emdash 0.41.0 → 0.42.0

package/dist/default-DaoYyFRS.mjs

@@ -0,0 +1,81 @@
+//#region src/seed/default.ts
+const defaultSeed = {
+	version: "1",
+	meta: {
+		name: "Default",
+		description: "Posts and pages with categories and tags"
+	},
+	collections: [{
+		slug: "posts",
+		label: "Posts",
+		labelSingular: "Post",
+		supports: [
+			"drafts",
+			"revisions",
+			"search"
+		],
+		fields: [
+			{
+				slug: "title",
+				label: "Title",
+				type: "string",
+				required: true,
+				searchable: true
+			},
+			{
+				slug: "featured_image",
+				label: "Featured Image",
+				type: "image"
+			},
+			{
+				slug: "content",
+				label: "Content",
+				type: "portableText",
+				searchable: true
+			},
+			{
+				slug: "excerpt",
+				label: "Excerpt",
+				type: "text"
+			}
+		]
+	}, {
+		slug: "pages",
+		label: "Pages",
+		labelSingular: "Page",
+		supports: [
+			"drafts",
+			"revisions",
+			"search"
+		],
+		fields: [{
+			slug: "title",
+			label: "Title",
+			type: "string",
+			required: true,
+			searchable: true
+		}, {
+			slug: "content",
+			label: "Content",
+			type: "portableText",
+			searchable: true
+		}]
+	}],
+	taxonomies: [{
+		name: "category",
+		label: "Categories",
+		labelSingular: "Category",
+		hierarchical: true,
+		collections: ["posts"]
+	}, {
+		name: "tag",
+		label: "Tags",
+		labelSingular: "Tag",
+		hierarchical: false,
+		collections: ["posts"]
+	}]
+};
+
+//#endregion
+export { defaultSeed as t };
+//# sourceMappingURL=default-DaoYyFRS.mjs.map

package/dist/default-DaoYyFRS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-DaoYyFRS.mjs","names":[],"sources":["../src/seed/default.ts"],"sourcesContent":["/**\n * Default seed applied when no user seed file exists.\n *\n * Provides the baseline schema every EmDash site needs:\n * posts, pages, categories, and tags.\n */\n\nimport type { SeedFile } from \"./types.js\";\n\nexport const defaultSeed: SeedFile = {\n\tversion: \"1\",\n\tmeta: {\n\t\tname: \"Default\",\n\t\tdescription: \"Posts and pages with categories and tags\",\n\t},\n\tcollections: [\n\t\t{\n\t\t\tslug: \"posts\",\n\t\t\tlabel: \"Posts\",\n\t\t\tlabelSingular: \"Post\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"featured_image\",\n\t\t\t\t\tlabel: \"Featured Image\",\n\t\t\t\t\ttype: \"image\",\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"excerpt\",\n\t\t\t\t\tlabel: \"Excerpt\",\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\t{\n\t\t\tslug: \"pages\",\n\t\t\tlabel: \"Pages\",\n\t\t\tlabelSingular: \"Page\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t],\n\ttaxonomies: [\n\t\t{\n\t\t\tname: \"category\",\n\t\t\tlabel: \"Categories\",\n\t\t\tlabelSingular: \"Category\",\n\t\t\thierarchical: true,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t\t{\n\t\t\tname: \"tag\",\n\t\t\tlabel: \"Tags\",\n\t\t\tlabelSingular: \"Tag\",\n\t\t\thierarchical: false,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t],\n};\n"],"mappings":";AASA,MAAa,cAAwB;CACpC,SAAS;CACT,MAAM;EACL,MAAM;EACN,aAAa;EACb;CACD,aAAa,CACZ;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ;GACP;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;EACD,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ,CACP;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,YAAY;GACZ,EACD;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,YAAY;GACZ,CACD;EACD,CACD;CACD,YAAY,CACX;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,CACD;CACD"}

package/dist/deferred-tasks-OBADxoFf.d.mts

@@ -0,0 +1,9 @@
+//#region src/deferred-tasks.d.ts
+interface DeferredTaskTracker {
+  settled: Promise<void>;
+  track<T>(promise: Promise<T>): Promise<T>;
+  settle(): void;
+}
+//#endregion
+export { DeferredTaskTracker as t };
+//# sourceMappingURL=deferred-tasks-OBADxoFf.d.mts.map

package/dist/deferred-tasks-OBADxoFf.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferred-tasks-OBADxoFf.d.mts","names":[],"sources":["../src/deferred-tasks.ts"],"mappings":";UAAiB,mBAAA;EAChB,OAAA,EAAS,OAAA;EACT,KAAA,IAAS,OAAA,EAAS,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;EACvC,MAAA;AAAA"}

package/dist/destination-r2zIAZ2S.mjs

@@ -0,0 +1,18 @@
+//#region src/redirects/destination.ts
+/**
+* Browsers strip tab/CR/LF anywhere in a URL, so `/\t/evil.example` resolves
+* as `//evil.example`. Reject every C0 control and DEL rather than just those.
+*/
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/**
+* Returns true if `destination` is a single-slash site-relative path, i.e. a
+* browser resolves it on the current origin: no scheme, no `//` or `/\`
+* prefix, and no control characters.
+*/
+function isSiteRelativeDestination(destination) {
+	return destination.startsWith("/") && destination[1] !== "/" && destination[1] !== "\\" && !CONTROL_CHARS.test(destination);
+}
+
+//#endregion
+export { isSiteRelativeDestination as t };
+//# sourceMappingURL=destination-r2zIAZ2S.mjs.map

package/dist/destination-r2zIAZ2S.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"destination-r2zIAZ2S.mjs","names":[],"sources":["../src/redirects/destination.ts"],"sourcesContent":["/**\n * Browsers strip tab/CR/LF anywhere in a URL, so `/\\t/evil.example` resolves\n * as `//evil.example`. Reject every C0 control and DEL rather than just those.\n */\n// eslint-disable-next-line no-control-regex -- matching control characters is the purpose of this regex\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f]/;\n\n/**\n * Returns true if `destination` is a single-slash site-relative path, i.e. a\n * browser resolves it on the current origin: no scheme, no `//` or `/\\`\n * prefix, and no control characters.\n */\nexport function isSiteRelativeDestination(destination: string): boolean {\n\treturn (\n\t\tdestination.startsWith(\"/\") &&\n\t\tdestination[1] !== \"/\" &&\n\t\tdestination[1] !== \"\\\\\" &&\n\t\t!CONTROL_CHARS.test(destination)\n\t);\n}\n"],"mappings":";;;;;AAKA,MAAM,gBAAgB;;;;;;AAOtB,SAAgB,0BAA0B,aAA8B;AACvE,QACC,YAAY,WAAW,IAAI,IAC3B,YAAY,OAAO,OACnB,YAAY,OAAO,QACnB,CAAC,cAAc,KAAK,YAAY"}

package/dist/dev-typegen-8JlYYFno.mjs

@@ -0,0 +1,29 @@
+//#region src/astro/dev-typegen.ts
+/**
+* Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.
+*
+* Schema mutations send an event over the Vite module runner's hot channel;
+* the Astro integration listens for it in Node and does the filesystem work.
+* The hot channel crosses realms (workerd under the Cloudflare adapter), and
+* runtime modules stay free of Node-only I/O. When HMR is disabled there is
+* no hot channel, so the integration also registers a same-realm global.
+*/
+const DEV_TYPEGEN_REFRESH_EVENT = "emdash:typegen-refresh";
+const DEV_TYPEGEN_REFRESH_GLOBAL = "__emdashDevTypegenRefresh";
+function refreshDevTypes() {
+	if (typeof import.meta.env === "undefined" || !import.meta.env.DEV) return;
+	try {
+		if (import.meta.hot) {
+			import.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);
+			return;
+		}
+		const fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);
+		if (typeof fn === "function") fn();
+	} catch (error) {
+		console.error("[emdash] dev typegen refresh failed:", error);
+	}
+}
+
+//#endregion
+export { DEV_TYPEGEN_REFRESH_GLOBAL as n, refreshDevTypes as r, DEV_TYPEGEN_REFRESH_EVENT as t };
+//# sourceMappingURL=dev-typegen-8JlYYFno.mjs.map

package/dist/dev-typegen-8JlYYFno.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-typegen-8JlYYFno.mjs","names":[],"sources":["../src/astro/dev-typegen.ts"],"sourcesContent":["/**\n * Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.\n *\n * Schema mutations send an event over the Vite module runner's hot channel;\n * the Astro integration listens for it in Node and does the filesystem work.\n * The hot channel crosses realms (workerd under the Cloudflare adapter), and\n * runtime modules stay free of Node-only I/O. When HMR is disabled there is\n * no hot channel, so the integration also registers a same-realm global.\n */\n\nexport const DEV_TYPEGEN_REFRESH_EVENT = \"emdash:typegen-refresh\";\n\nexport const DEV_TYPEGEN_REFRESH_GLOBAL = \"__emdashDevTypegenRefresh\";\n\nexport function refreshDevTypes(): void {\n\tif (typeof import.meta.env === \"undefined\" || !import.meta.env.DEV) return;\n\n\ttry {\n\t\tif (import.meta.hot) {\n\t\t\timport.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);\n\t\t\treturn;\n\t\t}\n\t\tconst fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);\n\t\tif (typeof fn === \"function\") fn();\n\t} catch (error) {\n\t\tconsole.error(\"[emdash] dev typegen refresh failed:\", error);\n\t}\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAa,4BAA4B;AAEzC,MAAa,6BAA6B;AAE1C,SAAgB,kBAAwB;AACvC,KAAI,OAAO,OAAO,KAAK,QAAQ,eAAe,CAAC,OAAO,KAAK,IAAI,IAAK;AAEpE,KAAI;AACH,MAAI,OAAO,KAAK,KAAK;AACpB,UAAO,KAAK,IAAI,KAAK,0BAA0B;AAC/C;;EAED,MAAM,KAAK,QAAQ,IAAI,YAAY,2BAA2B;AAC9D,MAAI,OAAO,OAAO,WAAY,KAAI;UAC1B,OAAO;AACf,UAAQ,MAAM,wCAAwC,MAAM"}

package/dist/device-flow-CzKi6tID.mjs

@@ -0,0 +1,521 @@
+import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
+import { i as generatePrefixedToken, o as hashApiToken, s as isValidScope, t as TOKEN_PREFIXES } from "./api-tokens-BLz2MtQs.mjs";
+import { o as lookupOAuthClient } from "./oauth-clients-C-8WDTqj.mjs";
+import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-DrrqvTZC.mjs";
+import { clampScopes } from "@emdash-cms/auth";
+import { generateCodeVerifier } from "arctic";
+
+//#region src/api/handlers/device-flow.ts
+/**
+* OAuth Device Flow handlers (RFC 8628).
+*
+* EmDash acts as an OAuth 2.0 authorization server. The CLI requests
+* a device code, displays a URL + user code, and polls for a token.
+* The user opens a browser, logs in, enters the code, and the CLI gets
+* an access + refresh token pair.
+*
+* Uses arctic for code generation and @emdash-cms/auth for token utilities.
+*/
+/** Device codes expire after 15 minutes */
+const DEVICE_CODE_TTL_SECONDS = 900;
+/** Default polling interval in seconds */
+const DEFAULT_INTERVAL = 5;
+/** RFC 8628 §3.5: interval increase on slow_down */
+const SLOW_DOWN_INCREMENT = 5;
+/** Maximum slow_down interval cap (seconds) */
+const MAX_SLOW_DOWN_INTERVAL = 60;
+/** Access token TTL: 1 hour */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+/** Refresh token TTL: 90 days */
+const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
+/** Default scopes for CLI login */
+const DEFAULT_SCOPES = [
+	"content:read",
+	"content:write",
+	"media:read",
+	"media:write",
+	"schema:read"
+];
+/** Pattern to normalize user codes (strip hyphens) */
+const HYPHEN_PATTERN = /-/g;
+/** Characters for user codes (uppercase, no ambiguous chars like 0/O, 1/I) */
+const USER_CODE_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+/** Generate a short human-readable user code (XXXX-XXXX) */
+function generateUserCode() {
+	const bytes = new Uint8Array(8);
+	crypto.getRandomValues(bytes);
+	const chars = Array.from(bytes, (b) => USER_CODE_CHARS[b % 32]).join("");
+	return `${chars.slice(0, 4)}-${chars.slice(4, 8)}`;
+}
+/** Get an ISO datetime string offset from now */
+function expiresAt(seconds) {
+	return new Date(Date.now() + seconds * 1e3).toISOString();
+}
+/** Validate and normalize scopes. Returns validated scope list. */
+function normalizeScopes(requested) {
+	if (!requested || requested.length === 0) return [...DEFAULT_SCOPES];
+	return [...new Set(requested.filter(isValidScope))];
+}
+/**
+* Scopes an approval by a user with `role` would grant:
+* requested_scopes ∩ scopesForRole(role). Approval and the approval-page
+* lookup must agree, so both go through here.
+*/
+function grantableScopes(requested, role) {
+	return clampScopes(requested, role);
+}
+/** Find a pending device code by user code, ignoring hyphens and case. Does not check expiry. */
+async function findPendingDeviceCode(db, userCode) {
+	const chars = userCode.replace(HYPHEN_PATTERN, "").toUpperCase();
+	if (chars.length !== 8) return void 0;
+	return db.selectFrom("_emdash_device_codes").selectAll().where("user_code", "=", `${chars.slice(0, 4)}-${chars.slice(4)}`).where("status", "=", "pending").executeTakeFirst();
+}
+/**
+* POST /oauth/device/code
+*
+* Issue a device code + user code. The CLI displays the user code
+* and tells the user to open the verification URI.
+*/
+async function handleDeviceCodeRequest(db, input, verificationUri) {
+	try {
+		const scopes = normalizeScopes(input.scope ? input.scope.split(" ").filter(Boolean) : []);
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "INVALID_SCOPE",
+				message: "No valid scopes requested"
+			}
+		};
+		const deviceCode = generateCodeVerifier();
+		const userCode = generateUserCode();
+		const expires = expiresAt(DEVICE_CODE_TTL_SECONDS);
+		await db.insertInto("_emdash_device_codes").values({
+			device_code: deviceCode,
+			user_code: userCode,
+			scopes: JSON.stringify(scopes),
+			status: "pending",
+			expires_at: expires,
+			interval: DEFAULT_INTERVAL
+		}).execute();
+		return {
+			success: true,
+			data: {
+				device_code: deviceCode,
+				user_code: userCode,
+				verification_uri: verificationUri,
+				expires_in: DEVICE_CODE_TTL_SECONDS,
+				interval: DEFAULT_INTERVAL
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "DEVICE_CODE_ERROR",
+				message: "Failed to create device code"
+			}
+		};
+	}
+}
+/**
+* POST /oauth/device/token
+*
+* CLI polls this endpoint with the device_code. Returns:
+* - 200 with tokens if authorized
+* - 400 with error "authorization_pending" while waiting
+* - 400 with error "slow_down" if polling too fast
+* - 400 with error "expired_token" if the code expired
+* - 400 with error "access_denied" if the user denied
+*/
+async function handleDeviceTokenExchange(db, input) {
+	try {
+		if (input.grant_type !== "urn:ietf:params:oauth:grant-type:device_code") return {
+			success: false,
+			error: {
+				code: "UNSUPPORTED_GRANT_TYPE",
+				message: "Invalid grant_type"
+			}
+		};
+		const row = await db.selectFrom("_emdash_device_codes").selectAll().where("device_code", "=", input.device_code).executeTakeFirst();
+		if (!row) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "Invalid device code"
+			}
+		};
+		const now = /* @__PURE__ */ new Date();
+		if (new Date(row.expires_at) < now) {
+			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).execute();
+			return {
+				success: false,
+				deviceFlowError: "expired_token",
+				error: {
+					code: "expired_token",
+					message: "The device code has expired"
+				}
+			};
+		}
+		if (row.status === "denied") {
+			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).execute();
+			return {
+				success: false,
+				deviceFlowError: "access_denied",
+				error: {
+					code: "access_denied",
+					message: "The user denied the request"
+				}
+			};
+		}
+		if (row.status === "pending") {
+			if (row.last_polled_at) {
+				const lastPolled = new Date(row.last_polled_at);
+				if ((now.getTime() - lastPolled.getTime()) / 1e3 < row.interval) {
+					const newInterval = Math.min(row.interval + SLOW_DOWN_INCREMENT, MAX_SLOW_DOWN_INTERVAL);
+					await db.updateTable("_emdash_device_codes").set({
+						interval: newInterval,
+						last_polled_at: now.toISOString()
+					}).where("device_code", "=", input.device_code).execute();
+					return {
+						success: false,
+						deviceFlowError: "slow_down",
+						deviceFlowInterval: newInterval,
+						error: {
+							code: "slow_down",
+							message: "Polling too fast"
+						}
+					};
+				}
+			}
+			await db.updateTable("_emdash_device_codes").set({ last_polled_at: now.toISOString() }).where("device_code", "=", input.device_code).execute();
+			return {
+				success: false,
+				deviceFlowError: "authorization_pending",
+				error: {
+					code: "authorization_pending",
+					message: "Authorization pending"
+				}
+			};
+		}
+		if (row.status !== "authorized" || !row.user_id) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "Invalid device code state"
+			}
+		};
+		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
+		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
+		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
+		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
+		const result = await withTransaction(db, async (trx) => {
+			const consumed = await trx.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).where("status", "=", "authorized").returningAll().executeTakeFirst();
+			if (!consumed) return null;
+			if (!consumed.user_id) return null;
+			const scopes = JSON.parse(consumed.scopes);
+			await trx.insertInto("_emdash_oauth_tokens").values({
+				token_hash: accessToken.hash,
+				token_type: "access",
+				user_id: consumed.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "cli",
+				expires_at: accessExpires,
+				refresh_token_hash: refreshToken.hash
+			}).execute();
+			await trx.insertInto("_emdash_oauth_tokens").values({
+				token_hash: refreshToken.hash,
+				token_type: "refresh",
+				user_id: consumed.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "cli",
+				expires_at: refreshExpires,
+				refresh_token_hash: null
+			}).execute();
+			return { scopes };
+		});
+		if (!result) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "Device code already consumed"
+			}
+		};
+		return {
+			success: true,
+			data: {
+				access_token: accessToken.raw,
+				refresh_token: refreshToken.raw,
+				token_type: "Bearer",
+				expires_in: ACCESS_TOKEN_TTL_SECONDS,
+				scope: result.scopes.join(" ")
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_EXCHANGE_ERROR",
+				message: "Failed to exchange device code"
+			}
+		};
+	}
+}
+/**
+* GET /oauth/device/authorize
+*
+* Returns the scopes a pending device code requested, and the subset an
+* approval by this user would grant, so the approval page can show them
+* before the user approves. Reveals nothing else about the device code.
+*/
+async function handleDeviceCodeLookup(db, userRole, input) {
+	try {
+		const match = await findPendingDeviceCode(db, input.user_code);
+		if (!match) return {
+			success: false,
+			error: {
+				code: "INVALID_CODE",
+				message: "Invalid or expired code"
+			}
+		};
+		if (new Date(match.expires_at) < /* @__PURE__ */ new Date()) return {
+			success: false,
+			error: {
+				code: "EXPIRED_CODE",
+				message: "This code has expired"
+			}
+		};
+		const requestedScopes = JSON.parse(match.scopes);
+		return {
+			success: true,
+			data: {
+				requestedScopes,
+				grantedScopes: grantableScopes(requestedScopes, userRole)
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "DEVICE_CODE_LOOKUP_ERROR",
+				message: "Failed to look up device code"
+			}
+		};
+	}
+}
+/**
+* POST /oauth/device/authorize
+*
+* The user submits the user_code after logging in via the browser.
+* This authorizes the device code, allowing the CLI to exchange it for tokens.
+*
+* Scopes are clamped to the user's role at this point. The stored scopes
+* are replaced with the intersection of requested scopes and the scopes
+* the user's role permits. This prevents scope escalation.
+*/
+async function handleDeviceAuthorize(db, userId, userRole, input) {
+	try {
+		const match = await findPendingDeviceCode(db, input.user_code);
+		if (!match) return {
+			success: false,
+			error: {
+				code: "INVALID_CODE",
+				message: "Invalid or expired code"
+			}
+		};
+		if (new Date(match.expires_at) < /* @__PURE__ */ new Date()) {
+			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", match.device_code).execute();
+			return {
+				success: false,
+				error: {
+					code: "EXPIRED_CODE",
+					message: "This code has expired"
+				}
+			};
+		}
+		if ((input.action ?? "approve") === "deny") {
+			await db.updateTable("_emdash_device_codes").set({ status: "denied" }).where("device_code", "=", match.device_code).execute();
+			return {
+				success: true,
+				data: { authorized: false }
+			};
+		}
+		const effectiveScopes = grantableScopes(JSON.parse(match.scopes), userRole);
+		if (effectiveScopes.length === 0) return {
+			success: false,
+			error: {
+				code: "INSUFFICIENT_ROLE",
+				message: "Your role does not permit any of the requested scopes"
+			}
+		};
+		await db.updateTable("_emdash_device_codes").set({
+			status: "authorized",
+			user_id: userId,
+			scopes: JSON.stringify(effectiveScopes)
+		}).where("device_code", "=", match.device_code).execute();
+		return {
+			success: true,
+			data: { authorized: true }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "AUTHORIZE_ERROR",
+				message: "Failed to authorize device"
+			}
+		};
+	}
+}
+/**
+* POST /oauth/token/refresh
+*
+* Exchange a refresh token for a new access token.
+* The refresh token itself is not rotated (per spec: optional rotation).
+*/
+async function handleTokenRefresh(db, input) {
+	try {
+		if (input.grant_type !== "refresh_token") return {
+			success: false,
+			error: {
+				code: "UNSUPPORTED_GRANT_TYPE",
+				message: "Invalid grant_type"
+			}
+		};
+		if (!input.refresh_token.startsWith(TOKEN_PREFIXES.OAUTH_REFRESH)) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "Invalid refresh token format"
+			}
+		};
+		const refreshHash = hashApiToken(input.refresh_token);
+		const row = await db.selectFrom("_emdash_oauth_tokens").selectAll().where("token_hash", "=", refreshHash).where("token_type", "=", "refresh").executeTakeFirst();
+		if (!row) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "Invalid refresh token"
+			}
+		};
+		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) {
+			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", refreshHash).execute();
+			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
+			return {
+				success: false,
+				error: {
+					code: "INVALID_GRANT",
+					message: "Refresh token expired"
+				}
+			};
+		}
+		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
+		if (!userInfo) {
+			await db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", row.user_id).execute();
+			return {
+				success: false,
+				error: {
+					code: "INVALID_GRANT",
+					message: "User not found"
+				}
+			};
+		}
+		if (userInfo.disabled) {
+			await db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", row.user_id).execute();
+			return {
+				success: false,
+				error: {
+					code: "INVALID_GRANT",
+					message: "User account is disabled"
+				}
+			};
+		}
+		let scopes = clampScopes(JSON.parse(row.scopes), userInfo.role);
+		if (row.client_id) {
+			const client = await lookupOAuthClient(db, row.client_id);
+			if (client?.scopes?.length) scopes = scopes.filter((s) => client.scopes.includes(s));
+		}
+		if (scopes.length === 0) {
+			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", refreshHash).execute();
+			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
+			return {
+				success: false,
+				error: {
+					code: "INVALID_GRANT",
+					message: "User role no longer supports any of the token's scopes"
+				}
+			};
+		}
+		await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).where("token_type", "=", "access").execute();
+		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
+		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
+		await db.insertInto("_emdash_oauth_tokens").values({
+			token_hash: accessToken.hash,
+			token_type: "access",
+			user_id: row.user_id,
+			scopes: JSON.stringify(scopes),
+			client_type: row.client_type,
+			expires_at: accessExpires,
+			refresh_token_hash: refreshHash
+		}).execute();
+		return {
+			success: true,
+			data: {
+				access_token: accessToken.raw,
+				refresh_token: input.refresh_token,
+				token_type: "Bearer",
+				expires_in: ACCESS_TOKEN_TTL_SECONDS,
+				scope: scopes.join(" ")
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_REFRESH_ERROR",
+				message: "Failed to refresh token"
+			}
+		};
+	}
+}
+/**
+* POST /oauth/token/revoke
+*
+* Revoke an access or refresh token. If a refresh token is revoked,
+* also revoke all associated access tokens.
+*
+* Per RFC 7009, this endpoint always returns 200 (even for invalid tokens).
+*/
+async function handleTokenRevoke(db, input) {
+	try {
+		const hash = hashApiToken(input.token);
+		const row = await db.selectFrom("_emdash_oauth_tokens").select([
+			"token_hash",
+			"token_type",
+			"refresh_token_hash"
+		]).where("token_hash", "=", hash).executeTakeFirst();
+		if (!row) return {
+			success: true,
+			data: { revoked: true }
+		};
+		if (row.token_type === "refresh") {
+			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", hash).execute();
+			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", hash).execute();
+		} else await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", hash).execute();
+		return {
+			success: true,
+			data: { revoked: true }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_REVOKE_ERROR",
+				message: "Failed to revoke token"
+			}
+		};
+	}
+}
+
+//#endregion
+export { handleTokenRefresh as a, handleDeviceTokenExchange as i, handleDeviceCodeLookup as n, handleTokenRevoke as o, handleDeviceCodeRequest as r, handleDeviceAuthorize as t };
+//# sourceMappingURL=device-flow-CzKi6tID.mjs.map