emdash 1.0.1 → 1.2.0

package/dist/migrations/index.d.mts

@@ -1,4 +1,4 @@
-import { a as MigrationExecutorModule, c as MigrationRequest, i as MigrationExecutorFactoryContext, l as MigrationTarget, n as MigrationExecutor, o as MigrationLockReport, r as MigrationExecutorFactory, s as MigrationReport, t as MigrationAction, u as MigrationTargetOverrides } from "../protocol-FvwLA8P-.mjs";
+import { a as MigrationExecutorModule, c as MigrationRequest, i as MigrationExecutorFactoryContext, l as MigrationTarget, n as MigrationExecutor, o as MigrationLockReport, r as MigrationExecutorFactory, s as MigrationReport, t as MigrationAction, u as MigrationTargetOverrides } from "../protocol-M268ox8L.mjs";
 import { Dialect } from "kysely";
 
 //#region src/migrations/direct-executor.d.ts

package/dist/migrations/index.mjs

@@ -1,8 +1,8 @@
-import "../runner-CLpxmhl8.mjs";
+import "../runner-wqt4BrIW.mjs";
 import "../dialect-helpers-7_IqPdh9.mjs";
 import "../config-CvmjJcVw.mjs";
 import "../datetime-normalization-PeiEdcRY.mjs";
-import { n as fingerprintMigrationSet, r as getCoreMigrationIdentity, t as createCoreMigrationIdentity } from "../identity-DJ-5AcdG.mjs";
-import { t as createDirectMigrationExecutor } from "../direct-executor-Db8xA3zg.mjs";
+import { n as fingerprintMigrationSet, r as getCoreMigrationIdentity, t as createCoreMigrationIdentity } from "../identity-BwBKM1fH.mjs";
+import { t as createDirectMigrationExecutor } from "../direct-executor-BXiYIVJ9.mjs";
 
 export { createCoreMigrationIdentity, createDirectMigrationExecutor, fingerprintMigrationSet, getCoreMigrationIdentity };

package/dist/mime-B5M9R53H.mjs

@@ -0,0 +1,81 @@
+import * as path from "node:path";
+
+//#region src/media/mime.ts
+function normalizeMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase();
+}
+function matchesMimeAllowlist(mime, allowList) {
+	const normalized = normalizeMime(mime);
+	for (const entry of allowList) {
+		if (!entry || !entry.includes("/")) continue;
+		const normalizedEntry = normalizeMime(entry);
+		if (normalizedEntry.endsWith("/")) {
+			if (normalized.startsWith(normalizedEntry)) return true;
+		} else if (normalized === normalizedEntry) return true;
+	}
+	return false;
+}
+const UNKNOWN_UPLOAD_TYPES = new Set(["", "application/octet-stream"]);
+/**
+* Resolve the MIME type for an uploaded file.
+*
+* Browsers that don't recognise an extension (e.g. `.jxl`) often report an
+* empty or generic `application/octet-stream` type. In those cases fall back to
+* the extension map so server-side allowlist checks can still identify allowed
+* formats such as `image/jxl`.
+*/
+function resolveUploadMimeType(filename, fileType) {
+	const normalized = normalizeMime(fileType);
+	if (normalized && !UNKNOWN_UPLOAD_TYPES.has(normalized)) return normalized;
+	return EXTENSION_TO_MIME[path.extname(filename).toLowerCase()] ?? "";
+}
+const EXTENSION_TO_MIME = {
+	".pdf": "application/pdf",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".webp": "image/webp",
+	".avif": "image/avif",
+	".jxl": "image/jxl",
+	".svg": "image/svg+xml",
+	".mp3": "audio/mpeg",
+	".wav": "audio/wav",
+	".mp4": "video/mp4",
+	".webm": "video/webm",
+	".zip": "application/zip",
+	".tar": "application/x-tar",
+	".gz": "application/gzip",
+	".csv": "text/csv",
+	".doc": "application/msword",
+	".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	".xls": "application/vnd.ms-excel",
+	".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	".txt": "text/plain",
+	".rtf": "application/rtf",
+	".vtt": "text/vtt",
+	".srt": "application/x-subrip",
+	".woff": "font/woff",
+	".woff2": "font/woff2"
+};
+/**
+* Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row
+* (raw JSON string). Returns null when the value is missing, malformed, or the
+* list is empty — callers treat that as "no field-specific constraint".
+*/
+function parseAllowedMimeTypes(rawValidation) {
+	if (!rawValidation) return null;
+	try {
+		const parsed = JSON.parse(rawValidation);
+		if (typeof parsed !== "object" || parsed === null) return null;
+		const list = parsed.allowedMimeTypes;
+		if (!Array.isArray(list) || list.length === 0) return null;
+		return list.filter((entry) => typeof entry === "string");
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+export { resolveUploadMimeType as i, normalizeMime as n, parseAllowedMimeTypes as r, matchesMimeAllowlist as t };
+//# sourceMappingURL=mime-B5M9R53H.mjs.map

package/dist/mime-B5M9R53H.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime-B5M9R53H.mjs","names":[],"sources":["../src/media/mime.ts"],"sourcesContent":["import * as path from \"node:path\";\n\nexport function normalizeMime(mime: string): string {\n\treturn mime.split(\";\")[0].trim().toLowerCase();\n}\n\nexport function matchesMimeAllowlist(mime: string, allowList: readonly string[]): boolean {\n\tconst normalized = normalizeMime(mime);\n\tfor (const entry of allowList) {\n\t\tif (!entry || !entry.includes(\"/\")) continue;\n\t\tconst normalizedEntry = normalizeMime(entry);\n\t\tif (normalizedEntry.endsWith(\"/\")) {\n\t\t\tif (normalized.startsWith(normalizedEntry)) return true;\n\t\t} else if (normalized === normalizedEntry) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\nconst UNKNOWN_UPLOAD_TYPES = new Set([\"\", \"application/octet-stream\"]);\n\n/**\n * Resolve the MIME type for an uploaded file.\n *\n * Browsers that don't recognise an extension (e.g. `.jxl`) often report an\n * empty or generic `application/octet-stream` type. In those cases fall back to\n * the extension map so server-side allowlist checks can still identify allowed\n * formats such as `image/jxl`.\n */\nexport function resolveUploadMimeType(filename: string, fileType: string): string {\n\tconst normalized = normalizeMime(fileType);\n\tif (normalized && !UNKNOWN_UPLOAD_TYPES.has(normalized)) {\n\t\treturn normalized;\n\t}\n\treturn EXTENSION_TO_MIME[path.extname(filename).toLowerCase()] ?? \"\";\n}\n\nexport const EXTENSION_TO_MIME: Readonly<Record<string, string>> = {\n\t\".pdf\": \"application/pdf\",\n\t\".png\": \"image/png\",\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".gif\": \"image/gif\",\n\t\".webp\": \"image/webp\",\n\t\".avif\": \"image/avif\",\n\t\".jxl\": \"image/jxl\",\n\t\".svg\": \"image/svg+xml\",\n\t\".mp3\": \"audio/mpeg\",\n\t\".wav\": \"audio/wav\",\n\t\".mp4\": \"video/mp4\",\n\t\".webm\": \"video/webm\",\n\t\".zip\": \"application/zip\",\n\t\".tar\": \"application/x-tar\",\n\t\".gz\": \"application/gzip\",\n\t\".csv\": \"text/csv\",\n\t\".doc\": \"application/msword\",\n\t\".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n\t\".xls\": \"application/vnd.ms-excel\",\n\t\".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n\t\".txt\": \"text/plain\",\n\t\".rtf\": \"application/rtf\",\n\t\".vtt\": \"text/vtt\",\n\t\".srt\": \"application/x-subrip\",\n\t\".woff\": \"font/woff\",\n\t\".woff2\": \"font/woff2\",\n};\n\nconst VALID_MIME_RE = /^[a-z0-9][a-z0-9!#$&^_+\\-.]*\\/[a-z0-9!#$&^_+\\-.]*$/i;\n\nexport function expandExtensionShorthand(entry: string): string | null {\n\tconst trimmed = entry.trim();\n\tif (!trimmed) return null;\n\tif (trimmed.includes(\"/\")) return VALID_MIME_RE.test(trimmed) ? trimmed : null;\n\tif (trimmed.startsWith(\".\")) {\n\t\treturn EXTENSION_TO_MIME[trimmed.toLowerCase()] ?? null;\n\t}\n\treturn null;\n}\n\n/**\n * Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row\n * (raw JSON string). Returns null when the value is missing, malformed, or the\n * list is empty — callers treat that as \"no field-specific constraint\".\n */\nexport function parseAllowedMimeTypes(rawValidation: string | null | undefined): string[] | null {\n\tif (!rawValidation) return null;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(rawValidation);\n\t\tif (typeof parsed !== \"object\" || parsed === null) return null;\n\t\tconst list = (parsed as { allowedMimeTypes?: unknown }).allowedMimeTypes;\n\t\tif (!Array.isArray(list) || list.length === 0) return null;\n\t\treturn list.filter((entry): entry is string => typeof entry === \"string\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;AAEA,SAAgB,cAAc,MAAsB;AACnD,QAAO,KAAK,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa;;AAG/C,SAAgB,qBAAqB,MAAc,WAAuC;CACzF,MAAM,aAAa,cAAc,KAAK;AACtC,MAAK,MAAM,SAAS,WAAW;AAC9B,MAAI,CAAC,SAAS,CAAC,MAAM,SAAS,IAAI,CAAE;EACpC,MAAM,kBAAkB,cAAc,MAAM;AAC5C,MAAI,gBAAgB,SAAS,IAAI,EAChC;OAAI,WAAW,WAAW,gBAAgB,CAAE,QAAO;aACzC,eAAe,gBACzB,QAAO;;AAGT,QAAO;;AAGR,MAAM,uBAAuB,IAAI,IAAI,CAAC,IAAI,2BAA2B,CAAC;;;;;;;;;AAUtE,SAAgB,sBAAsB,UAAkB,UAA0B;CACjF,MAAM,aAAa,cAAc,SAAS;AAC1C,KAAI,cAAc,CAAC,qBAAqB,IAAI,WAAW,CACtD,QAAO;AAER,QAAO,kBAAkB,KAAK,QAAQ,SAAS,CAAC,aAAa,KAAK;;AAGnE,MAAa,oBAAsD;CAClE,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,UAAU;CACV;;;;;;AAmBD,SAAgB,sBAAsB,eAA2D;AAChG,KAAI,CAAC,cAAe,QAAO;AAC3B,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,cAAc;AACjD,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;EAC1D,MAAM,OAAQ,OAA0C;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,WAAW,EAAG,QAAO;AACtD,SAAO,KAAK,QAAQ,UAA2B,OAAO,UAAU,SAAS;SAClE;AACP,SAAO"}

package/dist/mode-eieqAWLe.mjs

@@ -0,0 +1,23 @@
+//#region src/auth/mode.ts
+/**
+* Determine the active auth mode from config.
+*
+* Accepts `EmDashConfig` (or subtype) — checks for `auth` field via duck typing.
+*
+* @param config EmDash configuration
+* @returns The active auth mode
+*/
+function getAuthMode(config) {
+	const auth = config?.auth;
+	if (auth && "entrypoint" in auth && auth.entrypoint) return {
+		type: "external",
+		providerType: auth.type,
+		entrypoint: auth.entrypoint,
+		config: auth.config
+	};
+	return { type: "passkey" };
+}
+
+//#endregion
+export { getAuthMode as t };
+//# sourceMappingURL=mode-eieqAWLe.mjs.map

package/dist/mode-eieqAWLe.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-eieqAWLe.mjs","names":[],"sources":["../src/auth/mode.ts"],"sourcesContent":["/**\n * Auth Mode Detection\n *\n * Determines which authentication provider is active based on config.\n * Supports both passkey (default) and external auth providers via AuthDescriptor.\n */\n\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\nimport type {\n\tAuthDescriptor,\n\tAuthProviderDescriptor,\n\tAuthRouteDescriptor,\n\tAuthResult,\n\tExternalAuthConfig,\n} from \"./types.js\";\n\nexport type {\n\tAuthDescriptor,\n\tAuthProviderDescriptor,\n\tAuthRouteDescriptor,\n\tAuthResult,\n\tExternalAuthConfig,\n};\n\n/**\n * Passkey auth mode (default)\n */\nexport interface PasskeyAuthMode {\n\ttype: \"passkey\";\n}\n\n/**\n * External auth provider mode (Cloudflare Access, etc.)\n */\nexport interface ExternalAuthMode {\n\ttype: \"external\";\n\t/** Provider type identifier (e.g., \"cloudflare-access\") */\n\tproviderType: string;\n\t/** Module to import for authentication */\n\tentrypoint: string;\n\t/** Provider-specific configuration */\n\tconfig: unknown;\n}\n\n/**\n * Union of all auth modes\n */\nexport type AuthMode = PasskeyAuthMode | ExternalAuthMode;\n\n/**\n * Extended config type with auth.\n *\n * This is the same as `EmDashConfig` with an optional `auth` field.\n * Kept for backwards compatibility — prefer `EmDashConfig` in new code\n * since `getAuthMode` now accepts `EmDashConfig` directly.\n */\nexport interface EmDashConfigWithAuth extends EmDashConfig {\n\tauth?: AuthDescriptor;\n}\n\n/**\n * Determine the active auth mode from config.\n *\n * Accepts `EmDashConfig` (or subtype) — checks for `auth` field via duck typing.\n *\n * @param config EmDash configuration\n * @returns The active auth mode\n */\nexport function getAuthMode(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): AuthMode {\n\tconst auth = config?.auth;\n\n\t// Check for AuthDescriptor (transparent external auth like Cloudflare Access)\n\tif (auth && \"entrypoint\" in auth && auth.entrypoint) {\n\t\treturn {\n\t\t\ttype: \"external\",\n\t\t\tproviderType: auth.type,\n\t\t\tentrypoint: auth.entrypoint,\n\t\t\tconfig: auth.config,\n\t\t};\n\t}\n\n\t// Default to passkey\n\treturn { type: \"passkey\" };\n}\n\n/**\n * Check if an external auth provider is active\n */\nexport function isExternalAuthEnabled(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): boolean {\n\treturn getAuthMode(config).type === \"external\";\n}\n\n/**\n * Get external auth config if enabled\n */\nexport function getExternalAuthConfig(\n\tconfig: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,\n): ExternalAuthMode | null {\n\tconst mode = getAuthMode(config);\n\tif (mode.type === \"external\") {\n\t\treturn mode;\n\t}\n\treturn null;\n}\n"],"mappings":";;;;;;;;;AAoEA,SAAgB,YACf,QACW;CACX,MAAM,OAAO,QAAQ;AAGrB,KAAI,QAAQ,gBAAgB,QAAQ,KAAK,WACxC,QAAO;EACN,MAAM;EACN,cAAc,KAAK;EACnB,YAAY,KAAK;EACjB,QAAQ,KAAK;EACb;AAIF,QAAO,EAAE,MAAM,WAAW"}

package/dist/node-sqlite-compat-VuyzJw1b.mjs

@@ -0,0 +1,63 @@
+import { DatabaseSync } from "node:sqlite";
+
+//#region src/db/node-sqlite-compat.ts
+function openNodeSqliteDatabase(path, options = {}) {
+	return new NodeSqliteCompatDatabase(path, options);
+}
+var NodeSqliteCompatDatabase = class {
+	#database;
+	constructor(path, options = {}) {
+		const database = new DatabaseSync(path, { readOnly: options.readOnly });
+		this.#database = database;
+		try {
+			database.exec("PRAGMA busy_timeout = 5000");
+			database.exec("PRAGMA foreign_keys = ON");
+			database.exec("PRAGMA cache_size = -16000");
+			if (options.journalMode === "wal" && !options.readOnly) database.exec("PRAGMA journal_mode = WAL");
+			if (database.prepare("PRAGMA journal_mode").get()?.["journal_mode"] === "wal") database.exec("PRAGMA synchronous = NORMAL");
+		} catch (error) {
+			try {
+				database.close();
+			} catch {
+				throw new Error("SQLite setup failed and the connection could not be closed", { cause: error });
+			}
+			throw error;
+		}
+	}
+	get open() {
+		return this.#database.isOpen;
+	}
+	close() {
+		if (this.#database.isOpen) this.#database.close();
+	}
+	exec(sql) {
+		this.#database.exec(sql);
+	}
+	prepare(sql) {
+		const statement = this.#database.prepare(sql);
+		return {
+			reader: statement.columns().length > 0,
+			all: (...parameters) => statement.all(...toBindings(normalizeParameters(parameters))),
+			get: (...parameters) => statement.get(...toBindings(normalizeParameters(parameters))),
+			run: (...parameters) => statement.run(...toBindings(normalizeParameters(parameters))),
+			iterate: (...parameters) => statement.iterate(...toBindings(normalizeParameters(parameters)))
+		};
+	}
+};
+function normalizeParameters(parameters) {
+	return parameters.length === 1 && Array.isArray(parameters[0]) ? parameters[0] : parameters;
+}
+function toBindings(parameters) {
+	return parameters.map((value) => {
+		if (value === null || typeof value === "string" || typeof value === "number") return value;
+		if (typeof value === "bigint") return value;
+		if (typeof value === "boolean") return value ? 1 : 0;
+		if (value === void 0) return null;
+		if (value instanceof Uint8Array) return value;
+		throw new TypeError(`Cannot bind ${Object.prototype.toString.call(value)} to SQLite`);
+	});
+}
+
+//#endregion
+export { openNodeSqliteDatabase as t };
+//# sourceMappingURL=node-sqlite-compat-VuyzJw1b.mjs.map

package/dist/node-sqlite-compat-VuyzJw1b.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sqlite-compat-VuyzJw1b.mjs","names":["#database"],"sources":["../src/db/node-sqlite-compat.ts"],"sourcesContent":["import { DatabaseSync } from \"node:sqlite\";\n\nexport interface NodeSqliteCompatStatement {\n\treadonly reader: boolean;\n\tall(parameters: ReadonlyArray<unknown>): unknown[];\n\tall(...parameters: unknown[]): unknown[];\n\tget(parameters: ReadonlyArray<unknown>): unknown;\n\tget(...parameters: unknown[]): unknown;\n\trun(parameters: ReadonlyArray<unknown>): {\n\t\tchanges: number | bigint;\n\t\tlastInsertRowid: number | bigint;\n\t};\n\trun(...parameters: unknown[]): {\n\t\tchanges: number | bigint;\n\t\tlastInsertRowid: number | bigint;\n\t};\n\titerate(parameters: ReadonlyArray<unknown>): IterableIterator<unknown>;\n\titerate(...parameters: unknown[]): IterableIterator<unknown>;\n}\n\nexport interface NodeSqliteOpenOptions {\n\tjournalMode?: \"wal\";\n\treadOnly?: boolean;\n}\n\ntype SqliteBinding = null | number | bigint | string | Uint8Array;\n\nexport function openNodeSqliteDatabase(\n\tpath: string,\n\toptions: NodeSqliteOpenOptions = {},\n): NodeSqliteCompatDatabase {\n\treturn new NodeSqliteCompatDatabase(path, options);\n}\n\nexport class NodeSqliteCompatDatabase {\n\treadonly #database: DatabaseSync;\n\n\tconstructor(path: string, options: NodeSqliteOpenOptions = {}) {\n\t\tconst database = new DatabaseSync(path, { readOnly: options.readOnly });\n\t\tthis.#database = database;\n\n\t\ttry {\n\t\t\tdatabase.exec(\"PRAGMA busy_timeout = 5000\");\n\t\t\tdatabase.exec(\"PRAGMA foreign_keys = ON\");\n\t\t\t// Negative cache_size values are kibibytes.\n\t\t\tdatabase.exec(\"PRAGMA cache_size = -16000\");\n\t\t\tif (options.journalMode === \"wal\" && !options.readOnly) {\n\t\t\t\tdatabase.exec(\"PRAGMA journal_mode = WAL\");\n\t\t\t}\n\t\t\tconst journalMode = database.prepare(\"PRAGMA journal_mode\").get()?.[\"journal_mode\"];\n\t\t\tif (journalMode === \"wal\") {\n\t\t\t\tdatabase.exec(\"PRAGMA synchronous = NORMAL\");\n\t\t\t}\n\t\t} catch (error) {\n\t\t\ttry {\n\t\t\t\tdatabase.close();\n\t\t\t} catch {\n\t\t\t\tthrow new Error(\"SQLite setup failed and the connection could not be closed\", {\n\t\t\t\t\tcause: error,\n\t\t\t\t});\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tget open(): boolean {\n\t\treturn this.#database.isOpen;\n\t}\n\n\tclose(): void {\n\t\tif (this.#database.isOpen) this.#database.close();\n\t}\n\n\texec(sql: string): void {\n\t\tthis.#database.exec(sql);\n\t}\n\n\tprepare(sql: string): NodeSqliteCompatStatement {\n\t\tconst statement = this.#database.prepare(sql);\n\t\treturn {\n\t\t\treader: statement.columns().length > 0,\n\t\t\tall: (...parameters) => statement.all(...toBindings(normalizeParameters(parameters))),\n\t\t\tget: (...parameters) => statement.get(...toBindings(normalizeParameters(parameters))),\n\t\t\trun: (...parameters) => statement.run(...toBindings(normalizeParameters(parameters))),\n\t\t\titerate: (...parameters) => statement.iterate(...toBindings(normalizeParameters(parameters))),\n\t\t};\n\t}\n}\n\nfunction normalizeParameters(parameters: unknown[]): ReadonlyArray<unknown> {\n\treturn parameters.length === 1 && Array.isArray(parameters[0]) ? parameters[0] : parameters;\n}\n\nfunction toBindings(parameters: ReadonlyArray<unknown>): SqliteBinding[] {\n\treturn parameters.map((value) => {\n\t\tif (value === null || typeof value === \"string\" || typeof value === \"number\") {\n\t\t\treturn value;\n\t\t}\n\t\tif (typeof value === \"bigint\") return value;\n\t\tif (typeof value === \"boolean\") return value ? 1 : 0;\n\t\tif (value === undefined) return null;\n\t\tif (value instanceof Uint8Array) return value;\n\t\tthrow new TypeError(`Cannot bind ${Object.prototype.toString.call(value)} to SQLite`);\n\t});\n}\n"],"mappings":";;;AA2BA,SAAgB,uBACf,MACA,UAAiC,EAAE,EACR;AAC3B,QAAO,IAAI,yBAAyB,MAAM,QAAQ;;AAGnD,IAAa,2BAAb,MAAsC;CACrC,CAASA;CAET,YAAY,MAAc,UAAiC,EAAE,EAAE;EAC9D,MAAM,WAAW,IAAI,aAAa,MAAM,EAAE,UAAU,QAAQ,UAAU,CAAC;AACvE,QAAKA,WAAY;AAEjB,MAAI;AACH,YAAS,KAAK,6BAA6B;AAC3C,YAAS,KAAK,2BAA2B;AAEzC,YAAS,KAAK,6BAA6B;AAC3C,OAAI,QAAQ,gBAAgB,SAAS,CAAC,QAAQ,SAC7C,UAAS,KAAK,4BAA4B;AAG3C,OADoB,SAAS,QAAQ,sBAAsB,CAAC,KAAK,GAAG,oBAChD,MACnB,UAAS,KAAK,8BAA8B;WAErC,OAAO;AACf,OAAI;AACH,aAAS,OAAO;WACT;AACP,UAAM,IAAI,MAAM,8DAA8D,EAC7E,OAAO,OACP,CAAC;;AAEH,SAAM;;;CAIR,IAAI,OAAgB;AACnB,SAAO,MAAKA,SAAU;;CAGvB,QAAc;AACb,MAAI,MAAKA,SAAU,OAAQ,OAAKA,SAAU,OAAO;;CAGlD,KAAK,KAAmB;AACvB,QAAKA,SAAU,KAAK,IAAI;;CAGzB,QAAQ,KAAwC;EAC/C,MAAM,YAAY,MAAKA,SAAU,QAAQ,IAAI;AAC7C,SAAO;GACN,QAAQ,UAAU,SAAS,CAAC,SAAS;GACrC,MAAM,GAAG,eAAe,UAAU,IAAI,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GACrF,MAAM,GAAG,eAAe,UAAU,IAAI,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GACrF,MAAM,GAAG,eAAe,UAAU,IAAI,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GACrF,UAAU,GAAG,eAAe,UAAU,QAAQ,GAAG,WAAW,oBAAoB,WAAW,CAAC,CAAC;GAC7F;;;AAIH,SAAS,oBAAoB,YAA+C;AAC3E,QAAO,WAAW,WAAW,KAAK,MAAM,QAAQ,WAAW,GAAG,GAAG,WAAW,KAAK;;AAGlF,SAAS,WAAW,YAAqD;AACxE,QAAO,WAAW,KAAK,UAAU;AAChC,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,SACnE,QAAO;AAER,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,IAAI;AACnD,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,iBAAiB,WAAY,QAAO;AACxC,QAAM,IAAI,UAAU,eAAe,OAAO,UAAU,SAAS,KAAK,MAAM,CAAC,YAAY;GACpF"}

package/dist/oauth-authorization-B6ZJbMd2.mjs

@@ -0,0 +1,274 @@
+import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
+import { i as generatePrefixedToken, o as hashApiToken, s as isValidScope, t as TOKEN_PREFIXES } from "./api-tokens-D2zgAIEt.mjs";
+import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "./oauth-clients-DVjRc9v3.mjs";
+import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-Dz1_R5vT.mjs";
+import { clampScopes, computeS256Challenge, secureCompare } from "@emdash-cms/auth";
+import { generateCodeVerifier } from "arctic";
+
+//#region src/api/handlers/oauth-authorization.ts
+/**
+* OAuth 2.1 Authorization Code + PKCE handlers.
+*
+* Implements the server side of the authorization code grant for MCP clients
+* (Claude Desktop, VS Code, etc.) per the MCP authorization spec (draft).
+*
+* Uses arctic for PKCE challenge generation and @emdash-cms/auth for token
+* utilities. Token infrastructure is shared with the device flow.
+*/
+/** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */
+const AUTH_CODE_TTL_SECONDS = 600;
+/** Access token TTL: 1 hour */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+/** Refresh token TTL: 90 days */
+const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
+function expiresAt(seconds) {
+	return new Date(Date.now() + seconds * 1e3).toISOString();
+}
+/**
+* Validate and normalize scopes. Returns validated scope list.
+*/
+function normalizeScopes(requested) {
+	if (!requested) return [];
+	return requested.split(" ").filter(Boolean).filter(isValidScope);
+}
+/**
+* Process an authorization request after the user approves consent.
+*
+* Generates an authorization code, stores it with the PKCE challenge,
+* and returns the redirect URL with the code appended.
+*
+* Scopes are clamped to the user's role to prevent scope escalation.
+*/
+async function handleAuthorizationApproval(db, userId, userRole, params) {
+	try {
+		if (params.response_type !== "code") return {
+			success: false,
+			error: {
+				code: "UNSUPPORTED_RESPONSE_TYPE",
+				message: "Only response_type=code is supported"
+			}
+		};
+		const uriError = validateRedirectUri(params.redirect_uri);
+		if (uriError) return {
+			success: false,
+			error: {
+				code: "INVALID_REDIRECT_URI",
+				message: uriError
+			}
+		};
+		const client = await lookupOAuthClient(db, params.client_id);
+		if (!client) return {
+			success: false,
+			error: {
+				code: "INVALID_CLIENT",
+				message: "Unknown client_id"
+			}
+		};
+		const clientUriError = validateClientRedirectUri(params.redirect_uri, client.redirectUris);
+		if (clientUriError) return {
+			success: false,
+			error: {
+				code: "INVALID_REDIRECT_URI",
+				message: clientUriError
+			}
+		};
+		if (params.code_challenge_method !== "S256") return {
+			success: false,
+			error: {
+				code: "INVALID_REQUEST",
+				message: "Only S256 code_challenge_method is supported"
+			}
+		};
+		if (!params.code_challenge) return {
+			success: false,
+			error: {
+				code: "INVALID_REQUEST",
+				message: "code_challenge is required"
+			}
+		};
+		const userScopes = clampScopes(normalizeScopes(params.scope), userRole);
+		const clientScopes = client.scopes;
+		const scopes = clientScopes?.length ? userScopes.filter((s) => clientScopes.includes(s)) : userScopes;
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "INVALID_SCOPE",
+				message: "No valid scopes requested"
+			}
+		};
+		const code = generateCodeVerifier();
+		const codeHash = hashApiToken(code);
+		await db.insertInto("_emdash_authorization_codes").values({
+			code_hash: codeHash,
+			client_id: params.client_id,
+			redirect_uri: params.redirect_uri,
+			user_id: userId,
+			scopes: JSON.stringify(scopes),
+			code_challenge: params.code_challenge,
+			code_challenge_method: params.code_challenge_method,
+			resource: params.resource ?? null,
+			expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
+		}).execute();
+		const redirectUrl = new URL(params.redirect_uri);
+		redirectUrl.searchParams.set("code", code);
+		if (params.state) redirectUrl.searchParams.set("state", params.state);
+		return {
+			success: true,
+			data: { redirect_url: redirectUrl.toString() }
+		};
+	} catch (error) {
+		console.error("Authorization error:", error);
+		return {
+			success: false,
+			error: {
+				code: "AUTHORIZATION_ERROR",
+				message: "Failed to process authorization"
+			}
+		};
+	}
+}
+/**
+* Exchange an authorization code for access + refresh tokens.
+*
+* Validates the code, verifies PKCE, and issues tokens using the same
+* infrastructure as the device flow (ec_oat_*, ec_ort_*).
+*/
+async function handleAuthorizationCodeExchange(db, params) {
+	try {
+		if (params.grant_type !== "authorization_code") return {
+			success: false,
+			error: {
+				code: "unsupported_grant_type",
+				message: "Invalid grant_type"
+			}
+		};
+		const codeHash = hashApiToken(params.code);
+		const row = await db.deleteFrom("_emdash_authorization_codes").where("code_hash", "=", codeHash).returningAll().executeTakeFirst();
+		if (!row) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Invalid authorization code"
+			}
+		};
+		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Authorization code expired"
+			}
+		};
+		if (row.redirect_uri !== params.redirect_uri) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "redirect_uri mismatch"
+			}
+		};
+		if (row.client_id !== params.client_id) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "client_id mismatch"
+			}
+		};
+		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "PKCE verification failed"
+			}
+		};
+		if (row.resource && params.resource && row.resource !== params.resource) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "resource mismatch"
+			}
+		};
+		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
+		if (!userInfo) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User not found"
+			}
+		};
+		if (userInfo.disabled) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User account is disabled"
+			}
+		};
+		let scopes = clampScopes(JSON.parse(row.scopes), userInfo.role);
+		const client = await lookupOAuthClient(db, row.client_id);
+		if (client?.scopes?.length) scopes = scopes.filter((s) => client.scopes.includes(s));
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "User role no longer supports any of the requested scopes"
+			}
+		};
+		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
+		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
+		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
+		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
+		await withTransaction(db, async (trx) => {
+			await trx.insertInto("_emdash_oauth_tokens").values({
+				token_hash: accessToken.hash,
+				token_type: "access",
+				user_id: row.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "mcp",
+				expires_at: accessExpires,
+				refresh_token_hash: refreshToken.hash,
+				client_id: row.client_id
+			}).execute();
+			await trx.insertInto("_emdash_oauth_tokens").values({
+				token_hash: refreshToken.hash,
+				token_type: "refresh",
+				user_id: row.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: "mcp",
+				expires_at: refreshExpires,
+				refresh_token_hash: null,
+				client_id: row.client_id
+			}).execute();
+		});
+		return {
+			success: true,
+			data: {
+				access_token: accessToken.raw,
+				refresh_token: refreshToken.raw,
+				token_type: "Bearer",
+				expires_in: ACCESS_TOKEN_TTL_SECONDS,
+				scope: scopes.join(" ")
+			}
+		};
+	} catch (error) {
+		console.error("Token exchange error:", error);
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_EXCHANGE_ERROR",
+				message: "Failed to exchange authorization code"
+			}
+		};
+	}
+}
+/**
+* Build the authorization denied redirect URL.
+*/
+function buildDeniedRedirect(redirectUri, state) {
+	const url = new URL(redirectUri);
+	url.searchParams.set("error", "access_denied");
+	url.searchParams.set("error_description", "The user denied the authorization request");
+	if (state) url.searchParams.set("state", state);
+	return url.toString();
+}
+
+//#endregion
+export { handleAuthorizationApproval as n, handleAuthorizationCodeExchange as r, buildDeniedRedirect as t };
+//# sourceMappingURL=oauth-authorization-B6ZJbMd2.mjs.map

package/dist/oauth-authorization-B6ZJbMd2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-B6ZJbMd2.mjs","names":[],"sources":["../src/api/handlers/oauth-authorization.ts"],"sourcesContent":["/**\n * OAuth 2.1 Authorization Code + PKCE handlers.\n *\n * Implements the server side of the authorization code grant for MCP clients\n * (Claude Desktop, VS Code, etc.) per the MCP authorization spec (draft).\n *\n * Uses arctic for PKCE challenge generation and @emdash-cms/auth for token\n * utilities. Token infrastructure is shared with the device flow.\n */\n\nimport { clampScopes, computeS256Challenge, secureCompare } from \"@emdash-cms/auth\";\nimport type { RoleLevel } from \"@emdash-cms/auth\";\nimport { generateCodeVerifier } from \"arctic\";\nimport type { Kysely } from \"kysely\";\n\nimport {\n\tgeneratePrefixedToken,\n\thashApiToken,\n\tisValidScope,\n\tTOKEN_PREFIXES,\n} from \"../../auth/api-tokens.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { validateRedirectUri } from \"../oauth/redirect-uri.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { lookupOAuthClient, validateClientRedirectUri } from \"./oauth-clients.js\";\nimport { lookupUserRoleAndStatus } from \"./oauth-user-lookup.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */\nconst AUTH_CODE_TTL_SECONDS = 10 * 60;\n\n/** Access token TTL: 1 hour */\nconst ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n\n/** Refresh token TTL: 90 days */\nconst REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface AuthorizationParams {\n\tresponse_type: string;\n\tclient_id: string;\n\tredirect_uri: string;\n\tscope?: string;\n\tstate?: string;\n\tcode_challenge: string;\n\tcode_challenge_method: string;\n\tresource?: string;\n}\n\nexport interface TokenExchangeParams {\n\tgrant_type: string;\n\tcode: string;\n\tredirect_uri: string;\n\tclient_id: string;\n\tcode_verifier: string;\n\tresource?: string;\n}\n\nexport interface TokenResponse {\n\taccess_token: string;\n\trefresh_token: string;\n\ttoken_type: \"Bearer\";\n\texpires_in: number;\n\tscope: string;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction expiresAt(seconds: number): string {\n\treturn new Date(Date.now() + seconds * 1000).toISOString();\n}\n\nexport { validateRedirectUri };\n\n/**\n * Validate and normalize scopes. Returns validated scope list.\n */\nfunction normalizeScopes(requested?: string): string[] {\n\tif (!requested) return [];\n\n\tconst scopes = requested.split(\" \").filter(Boolean).filter(isValidScope);\n\n\treturn scopes;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Process an authorization request after the user approves consent.\n *\n * Generates an authorization code, stores it with the PKCE challenge,\n * and returns the redirect URL with the code appended.\n *\n * Scopes are clamped to the user's role to prevent scope escalation.\n */\nexport async function handleAuthorizationApproval(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tuserRole: RoleLevel,\n\tparams: AuthorizationParams,\n): Promise<ApiResult<{ redirect_url: string }>> {\n\ttry {\n\t\t// Validate response_type\n\t\tif (params.response_type !== \"code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"UNSUPPORTED_RESPONSE_TYPE\",\n\t\t\t\t\tmessage: \"Only response_type=code is supported\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate redirect_uri scheme/host (basic security check)\n\t\tconst uriError = validateRedirectUri(params.redirect_uri);\n\t\tif (uriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REDIRECT_URI\", message: uriError },\n\t\t\t};\n\t\t}\n\n\t\t// Look up the registered OAuth client\n\t\tconst client = await lookupOAuthClient(db, params.client_id);\n\t\tif (!client) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_CLIENT\",\n\t\t\t\t\tmessage: \"Unknown client_id\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate redirect_uri against client's registered URIs\n\t\tconst clientUriError = validateClientRedirectUri(params.redirect_uri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REDIRECT_URI\", message: clientUriError },\n\t\t\t};\n\t\t}\n\n\t\t// Validate code_challenge_method\n\t\tif (params.code_challenge_method !== \"S256\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_REQUEST\",\n\t\t\t\t\tmessage: \"Only S256 code_challenge_method is supported\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate code_challenge is present\n\t\tif (!params.code_challenge) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REQUEST\", message: \"code_challenge is required\" },\n\t\t\t};\n\t\t}\n\n\t\t// Validate scopes, then clamp to user's role\n\t\tconst userScopes = clampScopes(normalizeScopes(params.scope), userRole);\n\n\t\t// SEC-41: Intersect with client's registered scopes (if restricted).\n\t\t// A client registered with scopes: [\"content:read\"] should never receive\n\t\t// admin or schema:write, regardless of the approving user's role.\n\t\tconst clientScopes = client.scopes;\n\t\tconst scopes = clientScopes?.length\n\t\t\t? userScopes.filter((s: string) => clientScopes.includes(s))\n\t\t\t: userScopes;\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_SCOPE\", message: \"No valid scopes requested\" },\n\t\t\t};\n\t\t}\n\n\t\t// Generate authorization code (high entropy, base64url)\n\t\tconst code = generateCodeVerifier(); // 32 bytes random, base64url\n\t\tconst codeHash = hashApiToken(code);\n\n\t\t// Store the authorization code\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_authorization_codes\")\n\t\t\t.values({\n\t\t\t\tcode_hash: codeHash,\n\t\t\t\tclient_id: params.client_id,\n\t\t\t\tredirect_uri: params.redirect_uri,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tcode_challenge: params.code_challenge,\n\t\t\t\tcode_challenge_method: params.code_challenge_method,\n\t\t\t\tresource: params.resource ?? null,\n\t\t\t\texpires_at: expiresAt(AUTH_CODE_TTL_SECONDS),\n\t\t\t})\n\t\t\t.execute();\n\n\t\t// Build the redirect URL\n\t\tconst redirectUrl = new URL(params.redirect_uri);\n\t\tredirectUrl.searchParams.set(\"code\", code);\n\t\tif (params.state) {\n\t\t\tredirectUrl.searchParams.set(\"state\", params.state);\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { redirect_url: redirectUrl.toString() },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Authorization error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORIZATION_ERROR\",\n\t\t\t\tmessage: \"Failed to process authorization\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Exchange an authorization code for access + refresh tokens.\n *\n * Validates the code, verifies PKCE, and issues tokens using the same\n * infrastructure as the device flow (ec_oat_*, ec_ort_*).\n */\nexport async function handleAuthorizationCodeExchange(\n\tdb: Kysely<Database>,\n\tparams: TokenExchangeParams,\n): Promise<ApiResult<TokenResponse>> {\n\ttry {\n\t\t// Validate grant_type\n\t\tif (params.grant_type !== \"authorization_code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"unsupported_grant_type\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\t// SEC-39: Atomically consume the authorization code using DELETE...RETURNING.\n\t\t// This prevents TOCTOU double-exchange: two concurrent requests with the\n\t\t// same code will race on the DELETE, and only one will get a row back.\n\t\tconst codeHash = hashApiToken(params.code);\n\n\t\tconst row = await db\n\t\t\t.deleteFrom(\"_emdash_authorization_codes\")\n\t\t\t.where(\"code_hash\", \"=\", codeHash)\n\t\t\t.returningAll()\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"Invalid authorization code\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < new Date()) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"Authorization code expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify redirect_uri matches exactly\n\t\tif (row.redirect_uri !== params.redirect_uri) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"redirect_uri mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify client_id matches\n\t\tif (row.client_id !== params.client_id) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"client_id mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// PKCE verification: SHA256(code_verifier) must match stored code_challenge\n\t\t// Use constant-time comparison to prevent timing side-channels\n\t\tconst derivedChallenge = computeS256Challenge(params.code_verifier);\n\t\tif (!secureCompare(derivedChallenge, row.code_challenge)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"PKCE verification failed\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify resource matches (if stored)\n\t\tif (row.resource && params.resource && row.resource !== params.resource) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"resource mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// Revalidate user role before issuing tokens (same pattern as handleTokenRefresh).\n\t\t// The user's role may have changed since the authorization code was issued.\n\t\tconst userInfo = await lookupUserRoleAndStatus(db, row.user_id);\n\t\tif (!userInfo) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"User not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (userInfo.disabled) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"User account is disabled\" },\n\t\t\t};\n\t\t}\n\n\t\t// Re-clamp scopes against the user's current role\n\t\tconst storedScopes = JSON.parse(row.scopes) as string[];\n\t\tlet scopes = clampScopes(storedScopes, userInfo.role);\n\n\t\t// Intersect with client's registered scopes (if restricted)\n\t\tconst client = await lookupOAuthClient(db, row.client_id);\n\t\tif (client?.scopes?.length) {\n\t\t\tscopes = scopes.filter((s: string) => client.scopes!.includes(s));\n\t\t}\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"invalid_grant\",\n\t\t\t\t\tmessage: \"User role no longer supports any of the requested scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Issue tokens (same as device flow)\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\n\t\tconst refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);\n\t\tconst refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);\n\n\t\t// Atomically store both tokens in a transaction\n\t\tawait withTransaction(db, async (trx) => {\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\t\ttoken_type: \"access\",\n\t\t\t\t\tuser_id: row.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"mcp\",\n\t\t\t\t\texpires_at: accessExpires,\n\t\t\t\t\trefresh_token_hash: refreshToken.hash,\n\t\t\t\t\tclient_id: row.client_id,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: refreshToken.hash,\n\t\t\t\t\ttoken_type: \"refresh\",\n\t\t\t\t\tuser_id: row.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"mcp\",\n\t\t\t\t\texpires_at: refreshExpires,\n\t\t\t\t\trefresh_token_hash: null,\n\t\t\t\t\tclient_id: row.client_id,\n\t\t\t\t})\n\t\t\t\t.execute();\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: refreshToken.raw,\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Token exchange error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_EXCHANGE_ERROR\",\n\t\t\t\tmessage: \"Failed to exchange authorization code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Build the authorization denied redirect URL.\n */\nexport function buildDeniedRedirect(redirectUri: string, state?: string): string {\n\tconst url = new URL(redirectUri);\n\turl.searchParams.set(\"error\", \"access_denied\");\n\turl.searchParams.set(\"error_description\", \"The user denied the authorization request\");\n\tif (state) {\n\t\turl.searchParams.set(\"state\", state);\n\t}\n\treturn url.toString();\n}\n\n/**\n * Clean up expired authorization codes.\n */\nexport async function cleanupExpiredAuthorizationCodes(db: Kysely<Database>): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_authorization_codes\")\n\t\t.where(\"expires_at\", \"<\", new Date().toISOString())\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,MAAM,wBAAwB;;AAG9B,MAAM,2BAA2B;;AAGjC,MAAM,4BAA4B,OAAU,KAAK;AAsCjD,SAAS,UAAU,SAAyB;AAC3C,QAAO,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,IAAK,CAAC,aAAa;;;;;AAQ3D,SAAS,gBAAgB,WAA8B;AACtD,KAAI,CAAC,UAAW,QAAO,EAAE;AAIzB,QAFe,UAAU,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,aAAa;;;;;;;;;;AAiBzE,eAAsB,4BACrB,IACA,QACA,UACA,QAC+C;AAC/C,KAAI;AAEH,MAAI,OAAO,kBAAkB,OAC5B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,WAAW,oBAAoB,OAAO,aAAa;AACzD,MAAI,SACH,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS;IAAU;GAC1D;EAIF,MAAM,SAAS,MAAM,kBAAkB,IAAI,OAAO,UAAU;AAC5D,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,iBAAiB,0BAA0B,OAAO,cAAc,OAAO,aAAa;AAC1F,MAAI,eACH,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS;IAAgB;GAChE;AAIF,MAAI,OAAO,0BAA0B,OACpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAIF,MAAI,CAAC,OAAO,eACX,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAmB,SAAS;IAA8B;GACzE;EAIF,MAAM,aAAa,YAAY,gBAAgB,OAAO,MAAM,EAAE,SAAS;EAKvE,MAAM,eAAe,OAAO;EAC5B,MAAM,SAAS,cAAc,SAC1B,WAAW,QAAQ,MAAc,aAAa,SAAS,EAAE,CAAC,GAC1D;AAEH,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAIF,MAAM,OAAO,sBAAsB;EACnC,MAAM,WAAW,aAAa,KAAK;AAGnC,QAAM,GACJ,WAAW,8BAA8B,CACzC,OAAO;GACP,WAAW;GACX,WAAW,OAAO;GAClB,cAAc,OAAO;GACrB,SAAS;GACT,QAAQ,KAAK,UAAU,OAAO;GAC9B,gBAAgB,OAAO;GACvB,uBAAuB,OAAO;GAC9B,UAAU,OAAO,YAAY;GAC7B,YAAY,UAAU,sBAAsB;GAC5C,CAAC,CACD,SAAS;EAGX,MAAM,cAAc,IAAI,IAAI,OAAO,aAAa;AAChD,cAAY,aAAa,IAAI,QAAQ,KAAK;AAC1C,MAAI,OAAO,MACV,aAAY,aAAa,IAAI,SAAS,OAAO,MAAM;AAGpD,SAAO;GACN,SAAS;GACT,MAAM,EAAE,cAAc,YAAY,UAAU,EAAE;GAC9C;UACO,OAAO;AACf,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,gCACrB,IACA,QACoC;AACpC,KAAI;AAEH,MAAI,OAAO,eAAe,qBACzB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;EAMF,MAAM,WAAW,aAAa,OAAO,KAAK;EAE1C,MAAM,MAAM,MAAM,GAChB,WAAW,8BAA8B,CACzC,MAAM,aAAa,KAAK,SAAS,CACjC,cAAc,CACd,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA8B;GACvE;AAIF,MAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA8B;GACvE;AAIF,MAAI,IAAI,iBAAiB,OAAO,aAC/B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAyB;GAClE;AAIF,MAAI,IAAI,cAAc,OAAO,UAC5B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAsB;GAC/D;AAMF,MAAI,CAAC,cADoB,qBAAqB,OAAO,cAAc,EAC9B,IAAI,eAAe,CACvD,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA4B;GACrE;AAIF,MAAI,IAAI,YAAY,OAAO,YAAY,IAAI,aAAa,OAAO,SAC9D,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAqB;GAC9D;EAKF,MAAM,WAAW,MAAM,wBAAwB,IAAI,IAAI,QAAQ;AAC/D,MAAI,CAAC,SACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAkB;GAC3D;AAGF,MAAI,SAAS,SACZ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA4B;GACrE;EAKF,IAAI,SAAS,YADQ,KAAK,MAAM,IAAI,OAAO,EACJ,SAAS,KAAK;EAGrD,MAAM,SAAS,MAAM,kBAAkB,IAAI,IAAI,UAAU;AACzD,MAAI,QAAQ,QAAQ,OACnB,UAAS,OAAO,QAAQ,MAAc,OAAO,OAAQ,SAAS,EAAE,CAAC;AAGlE,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;EAEzD,MAAM,eAAe,sBAAsB,eAAe,cAAc;EACxE,MAAM,iBAAiB,UAAU,0BAA0B;AAG3D,QAAM,gBAAgB,IAAI,OAAO,QAAQ;AACxC,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,YAAY;IACxB,YAAY;IACZ,SAAS,IAAI;IACb,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB,aAAa;IACjC,WAAW,IAAI;IACf,CAAC,CACD,SAAS;AAEX,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,aAAa;IACzB,YAAY;IACZ,SAAS,IAAI;IACb,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,WAAW,IAAI;IACf,CAAC,CACD,SAAS;IACV;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,aAAa;IAC5B,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,KAAK,IAAI;IACvB;GACD;UACO,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,SAAgB,oBAAoB,aAAqB,OAAwB;CAChF,MAAM,MAAM,IAAI,IAAI,YAAY;AAChC,KAAI,aAAa,IAAI,SAAS,gBAAgB;AAC9C,KAAI,aAAa,IAAI,qBAAqB,4CAA4C;AACtF,KAAI,MACH,KAAI,aAAa,IAAI,SAAS,MAAM;AAErC,QAAO,IAAI,UAAU"}