emdash 1.0.1 → 1.1.0

package/dist/astro/routes/api/widget-areas/_name_.mjs

@@ -1,15 +1,15 @@
 import "../../../../dialect-helpers-7_IqPdh9.mjs";
 import "../../../../config-CvmjJcVw.mjs";
-import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../request-cache-C4CIo5ad.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import { i as widgetAreaTag } from "../../../../chrome-tags-CKELm-bo.mjs";
-import "../../../../loader-D4edocWH.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DIYXAVk4.mjs";
-import { a as rowToWidget } from "../../../../widgets-DMAgGcQt.mjs";
-import { i as requirePerm } from "../../../../authorize-CTGywswM.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import { i as widgetAreaTag } from "../../../../chrome-tags-BIKBMZYO.mjs";
+import "../../../../loader-1DMiOq5s.mjs";
+import "../../../../errors-CuHQRiBW.mjs";
+import "../../../../errors-DTE6C3K_.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-B0rgPgsQ.mjs";
+import { a as rowToWidget } from "../../../../widgets-BkxBAgZ_.mjs";
+import { i as requirePerm } from "../../../../authorize-DeWfk--K.mjs";
 
 //#region src/astro/routes/api/widget-areas/[name].ts
 const prerender = false;

package/dist/astro/routes/api/widget-areas/index.mjs

@@ -1,27 +1,27 @@
 import "../../../../dialect-helpers-7_IqPdh9.mjs";
 import "../../../../config-CvmjJcVw.mjs";
-import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../request-cache-C4CIo5ad.mjs";
 import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import { i as widgetAreaTag } from "../../../../chrome-tags-CKELm-bo.mjs";
-import "../../../../loader-D4edocWH.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import "../../../../settings-CwcrX-Ay.mjs";
-import "../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-5Y0W39xR.mjs";
-import "../../../../redirects-1nhdEaTq.mjs";
-import { s as createWidgetAreaBody } from "../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../media-Bs6qmlVl.mjs";
-import "../../../../comments-zrTgWBSg.mjs";
-import "../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../menus-mC_XTxD7.mjs";
-import "../../../../status-C6IrSLMT.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import { i as widgetAreaTag } from "../../../../chrome-tags-BIKBMZYO.mjs";
+import "../../../../loader-1DMiOq5s.mjs";
+import "../../../../errors-CuHQRiBW.mjs";
+import "../../../../errors-DTE6C3K_.mjs";
+import "../../../../settings-WHr45II1.mjs";
+import "../../../../site-settings-KJOqJW6W.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-B0rgPgsQ.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-CmFDTGzp.mjs";
+import "../../../../redirects-D4EWeXAo.mjs";
+import { s as createWidgetAreaBody } from "../../../../entry-lock-sxz2PGAT.mjs";
+import "../../../../media-aahnKHze.mjs";
+import "../../../../comments-BRtp992B.mjs";
+import "../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../menus-BQKqf0Up.mjs";
+import "../../../../status-D39Fpy8R.mjs";
 import "../../../../api/schemas/index.mjs";
-import { a as rowToWidget } from "../../../../widgets-DMAgGcQt.mjs";
-import { i as requirePerm } from "../../../../authorize-CTGywswM.mjs";
+import { a as rowToWidget } from "../../../../widgets-BkxBAgZ_.mjs";
+import { i as requirePerm } from "../../../../authorize-DeWfk--K.mjs";
 import { ulid } from "ulidx";
 
 //#region src/astro/routes/api/widget-areas/index.ts

package/dist/astro/routes/api/widget-components.mjs

@@ -1,9 +1,9 @@
-import "../../../base64-DvnNgP7e.mjs";
-import "../../../types-j6MBDjlZ.mjs";
-import "../../../errors-CjXd1LgH.mjs";
-import "../../../errors-CNvATh_7.mjs";
-import { n as apiSuccess, r as handleError } from "../../../error-DIYXAVk4.mjs";
-import { t as getWidgetComponents } from "../../../components-Dbf4Eq16.mjs";
+import "../../../base64-BQBZwXCx.mjs";
+import "../../../types-C-Xp0CcN.mjs";
+import "../../../errors-CuHQRiBW.mjs";
+import "../../../errors-DTE6C3K_.mjs";
+import { n as apiSuccess, r as handleError } from "../../../error-B0rgPgsQ.mjs";
+import { t as getWidgetComponents } from "../../../components-CQY-Sgm-.mjs";
 
 //#region src/astro/routes/api/widget-components.ts
 const prerender = false;

package/dist/astro/routes/robots.txt.mjs

@@ -2,15 +2,15 @@ import "../../dialect-helpers-7_IqPdh9.mjs";
 import "../../config-CvmjJcVw.mjs";
 import "../../after-PcEvMY_6.mjs";
 import "../../options-DhrI7eMv.mjs";
-import "../../base64-DvnNgP7e.mjs";
-import "../../secrets-CIi0nFiR.mjs";
+import "../../secrets-Cc_O3Kp-.mjs";
+import "../../base64-BQBZwXCx.mjs";
 import "../../object-cache-Bo6DGaC9.mjs";
 import "../../request-cache-C4CIo5ad.mjs";
-import "../../types-j6MBDjlZ.mjs";
-import "../../media-CputjGE1.mjs";
-import "../../loader-D4edocWH.mjs";
-import { o as getSiteSettingsWithDb } from "../../settings-D_cJtT48.mjs";
-import { r as getPublicOrigin } from "../../public-url-7j0cpCFc.mjs";
+import "../../types-C-Xp0CcN.mjs";
+import "../../media-BzUDu7nl.mjs";
+import "../../loader-1DMiOq5s.mjs";
+import { o as getSiteSettingsWithDb } from "../../settings-m5tIYnF0.mjs";
+import { r as getPublicOrigin } from "../../public-url-B5a0QAh6.mjs";
 
 //#region src/astro/routes/robots.txt.ts
 const prerender = false;

package/dist/astro/routes/sitemap-_collection_.xml.mjs

@@ -2,18 +2,18 @@ import "../../dialect-helpers-7_IqPdh9.mjs";
 import { i as isI18nEnabled, r as getI18nConfig } from "../../config-CvmjJcVw.mjs";
 import "../../after-PcEvMY_6.mjs";
 import "../../options-DhrI7eMv.mjs";
-import "../../base64-DvnNgP7e.mjs";
-import "../../secrets-CIi0nFiR.mjs";
+import "../../secrets-Cc_O3Kp-.mjs";
+import "../../base64-BQBZwXCx.mjs";
 import "../../object-cache-Bo6DGaC9.mjs";
 import "../../request-cache-C4CIo5ad.mjs";
-import "../../types-j6MBDjlZ.mjs";
-import "../../media-CputjGE1.mjs";
+import "../../types-C-Xp0CcN.mjs";
+import "../../media-BzUDu7nl.mjs";
 import { a as resolveLocalizedContentRoutePath } from "../../resolve-D-kqyKns.mjs";
-import "../../loader-D4edocWH.mjs";
-import { t as handleSitemapData } from "../../seo-DifeiGdl.mjs";
-import { o as getSiteSettingsWithDb } from "../../settings-D_cJtT48.mjs";
-import { t as buildSeoImageUrl } from "../../media-url-DbkMY3y6.mjs";
-import { r as getPublicOrigin } from "../../public-url-7j0cpCFc.mjs";
+import "../../loader-1DMiOq5s.mjs";
+import { t as handleSitemapData } from "../../seo-C61bnPuV.mjs";
+import { o as getSiteSettingsWithDb } from "../../settings-m5tIYnF0.mjs";
+import { t as buildSeoImageUrl } from "../../media-url-DloW2xrP.mjs";
+import { r as getPublicOrigin } from "../../public-url-B5a0QAh6.mjs";
 import virtualConfig from "virtual:emdash/config";
 
 //#region src/astro/routes/sitemap-[collection].xml.ts

package/dist/astro/routes/sitemap.xml.mjs

@@ -2,16 +2,16 @@ import "../../dialect-helpers-7_IqPdh9.mjs";
 import "../../config-CvmjJcVw.mjs";
 import "../../after-PcEvMY_6.mjs";
 import "../../options-DhrI7eMv.mjs";
-import "../../base64-DvnNgP7e.mjs";
-import "../../secrets-CIi0nFiR.mjs";
+import "../../secrets-Cc_O3Kp-.mjs";
+import "../../base64-BQBZwXCx.mjs";
 import "../../object-cache-Bo6DGaC9.mjs";
 import "../../request-cache-C4CIo5ad.mjs";
-import "../../types-j6MBDjlZ.mjs";
-import "../../media-CputjGE1.mjs";
-import "../../loader-D4edocWH.mjs";
-import { t as handleSitemapData } from "../../seo-DifeiGdl.mjs";
-import { o as getSiteSettingsWithDb } from "../../settings-D_cJtT48.mjs";
-import { r as getPublicOrigin } from "../../public-url-7j0cpCFc.mjs";
+import "../../types-C-Xp0CcN.mjs";
+import "../../media-BzUDu7nl.mjs";
+import "../../loader-1DMiOq5s.mjs";
+import { t as handleSitemapData } from "../../seo-C61bnPuV.mjs";
+import { o as getSiteSettingsWithDb } from "../../settings-m5tIYnF0.mjs";
+import { r as getPublicOrigin } from "../../public-url-B5a0QAh6.mjs";
 
 //#region src/astro/routes/sitemap.xml.ts
 const prerender = false;

package/dist/astro/types.d.mts

@@ -1,20 +1,20 @@
-import { r as ContentFieldFilters } from "../content-list-query-B6P37Ug_.mjs";
-import { a as CollectionWithFields } from "../types-Bs4bi95j.mjs";
-import { i as ContentItem } from "../types-B8sF_kE5.mjs";
-import { d as ContentResponse, u as ContentListResponse } from "../parse-BPblgoa-.mjs";
-import { t as Database } from "../types-ibtP7GEA.mjs";
-import { It as PageFragmentContribution, Sn as ResolvedPlugin, dn as PublicPageContext, en as PluginEditorAction, k as ContentActionOrigin, nn as PluginEditorPanel, t as ActorInfo, zt as PageMetadataContribution } from "../types-BYVIYOlD.mjs";
-import "../options-DRF6dlXY.mjs";
-import "../entry-lock-DY8B-xcr.mjs";
-import { f as MediaProvider, p as MediaProviderCapabilities } from "../placeholder-Bez2282x.mjs";
-import { Ar as EmDashConfig, Dr as RouteCallerInput, Er as PluginContentCacheInvalidator, Or as RouteMeta, Sr as SandboxedPluginEntry, Xr as MediaListResponse, Zr as MediaResponse, br as ResolvedPluginEditorExtension, t as ManifestRegistryConfigurationError, yr as PluginEditorExtensionDispatch } from "../config-BCM5sQP7.mjs";
-import "../runner-CWl76CH3.mjs";
-import { $ as MediaItem, J as HookPipeline, q as EmailPipeline, x as SandboxRunner } from "../storage-query-CdVF2bng.mjs";
-import "../index-xCy3j0f6.mjs";
-import { d as Storage } from "../types-MN9bOQ1g.mjs";
-import "../types-Dr1LVwL7.mjs";
-import "../hreflang-uIBOE5yg.mjs";
-import "../validate-Df09inbC.mjs";
+import { r as ContentFieldFilters } from "../content-list-query-DiNwyKtd.mjs";
+import { a as CollectionWithFields } from "../types-CLTQ9b_r.mjs";
+import { i as ContentItem } from "../types-LtS0SM4F.mjs";
+import { d as ContentResponse, u as ContentListResponse } from "../parse-QVS0t5oR.mjs";
+import { t as Database } from "../types-ifgOkcBa.mjs";
+import { Bt as PageMetadataContribution, Cn as ResolvedPlugin, Lt as PageFragmentContribution, fn as PublicPageContext, k as ContentActionOrigin, rn as PluginEditorPanel, t as ActorInfo, tn as PluginEditorAction } from "../types-BT1p3uyb.mjs";
+import "../options-B41aLm1I.mjs";
+import "../entry-lock-esmMbgI9.mjs";
+import { f as MediaProvider, p as MediaProviderCapabilities } from "../placeholder-Dn7MMdWr.mjs";
+import { Cr as SandboxedPluginEntry, Dr as PluginContentCacheInvalidator, Or as RouteCallerInput, Qr as MediaResponse, Zr as MediaListResponse, br as PluginEditorExtensionDispatch, jr as EmDashConfig, kr as RouteMeta, t as ManifestRegistryConfigurationError, xr as ResolvedPluginEditorExtension } from "../config-B6BDSsz2.mjs";
+import "../runner-J3Cj6DGk.mjs";
+import { $ as MediaItem, J as HookPipeline, q as EmailPipeline, x as SandboxRunner } from "../storage-query-C7iy6eUb.mjs";
+import "../index-B4sIdCAT.mjs";
+import { d as Storage } from "../types-CQLvuXoZ.mjs";
+import "../types-CV5xszpF.mjs";
+import "../hreflang-egumj6WF.mjs";
+import "../validate-CfQ9_YlD.mjs";
 import "../index.mjs";
 import { Kysely } from "kysely";
 import * as zod from "zod";

package/dist/audit-CCH3MA4Y.mjs

@@ -0,0 +1,127 @@
+import { c as encodeCursor, s as decodeCursor } from "./types-C-Xp0CcN.mjs";
+import { ulid } from "ulidx";
+
+//#region src/database/repositories/audit.ts
+/**
+* Audit repository for logging system events
+*
+* Tracks user actions for security, debugging, and compliance.
+* All mutations should create an audit log entry.
+*/
+var AuditRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	/**
+	* Create an audit log entry
+	*/
+	async log(input) {
+		const id = ulid();
+		const row = {
+			id,
+			actor_id: input.actorId ?? null,
+			actor_ip: input.actorIp ?? null,
+			action: input.action,
+			resource_type: input.resourceType ?? null,
+			resource_id: input.resourceId ?? null,
+			details: input.details ? JSON.stringify(input.details) : null,
+			status: input.status ?? null
+		};
+		await this.db.insertInto("audit_logs").values(row).execute();
+		const log = await this.findById(id);
+		if (!log) throw new Error("Failed to create audit log");
+		return log;
+	}
+	/**
+	* Find audit log by ID
+	*/
+	async findById(id) {
+		const row = await this.db.selectFrom("audit_logs").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? this.rowToAuditLog(row) : null;
+	}
+	/**
+	* Query audit logs with filters and cursor-based pagination
+	*/
+	async findMany(query = {}) {
+		const limit = Math.min(Math.max(1, query.limit || 50), 100);
+		let q = this.db.selectFrom("audit_logs").selectAll().orderBy("timestamp", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
+		if (query.action) q = q.where("action", "=", query.action);
+		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
+		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
+		if (query.status) q = q.where("status", "=", query.status);
+		if (query.since) q = q.where("timestamp", ">=", query.since);
+		if (query.until) q = q.where("timestamp", "<=", query.until);
+		if (query.cursor) {
+			const decoded = decodeCursor(query.cursor);
+			q = q.where((eb) => eb.or([eb("timestamp", "<", decoded.orderValue), eb.and([eb("timestamp", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		const rows = await q.execute();
+		const items = rows.slice(0, limit).map((row) => this.rowToAuditLog(row));
+		const result = { items };
+		if (rows.length > limit && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.timestamp, last.id);
+		}
+		return result;
+	}
+	/**
+	* Get all logs for a specific resource
+	*/
+	async findByResource(resourceType, resourceId, options = {}) {
+		let query = this.db.selectFrom("audit_logs").selectAll().where("resource_type", "=", resourceType).where("resource_id", "=", resourceId).orderBy("timestamp", "desc");
+		if (options.limit) query = query.limit(options.limit);
+		return (await query.execute()).map((row) => this.rowToAuditLog(row));
+	}
+	/**
+	* Get all logs for a specific user
+	*/
+	async findByActor(actorId, options = {}) {
+		let query = this.db.selectFrom("audit_logs").selectAll().where("actor_id", "=", actorId).orderBy("timestamp", "desc");
+		if (options.since) query = query.where("timestamp", ">=", options.since);
+		if (options.limit) query = query.limit(options.limit);
+		return (await query.execute()).map((row) => this.rowToAuditLog(row));
+	}
+	/**
+	* Count logs matching a query
+	*/
+	async count(query = {}) {
+		let q = this.db.selectFrom("audit_logs").select((eb) => eb.fn.count("id").as("count"));
+		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
+		if (query.action) q = q.where("action", "=", query.action);
+		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
+		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
+		if (query.status) q = q.where("status", "=", query.status);
+		if (query.since) q = q.where("timestamp", ">=", query.since);
+		if (query.until) q = q.where("timestamp", "<=", query.until);
+		const result = await q.executeTakeFirst();
+		return Number(result?.count || 0);
+	}
+	/**
+	* Delete old audit logs (for retention policy)
+	*/
+	async deleteOlderThan(date) {
+		const result = await this.db.deleteFrom("audit_logs").where("timestamp", "<", date).executeTakeFirst();
+		return Number(result.numDeletedRows ?? 0);
+	}
+	/**
+	* Convert database row to AuditLog object
+	*/
+	rowToAuditLog(row) {
+		return {
+			id: row.id,
+			timestamp: row.timestamp,
+			actorId: row.actor_id,
+			actorIp: row.actor_ip,
+			action: row.action,
+			resourceType: row.resource_type,
+			resourceId: row.resource_id,
+			details: row.details ? JSON.parse(row.details) : null,
+			status: row.status
+		};
+	}
+};
+
+//#endregion
+export { AuditRepository as t };
+//# sourceMappingURL=audit-CCH3MA4Y.mjs.map

package/dist/audit-CCH3MA4Y.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-CCH3MA4Y.mjs","names":[],"sources":["../src/database/repositories/audit.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport type { Database, AuditLogTable } from \"../types.js\";\nimport { encodeCursor, decodeCursor, type FindManyResult } from \"./types.js\";\n\nexport type AuditAction =\n\t| \"create\"\n\t| \"update\"\n\t| \"delete\"\n\t| \"publish\"\n\t| \"unpublish\"\n\t| \"login\"\n\t| \"logout\"\n\t| \"password_change\"\n\t| \"settings_update\"\n\t| \"schema_change\"\n\t| \"plugin_tool_invoke\"\n\t| \"transfer_export_create\"\n\t| \"transfer_import_create\"\n\t| \"transfer_import_execute\"\n\t| \"transfer_import_cancel\"\n\t| \"transfer_import_abandon\"\n\t| \"transfer_import_complete\"\n\t| \"transfer_import_fail\"\n\t| \"transfer_approval_approve\"\n\t| \"transfer_approval_deny\";\n\nexport type AuditStatus = \"success\" | \"failure\" | \"denied\";\n\nexport interface AuditLog {\n\tid: string;\n\ttimestamp: string;\n\tactorId: string | null;\n\tactorIp: string | null;\n\taction: AuditAction;\n\tresourceType: string | null;\n\tresourceId: string | null;\n\tdetails: Record<string, unknown> | null;\n\tstatus: AuditStatus | null;\n}\n\nexport interface CreateAuditLogInput {\n\tactorId?: string;\n\tactorIp?: string;\n\taction: AuditAction;\n\tresourceType?: string;\n\tresourceId?: string;\n\tdetails?: Record<string, unknown>;\n\tstatus?: AuditStatus;\n}\n\nexport interface AuditLogQuery {\n\tactorId?: string;\n\taction?: AuditAction;\n\tresourceType?: string;\n\tresourceId?: string;\n\tstatus?: AuditStatus;\n\tsince?: string; // ISO date\n\tuntil?: string; // ISO date\n\tlimit?: number;\n\tcursor?: string;\n}\n\n/**\n * Audit repository for logging system events\n *\n * Tracks user actions for security, debugging, and compliance.\n * All mutations should create an audit log entry.\n */\nexport class AuditRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\t/**\n\t * Create an audit log entry\n\t */\n\tasync log(input: CreateAuditLogInput): Promise<AuditLog> {\n\t\tconst id = ulid();\n\n\t\tconst row: Omit<AuditLogTable, \"timestamp\"> = {\n\t\t\tid,\n\t\t\tactor_id: input.actorId ?? null,\n\t\t\tactor_ip: input.actorIp ?? null,\n\t\t\taction: input.action,\n\t\t\tresource_type: input.resourceType ?? null,\n\t\t\tresource_id: input.resourceId ?? null,\n\t\t\tdetails: input.details ? JSON.stringify(input.details) : null,\n\t\t\tstatus: input.status ?? null,\n\t\t};\n\n\t\tawait this.db.insertInto(\"audit_logs\").values(row).execute();\n\n\t\tconst log = await this.findById(id);\n\t\tif (!log) {\n\t\t\tthrow new Error(\"Failed to create audit log\");\n\t\t}\n\t\treturn log;\n\t}\n\n\t/**\n\t * Find audit log by ID\n\t */\n\tasync findById(id: string): Promise<AuditLog | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\n\t\treturn row ? this.rowToAuditLog(row) : null;\n\t}\n\n\t/**\n\t * Query audit logs with filters and cursor-based pagination\n\t */\n\tasync findMany(query: AuditLogQuery = {}): Promise<FindManyResult<AuditLog>> {\n\t\tconst limit = Math.min(Math.max(1, query.limit || 50), 100);\n\n\t\tlet q = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"timestamp\", \"desc\")\n\t\t\t.orderBy(\"id\", \"desc\")\n\t\t\t.limit(limit + 1);\n\n\t\tif (query.actorId) {\n\t\t\tq = q.where(\"actor_id\", \"=\", query.actorId);\n\t\t}\n\n\t\tif (query.action) {\n\t\t\tq = q.where(\"action\", \"=\", query.action);\n\t\t}\n\n\t\tif (query.resourceType) {\n\t\t\tq = q.where(\"resource_type\", \"=\", query.resourceType);\n\t\t}\n\n\t\tif (query.resourceId) {\n\t\t\tq = q.where(\"resource_id\", \"=\", query.resourceId);\n\t\t}\n\n\t\tif (query.status) {\n\t\t\tq = q.where(\"status\", \"=\", query.status);\n\t\t}\n\n\t\tif (query.since) {\n\t\t\tq = q.where(\"timestamp\", \">=\", query.since);\n\t\t}\n\n\t\tif (query.until) {\n\t\t\tq = q.where(\"timestamp\", \"<=\", query.until);\n\t\t}\n\n\t\tif (query.cursor) {\n\t\t\tconst decoded = decodeCursor(query.cursor);\n\t\t\tq = q.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"timestamp\", \"<\", decoded.orderValue),\n\t\t\t\t\teb.and([eb(\"timestamp\", \"=\", decoded.orderValue), eb(\"id\", \"<\", decoded.id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tconst rows = await q.execute();\n\t\tconst items = rows.slice(0, limit).map((row) => this.rowToAuditLog(row));\n\t\tconst result: FindManyResult<AuditLog> = { items };\n\n\t\tif (rows.length > limit && items.length > 0) {\n\t\t\tconst last = items.at(-1)!;\n\t\t\tresult.nextCursor = encodeCursor(last.timestamp, last.id);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Get all logs for a specific resource\n\t */\n\tasync findByResource(\n\t\tresourceType: string,\n\t\tresourceId: string,\n\t\toptions: { limit?: number } = {},\n\t): Promise<AuditLog[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"resource_type\", \"=\", resourceType)\n\t\t\t.where(\"resource_id\", \"=\", resourceId)\n\t\t\t.orderBy(\"timestamp\", \"desc\");\n\n\t\tif (options.limit) {\n\t\t\tquery = query.limit(options.limit);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToAuditLog(row));\n\t}\n\n\t/**\n\t * Get all logs for a specific user\n\t */\n\tasync findByActor(\n\t\tactorId: string,\n\t\toptions: { limit?: number; since?: string } = {},\n\t): Promise<AuditLog[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"actor_id\", \"=\", actorId)\n\t\t\t.orderBy(\"timestamp\", \"desc\");\n\n\t\tif (options.since) {\n\t\t\tquery = query.where(\"timestamp\", \">=\", options.since);\n\t\t}\n\n\t\tif (options.limit) {\n\t\t\tquery = query.limit(options.limit);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToAuditLog(row));\n\t}\n\n\t/**\n\t * Count logs matching a query\n\t */\n\tasync count(query: Omit<AuditLogQuery, \"limit\" | \"cursor\"> = {}): Promise<number> {\n\t\tlet q = this.db.selectFrom(\"audit_logs\").select((eb) => eb.fn.count(\"id\").as(\"count\"));\n\n\t\tif (query.actorId) {\n\t\t\tq = q.where(\"actor_id\", \"=\", query.actorId);\n\t\t}\n\n\t\tif (query.action) {\n\t\t\tq = q.where(\"action\", \"=\", query.action);\n\t\t}\n\n\t\tif (query.resourceType) {\n\t\t\tq = q.where(\"resource_type\", \"=\", query.resourceType);\n\t\t}\n\n\t\tif (query.resourceId) {\n\t\t\tq = q.where(\"resource_id\", \"=\", query.resourceId);\n\t\t}\n\n\t\tif (query.status) {\n\t\t\tq = q.where(\"status\", \"=\", query.status);\n\t\t}\n\n\t\tif (query.since) {\n\t\t\tq = q.where(\"timestamp\", \">=\", query.since);\n\t\t}\n\n\t\tif (query.until) {\n\t\t\tq = q.where(\"timestamp\", \"<=\", query.until);\n\t\t}\n\n\t\tconst result = await q.executeTakeFirst();\n\t\treturn Number(result?.count || 0);\n\t}\n\n\t/**\n\t * Delete old audit logs (for retention policy)\n\t */\n\tasync deleteOlderThan(date: string): Promise<number> {\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"audit_logs\")\n\t\t\t.where(\"timestamp\", \"<\", date)\n\t\t\t.executeTakeFirst();\n\n\t\treturn Number(result.numDeletedRows ?? 0);\n\t}\n\n\t/**\n\t * Convert database row to AuditLog object\n\t */\n\tprivate rowToAuditLog(row: {\n\t\tid: string;\n\t\ttimestamp: string;\n\t\tactor_id: string | null;\n\t\tactor_ip: string | null;\n\t\taction: string;\n\t\tresource_type: string | null;\n\t\tresource_id: string | null;\n\t\tdetails: string | null;\n\t\tstatus: string | null;\n\t}): AuditLog {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttimestamp: row.timestamp,\n\t\t\tactorId: row.actor_id,\n\t\t\tactorIp: row.actor_ip,\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- DB stores string; validated at insert but linter can't follow\n\t\t\taction: row.action as AuditAction,\n\t\t\tresourceType: row.resource_type,\n\t\t\tresourceId: row.resource_id,\n\t\t\tdetails: row.details ? JSON.parse(row.details) : null,\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- DB stores string; validated at insert but linter can't follow\n\t\t\tstatus: row.status as AuditStatus | null,\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;AAsEA,IAAa,kBAAb,MAA6B;CAC5B,YAAY,AAAQ,IAAsB;EAAtB;;;;;CAKpB,MAAM,IAAI,OAA+C;EACxD,MAAM,KAAK,MAAM;EAEjB,MAAM,MAAwC;GAC7C;GACA,UAAU,MAAM,WAAW;GAC3B,UAAU,MAAM,WAAW;GAC3B,QAAQ,MAAM;GACd,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,cAAc;GACjC,SAAS,MAAM,UAAU,KAAK,UAAU,MAAM,QAAQ,GAAG;GACzD,QAAQ,MAAM,UAAU;GACxB;AAED,QAAM,KAAK,GAAG,WAAW,aAAa,CAAC,OAAO,IAAI,CAAC,SAAS;EAE5D,MAAM,MAAM,MAAM,KAAK,SAAS,GAAG;AACnC,MAAI,CAAC,IACJ,OAAM,IAAI,MAAM,6BAA6B;AAE9C,SAAO;;;;;CAMR,MAAM,SAAS,IAAsC;EACpD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AAEpB,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;CAMxC,MAAM,SAAS,QAAuB,EAAE,EAAqC;EAC5E,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,SAAS,GAAG,EAAE,IAAI;EAE3D,IAAI,IAAI,KAAK,GACX,WAAW,aAAa,CACxB,WAAW,CACX,QAAQ,aAAa,OAAO,CAC5B,QAAQ,MAAM,OAAO,CACrB,MAAM,QAAQ,EAAE;AAElB,MAAI,MAAM,QACT,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,QAAQ;AAG5C,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,aACT,KAAI,EAAE,MAAM,iBAAiB,KAAK,MAAM,aAAa;AAGtD,MAAI,MAAM,WACT,KAAI,EAAE,MAAM,eAAe,KAAK,MAAM,WAAW;AAGlD,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,QAAQ;GACjB,MAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,OAAI,EAAE,OAAO,OACZ,GAAG,GAAG,CACL,GAAG,aAAa,KAAK,QAAQ,WAAW,EACxC,GAAG,IAAI,CAAC,GAAG,aAAa,KAAK,QAAQ,WAAW,EAAE,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,CAC7E,CAAC,CACF;;EAGF,MAAM,OAAO,MAAM,EAAE,SAAS;EAC9B,MAAM,QAAQ,KAAK,MAAM,GAAG,MAAM,CAAC,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;EACxE,MAAM,SAAmC,EAAE,OAAO;AAElD,MAAI,KAAK,SAAS,SAAS,MAAM,SAAS,GAAG;GAC5C,MAAM,OAAO,MAAM,GAAG,GAAG;AACzB,UAAO,aAAa,aAAa,KAAK,WAAW,KAAK,GAAG;;AAG1D,SAAO;;;;;CAMR,MAAM,eACL,cACA,YACA,UAA8B,EAAE,EACV;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,iBAAiB,KAAK,aAAa,CACzC,MAAM,eAAe,KAAK,WAAW,CACrC,QAAQ,aAAa,OAAO;AAE9B,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,QAAQ,MAAM;AAInC,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;CAMlD,MAAM,YACL,SACA,UAA8C,EAAE,EAC1B;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,YAAY,KAAK,QAAQ,CAC/B,QAAQ,aAAa,OAAO;AAE9B,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,aAAa,MAAM,QAAQ,MAAM;AAGtD,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,QAAQ,MAAM;AAInC,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;CAMlD,MAAM,MAAM,QAAiD,EAAE,EAAmB;EACjF,IAAI,IAAI,KAAK,GAAG,WAAW,aAAa,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC;AAEtF,MAAI,MAAM,QACT,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,QAAQ;AAG5C,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,aACT,KAAI,EAAE,MAAM,iBAAiB,KAAK,MAAM,aAAa;AAGtD,MAAI,MAAM,WACT,KAAI,EAAE,MAAM,eAAe,KAAK,MAAM,WAAW;AAGlD,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;EAG5C,MAAM,SAAS,MAAM,EAAE,kBAAkB;AACzC,SAAO,OAAO,QAAQ,SAAS,EAAE;;;;;CAMlC,MAAM,gBAAgB,MAA+B;EACpD,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,aAAa,CACxB,MAAM,aAAa,KAAK,KAAK,CAC7B,kBAAkB;AAEpB,SAAO,OAAO,OAAO,kBAAkB,EAAE;;;;;CAM1C,AAAQ,cAAc,KAUT;AACZ,SAAO;GACN,IAAI,IAAI;GACR,WAAW,IAAI;GACf,SAAS,IAAI;GACb,SAAS,IAAI;GAEb,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB,YAAY,IAAI;GAChB,SAAS,IAAI,UAAU,KAAK,MAAM,IAAI,QAAQ,GAAG;GAEjD,QAAQ,IAAI;GACZ"}

package/dist/auth/providers/github.d.mts

@@ -1,4 +1,4 @@
-import { r as AuthProviderDescriptor } from "../../types-CGuODCZi.mjs";
+import { r as AuthProviderDescriptor } from "../../types-BYaPWs_F.mjs";
 
 //#region src/auth/providers/github.d.ts
 /**

package/dist/auth/providers/google.d.mts

@@ -1,4 +1,4 @@
-import { r as AuthProviderDescriptor } from "../../types-CGuODCZi.mjs";
+import { r as AuthProviderDescriptor } from "../../types-BYaPWs_F.mjs";
 
 //#region src/auth/providers/google.d.ts
 /**

package/dist/auth/providers/microsoft.d.mts

@@ -0,0 +1,27 @@
+import { r as AuthProviderDescriptor } from "../../types-BYaPWs_F.mjs";
+
+//#region src/auth/providers/microsoft.d.ts
+interface MicrosoftProviderOptions {
+  /**
+   * Whether sign-in email addresses count as verified, which EmDash requires
+   * before it links an existing user, accepts an invite, or allows
+   * self-signup. By default, only accounts that sign in through a configured
+   * directory (tenant) ID count as verified, and only for an address in the
+   * domain of their sign-in name or confirmed by the `xms_edov` claim;
+   * accounts homed in another directory or identity provider, such as
+   * guests, and sign-ins through `common`, `organizations` or `consumers`
+   * do not.
+   */
+  emailVerified?: boolean;
+}
+/**
+ * Configure Microsoft Entra ID as an auth provider.
+ *
+ * Requires `EMDASH_OAUTH_MICROSOFT_CLIENT_ID`, `EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET`
+ * and `EMDASH_OAUTH_MICROSOFT_TENANT_ID` (or `MICROSOFT_CLIENT_ID` /
+ * `MICROSOFT_CLIENT_SECRET` / `MICROSOFT_TENANT_ID`) environment variables.
+ */
+declare function microsoft(options?: MicrosoftProviderOptions): AuthProviderDescriptor;
+//#endregion
+export { MicrosoftProviderOptions, microsoft };
+//# sourceMappingURL=microsoft.d.mts.map

package/dist/auth/providers/microsoft.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.d.mts","names":[],"sources":["../../../src/auth/providers/microsoft.ts"],"mappings":";;;UAkBiB,wBAAA;;;;;;;;;;;EAWhB,aAAA;AAAA;;;;;;;;iBAUe,SAAA,CAAU,OAAA,GAAS,wBAAA,GAAgC,sBAAA"}

package/dist/auth/providers/microsoft.mjs

@@ -0,0 +1,20 @@
+//#region src/auth/providers/microsoft.ts
+/**
+* Configure Microsoft Entra ID as an auth provider.
+*
+* Requires `EMDASH_OAUTH_MICROSOFT_CLIENT_ID`, `EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET`
+* and `EMDASH_OAUTH_MICROSOFT_TENANT_ID` (or `MICROSOFT_CLIENT_ID` /
+* `MICROSOFT_CLIENT_SECRET` / `MICROSOFT_TENANT_ID`) environment variables.
+*/
+function microsoft(options = {}) {
+	return {
+		id: "microsoft",
+		label: "Microsoft",
+		config: options,
+		adminEntry: "emdash/auth/providers/microsoft-admin"
+	};
+}
+
+//#endregion
+export { microsoft };
+//# sourceMappingURL=microsoft.mjs.map

package/dist/auth/providers/microsoft.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.mjs","names":[],"sources":["../../../src/auth/providers/microsoft.ts"],"sourcesContent":["/**\n * Microsoft OAuth Auth Provider\n *\n * Returns an AuthProviderDescriptor for Microsoft Entra ID login.\n * Credentials are read from environment variables at runtime.\n *\n * @example\n * ```ts\n * import { microsoft } from \"emdash/auth/providers/microsoft\";\n *\n * emdash({\n *   authProviders: [microsoft()],\n * })\n * ```\n */\n\nimport type { AuthProviderDescriptor } from \"../types.js\";\n\nexport interface MicrosoftProviderOptions {\n\t/**\n\t * Whether sign-in email addresses count as verified, which EmDash requires\n\t * before it links an existing user, accepts an invite, or allows\n\t * self-signup. By default, only accounts that sign in through a configured\n\t * directory (tenant) ID count as verified, and only for an address in the\n\t * domain of their sign-in name or confirmed by the `xms_edov` claim;\n\t * accounts homed in another directory or identity provider, such as\n\t * guests, and sign-ins through `common`, `organizations` or `consumers`\n\t * do not.\n\t */\n\temailVerified?: boolean;\n}\n\n/**\n * Configure Microsoft Entra ID as an auth provider.\n *\n * Requires `EMDASH_OAUTH_MICROSOFT_CLIENT_ID`, `EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET`\n * and `EMDASH_OAUTH_MICROSOFT_TENANT_ID` (or `MICROSOFT_CLIENT_ID` /\n * `MICROSOFT_CLIENT_SECRET` / `MICROSOFT_TENANT_ID`) environment variables.\n */\nexport function microsoft(options: MicrosoftProviderOptions = {}): AuthProviderDescriptor {\n\treturn {\n\t\tid: \"microsoft\",\n\t\tlabel: \"Microsoft\",\n\t\tconfig: options,\n\t\tadminEntry: \"emdash/auth/providers/microsoft-admin\",\n\t};\n}\n"],"mappings":";;;;;;;;AAuCA,SAAgB,UAAU,UAAoC,EAAE,EAA0B;AACzF,QAAO;EACN,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,YAAY;EACZ"}