emdash 1.0.1 → 1.1.0

package/dist/menus-BQKqf0Up.mjs

@@ -0,0 +1,92 @@
+import { t as isSafeHref } from "./url-Dn3IStq8.mjs";
+import { y as localeCode } from "./redirects-D4EWeXAo.mjs";
+import { z } from "zod";
+
+//#region src/api/schemas/menus.ts
+/**
+* Allowed menu item types. `custom` uses `customUrl`; the others resolve a URL
+* from `referenceCollection` + `referenceId` (a translation_group id).
+*/
+const menuItemTypeEnum = z.enum([
+	"custom",
+	"page",
+	"post",
+	"taxonomy",
+	"collection"
+]);
+const safeHref = z.string().trim().refine(isSafeHref, "URL must use http, https, mailto, tel, a relative path, or a fragment identifier");
+const createMenuBody = z.object({
+	name: z.string().min(1),
+	label: z.string().min(1),
+	locale: localeCode.optional(),
+	translationOf: z.string().min(1).optional()
+}).strict().meta({ id: "CreateMenuBody" });
+const updateMenuBody = z.object({ label: z.string().min(1).optional() }).strict().meta({ id: "UpdateMenuBody" });
+const createMenuItemBody = z.object({
+	type: menuItemTypeEnum,
+	label: z.string().min(1),
+	referenceCollection: z.string().optional(),
+	referenceId: z.string().optional(),
+	customUrl: safeHref.optional(),
+	target: z.string().optional(),
+	titleAttr: z.string().optional(),
+	cssClasses: z.string().optional(),
+	parentId: z.string().optional(),
+	sortOrder: z.number().int().min(0).optional()
+}).strict().meta({ id: "CreateMenuItemBody" });
+const updateMenuItemBody = z.object({
+	label: z.string().min(1).optional(),
+	customUrl: safeHref.optional(),
+	target: z.string().optional(),
+	titleAttr: z.string().optional(),
+	cssClasses: z.string().optional(),
+	parentId: z.string().nullish(),
+	sortOrder: z.number().int().min(0).optional()
+}).strict().meta({ id: "UpdateMenuItemBody" });
+const reorderMenuItemsBody = z.object({ items: z.array(z.object({
+	id: z.string().min(1),
+	parentId: z.string().nullable(),
+	sortOrder: z.number().int().min(0)
+})) }).meta({ id: "ReorderMenuItemsBody" });
+const menuSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	label: z.string(),
+	createdAt: z.string(),
+	updatedAt: z.string(),
+	locale: z.string(),
+	translationGroup: z.string().nullable()
+}).meta({ id: "Menu" });
+const menuItemSchema = z.object({
+	id: z.string(),
+	menuId: z.string(),
+	parentId: z.string().nullable(),
+	sortOrder: z.number().int(),
+	type: z.string(),
+	referenceCollection: z.string().nullable(),
+	referenceId: z.string().nullable(),
+	customUrl: z.string().nullable(),
+	label: z.string(),
+	titleAttr: z.string().nullable(),
+	target: z.string().nullable(),
+	cssClasses: z.string().nullable(),
+	createdAt: z.string(),
+	locale: z.string(),
+	translationGroup: z.string().nullable()
+}).meta({ id: "MenuItem" });
+const menuTranslationsSchema = z.object({
+	translationGroup: z.string().nullable(),
+	translations: z.array(z.object({
+		id: z.string(),
+		name: z.string(),
+		label: z.string(),
+		locale: z.string(),
+		updatedAt: z.string()
+	}))
+}).meta({ id: "MenuTranslations" });
+const menuListItemSchema = menuSchema.extend({ itemCount: z.number().int() }).meta({ id: "MenuListItem" });
+const menuWithItemsSchema = menuSchema.extend({ items: z.array(menuItemSchema) }).meta({ id: "MenuWithItems" });
+
+//#endregion
+export { menuListItemSchema as a, menuWithItemsSchema as c, updateMenuBody as d, updateMenuItemBody as f, menuItemTypeEnum as i, reorderMenuItemsBody as l, createMenuItemBody as n, menuSchema as o, menuItemSchema as r, menuTranslationsSchema as s, createMenuBody as t, safeHref as u };
+//# sourceMappingURL=menus-BQKqf0Up.mjs.map

package/dist/menus-BQKqf0Up.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"menus-BQKqf0Up.mjs","names":[],"sources":["../src/api/schemas/menus.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { isSafeHref } from \"../../utils/url.js\";\nimport { localeCode } from \"./common.js\";\n\n// ---------------------------------------------------------------------------\n// Menus: Input schemas\n// ---------------------------------------------------------------------------\n\n/**\n * Allowed menu item types. `custom` uses `customUrl`; the others resolve a URL\n * from `referenceCollection` + `referenceId` (a translation_group id).\n */\nexport const menuItemTypeEnum = z.enum([\"custom\", \"page\", \"post\", \"taxonomy\", \"collection\"]);\n\nexport const safeHref = z\n\t.string()\n\t.trim()\n\t.refine(\n\t\tisSafeHref,\n\t\t\"URL must use http, https, mailto, tel, a relative path, or a fragment identifier\",\n\t);\n\nexport const createMenuBody = z\n\t.object({\n\t\tname: z.string().min(1),\n\t\tlabel: z.string().min(1),\n\t\tlocale: localeCode.optional(),\n\t\t/** When set, clones the items from the source menu. The new menu joins\n\t\t * the source's translation_group. */\n\t\ttranslationOf: z.string().min(1).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"CreateMenuBody\" });\n\nexport const updateMenuBody = z\n\t.object({\n\t\tlabel: z.string().min(1).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"UpdateMenuBody\" });\n\nexport const createMenuItemBody = z\n\t.object({\n\t\ttype: menuItemTypeEnum,\n\t\tlabel: z.string().min(1),\n\t\treferenceCollection: z.string().optional(),\n\t\treferenceId: z.string().optional(),\n\t\tcustomUrl: safeHref.optional(),\n\t\ttarget: z.string().optional(),\n\t\ttitleAttr: z.string().optional(),\n\t\tcssClasses: z.string().optional(),\n\t\tparentId: z.string().optional(),\n\t\tsortOrder: z.number().int().min(0).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"CreateMenuItemBody\" });\n\nexport const updateMenuItemBody = z\n\t.object({\n\t\tlabel: z.string().min(1).optional(),\n\t\tcustomUrl: safeHref.optional(),\n\t\ttarget: z.string().optional(),\n\t\ttitleAttr: z.string().optional(),\n\t\tcssClasses: z.string().optional(),\n\t\tparentId: z.string().nullish(),\n\t\tsortOrder: z.number().int().min(0).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"UpdateMenuItemBody\" });\n\nexport const reorderMenuItemsBody = z\n\t.object({\n\t\titems: z.array(\n\t\t\tz.object({\n\t\t\t\tid: z.string().min(1),\n\t\t\t\tparentId: z.string().nullable(),\n\t\t\t\tsortOrder: z.number().int().min(0),\n\t\t\t}),\n\t\t),\n\t})\n\t.meta({ id: \"ReorderMenuItemsBody\" });\n\n// ---------------------------------------------------------------------------\n// Menus: Response schemas\n//\n// All responses are camelCase to align with the rest of the EmDash REST API\n// (content, taxonomies, redirects, etc.). The DB columns are snake_case;\n// handlers hydrate rows into the shapes below before returning.\n// ---------------------------------------------------------------------------\n\nexport const menuSchema = z\n\t.object({\n\t\tid: z.string(),\n\t\tname: z.string(),\n\t\tlabel: z.string(),\n\t\tcreatedAt: z.string(),\n\t\tupdatedAt: z.string(),\n\t\tlocale: z.string(),\n\t\ttranslationGroup: z.string().nullable(),\n\t})\n\t.meta({ id: \"Menu\" });\n\nexport const menuItemSchema = z\n\t.object({\n\t\tid: z.string(),\n\t\tmenuId: z.string(),\n\t\tparentId: z.string().nullable(),\n\t\tsortOrder: z.number().int(),\n\t\ttype: z.string(),\n\t\treferenceCollection: z.string().nullable(),\n\t\treferenceId: z.string().nullable(),\n\t\tcustomUrl: z.string().nullable(),\n\t\tlabel: z.string(),\n\t\ttitleAttr: z.string().nullable(),\n\t\ttarget: z.string().nullable(),\n\t\tcssClasses: z.string().nullable(),\n\t\tcreatedAt: z.string(),\n\t\tlocale: z.string(),\n\t\ttranslationGroup: z.string().nullable(),\n\t})\n\t.meta({ id: \"MenuItem\" });\n\nexport const menuTranslationsSchema = z\n\t.object({\n\t\ttranslationGroup: z.string().nullable(),\n\t\ttranslations: z.array(\n\t\t\tz.object({\n\t\t\t\tid: z.string(),\n\t\t\t\tname: z.string(),\n\t\t\t\tlabel: z.string(),\n\t\t\t\tlocale: z.string(),\n\t\t\t\tupdatedAt: z.string(),\n\t\t\t}),\n\t\t),\n\t})\n\t.meta({ id: \"MenuTranslations\" });\n\nexport const menuListItemSchema = menuSchema\n\t.extend({\n\t\titemCount: z.number().int(),\n\t})\n\t.meta({ id: \"MenuListItem\" });\n\nexport const menuWithItemsSchema = menuSchema\n\t.extend({\n\t\titems: z.array(menuItemSchema),\n\t})\n\t.meta({ id: \"MenuWithItems\" });\n"],"mappings":";;;;;;;;;AAaA,MAAa,mBAAmB,EAAE,KAAK;CAAC;CAAU;CAAQ;CAAQ;CAAY;CAAa,CAAC;AAE5F,MAAa,WAAW,EACtB,QAAQ,CACR,MAAM,CACN,OACA,YACA,mFACA;AAEF,MAAa,iBAAiB,EAC5B,OAAO;CACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,QAAQ,WAAW,UAAU;CAG7B,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CAC3C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,kBAAkB,CAAC;AAEhC,MAAa,iBAAiB,EAC5B,OAAO,EACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACnC,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,kBAAkB,CAAC;AAEhC,MAAa,qBAAqB,EAChC,OAAO;CACP,MAAM;CACN,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,WAAW,SAAS,UAAU;CAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,qBAAqB,EAChC,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnC,WAAW,SAAS,UAAU;CAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,uBAAuB,EAClC,OAAO,EACP,OAAO,EAAE,MACR,EAAE,OAAO;CACR,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;CACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE;CAClC,CAAC,CACF,EACD,CAAC,CACD,KAAK,EAAE,IAAI,wBAAwB,CAAC;AAUtC,MAAa,aAAa,EACxB,OAAO;CACP,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,WAAW,EAAE,QAAQ;CACrB,WAAW,EAAE,QAAQ;CACrB,QAAQ,EAAE,QAAQ;CAClB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,CAAC,CACD,KAAK,EAAE,IAAI,QAAQ,CAAC;AAEtB,MAAa,iBAAiB,EAC5B,OAAO;CACP,IAAI,EAAE,QAAQ;CACd,QAAQ,EAAE,QAAQ;CAClB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK;CAC3B,MAAM,EAAE,QAAQ;CAChB,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,OAAO,EAAE,QAAQ;CACjB,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,WAAW,EAAE,QAAQ;CACrB,QAAQ,EAAE,QAAQ;CAClB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,CAAC,CACD,KAAK,EAAE,IAAI,YAAY,CAAC;AAE1B,MAAa,yBAAyB,EACpC,OAAO;CACP,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,cAAc,EAAE,MACf,EAAE,OAAO;EACR,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ;EAChB,OAAO,EAAE,QAAQ;EACjB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,QAAQ;EACrB,CAAC,CACF;CACD,CAAC,CACD,KAAK,EAAE,IAAI,oBAAoB,CAAC;AAElC,MAAa,qBAAqB,WAChC,OAAO,EACP,WAAW,EAAE,QAAQ,CAAC,KAAK,EAC3B,CAAC,CACD,KAAK,EAAE,IAAI,gBAAgB,CAAC;AAE9B,MAAa,sBAAsB,WACjC,OAAO,EACP,OAAO,EAAE,MAAM,eAAe,EAC9B,CAAC,CACD,KAAK,EAAE,IAAI,iBAAiB,CAAC"}

package/dist/migrations/index.d.mts

@@ -1,4 +1,4 @@
-import { a as MigrationExecutorModule, c as MigrationRequest, i as MigrationExecutorFactoryContext, l as MigrationTarget, n as MigrationExecutor, o as MigrationLockReport, r as MigrationExecutorFactory, s as MigrationReport, t as MigrationAction, u as MigrationTargetOverrides } from "../protocol-FvwLA8P-.mjs";
+import { a as MigrationExecutorModule, c as MigrationRequest, i as MigrationExecutorFactoryContext, l as MigrationTarget, n as MigrationExecutor, o as MigrationLockReport, r as MigrationExecutorFactory, s as MigrationReport, t as MigrationAction, u as MigrationTargetOverrides } from "../protocol-ClxN-m1e.mjs";
 import { Dialect } from "kysely";
 
 //#region src/migrations/direct-executor.d.ts

package/dist/migrations/index.mjs

@@ -1,8 +1,8 @@
-import "../runner-CLpxmhl8.mjs";
+import "../runner-CskI4Hmq.mjs";
 import "../dialect-helpers-7_IqPdh9.mjs";
 import "../config-CvmjJcVw.mjs";
 import "../datetime-normalization-PeiEdcRY.mjs";
-import { n as fingerprintMigrationSet, r as getCoreMigrationIdentity, t as createCoreMigrationIdentity } from "../identity-DJ-5AcdG.mjs";
-import { t as createDirectMigrationExecutor } from "../direct-executor-Db8xA3zg.mjs";
+import { n as fingerprintMigrationSet, r as getCoreMigrationIdentity, t as createCoreMigrationIdentity } from "../identity-Dfrx2_Bc.mjs";
+import { t as createDirectMigrationExecutor } from "../direct-executor-DMWwCey3.mjs";
 
 export { createCoreMigrationIdentity, createDirectMigrationExecutor, fingerprintMigrationSet, getCoreMigrationIdentity };

package/dist/mime-B5M9R53H.mjs

@@ -0,0 +1,81 @@
+import * as path from "node:path";
+
+//#region src/media/mime.ts
+function normalizeMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase();
+}
+function matchesMimeAllowlist(mime, allowList) {
+	const normalized = normalizeMime(mime);
+	for (const entry of allowList) {
+		if (!entry || !entry.includes("/")) continue;
+		const normalizedEntry = normalizeMime(entry);
+		if (normalizedEntry.endsWith("/")) {
+			if (normalized.startsWith(normalizedEntry)) return true;
+		} else if (normalized === normalizedEntry) return true;
+	}
+	return false;
+}
+const UNKNOWN_UPLOAD_TYPES = new Set(["", "application/octet-stream"]);
+/**
+* Resolve the MIME type for an uploaded file.
+*
+* Browsers that don't recognise an extension (e.g. `.jxl`) often report an
+* empty or generic `application/octet-stream` type. In those cases fall back to
+* the extension map so server-side allowlist checks can still identify allowed
+* formats such as `image/jxl`.
+*/
+function resolveUploadMimeType(filename, fileType) {
+	const normalized = normalizeMime(fileType);
+	if (normalized && !UNKNOWN_UPLOAD_TYPES.has(normalized)) return normalized;
+	return EXTENSION_TO_MIME[path.extname(filename).toLowerCase()] ?? "";
+}
+const EXTENSION_TO_MIME = {
+	".pdf": "application/pdf",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".webp": "image/webp",
+	".avif": "image/avif",
+	".jxl": "image/jxl",
+	".svg": "image/svg+xml",
+	".mp3": "audio/mpeg",
+	".wav": "audio/wav",
+	".mp4": "video/mp4",
+	".webm": "video/webm",
+	".zip": "application/zip",
+	".tar": "application/x-tar",
+	".gz": "application/gzip",
+	".csv": "text/csv",
+	".doc": "application/msword",
+	".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	".xls": "application/vnd.ms-excel",
+	".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	".txt": "text/plain",
+	".rtf": "application/rtf",
+	".vtt": "text/vtt",
+	".srt": "application/x-subrip",
+	".woff": "font/woff",
+	".woff2": "font/woff2"
+};
+/**
+* Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row
+* (raw JSON string). Returns null when the value is missing, malformed, or the
+* list is empty — callers treat that as "no field-specific constraint".
+*/
+function parseAllowedMimeTypes(rawValidation) {
+	if (!rawValidation) return null;
+	try {
+		const parsed = JSON.parse(rawValidation);
+		if (typeof parsed !== "object" || parsed === null) return null;
+		const list = parsed.allowedMimeTypes;
+		if (!Array.isArray(list) || list.length === 0) return null;
+		return list.filter((entry) => typeof entry === "string");
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+export { resolveUploadMimeType as i, normalizeMime as n, parseAllowedMimeTypes as r, matchesMimeAllowlist as t };
+//# sourceMappingURL=mime-B5M9R53H.mjs.map

package/dist/mime-B5M9R53H.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime-B5M9R53H.mjs","names":[],"sources":["../src/media/mime.ts"],"sourcesContent":["import * as path from \"node:path\";\n\nexport function normalizeMime(mime: string): string {\n\treturn mime.split(\";\")[0].trim().toLowerCase();\n}\n\nexport function matchesMimeAllowlist(mime: string, allowList: readonly string[]): boolean {\n\tconst normalized = normalizeMime(mime);\n\tfor (const entry of allowList) {\n\t\tif (!entry || !entry.includes(\"/\")) continue;\n\t\tconst normalizedEntry = normalizeMime(entry);\n\t\tif (normalizedEntry.endsWith(\"/\")) {\n\t\t\tif (normalized.startsWith(normalizedEntry)) return true;\n\t\t} else if (normalized === normalizedEntry) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\nconst UNKNOWN_UPLOAD_TYPES = new Set([\"\", \"application/octet-stream\"]);\n\n/**\n * Resolve the MIME type for an uploaded file.\n *\n * Browsers that don't recognise an extension (e.g. `.jxl`) often report an\n * empty or generic `application/octet-stream` type. In those cases fall back to\n * the extension map so server-side allowlist checks can still identify allowed\n * formats such as `image/jxl`.\n */\nexport function resolveUploadMimeType(filename: string, fileType: string): string {\n\tconst normalized = normalizeMime(fileType);\n\tif (normalized && !UNKNOWN_UPLOAD_TYPES.has(normalized)) {\n\t\treturn normalized;\n\t}\n\treturn EXTENSION_TO_MIME[path.extname(filename).toLowerCase()] ?? \"\";\n}\n\nexport const EXTENSION_TO_MIME: Readonly<Record<string, string>> = {\n\t\".pdf\": \"application/pdf\",\n\t\".png\": \"image/png\",\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".gif\": \"image/gif\",\n\t\".webp\": \"image/webp\",\n\t\".avif\": \"image/avif\",\n\t\".jxl\": \"image/jxl\",\n\t\".svg\": \"image/svg+xml\",\n\t\".mp3\": \"audio/mpeg\",\n\t\".wav\": \"audio/wav\",\n\t\".mp4\": \"video/mp4\",\n\t\".webm\": \"video/webm\",\n\t\".zip\": \"application/zip\",\n\t\".tar\": \"application/x-tar\",\n\t\".gz\": \"application/gzip\",\n\t\".csv\": \"text/csv\",\n\t\".doc\": \"application/msword\",\n\t\".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n\t\".xls\": \"application/vnd.ms-excel\",\n\t\".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n\t\".txt\": \"text/plain\",\n\t\".rtf\": \"application/rtf\",\n\t\".vtt\": \"text/vtt\",\n\t\".srt\": \"application/x-subrip\",\n\t\".woff\": \"font/woff\",\n\t\".woff2\": \"font/woff2\",\n};\n\nconst VALID_MIME_RE = /^[a-z0-9][a-z0-9!#$&^_+\\-.]*\\/[a-z0-9!#$&^_+\\-.]*$/i;\n\nexport function expandExtensionShorthand(entry: string): string | null {\n\tconst trimmed = entry.trim();\n\tif (!trimmed) return null;\n\tif (trimmed.includes(\"/\")) return VALID_MIME_RE.test(trimmed) ? trimmed : null;\n\tif (trimmed.startsWith(\".\")) {\n\t\treturn EXTENSION_TO_MIME[trimmed.toLowerCase()] ?? null;\n\t}\n\treturn null;\n}\n\n/**\n * Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row\n * (raw JSON string). Returns null when the value is missing, malformed, or the\n * list is empty — callers treat that as \"no field-specific constraint\".\n */\nexport function parseAllowedMimeTypes(rawValidation: string | null | undefined): string[] | null {\n\tif (!rawValidation) return null;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(rawValidation);\n\t\tif (typeof parsed !== \"object\" || parsed === null) return null;\n\t\tconst list = (parsed as { allowedMimeTypes?: unknown }).allowedMimeTypes;\n\t\tif (!Array.isArray(list) || list.length === 0) return null;\n\t\treturn list.filter((entry): entry is string => typeof entry === \"string\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;AAEA,SAAgB,cAAc,MAAsB;AACnD,QAAO,KAAK,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa;;AAG/C,SAAgB,qBAAqB,MAAc,WAAuC;CACzF,MAAM,aAAa,cAAc,KAAK;AACtC,MAAK,MAAM,SAAS,WAAW;AAC9B,MAAI,CAAC,SAAS,CAAC,MAAM,SAAS,IAAI,CAAE;EACpC,MAAM,kBAAkB,cAAc,MAAM;AAC5C,MAAI,gBAAgB,SAAS,IAAI,EAChC;OAAI,WAAW,WAAW,gBAAgB,CAAE,QAAO;aACzC,eAAe,gBACzB,QAAO;;AAGT,QAAO;;AAGR,MAAM,uBAAuB,IAAI,IAAI,CAAC,IAAI,2BAA2B,CAAC;;;;;;;;;AAUtE,SAAgB,sBAAsB,UAAkB,UAA0B;CACjF,MAAM,aAAa,cAAc,SAAS;AAC1C,KAAI,cAAc,CAAC,qBAAqB,IAAI,WAAW,CACtD,QAAO;AAER,QAAO,kBAAkB,KAAK,QAAQ,SAAS,CAAC,aAAa,KAAK;;AAGnE,MAAa,oBAAsD;CAClE,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,UAAU;CACV;;;;;;AAmBD,SAAgB,sBAAsB,eAA2D;AAChG,KAAI,CAAC,cAAe,QAAO;AAC3B,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,cAAc;AACjD,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;EAC1D,MAAM,OAAQ,OAA0C;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,WAAW,EAAG,QAAO;AACtD,SAAO,KAAK,QAAQ,UAA2B,OAAO,UAAU,SAAS;SAClE;AACP,SAAO"}

package/dist/mode-nh0ppSX5.mjs

@@ -0,0 +1,23 @@
+//#region src/auth/mode.ts
+/**
+* Determine the active auth mode from config.
+*
+* Accepts `EmDashConfig` (or subtype) — checks for `auth` field via duck typing.
+*
+* @param config EmDash configuration
+* @returns The active auth mode
+*/
+function getAuthMode(config) {
+	const auth = config?.auth;
+	if (auth && "entrypoint" in auth && auth.entrypoint) return {
+		type: "external",
+		providerType: auth.type,
+		entrypoint: auth.entrypoint,
+		config: auth.config
+	};
+	return { type: "passkey" };
+}
+
+//#endregion
+export { getAuthMode as t };
+//# sourceMappingURL=mode-nh0ppSX5.mjs.map

package/dist/mode-nh0ppSX5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-nh0ppSX5.mjs","names":[],"sources":["../src/auth/mode.ts"],"sourcesContent":["/**\n * Auth Mode Detection\n *\n * Determines which authentication provider is active based on config.\n * Supports both passkey (default) and external auth providers via AuthDescriptor.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\nimport type {\n\tAuthDescriptor,\n\tAuthProviderDescriptor,\n\tAuthRouteDescriptor,\n\tAuthResult,\n\tExternalAuthConfig,\n} from \"./types.js\";\n\nexport type {\n\tAuthDescriptor,\n\tAuthProviderDescriptor,\n\tAuthRouteDescriptor,\n\tAuthResult,\n\tExternalAuthConfig,\n};\n\n/**\n * Passkey auth mode (default)\n */\nexport interface PasskeyAuthMode {\n\ttype: \"passkey\";\n}\n\n/**\n * External auth provider mode (Cloudflare Access, etc.)\n */\nexport interface ExternalAuthMode {\n\ttype: \"external\";\n\t/** Provider type identifier (e.g., \"cloudflare-access\") */\n\tproviderType: string;\n\t/** Module to import for authentication */\n\tentrypoint: string;\n\t/** Provider-specific configuration */\n\tconfig: unknown;\n}\n\n/**\n * Union of all auth modes\n */\nexport type AuthMode = PasskeyAuthMode | ExternalAuthMode;\n\n/**\n * Extended config type with auth.\n *\n * This is the same as `EmDashConfig` with an optional `auth` field.\n * Kept for backwards compatibility — prefer `EmDashConfig` in new code\n * since `getAuthMode` now accepts `EmDashConfig` directly.\n */\nexport interface EmDashConfigWithAuth extends EmDashConfig {\n\tauth?: AuthDescriptor;\n}\n\n/**\n * Determine the active auth mode from config.\n *\n * Accepts `EmDashConfig` (or subtype) — checks for `auth` field via duck typing.\n *\n * @param config EmDash configuration\n * @returns The active auth mode\n */\nexport function getAuthMode(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): AuthMode {\n\tconst auth = config?.auth;\n\n\t// Check for AuthDescriptor (transparent external auth like Cloudflare Access)\n\tif (auth && \"entrypoint\" in auth && auth.entrypoint) {\n\t\treturn {\n\t\t\ttype: \"external\",\n\t\t\tproviderType: auth.type,\n\t\t\tentrypoint: auth.entrypoint,\n\t\t\tconfig: auth.config,\n\t\t};\n\t}\n\n\t// Default to passkey\n\treturn { type: \"passkey\" };\n}\n\n/**\n * Check if an external auth provider is active\n */\nexport function isExternalAuthEnabled(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): boolean {\n\treturn getAuthMode(config).type === \"external\";\n}\n\n/**\n * Get external auth config if enabled\n */\nexport function getExternalAuthConfig(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): ExternalAuthMode | null {\n\tconst mode = getAuthMode(config);\n\tif (mode.type === \"external\") {\n\t\treturn mode;\n\t}\n\treturn null;\n}\n"],"mappings":";;;;;;;;;AAoEA,SAAgB,YACf,QACW;CACX,MAAM,OAAO,QAAQ;AAGrB,KAAI,QAAQ,gBAAgB,QAAQ,KAAK,WACxC,QAAO;EACN,MAAM;EACN,cAAc,KAAK;EACnB,YAAY,KAAK;EACjB,QAAQ,KAAK;EACb;AAIF,QAAO,EAAE,MAAM,WAAW"}

package/dist/node-sqlite-compat-CDOEcc97.mjs

@@ -0,0 +1,63 @@
+import { DatabaseSync } from "node:sqlite";
+
+//#region src/db/node-sqlite-compat.ts
+function openNodeSqliteDatabase(path, options = {}) {
+	return new NodeSqliteCompatDatabase(path, options);
+}
+var NodeSqliteCompatDatabase = class {
+	#database;
+	constructor(path, options = {}) {
+		const database = new DatabaseSync(path, { readOnly: options.readOnly });
+		this.#database = database;
+		try {
+			database.exec("PRAGMA busy_timeout = 5000");
+			database.exec("PRAGMA foreign_keys = ON");
+			database.exec("PRAGMA cache_size = -16000");
+			if (options.journalMode === "wal" && !options.readOnly) database.exec("PRAGMA journal_mode = WAL");
+			if (database.prepare("PRAGMA journal_mode").get()?.["journal_mode"] === "wal") database.exec("PRAGMA synchronous = NORMAL");
+		} catch (error) {
+			try {
+				database.close();
+			} catch {
+				throw new Error("SQLite setup failed and the connection could not be closed", { cause: error });
+			}
+			throw error;
+		}
+	}
+	get open() {
+		return this.#database.isOpen;
+	}
+	close() {
+		if (this.#database.isOpen) this.#database.close();
+	}
+	exec(sql) {
+		this.#database.exec(sql);
+	}
+	prepare(sql) {
+		const statement = this.#database.prepare(sql);
+		return {
+			reader: statement.columns().length > 0,
+			all: (...parameters) => statement.all(...toBindings(normalizeParameters(parameters))),
+			get: (...parameters) => statement.get(...toBindings(normalizeParameters(parameters))),
+			run: (...parameters) => statement.run(...toBindings(normalizeParameters(parameters))),
+			iterate: (...parameters) => statement.iterate(...toBindings(normalizeParameters(parameters)))
+		};
+	}
+};
+function normalizeParameters(parameters) {
+	return parameters.length === 1 && Array.isArray(parameters[0]) ? parameters[0] : parameters;
+}
+function toBindings(parameters) {
+	return parameters.map((value) => {
+		if (value === null || typeof value === "string" || typeof value === "number") return value;
+		if (typeof value === "bigint") return value;
+		if (typeof value === "boolean") return value ? 1 : 0;
+		if (value === void 0) return null;
+		if (value instanceof Uint8Array) return value;
+		throw new TypeError(`Cannot bind ${Object.prototype.toString.call(value)} to SQLite`);
+	});
+}
+
+//#endregion
+export { openNodeSqliteDatabase as t };
+//# sourceMappingURL=node-sqlite-compat-CDOEcc97.mjs.map

package/dist/node-sqlite-compat-CDOEcc97.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sqlite-compat-CDOEcc97.mjs","names":["#database"],"sources":["../src/db/node-sqlite-compat.ts"],"sourcesContent":["import { DatabaseSync } from \"node:sqlite\";\n\nexport interface NodeSqliteCompatStatement {\n\treadonly reader: boolean;\n\tall(parameters: ReadonlyArray<unknown>): unknown[];\n\tall(...parameters: unknown[]): unknown[];\n\tget(parameters: ReadonlyArray<unknown>): unknown;\n\tget(...parameters: unknown[]): unknown;\n\trun(parameters: ReadonlyArray<unknown>): {\n\t\tchanges: number | bigint;\n\t\tlastInsertRowid: number | bigint;\n\t};\n\trun(...parameters: unknown[]): {\n\t\tchanges: number | bigint;\n\t\tlastInsertRowid: number | bigint;\n\t};\n\titerate(parameters: ReadonlyArray<unknown>): IterableIterator<unknown>;\n\titerate(...parameters: unknown[]): IterableIterator<unknown>;\n}\n\nexport interface NodeSqliteOpenOptions {\n\tjournalMode?: \"wal\";\n\treadOnly?: boolean;\n}\n\ntype SqliteBinding = null | number | bigint | string | Uint8Array;\n\nexport function openNodeSqliteDatabase(\n\tpath: string,\n\toptions: NodeSqliteOpenOptions = {},\n): NodeSqliteCompatDatabase {\n\treturn new NodeSqliteCompatDatabase(path, options);\n}\n\nexport class NodeSqliteCompatDatabase {\n\treadonly #database: DatabaseSync;\n\n\tconstructor(path: string, options: NodeSqliteOpenOptions = {}) {\n\t\tconst database = new DatabaseSync(path, { readOnly: options.readOnly });\n\t\tthis.#database = database;\n\n\t\ttry {\n\t\t\tdatabase.exec(\"PRAGMA busy_timeout = 5000\");\n\t\t\tdatabase.exec(\"PRAGMA foreign_keys = ON\");\n\t\t\t// Negative cache_size values are kibibytes.\n\t\t\tdatabase.exec(\"PRAGMA cache_size = -16000\");\n\t\t\tif (options.journalMode === \"wal\" && !options.readOnly) {\n\t\t\t\tdatabase.exec(\"PRAGMA journal_mode = WAL\");\n\t\t\t}\n\t\t\tconst journalMode = database.prepare(\"PRAGMA journal_mode\").get()?.[\"journal_mode\"];\n\t\t\tif (journalMode === \"wal\") {\n\t\t\t\tdatabase.exec(\"PRAGMA synchronous = NORMAL\");\n\t\t\t}\n\t\t} catch (error) {\n\t\t\ttry {\n\t\t\t\tdatabase.close();\n\t\t\t} catch {\n\t\t\t\tthrow new Error(\"SQLite setup failed and the connection could not be closed\", {\n\t\t\t\t\tcause: error,\n\t\t\t\t});\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tget open(): boolean {\n\t\treturn this.#database.isOpen;\n\t}\n\n\tclose(): void {\n\t\tif (this.#database.isOpen) this.#database.close();\n\t}\n\n\texec(sql: string): void {\n\t\tthis.#database.exec(sql);\n\t}\n\n\tprepare(sql: string): NodeSqliteCompatStatement {\n\t\tconst statement = this.#database.prepare(sql);\n\t\treturn {\n\t\t\treader: statement.columns().length > 0,\n\t\t\tall: (...parameters) => statement.all(...toBindings(normalizeParameters(parameters))),\n\t\t\tget: (...parameters) => statement.get(...toBindings(normalizeParameters(parameters))),\n\t\t\trun: (...parameters) => statement.run(...toBindings(normalizeParameters(parameters))),\n\t\t\titerate: (...parameters) => statement.iterate(...toBindings(normalizeParameters(parameters))),\n\t\t};\n\t}\n}\n\nfunction normalizeParameters(parameters: unknown[]): ReadonlyArray<unknown> {\n\treturn parameters.length === 1 && Array.isArray(parameters[0]) ? parameters[0] : parameters;\n}\n\nfunction toBindings(parameters: ReadonlyArray<unknown>): SqliteBinding[] {\n\treturn parameters.map((value) => {\n\t\tif (value === null || typeof value === \"string\" || typeof value === \"number\") {\n\t\t\treturn value;\n\t\t}\n\t\tif (typeof value === \"bigint\") return value;\n\t\tif (typeof value === \"boolean\") return value ? 1 : 0;\n\t\tif (value === undefined) return null;\n\t\tif (value instanceof Uint8Array) return value;\n\t\tthrow new TypeError(`Cannot bind ${Object.prototype.toString.call(value)} to SQLite`);\n\t});\n}\n"],"mappings":";;;AA2BA,SAAgB,uBACf,MACA,UAAiC,EAAE,EACR;AAC3B,QAAO,IAAI,yBAAyB,MAAM,QAAQ;;AAGnD,IAAa,2BAAb,MAAsC;CACrC,CAASA;CAET,YAAY,MAAc,UAAiC,EAAE,EAAE;EAC9D,MAAM,WAAW,IAAI,aAAa,MAAM,EAAE,UAAU,QAAQ,UAAU,CAAC;AACvE,QAAKA,WAAY;AAEjB,MAAI;AACH,YAAS,KAAK,6BAA6B;AAC3C,YAAS,KAAK,2BAA2B;AAEzC,YAAS,KAAK,6BAA6B;AAC3C,OAAI,QAAQ,gBAAgB,SAAS,CAAC,QAAQ,SAC7C,UAAS,KAAK,4BAA4B;AAG3C,OADoB,SAAS,QAAQ,sBAAsB,CAAC,KAAK,GAAG,oBAChD,MACnB,UAAS,KAAK,8BAA8B;WAErC,OAAO;AACf,OAAI;AACH,aAAS,OAAO;WACT;AACP,UAAM,IAAI,MAAM,8DAA8D,EAC7E,OAAO,OACP,CAAC;;AAEH,SAAM;;;CAIR,IAAI,OAAgB;AACnB,SAAO,MAAKA,SAAU;;CAGvB,QAAc;AACb,MAAI,MAAKA,SAAU,OAAQ,OAAKA,SAAU,OAAO;;CAGlD,KAAK,KAAmB;AACvB,QAAKA,SAAU,KAAK,IAAI;;CAGzB,QAAQ,KAAwC;EAC/C,MAAM,YAAY,MAAKA,SAAU,QAAQ,IAAI;AAC7C,SAAO;GACN,QAAQ,UAAU,SAAS,CAAC,SAAS;GACrC,MAAM,GAAG,eAAe,UAAU,IAAI,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GACrF,MAAM,GAAG,eAAe,UAAU,IAAI,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GACrF,MAAM,GAAG,eAAe,UAAU,IAAI,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GACrF,UAAU,GAAG,eAAe,UAAU,QAAQ,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GAC7F;;;AAIH,SAAS,oBAAoB,YAA+C;AAC3E,QAAO,WAAW,WAAW,KAAK,MAAM,QAAQ,WAAW,GAAG,GAAG,WAAW,KAAK;;AAGlF,SAAS,WAAW,YAAqD;AACxE,QAAO,WAAW,KAAK,UAAU;AAChC,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,SACnE,QAAO;AAER,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,IAAI;AACnD,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,iBAAiB,WAAY,QAAO;AACxC,QAAM,IAAI,UAAU,eAAe,OAAO,UAAU,SAAS,KAAK,MAAM,CAAC,YAAY;GACpF"}

package/dist/oauth-authorization-BtYQ80uU.mjs

@@ -0,0 +1,274 @@
+import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
+import { i as generatePrefixedToken, o as hashApiToken, s as isValidScope, t as TOKEN_PREFIXES } from "./api-tokens-BLz2MtQs.mjs";
+import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "./oauth-clients-C1S4NQHh.mjs";
+import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-BNp1aFAr.mjs";
+import { clampScopes, computeS256Challenge, secureCompare } from "@emdash-cms/auth";
+import { generateCodeVerifier } from "arctic";
+
+//#region src/api/handlers/oauth-authorization.ts
+/**
+* OAuth 2.1 Authorization Code + PKCE handlers.
+*
+* Implements the server side of the authorization code grant for MCP clients
+* (Claude Desktop, VS Code, etc.) per the MCP authorization spec (draft).
+*
+* Uses arctic for PKCE challenge generation and @emdash-cms/auth for token
+* utilities. Token infrastructure is shared with the device flow.
+*/
+/** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */
+const AUTH_CODE_TTL_SECONDS = 600;
+/** Access token TTL: 1 hour */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+/** Refresh token TTL: 90 days */
+const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
+function expiresAt(seconds) {
+	return new Date(Date.now() + seconds * 1e3).toISOString();
+}
+/**
+* Validate and normalize scopes. Returns validated scope list.
+*/
+function normalizeScopes(requested) {
+	if (!requested) return [];
+	return requested.split(" ").filter(Boolean).filter(isValidScope);
+}
+/**
+* Process an authorization request after the user approves consent.
+*
+* Generates an authorization code, stores it with the PKCE challenge,
+* and returns the redirect URL with the code appended.
+*
+* Scopes are clamped to the user's role to prevent scope escalation.
+*/
+async function handleAuthorizationApproval(db, userId, userRole, params) {
+	try {
+		if (params.response_type !== "code") return {
+			success: false,
+			error: {
+				code: "UNSUPPORTED_RESPONSE_TYPE",
+				message: "Only response_type=code is supported"
+			}
+		};
+		const uriError = validateRedirectUri(params.redirect_uri);
+		if (uriError) return {
+			success: false,
+			error: {
+				code: "INVALID_REDIRECT_URI",
+				message: uriError
+			}
+		};
+		const client = await lookupOAuthClient(db, params.client_id);
+		if (!client) return {
+			success: false,
+			error: {
+				code: "INVALID_CLIENT",
+				message: "Unknown client_id"
+			}
+		};
+		const clientUriError = validateClientRedirectUri(params.redirect_uri, client.redirectUris);
+		if (clientUriError) return {
+			success: false,
+			error: {
+				code: "INVALID_REDIRECT_URI",
+				message: clientUriError
+			}
+		};
+		if (params.code_challenge_method !== "S256") return {
+			success: false,
+			error: {
+				code: "INVALID_REQUEST",
+				message: "Only S256 code_challenge_method is supported"
+			}
+		};
+		if (!params.code_challenge) return {
+			success: false,
+			error: {
+				code: "INVALID_REQUEST",
+				message: "code_challenge is required"
+			}
+		};
+		const userScopes = clampScopes(normalizeScopes(params.scope), userRole);
+		const clientScopes = client.scopes;
+		const scopes = clientScopes?.length ? userScopes.filter((s) => clientScopes.includes(s)) : userScopes;
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "INVALID_SCOPE",
+				message: "No valid scopes requested"
+			}
+		};
+		const code = generateCodeVerifier();
+		const codeHash = hashApiToken(code);
+		await db.insertInto("_emdash_authorization_codes").values({
+			code_hash: codeHash,
+			client_id: params.client_id,
+			redirect_uri: params.redirect_uri,
+			user_id: userId,
+			scopes: JSON.stringify(scopes),
+			code_challenge: params.code_challenge,
+			code_challenge_method: params.code_challenge_method,
+			resource: params.resource ?? null,
+			expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
+		}).execute();
+		const redirectUrl = new URL(params.redirect_uri);
+		redirectUrl.searchParams.set("code", code);
+		if (params.state) redirectUrl.searchParams.set("state", params.state);
+		return {
+			success: true,
+			data: { redirect_url: redirectUrl.toString() }
+		};
+	} catch (error) {
+		console.error("Authorization error:", error);
+		return {
+			success: false,
+			error: {
+				code: "AUTHORIZATION_ERROR",
+				message: "Failed to process authorization"
+			}
+		};
+	}
+}
+/**
+* Exchange an authorization code for access + refresh tokens.
+*
+* Validates the code, verifies PKCE, and issues tokens using the same
+* infrastructure as the device flow (ec_oat_*, ec_ort_*).
+*/
+async function handleAuthorizationCodeExchange(db, params) {
+	try {
+		if (params.grant_type !== "authorization_code") return {
+			success: false,
+			error: {
+				code: "unsupported_grant_type",
+				message: "Invalid grant_type"
+			}
+		};
+		const codeHash = hashApiToken(params.code);
+		const row = await db.deleteFrom("_emdash_authorization_codes").where("code_hash", "=", codeHash).returningAll().executeTakeFirst();
+		if (!row) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Invalid authorization code"
+			}
+		};
+		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Authorization code expired"
+			}
+		};
+		if (row.redirect_uri !== params.redirect_uri) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "redirect_uri mismatch"
+			}
+		};
+		if (row.client_id !== params.client_id) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "client_id mismatch"
+			}
+		};
+		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "PKCE verification failed"
+			}
+		};
+		if (row.resource && params.resource && row.resource !== params.resource) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "resource mismatch"
+			}
+		};
+		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
+		if (!userInfo) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User not found"
+			}
+		};
+		if (userInfo.disabled) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User account is disabled"
+			}
+		};
+		let scopes = clampScopes(JSON.parse(row.scopes), userInfo.role);
+		const client = await lookupOAuthClient(db, row.client_id);
+		if (client?.scopes?.length) scopes = scopes.filter((s) => client.scopes.includes(s));
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User role no longer supports any of the requested scopes"
+			}
+		};
+		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
+		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
+		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
+		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
+		await withTransaction(db, async (trx) => {
+			await trx.insertInto("_emdash_oauth_tokens").values({
+				token_hash: accessToken.hash,
+				token_type: "access",
+				user_id: row.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "mcp",
+				expires_at: accessExpires,
+				refresh_token_hash: refreshToken.hash,
+				client_id: row.client_id
+			}).execute();
+			await trx.insertInto("_emdash_oauth_tokens").values({
+				token_hash: refreshToken.hash,
+				token_type: "refresh",
+				user_id: row.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "mcp",
+				expires_at: refreshExpires,
+				refresh_token_hash: null,
+				client_id: row.client_id
+			}).execute();
+		});
+		return {
+			success: true,
+			data: {
+				access_token: accessToken.raw,
+				refresh_token: refreshToken.raw,
+				token_type: "Bearer",
+				expires_in: ACCESS_TOKEN_TTL_SECONDS,
+				scope: scopes.join(" ")
+			}
+		};
+	} catch (error) {
+		console.error("Token exchange error:", error);
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_EXCHANGE_ERROR",
+				message: "Failed to exchange authorization code"
+			}
+		};
+	}
+}
+/**
+* Build the authorization denied redirect URL.
+*/
+function buildDeniedRedirect(redirectUri, state) {
+	const url = new URL(redirectUri);
+	url.searchParams.set("error", "access_denied");
+	url.searchParams.set("error_description", "The user denied the authorization request");
+	if (state) url.searchParams.set("state", state);
+	return url.toString();
+}
+
+//#endregion
+export { handleAuthorizationApproval as n, handleAuthorizationCodeExchange as r, buildDeniedRedirect as t };
+//# sourceMappingURL=oauth-authorization-BtYQ80uU.mjs.map

package/dist/oauth-authorization-BtYQ80uU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-BtYQ80uU.mjs","names":[],"sources":["../src/api/handlers/oauth-authorization.ts"],"sourcesContent":["/**\n * OAuth 2.1 Authorization Code + PKCE handlers.\n *\n * Implements the server side of the authorization code grant for MCP clients\n * (Claude Desktop, VS Code, etc.) per the MCP authorization spec (draft).\n *\n * Uses arctic for PKCE challenge generation and @emdash-cms/auth for token\n * utilities. Token infrastructure is shared with the device flow.\n */\n\nimport { clampScopes, computeS256Challenge, secureCompare } from \"@emdash-cms/auth\";\nimport type { RoleLevel } from \"@emdash-cms/auth\";\nimport { generateCodeVerifier } from \"arctic\";\nimport type { Kysely } from \"kysely\";\n\nimport {\n\tgeneratePrefixedToken,\n\thashApiToken,\n\tisValidScope,\n\tTOKEN_PREFIXES,\n} from \"../../auth/api-tokens.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { validateRedirectUri } from \"../oauth/redirect-uri.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { lookupOAuthClient, validateClientRedirectUri } from \"./oauth-clients.js\";\nimport { lookupUserRoleAndStatus } from \"./oauth-user-lookup.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */\nconst AUTH_CODE_TTL_SECONDS = 10 * 60;\n\n/** Access token TTL: 1 hour */\nconst ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\n/** Refresh token TTL: 90 days */\nconst REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface AuthorizationParams {\n\tresponse_type: string;\n\tclient_id: string;\n\tredirect_uri: string;\n\tscope?: string;\n\tstate?: string;\n\tcode_challenge: string;\n\tcode_challenge_method: string;\n\tresource?: string;\n}\n\nexport interface TokenExchangeParams {\n\tgrant_type: string;\n\tcode: string;\n\tredirect_uri: string;\n\tclient_id: string;\n\tcode_verifier: string;\n\tresource?: string;\n}\n\nexport interface TokenResponse {\n\taccess_token: string;\n\trefresh_token: string;\n\ttoken_type: \"Bearer\";\n\texpires_in: number;\n\tscope: string;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction expiresAt(seconds: number): string {\n\treturn new Date(Date.now() + seconds * 1000).toISOString();\n}\n\nexport { validateRedirectUri };\n\n/**\n * Validate and normalize scopes. Returns validated scope list.\n */\nfunction normalizeScopes(requested?: string): string[] {\n\tif (!requested) return [];\n\n\tconst scopes = requested.split(\" \").filter(Boolean).filter(isValidScope);\n\n\treturn scopes;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Process an authorization request after the user approves consent.\n *\n * Generates an authorization code, stores it with the PKCE challenge,\n * and returns the redirect URL with the code appended.\n *\n * Scopes are clamped to the user's role to prevent scope escalation.\n */\nexport async function handleAuthorizationApproval(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tuserRole: RoleLevel,\n\tparams: AuthorizationParams,\n): Promise<ApiResult<{ redirect_url: string }>> {\n\ttry {\n\t\t// Validate response_type\n\t\tif (params.response_type !== \"code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"UNSUPPORTED_RESPONSE_TYPE\",\n\t\t\t\t\tmessage: \"Only response_type=code is supported\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate redirect_uri scheme/host (basic security check)\n\t\tconst uriError = validateRedirectUri(params.redirect_uri);\n\t\tif (uriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REDIRECT_URI\", message: uriError },\n\t\t\t};\n\t\t}\n\n\t\t// Look up the registered OAuth client\n\t\tconst client = await lookupOAuthClient(db, params.client_id);\n\t\tif (!client) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_CLIENT\",\n\t\t\t\t\tmessage: \"Unknown client_id\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate redirect_uri against client's registered URIs\n\t\tconst clientUriError = validateClientRedirectUri(params.redirect_uri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REDIRECT_URI\", message: clientUriError },\n\t\t\t};\n\t\t}\n\n\t\t// Validate code_challenge_method\n\t\tif (params.code_challenge_method !== \"S256\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_REQUEST\",\n\t\t\t\t\tmessage: \"Only S256 code_challenge_method is supported\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate code_challenge is present\n\t\tif (!params.code_challenge) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REQUEST\", message: \"code_challenge is required\" },\n\t\t\t};\n\t\t}\n\n\t\t// Validate scopes, then clamp to user's role\n\t\tconst userScopes = clampScopes(normalizeScopes(params.scope), userRole);\n\n\t\t// SEC-41: Intersect with client's registered scopes (if restricted).\n\t\t// A client registered with scopes: [\"content:read\"] should never receive\n\t\t// admin or schema:write, regardless of the approving user's role.\n\t\tconst clientScopes = client.scopes;\n\t\tconst scopes = clientScopes?.length\n\t\t\t? userScopes.filter((s: string) => clientScopes.includes(s))\n\t\t\t: userScopes;\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_SCOPE\", message: \"No valid scopes requested\" },\n\t\t\t};\n\t\t}\n\n\t\t// Generate authorization code (high entropy, base64url)\n\t\tconst code = generateCodeVerifier(); // 32 bytes random, base64url\n\t\tconst codeHash = hashApiToken(code);\n\n\t\t// Store the authorization code\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_authorization_codes\")\n\t\t\t.values({\n\t\t\t\tcode_hash: codeHash,\n\t\t\t\tclient_id: params.client_id,\n\t\t\t\tredirect_uri: params.redirect_uri,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tcode_challenge: params.code_challenge,\n\t\t\t\tcode_challenge_method: params.code_challenge_method,\n\t\t\t\tresource: params.resource ?? null,\n\t\t\t\texpires_at: expiresAt(AUTH_CODE_TTL_SECONDS),\n\t\t\t})\n\t\t\t.execute();\n\n\t\t// Build the redirect URL\n\t\tconst redirectUrl = new URL(params.redirect_uri);\n\t\tredirectUrl.searchParams.set(\"code\", code);\n\t\tif (params.state) {\n\t\t\tredirectUrl.searchParams.set(\"state\", params.state);\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { redirect_url: redirectUrl.toString() },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Authorization error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORIZATION_ERROR\",\n\t\t\t\tmessage: \"Failed to process authorization\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Exchange an authorization code for access + refresh tokens.\n *\n * Validates the code, verifies PKCE, and issues tokens using the same\n * infrastructure as the device flow (ec_oat_*, ec_ort_*).\n */\nexport async function handleAuthorizationCodeExchange(\n\tdb: Kysely<Database>,\n\tparams: TokenExchangeParams,\n): Promise<ApiResult<TokenResponse>> {\n\ttry {\n\t\t// Validate grant_type\n\t\tif (params.grant_type !== \"authorization_code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"unsupported_grant_type\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\t// SEC-39: Atomically consume the authorization code using DELETE...RETURNING.\n\t\t// This prevents TOCTOU double-exchange: two concurrent requests with the\n\t\t// same code will race on the DELETE, and only one will get a row back.\n\t\tconst codeHash = hashApiToken(params.code);\n\n\t\tconst row = await db\n\t\t\t.deleteFrom(\"_emdash_authorization_codes\")\n\t\t\t.where(\"code_hash\", \"=\", codeHash)\n\t\t\t.returningAll()\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"Invalid authorization code\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < new Date()) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"Authorization code expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify redirect_uri matches exactly\n\t\tif (row.redirect_uri !== params.redirect_uri) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"redirect_uri mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify client_id matches\n\t\tif (row.client_id !== params.client_id) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"client_id mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// PKCE verification: SHA256(code_verifier) must match stored code_challenge\n\t\t// Use constant-time comparison to prevent timing side-channels\n\t\tconst derivedChallenge = computeS256Challenge(params.code_verifier);\n\t\tif (!secureCompare(derivedChallenge, row.code_challenge)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"PKCE verification failed\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify resource matches (if stored)\n\t\tif (row.resource && params.resource && row.resource !== params.resource) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"resource mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// Revalidate user role before issuing tokens (same pattern as handleTokenRefresh).\n\t\t// The user's role may have changed since the authorization code was issued.\n\t\tconst userInfo = await lookupUserRoleAndStatus(db, row.user_id);\n\t\tif (!userInfo) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"User not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (userInfo.disabled) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"User account is disabled\" },\n\t\t\t};\n\t\t}\n\n\t\t// Re-clamp scopes against the user's current role\n\t\tconst storedScopes = JSON.parse(row.scopes) as string[];\n\t\tlet scopes = clampScopes(storedScopes, userInfo.role);\n\n\t\t// Intersect with client's registered scopes (if restricted)\n\t\tconst client = await lookupOAuthClient(db, row.client_id);\n\t\tif (client?.scopes?.length) {\n\t\t\tscopes = scopes.filter((s: string) => client.scopes!.includes(s));\n\t\t}\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"invalid_grant\",\n\t\t\t\t\tmessage: \"User role no longer supports any of the requested scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Issue tokens (same as device flow)\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\n\t\tconst refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);\n\t\tconst refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);\n\n\t\t// Atomically store both tokens in a transaction\n\t\tawait withTransaction(db, async (trx) => {\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\t\ttoken_type: \"access\",\n\t\t\t\t\tuser_id: row.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"mcp\",\n\t\t\t\t\texpires_at: accessExpires,\n\t\t\t\t\trefresh_token_hash: refreshToken.hash,\n\t\t\t\t\tclient_id: row.client_id,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: refreshToken.hash,\n\t\t\t\t\ttoken_type: \"refresh\",\n\t\t\t\t\tuser_id: row.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"mcp\",\n\t\t\t\t\texpires_at: refreshExpires,\n\t\t\t\t\trefresh_token_hash: null,\n\t\t\t\t\tclient_id: row.client_id,\n\t\t\t\t})\n\t\t\t\t.execute();\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: refreshToken.raw,\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Token exchange error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_EXCHANGE_ERROR\",\n\t\t\t\tmessage: \"Failed to exchange authorization code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Build the authorization denied redirect URL.\n */\nexport function buildDeniedRedirect(redirectUri: string, state?: string): string {\n\tconst url = new URL(redirectUri);\n\turl.searchParams.set(\"error\", \"access_denied\");\n\turl.searchParams.set(\"error_description\", \"The user denied the authorization request\");\n\tif (state) {\n\t\turl.searchParams.set(\"state\", state);\n\t}\n\treturn url.toString();\n}\n\n/**\n * Clean up expired authorization codes.\n */\nexport async function cleanupExpiredAuthorizationCodes(db: Kysely<Database>): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_authorization_codes\")\n\t\t.where(\"expires_at\", \"<\", new Date().toISOString())\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,MAAM,wBAAwB;;AAG9B,MAAM,2BAA2B;;AAGjC,MAAM,4BAA4B,OAAU,KAAK;AAsCjD,SAAS,UAAU,SAAyB;AAC3C,QAAO,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,IAAK,CAAC,aAAa;;;;;AAQ3D,SAAS,gBAAgB,WAA8B;AACtD,KAAI,CAAC,UAAW,QAAO,EAAE;AAIzB,QAFe,UAAU,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,aAAa;;;;;;;;;;AAiBzE,eAAsB,4BACrB,IACA,QACA,UACA,QAC+C;AAC/C,KAAI;AAEH,MAAI,OAAO,kBAAkB,OAC5B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,WAAW,oBAAoB,OAAO,aAAa;AACzD,MAAI,SACH,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS;IAAU;GAC1D;EAIF,MAAM,SAAS,MAAM,kBAAkB,IAAI,OAAO,UAAU;AAC5D,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,iBAAiB,0BAA0B,OAAO,cAAc,OAAO,aAAa;AAC1F,MAAI,eACH,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS;IAAgB;GAChE;AAIF,MAAI,OAAO,0BAA0B,OACpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAIF,MAAI,CAAC,OAAO,eACX,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAmB,SAAS;IAA8B;GACzE;EAIF,MAAM,aAAa,YAAY,gBAAgB,OAAO,MAAM,EAAE,SAAS;EAKvE,MAAM,eAAe,OAAO;EAC5B,MAAM,SAAS,cAAc,SAC1B,WAAW,QAAQ,MAAc,aAAa,SAAS,EAAE,CAAC,GAC1D;AAEH,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAIF,MAAM,OAAO,sBAAsB;EACnC,MAAM,WAAW,aAAa,KAAK;AAGnC,QAAM,GACJ,WAAW,8BAA8B,CACzC,OAAO;GACP,WAAW;GACX,WAAW,OAAO;GAClB,cAAc,OAAO;GACrB,SAAS;GACT,QAAQ,KAAK,UAAU,OAAO;GAC9B,gBAAgB,OAAO;GACvB,uBAAuB,OAAO;GAC9B,UAAU,OAAO,YAAY;GAC7B,YAAY,UAAU,sBAAsB;GAC5C,CAAC,CACD,SAAS;EAGX,MAAM,cAAc,IAAI,IAAI,OAAO,aAAa;AAChD,cAAY,aAAa,IAAI,QAAQ,KAAK;AAC1C,MAAI,OAAO,MACV,aAAY,aAAa,IAAI,SAAS,OAAO,MAAM;AAGpD,SAAO;GACN,SAAS;GACT,MAAM,EAAE,cAAc,YAAY,UAAU,EAAE;GAC9C;UACO,OAAO;AACf,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,gCACrB,IACA,QACoC;AACpC,KAAI;AAEH,MAAI,OAAO,eAAe,qBACzB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;EAMF,MAAM,WAAW,aAAa,OAAO,KAAK;EAE1C,MAAM,MAAM,MAAM,GAChB,WAAW,8BAA8B,CACzC,MAAM,aAAa,KAAK,SAAS,CACjC,cAAc,CACd,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA8B;GACvE;AAIF,MAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA8B;GACvE;AAIF,MAAI,IAAI,iBAAiB,OAAO,aAC/B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAyB;GAClE;AAIF,MAAI,IAAI,cAAc,OAAO,UAC5B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAsB;GAC/D;AAMF,MAAI,CAAC,cADoB,qBAAqB,OAAO,cAAc,EAC9B,IAAI,eAAe,CACvD,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA4B;GACrE;AAIF,MAAI,IAAI,YAAY,OAAO,YAAY,IAAI,aAAa,OAAO,SAC9D,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAqB;GAC9D;EAKF,MAAM,WAAW,MAAM,wBAAwB,IAAI,IAAI,QAAQ;AAC/D,MAAI,CAAC,SACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAkB;GAC3D;AAGF,MAAI,SAAS,SACZ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA4B;GACrE;EAKF,IAAI,SAAS,YADQ,KAAK,MAAM,IAAI,OAAO,EACJ,SAAS,KAAK;EAGrD,MAAM,SAAS,MAAM,kBAAkB,IAAI,IAAI,UAAU;AACzD,MAAI,QAAQ,QAAQ,OACnB,UAAS,OAAO,QAAQ,MAAc,OAAO,OAAQ,SAAS,EAAE,CAAC;AAGlE,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;EAEzD,MAAM,eAAe,sBAAsB,eAAe,cAAc;EACxE,MAAM,iBAAiB,UAAU,0BAA0B;AAG3D,QAAM,gBAAgB,IAAI,OAAO,QAAQ;AACxC,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,YAAY;IACxB,YAAY;IACZ,SAAS,IAAI;IACb,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB,aAAa;IACjC,WAAW,IAAI;IACf,CAAC,CACD,SAAS;AAEX,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,aAAa;IACzB,YAAY;IACZ,SAAS,IAAI;IACb,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,WAAW,IAAI;IACf,CAAC,CACD,SAAS;IACV;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,aAAa;IAC5B,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,KAAK,IAAI;IACvB;GACD;UACO,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,SAAgB,oBAAoB,aAAqB,OAAwB;CAChF,MAAM,MAAM,IAAI,IAAI,YAAY;AAChC,KAAI,aAAa,IAAI,SAAS,gBAAgB;AAC9C,KAAI,aAAa,IAAI,qBAAqB,4CAA4C;AACtF,KAAI,MACH,KAAI,aAAa,IAAI,SAAS,MAAM;AAErC,QAAO,IAAI,UAAU"}