE,QAAO,gBAAgB,SAAS;;AAGjC,SAAgB,WAAW,MAAsC;AAChE,QAAO,gBAAgB,KAAK;;;AAI7B,SAAgB,cAAc,SAAyD;CACtF,MAAM,EAAE,eAAe,UAAU,GAAG,SAAS;AAC7C,QAAO,gBAAgB,KAAK;;;AAI7B,eAAsB,mBACrB,SACkB;AAClB,MAAK,MAAM,GAAG,QAAQ,QACrB,KAAI,CAAC,YAAY,IAAI,CAAE,OAAM,IAAI,UAAU,mCAAmC;AAE/E,QAAO,UAAU,cAAc,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;;;AAIvE,eAAsB,cACrB,QACwB;AACxB,MAAK,MAAM,KAAK,QAAQ,OACvB,KAAI,CAAC,YAAY,IAAI,CAAE,OAAM,IAAI,UAAU,mCAAmC;AAE/E,QAAO,gBAAgB,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;EAAC;EAAM;EAAK;EAAI,CAAC,CAAC;;;;;;AAO3E,SAAgB,oBACf,QACA,UAAkE,EAAE,EACO;CAC3E,IAAI,QAAQ;AAWZ,QAAO;EAAE,QAVM,IAAI,gBAAwC,EAC1D,UAAU,OAAO,YAAY;AAC5B,YAAS,MAAM;AACf,OAAI,QAAQ,aAAa,UAAa,QAAQ,QAAQ,SACrD,OAAM,QAAQ,mBAAmB,oBAAI,IAAI,WAAW,oCAAoC;AAEzF,UAAO,OAAO,MAAM;AACpB,cAAW,QAAQ,MAAM;KAE1B,CAAC;EACe,aAAa;EAAO"}

package/dist/direct-executor-DyjAqkpT.mjs

@@ -0,0 +1,104 @@
+import { i as getExactMigrationStatus, s as runMigrations } from "./runner-B3eyB9Gb.mjs";
+import { clearMigrationLock, readMigrationLock } from "./database/migration-lock.mjs";
+import { c as setI18nConfig, r as getI18nConfig } from "./config-CvmjJcVw.mjs";
+import { r as getCoreMigrationIdentity } from "./identity-NVTOOQyq.mjs";
+import { Kysely } from "kysely";
+
+//#region src/migrations/direct-executor.ts
+const LOCK_ID_PATTERN = /^[1-9]\d{0,15}$/;
+function createReport(target, status, executed, lockHeldSince = null) {
+	const report = {
+		target,
+		knownApplied: [...status.knownApplied],
+		pending: [...status.pending],
+		unknownApplied: [...status.unknownApplied],
+		executed: [...executed]
+	};
+	if (lockHeldSince !== null) report.lock = {
+		id: String(lockHeldSince),
+		heldSince: new Date(lockHeldSince).toISOString()
+	};
+	return report;
+}
+async function releaseLock(db, lockId) {
+	if (!lockId || !LOCK_ID_PATTERN.test(lockId)) throw new Error("Releasing the migration lock requires the lock id reported by status.");
+	const lock = Number(lockId);
+	const heldSince = await readMigrationLock(db);
+	if (heldSince === lock && await clearMigrationLock(db, lock)) return;
+	const current = heldSince === lock ? await readMigrationLock(db) : heldSince;
+	throw new Error(current === null ? "The migration lock is not held." : "The migration lock has a different id now. Check the status again before releasing it.");
+}
+async function verifyRequest(request) {
+	const identity = await getCoreMigrationIdentity();
+	if (request.artifact.emdashVersion !== identity.emdashVersion || request.artifact.migrationSetFingerprint !== identity.fingerprint) throw new Error("Migration artifact does not match the loaded EmDash version and migration registry.");
+}
+async function executeRequest(db, target, request) {
+	const initialStatus = await getExactMigrationStatus(db);
+	if (request.action === "check") return createReport(target, initialStatus, [], await readMigrationLock(db));
+	if (request.action === "release-lock") {
+		await releaseLock(db, request.lockId);
+		return createReport(target, initialStatus, []);
+	}
+	if (initialStatus.unknownApplied.length > 0) throw new Error(`Cannot apply migrations with unknown applied migrations: ${initialStatus.unknownApplied.join(", ")}`);
+	if (initialStatus.pending.length === 0) return createReport(target, initialStatus, []);
+	const result = await runMigrations(db);
+	return createReport(target, await getExactMigrationStatus(db), result.applied);
+}
+function createDirectMigrationExecutor(options) {
+	const target = Object.freeze({ ...options.target });
+	let used = false;
+	let disposed = false;
+	let activeDb;
+	let closePromise;
+	const closeActiveDb = () => {
+		if (!activeDb) return Promise.resolve();
+		closePromise ??= activeDb.destroy();
+		return closePromise;
+	};
+	return {
+		target,
+		async execute(request) {
+			if (disposed) throw new Error("Migration executor has been disposed.");
+			if (used) throw new Error("Migration executors are single-use.");
+			used = true;
+			if (request.action !== "check" && request.action !== "apply" && request.action !== "release-lock") throw new Error("Unsupported migration action.");
+			await verifyRequest(request);
+			const db = new Kysely({ dialect: await options.createDialect() });
+			activeDb = db;
+			if (disposed) {
+				await closeActiveDb();
+				throw new Error("Migration executor has been disposed.");
+			}
+			const previousI18n = getI18nConfig();
+			let executionFailed = false;
+			let executionError;
+			let report;
+			setI18nConfig(request.i18n);
+			try {
+				report = await executeRequest(db, target, request);
+			} catch (error) {
+				executionFailed = true;
+				executionError = error;
+			} finally {
+				setI18nConfig(previousI18n);
+				try {
+					await closeActiveDb();
+				} catch {
+					console.error("[migrations] Database close failed.");
+					closePromise = Promise.resolve();
+				}
+			}
+			if (executionFailed) throw executionError;
+			if (!report) throw new Error("Migration execution did not produce a report.");
+			return report;
+		},
+		dispose() {
+			disposed = true;
+			return closeActiveDb();
+		}
+	};
+}
+
+//#endregion
+export { createDirectMigrationExecutor as t };
+//# sourceMappingURL=direct-executor-DyjAqkpT.mjs.map

package/dist/direct-executor-DyjAqkpT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-executor-DyjAqkpT.mjs","names":[],"sources":["../src/migrations/direct-executor.ts"],"sourcesContent":["import { type Dialect, Kysely } from \"kysely\";\n\nimport { clearMigrationLock, readMigrationLock } from \"../database/migration-lock.js\";\nimport {\n\tgetExactMigrationStatus,\n\trunMigrations,\n\ttype ExactMigrationStatus,\n} from \"../database/migrations/runner.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getI18nConfig, setI18nConfig } from \"../i18n/config.js\";\nimport { getCoreMigrationIdentity } from \"./identity.js\";\nimport type {\n\tMigrationExecutor,\n\tMigrationReport,\n\tMigrationRequest,\n\tMigrationTarget,\n} from \"./protocol.js\";\n\nexport interface DirectMigrationExecutorOptions {\n\ttarget: MigrationTarget;\n\tcreateDialect: () => Dialect | Promise<Dialect>;\n}\n\nconst LOCK_ID_PATTERN = /^[1-9]\\d{0,15}$/;\n\nfunction createReport(\n\ttarget: MigrationTarget,\n\tstatus: ExactMigrationStatus,\n\texecuted: readonly string[],\n\tlockHeldSince: number | null = null,\n): MigrationReport {\n\tconst report: MigrationReport = {\n\t\ttarget,\n\t\tknownApplied: [...status.knownApplied],\n\t\tpending: [...status.pending],\n\t\tunknownApplied: [...status.unknownApplied],\n\t\texecuted: [...executed],\n\t};\n\tif (lockHeldSince !== null) {\n\t\treport.lock = {\n\t\t\tid: String(lockHeldSince),\n\t\t\theldSince: new Date(lockHeldSince).toISOString(),\n\t\t};\n\t}\n\treturn report;\n}\n\nasync function releaseLock(db: Kysely<Database>, lockId: string | undefined): Promise<void> {\n\tif (!lockId || !LOCK_ID_PATTERN.test(lockId)) {\n\t\tthrow new Error(\"Releasing the migration lock requires the lock id reported by status.\");\n\t}\n\tconst lock = Number(lockId);\n\t// Read before writing: on Postgres the lock column is a 32-bit integer that\n\t// a lock id does not fit, and no Postgres lock is ever held in it.\n\tconst heldSince = await readMigrationLock(db);\n\tif (heldSince === lock && (await clearMigrationLock(db, lock))) return;\n\tconst current = heldSince === lock ? await readMigrationLock(db) : heldSince;\n\t// No lock ids here: the CLI's redaction can rewrite digits that match an\n\t// environment value.\n\tthrow new Error(\n\t\tcurrent === null\n\t\t\t? \"The migration lock is not held.\"\n\t\t\t: \"The migration lock has a different id now. Check the status again before releasing it.\",\n\t);\n}\n\nasync function verifyRequest(request: MigrationRequest): Promise<void> {\n\tconst identity = await getCoreMigrationIdentity();\n\tif (\n\t\trequest.artifact.emdashVersion !== identity.emdashVersion ||\n\t\trequest.artifact.migrationSetFingerprint !== identity.fingerprint\n\t) {\n\t\tthrow new Error(\n\t\t\t\"Migration artifact does not match the loaded EmDash version and migration registry.\",\n\t\t);\n\t}\n}\n\nasync function executeRequest(\n\tdb: Kysely<Database>,\n\ttarget: MigrationTarget,\n\trequest: MigrationRequest,\n): Promise<MigrationReport> {\n\tconst initialStatus = await getExactMigrationStatus(db);\n\tif (request.action === \"check\") {\n\t\treturn createReport(target, initialStatus, [], await readMigrationLock(db));\n\t}\n\tif (request.action === \"release-lock\") {\n\t\tawait releaseLock(db, request.lockId);\n\t\treturn createReport(target, initialStatus, []);\n\t}\n\n\tif (initialStatus.unknownApplied.length > 0) {\n\t\tthrow new Error(\n\t\t\t`Cannot apply migrations with unknown applied migrations: ${initialStatus.unknownApplied.join(\", \")}`,\n\t\t);\n\t}\n\tif (initialStatus.pending.length === 0) {\n\t\treturn createReport(target, initialStatus, []);\n\t}\n\n\tconst result = await runMigrations(db);\n\tconst finalStatus = await getExactMigrationStatus(db);\n\treturn createReport(target, finalStatus, result.applied);\n}\n\nexport function createDirectMigrationExecutor(\n\toptions: DirectMigrationExecutorOptions,\n): MigrationExecutor {\n\tconst target = Object.freeze({ ...options.target });\n\tlet used = false;\n\tlet disposed = false;\n\tlet activeDb: Kysely<Database> | undefined;\n\tlet closePromise: Promise<void> | undefined;\n\n\tconst closeActiveDb = (): Promise<void> => {\n\t\tif (!activeDb) return Promise.resolve();\n\t\tclosePromise ??= activeDb.destroy();\n\t\treturn closePromise;\n\t};\n\n\treturn {\n\t\ttarget,\n\t\tasync execute(request) {\n\t\t\tif (disposed) {\n\t\t\t\tthrow new Error(\"Migration executor has been disposed.\");\n\t\t\t}\n\t\t\tif (used) {\n\t\t\t\tthrow new Error(\"Migration executors are single-use.\");\n\t\t\t}\n\t\t\tused = true;\n\n\t\t\tif (\n\t\t\t\trequest.action !== \"check\" &&\n\t\t\t\trequest.action !== \"apply\" &&\n\t\t\t\trequest.action !== \"release-lock\"\n\t\t\t) {\n\t\t\t\tthrow new Error(\"Unsupported migration action.\");\n\t\t\t}\n\t\t\tawait verifyRequest(request);\n\n\t\t\tconst dialect = await options.createDialect();\n\t\t\tconst db = new Kysely<Database>({ dialect });\n\t\t\tactiveDb = db;\n\t\t\tif (disposed) {\n\t\t\t\tawait closeActiveDb();\n\t\t\t\tthrow new Error(\"Migration executor has been disposed.\");\n\t\t\t}\n\t\t\tconst previousI18n = getI18nConfig();\n\t\t\tlet executionFailed = false;\n\t\t\tlet executionError: unknown;\n\t\t\tlet report: MigrationReport | undefined;\n\t\t\tsetI18nConfig(request.i18n);\n\n\t\t\ttry {\n\t\t\t\treport = await executeRequest(db, target, request);\n\t\t\t} catch (error) {\n\t\t\t\texecutionFailed = true;\n\t\t\t\texecutionError = error;\n\t\t\t} finally {\n\t\t\t\tsetI18nConfig(previousI18n);\n\t\t\t\ttry {\n\t\t\t\t\tawait closeActiveDb();\n\t\t\t\t} catch {\n\t\t\t\t\tconsole.error(\"[migrations] Database close failed.\");\n\t\t\t\t\tclosePromise = Promise.resolve();\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (executionFailed) throw executionError;\n\t\t\tif (!report) throw new Error(\"Migration execution did not produce a report.\");\n\t\t\treturn report;\n\t\t},\n\t\tdispose() {\n\t\t\tdisposed = true;\n\t\t\treturn closeActiveDb();\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;AAuBA,MAAM,kBAAkB;AAExB,SAAS,aACR,QACA,QACA,UACA,gBAA+B,MACb;CAClB,MAAM,SAA0B;EAC/B;EACA,cAAc,CAAC,GAAG,OAAO,aAAa;EACtC,SAAS,CAAC,GAAG,OAAO,QAAQ;EAC5B,gBAAgB,CAAC,GAAG,OAAO,eAAe;EAC1C,UAAU,CAAC,GAAG,SAAS;EACvB;AACD,KAAI,kBAAkB,KACrB,QAAO,OAAO;EACb,IAAI,OAAO,cAAc;EACzB,WAAW,IAAI,KAAK,cAAc,CAAC,aAAa;EAChD;AAEF,QAAO;;AAGR,eAAe,YAAY,IAAsB,QAA2C;AAC3F,KAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,OAAO,CAC3C,OAAM,IAAI,MAAM,wEAAwE;CAEzF,MAAM,OAAO,OAAO,OAAO;CAG3B,MAAM,YAAY,MAAM,kBAAkB,GAAG;AAC7C,KAAI,cAAc,QAAS,MAAM,mBAAmB,IAAI,KAAK,CAAG;CAChE,MAAM,UAAU,cAAc,OAAO,MAAM,kBAAkB,GAAG,GAAG;AAGnE,OAAM,IAAI,MACT,YAAY,OACT,oCACA,yFACH;;AAGF,eAAe,cAAc,SAA0C;CACtE,MAAM,WAAW,MAAM,0BAA0B;AACjD,KACC,QAAQ,SAAS,kBAAkB,SAAS,iBAC5C,QAAQ,SAAS,4BAA4B,SAAS,YAEtD,OAAM,IAAI,MACT,sFACA;;AAIH,eAAe,eACd,IACA,QACA,SAC2B;CAC3B,MAAM,gBAAgB,MAAM,wBAAwB,GAAG;AACvD,KAAI,QAAQ,WAAW,QACtB,QAAO,aAAa,QAAQ,eAAe,EAAE,EAAE,MAAM,kBAAkB,GAAG,CAAC;AAE5E,KAAI,QAAQ,WAAW,gBAAgB;AACtC,QAAM,YAAY,IAAI,QAAQ,OAAO;AACrC,SAAO,aAAa,QAAQ,eAAe,EAAE,CAAC;;AAG/C,KAAI,cAAc,eAAe,SAAS,EACzC,OAAM,IAAI,MACT,4DAA4D,cAAc,eAAe,KAAK,KAAK,GACnG;AAEF,KAAI,cAAc,QAAQ,WAAW,EACpC,QAAO,aAAa,QAAQ,eAAe,EAAE,CAAC;CAG/C,MAAM,SAAS,MAAM,cAAc,GAAG;AAEtC,QAAO,aAAa,QADA,MAAM,wBAAwB,GAAG,EACZ,OAAO,QAAQ;;AAGzD,SAAgB,8BACf,SACoB;CACpB,MAAM,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CACnD,IAAI,OAAO;CACX,IAAI,WAAW;CACf,IAAI;CACJ,IAAI;CAEJ,MAAM,sBAAqC;AAC1C,MAAI,CAAC,SAAU,QAAO,QAAQ,SAAS;AACvC,mBAAiB,SAAS,SAAS;AACnC,SAAO;;AAGR,QAAO;EACN;EACA,MAAM,QAAQ,SAAS;AACtB,OAAI,SACH,OAAM,IAAI,MAAM,wCAAwC;AAEzD,OAAI,KACH,OAAM,IAAI,MAAM,sCAAsC;AAEvD,UAAO;AAEP,OACC,QAAQ,WAAW,WACnB,QAAQ,WAAW,WACnB,QAAQ,WAAW,eAEnB,OAAM,IAAI,MAAM,gCAAgC;AAEjD,SAAM,cAAc,QAAQ;GAG5B,MAAM,KAAK,IAAI,OAAiB,EAAE,SADlB,MAAM,QAAQ,eAAe,EACF,CAAC;AAC5C,cAAW;AACX,OAAI,UAAU;AACb,UAAM,eAAe;AACrB,UAAM,IAAI,MAAM,wCAAwC;;GAEzD,MAAM,eAAe,eAAe;GACpC,IAAI,kBAAkB;GACtB,IAAI;GACJ,IAAI;AACJ,iBAAc,QAAQ,KAAK;AAE3B,OAAI;AACH,aAAS,MAAM,eAAe,IAAI,QAAQ,QAAQ;YAC1C,OAAO;AACf,sBAAkB;AAClB,qBAAiB;aACR;AACT,kBAAc,aAAa;AAC3B,QAAI;AACH,WAAM,eAAe;YACd;AACP,aAAQ,MAAM,sCAAsC;AACpD,oBAAe,QAAQ,SAAS;;;AAIlC,OAAI,gBAAiB,OAAM;AAC3B,OAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,gDAAgD;AAC7E,UAAO;;EAER,UAAU;AACT,cAAW;AACX,UAAO,eAAe;;EAEvB"}