emdash 1.0.1 → 1.2.0

package/dist/oauth-clients-BZWZvKXa.mjs

@@ -1,266 +0,0 @@
-//#region src/api/oauth/redirect-uri.ts
-/**
-* Validate a redirect URI per OAuth 2.1 security requirements.
-*
-* Allows localhost / loopback redirect URIs over HTTP for native clients,
-* and any HTTPS URL for web-based flows.
-*/
-function validateRedirectUri(uri) {
-	try {
-		const url = new URL(uri);
-		if (uri.startsWith("//")) return "Protocol-relative redirect URIs are not allowed";
-		if (url.protocol === "http:") {
-			const host = url.hostname;
-			if (host === "127.0.0.1" || host === "localhost" || host === "[::1]") return null;
-			return "HTTP redirect URIs are only allowed for localhost";
-		}
-		if (url.protocol === "https:") return null;
-		return `Unsupported redirect URI scheme: ${url.protocol}`;
-	} catch {
-		return "Invalid redirect URI";
-	}
-}
-
-//#endregion
-//#region src/api/handlers/oauth-clients.ts
-/** Parse a JSON string column into a typed value. */
-function parseJsonColumn(value) {
-	return JSON.parse(value);
-}
-function validateRegisteredRedirectUris(redirectUris) {
-	for (const redirectUri of redirectUris) {
-		const error = validateRedirectUri(redirectUri);
-		if (error) return `Invalid redirect URI: ${error}`;
-	}
-	return null;
-}
-/**
-* Create a new OAuth client.
-*/
-async function handleOAuthClientCreate(db, input) {
-	try {
-		if (input.redirectUris.length === 0) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: "At least one redirect URI is required"
-			}
-		};
-		const redirectUriError = validateRegisteredRedirectUris(input.redirectUris);
-		if (redirectUriError) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: redirectUriError
-			}
-		};
-		if (await db.selectFrom("_emdash_oauth_clients").select("id").where("id", "=", input.id).executeTakeFirst()) return {
-			success: false,
-			error: {
-				code: "CONFLICT",
-				message: "OAuth client with this ID already exists"
-			}
-		};
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		await db.insertInto("_emdash_oauth_clients").values({
-			id: input.id,
-			name: input.name,
-			redirect_uris: JSON.stringify(input.redirectUris),
-			scopes: input.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null
-		}).execute();
-		return {
-			success: true,
-			data: {
-				id: input.id,
-				name: input.name,
-				redirectUris: input.redirectUris,
-				scopes: input.scopes && input.scopes.length > 0 ? input.scopes : null,
-				createdAt: now,
-				updatedAt: now
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "CLIENT_CREATE_ERROR",
-				message: "Failed to create OAuth client"
-			}
-		};
-	}
-}
-/**
-* List all registered OAuth clients.
-*/
-async function handleOAuthClientList(db) {
-	try {
-		return {
-			success: true,
-			data: { items: (await db.selectFrom("_emdash_oauth_clients").selectAll().orderBy("created_at", "desc").execute()).map((row) => ({
-				id: row.id,
-				name: row.name,
-				redirectUris: parseJsonColumn(row.redirect_uris),
-				scopes: row.scopes ? parseJsonColumn(row.scopes) : null,
-				createdAt: row.created_at,
-				updatedAt: row.updated_at
-			})) }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "CLIENT_LIST_ERROR",
-				message: "Failed to list OAuth clients"
-			}
-		};
-	}
-}
-/**
-* Get a single OAuth client by ID.
-*/
-async function handleOAuthClientGet(db, clientId) {
-	try {
-		const row = await db.selectFrom("_emdash_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst();
-		if (!row) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "OAuth client not found"
-			}
-		};
-		return {
-			success: true,
-			data: {
-				id: row.id,
-				name: row.name,
-				redirectUris: parseJsonColumn(row.redirect_uris),
-				scopes: row.scopes ? parseJsonColumn(row.scopes) : null,
-				createdAt: row.created_at,
-				updatedAt: row.updated_at
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "CLIENT_GET_ERROR",
-				message: "Failed to get OAuth client"
-			}
-		};
-	}
-}
-/**
-* Update an OAuth client.
-*/
-async function handleOAuthClientUpdate(db, clientId, input) {
-	try {
-		if (!await db.selectFrom("_emdash_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst()) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "OAuth client not found"
-			}
-		};
-		if (input.redirectUris !== void 0 && input.redirectUris.length === 0) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: "At least one redirect URI is required"
-			}
-		};
-		if (input.redirectUris !== void 0) {
-			const redirectUriError = validateRegisteredRedirectUris(input.redirectUris);
-			if (redirectUriError) return {
-				success: false,
-				error: {
-					code: "VALIDATION_ERROR",
-					message: redirectUriError
-				}
-			};
-		}
-		const updates = { updated_at: (/* @__PURE__ */ new Date()).toISOString() };
-		if (input.name !== void 0) updates.name = input.name;
-		if (input.redirectUris !== void 0) updates.redirect_uris = JSON.stringify(input.redirectUris);
-		if (input.scopes !== void 0) updates.scopes = input.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null;
-		await db.updateTable("_emdash_oauth_clients").set(updates).where("id", "=", clientId).execute();
-		const updated = await db.selectFrom("_emdash_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst();
-		if (!updated) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "OAuth client not found after update"
-			}
-		};
-		return {
-			success: true,
-			data: {
-				id: updated.id,
-				name: updated.name,
-				redirectUris: parseJsonColumn(updated.redirect_uris),
-				scopes: updated.scopes ? parseJsonColumn(updated.scopes) : null,
-				createdAt: updated.created_at,
-				updatedAt: updated.updated_at
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "CLIENT_UPDATE_ERROR",
-				message: "Failed to update OAuth client"
-			}
-		};
-	}
-}
-/**
-* Delete an OAuth client.
-*/
-async function handleOAuthClientDelete(db, clientId) {
-	try {
-		if ((await db.deleteFrom("_emdash_oauth_clients").where("id", "=", clientId).executeTakeFirst()).numDeletedRows === 0n) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "OAuth client not found"
-			}
-		};
-		return {
-			success: true,
-			data: { deleted: true }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "CLIENT_DELETE_ERROR",
-				message: "Failed to delete OAuth client"
-			}
-		};
-	}
-}
-/**
-* Look up a registered OAuth client by ID.
-* Returns the client's redirect URIs or null if the client is not registered.
-*/
-async function lookupOAuthClient(db, clientId) {
-	const row = await db.selectFrom("_emdash_oauth_clients").select(["redirect_uris", "scopes"]).where("id", "=", clientId).executeTakeFirst();
-	if (!row) return null;
-	return {
-		redirectUris: parseJsonColumn(row.redirect_uris),
-		scopes: row.scopes ? parseJsonColumn(row.scopes) : null
-	};
-}
-/**
-* Validate that a redirect URI is in the client's registered set.
-*
-* Comparison is exact string match (per RFC 6749 §3.1.2.3).
-* Returns null if valid, or an error message if not.
-*/
-function validateClientRedirectUri(redirectUri, allowedUris) {
-	if (allowedUris.includes(redirectUri)) return null;
-	return "redirect_uri is not registered for this client";
-}
-
-//#endregion
-export { handleOAuthClientUpdate as a, validateRedirectUri as c, handleOAuthClientList as i, handleOAuthClientDelete as n, lookupOAuthClient as o, handleOAuthClientGet as r, validateClientRedirectUri as s, handleOAuthClientCreate as t };
-//# sourceMappingURL=oauth-clients-BZWZvKXa.mjs.map

package/dist/oauth-clients-BZWZvKXa.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-clients-BZWZvKXa.mjs","names":[],"sources":["../src/api/oauth/redirect-uri.ts","../src/api/handlers/oauth-clients.ts"],"sourcesContent":["/**\n * Validate a redirect URI per OAuth 2.1 security requirements.\n *\n * Allows localhost / loopback redirect URIs over HTTP for native clients,\n * and any HTTPS URL for web-based flows.\n */\nexport function validateRedirectUri(uri: string): string | null {\n\ttry {\n\t\tconst url = new URL(uri);\n\n\t\t// Reject protocol-relative URLs\n\t\tif (uri.startsWith(\"//\")) {\n\t\t\treturn \"Protocol-relative redirect URIs are not allowed\";\n\t\t}\n\n\t\t// Allow localhost/loopback over HTTP (for desktop MCP clients)\n\t\tif (url.protocol === \"http:\") {\n\t\t\tconst host = url.hostname;\n\t\t\tif (host === \"127.0.0.1\" || host === \"localhost\" || host === \"[::1]\") {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\treturn \"HTTP redirect URIs are only allowed for localhost\";\n\t\t}\n\n\t\t// Allow HTTPS\n\t\tif (url.protocol === \"https:\") {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn `Unsupported redirect URI scheme: ${url.protocol}`;\n\t} catch {\n\t\treturn \"Invalid redirect URI\";\n\t}\n}\n","/**\n * OAuth client management handlers.\n *\n * CRUD operations for registered OAuth clients. Each client has a set\n * of pre-registered redirect URIs. The authorization endpoint rejects\n * any redirect_uri not in the client's registered set.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport { validateRedirectUri } from \"../oauth/redirect-uri.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Parse a JSON string column into a typed value. */\nfunction parseJsonColumn<T>(value: string): T {\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- JSON.parse returns unknown, callers provide the expected shape\n\treturn JSON.parse(value) as T;\n}\n\nfunction validateRegisteredRedirectUris(redirectUris: string[]): string | null {\n\tfor (const redirectUri of redirectUris) {\n\t\tconst error = validateRedirectUri(redirectUri);\n\t\tif (error) {\n\t\t\treturn `Invalid redirect URI: ${error}`;\n\t\t}\n\t}\n\treturn null;\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface OAuthClientInfo {\n\tid: string;\n\tname: string;\n\tredirectUris: string[];\n\tscopes: string[] | null;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new OAuth client.\n */\nexport async function handleOAuthClientCreate(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tid: string;\n\t\tname: string;\n\t\tredirectUris: string[];\n\t\tscopes?: string[] | null;\n\t},\n): Promise<ApiResult<OAuthClientInfo>> {\n\ttry {\n\t\tif (input.redirectUris.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: \"At least one redirect URI is required\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst redirectUriError = validateRegisteredRedirectUris(input.redirectUris);\n\t\tif (redirectUriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: redirectUriError,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Check for duplicate client ID\n\t\tconst existing = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"id\", \"=\", input.id)\n\t\t\t.executeTakeFirst();\n\n\t\tif (existing) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"CONFLICT\", message: \"OAuth client with this ID already exists\" },\n\t\t\t};\n\t\t}\n\n\t\tconst now = new Date().toISOString();\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_oauth_clients\")\n\t\t\t.values({\n\t\t\t\tid: input.id,\n\t\t\t\tname: input.name,\n\t\t\t\tredirect_uris: JSON.stringify(input.redirectUris),\n\t\t\t\tscopes: input.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tid: input.id,\n\t\t\t\tname: input.name,\n\t\t\t\tredirectUris: input.redirectUris,\n\t\t\t\tscopes: input.scopes && input.scopes.length > 0 ? input.scopes : null,\n\t\t\t\tcreatedAt: now,\n\t\t\t\tupdatedAt: now,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all registered OAuth clients.\n */\nexport async function handleOAuthClientList(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<{ items: OAuthClientInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: OAuthClientInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tredirectUris: parseJsonColumn<string[]>(row.redirect_uris),\n\t\t\tscopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tupdatedAt: row.updated_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list OAuth clients\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get a single OAuth client by ID.\n */\nexport async function handleOAuthClientGet(\n\tdb: Kysely<Database>,\n\tclientId: string,\n): Promise<ApiResult<OAuthClientInfo>> {\n\ttry {\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tid: row.id,\n\t\t\t\tname: row.name,\n\t\t\t\tredirectUris: parseJsonColumn<string[]>(row.redirect_uris),\n\t\t\t\tscopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\tupdatedAt: row.updated_at,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Update an OAuth client.\n */\nexport async function handleOAuthClientUpdate(\n\tdb: Kysely<Database>,\n\tclientId: string,\n\tinput: {\n\t\tname?: string;\n\t\tredirectUris?: string[];\n\t\tscopes?: string[] | null;\n\t},\n): Promise<ApiResult<OAuthClientInfo>> {\n\ttry {\n\t\tconst existing = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!existing) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (input.redirectUris !== undefined && input.redirectUris.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: \"At least one redirect URI is required\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tif (input.redirectUris !== undefined) {\n\t\t\tconst redirectUriError = validateRegisteredRedirectUris(input.redirectUris);\n\t\t\tif (redirectUriError) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: redirectUriError,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tconst updates: Record<string, string | null> = {\n\t\t\tupdated_at: new Date().toISOString(),\n\t\t};\n\n\t\tif (input.name !== undefined) {\n\t\t\tupdates.name = input.name;\n\t\t}\n\t\tif (input.redirectUris !== undefined) {\n\t\t\tupdates.redirect_uris = JSON.stringify(input.redirectUris);\n\t\t}\n\t\tif (input.scopes !== undefined) {\n\t\t\tupdates.scopes =\n\t\t\t\tinput.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null;\n\t\t}\n\n\t\tawait db.updateTable(\"_emdash_oauth_clients\").set(updates).where(\"id\", \"=\", clientId).execute();\n\n\t\t// Fetch the updated row\n\t\tconst updated = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!updated) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found after update\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tid: updated.id,\n\t\t\t\tname: updated.name,\n\t\t\t\tredirectUris: parseJsonColumn<string[]>(updated.redirect_uris),\n\t\t\t\tscopes: updated.scopes ? parseJsonColumn<string[]>(updated.scopes) : null,\n\t\t\t\tcreatedAt: updated.created_at,\n\t\t\t\tupdatedAt: updated.updated_at,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_UPDATE_ERROR\",\n\t\t\t\tmessage: \"Failed to update OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete an OAuth client.\n */\nexport async function handleOAuthClientDelete(\n\tdb: Kysely<Database>,\n\tclientId: string,\n): Promise<ApiResult<{ deleted: true }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_oauth_clients\")\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { deleted: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Lookup helpers (used by authorization handler)\n// ---------------------------------------------------------------------------\n\n/**\n * Look up a registered OAuth client by ID.\n * Returns the client's redirect URIs or null if the client is not registered.\n */\nexport async function lookupOAuthClient(\n\tdb: Kysely<Database>,\n\tclientId: string,\n): Promise<{ redirectUris: string[]; scopes: string[] | null } | null> {\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t.select([\"redirect_uris\", \"scopes\"])\n\t\t.where(\"id\", \"=\", clientId)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\treturn {\n\t\tredirectUris: parseJsonColumn<string[]>(row.redirect_uris),\n\t\tscopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,\n\t};\n}\n\n/**\n * Validate that a redirect URI is in the client's registered set.\n *\n * Comparison is exact string match (per RFC 6749 §3.1.2.3).\n * Returns null if valid, or an error message if not.\n */\nexport function validateClientRedirectUri(\n\tredirectUri: string,\n\tallowedUris: string[],\n): string | null {\n\tif (allowedUris.includes(redirectUri)) {\n\t\treturn null; // OK\n\t}\n\treturn \"redirect_uri is not registered for this client\";\n}\n"],"mappings":";;;;;;;AAMA,SAAgB,oBAAoB,KAA4B;AAC/D,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,IAAI;AAGxB,MAAI,IAAI,WAAW,KAAK,CACvB,QAAO;AAIR,MAAI,IAAI,aAAa,SAAS;GAC7B,MAAM,OAAO,IAAI;AACjB,OAAI,SAAS,eAAe,SAAS,eAAe,SAAS,QAC5D,QAAO;AAER,UAAO;;AAIR,MAAI,IAAI,aAAa,SACpB,QAAO;AAGR,SAAO,oCAAoC,IAAI;SACxC;AACP,SAAO;;;;;;;ACZT,SAAS,gBAAmB,OAAkB;AAE7C,QAAO,KAAK,MAAM,MAAM;;AAGzB,SAAS,+BAA+B,cAAuC;AAC9E,MAAK,MAAM,eAAe,cAAc;EACvC,MAAM,QAAQ,oBAAoB,YAAY;AAC9C,MAAI,MACH,QAAO,yBAAyB;;AAGlC,QAAO;;;;;AAuBR,eAAsB,wBACrB,IACA,OAMsC;AACtC,KAAI;AACH,MAAI,MAAM,aAAa,WAAW,EACjC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,MAAM,mBAAmB,+BAA+B,MAAM,aAAa;AAC3E,MAAI,iBACH,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAUF,MANiB,MAAM,GACrB,WAAW,wBAAwB,CACnC,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,MAAM,GAAG,CAC1B,kBAAkB,CAGnB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAY,SAAS;IAA4C;GAChF;EAGF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;AAEpC,QAAM,GACJ,WAAW,wBAAwB,CACnC,OAAO;GACP,IAAI,MAAM;GACV,MAAM,MAAM;GACZ,eAAe,KAAK,UAAU,MAAM,aAAa;GACjD,QAAQ,MAAM,UAAU,MAAM,OAAO,SAAS,IAAI,KAAK,UAAU,MAAM,OAAO,GAAG;GACjF,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,IAAI,MAAM;IACV,MAAM,MAAM;IACZ,cAAc,MAAM;IACpB,QAAQ,MAAM,UAAU,MAAM,OAAO,SAAS,IAAI,MAAM,SAAS;IACjE,WAAW;IACX,WAAW;IACX;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,sBACrB,IACmD;AACnD,KAAI;AAgBH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QAfnB,MAAM,GACjB,WAAW,wBAAwB,CACnC,WAAW,CACX,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAE2B,KAAK,SAAS;IACnD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,cAAc,gBAA0B,IAAI,cAAc;IAC1D,QAAQ,IAAI,SAAS,gBAA0B,IAAI,OAAO,GAAG;IAC7D,WAAW,IAAI;IACf,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,UACsC;AACtC,KAAI;EACH,MAAM,MAAM,MAAM,GAChB,WAAW,wBAAwB,CACnC,WAAW,CACX,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAC/D;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,IAAI,IAAI;IACR,MAAM,IAAI;IACV,cAAc,gBAA0B,IAAI,cAAc;IAC1D,QAAQ,IAAI,SAAS,gBAA0B,IAAI,OAAO,GAAG;IAC7D,WAAW,IAAI;IACf,WAAW,IAAI;IACf;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,wBACrB,IACA,UACA,OAKsC;AACtC,KAAI;AAOH,MAAI,CANa,MAAM,GACrB,WAAW,wBAAwB,CACnC,WAAW,CACX,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB,CAGnB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAC/D;AAGF,MAAI,MAAM,iBAAiB,UAAa,MAAM,aAAa,WAAW,EACrE,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAGF,MAAI,MAAM,iBAAiB,QAAW;GACrC,MAAM,mBAAmB,+BAA+B,MAAM,aAAa;AAC3E,OAAI,iBACH,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;EAIH,MAAM,UAAyC,EAC9C,6BAAY,IAAI,MAAM,EAAC,aAAa,EACpC;AAED,MAAI,MAAM,SAAS,OAClB,SAAQ,OAAO,MAAM;AAEtB,MAAI,MAAM,iBAAiB,OAC1B,SAAQ,gBAAgB,KAAK,UAAU,MAAM,aAAa;AAE3D,MAAI,MAAM,WAAW,OACpB,SAAQ,SACP,MAAM,UAAU,MAAM,OAAO,SAAS,IAAI,KAAK,UAAU,MAAM,OAAO,GAAG;AAG3E,QAAM,GAAG,YAAY,wBAAwB,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,SAAS,CAAC,SAAS;EAG/F,MAAM,UAAU,MAAM,GACpB,WAAW,wBAAwB,CACnC,WAAW,CACX,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB;AAEpB,MAAI,CAAC,QACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAuC;GAC5E;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,IAAI,QAAQ;IACZ,MAAM,QAAQ;IACd,cAAc,gBAA0B,QAAQ,cAAc;IAC9D,QAAQ,QAAQ,SAAS,gBAA0B,QAAQ,OAAO,GAAG;IACrE,WAAW,QAAQ;IACnB,WAAW,QAAQ;IACnB;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,wBACrB,IACA,UACwC;AACxC,KAAI;AAMH,OALe,MAAM,GACnB,WAAW,wBAAwB,CACnC,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAC/D;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;AAYH,eAAsB,kBACrB,IACA,UACsE;CACtE,MAAM,MAAM,MAAM,GAChB,WAAW,wBAAwB,CACnC,OAAO,CAAC,iBAAiB,SAAS,CAAC,CACnC,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAEjB,QAAO;EACN,cAAc,gBAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,SAAS,gBAA0B,IAAI,OAAO,GAAG;EAC7D;;;;;;;;AASF,SAAgB,0BACf,aACA,aACgB;AAChB,KAAI,YAAY,SAAS,YAAY,CACpC,QAAO;AAER,QAAO"}

package/dist/oauth-state-store-CxXTjXdI.mjs

@@ -1,50 +0,0 @@
-//#region src/auth/oauth-state-store.ts
-const OAUTH_STATE_TTL_MS = 600 * 1e3;
-function createOAuthStateStore(db) {
-	return {
-		async set(state, data) {
-			const expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();
-			await db.insertInto("auth_challenges").values({
-				challenge: state,
-				type: "oauth",
-				user_id: null,
-				data: JSON.stringify(data),
-				expires_at: expiresAt
-			}).onConflict((oc) => oc.column("challenge").doUpdateSet({
-				type: "oauth",
-				data: JSON.stringify(data),
-				expires_at: expiresAt
-			})).execute();
-		},
-		async get(state) {
-			const row = await db.selectFrom("auth_challenges").selectAll().where("challenge", "=", state).where("type", "=", "oauth").executeTakeFirst();
-			if (!row) return null;
-			if (new Date(row.expires_at).getTime() < Date.now()) {
-				await this.delete(state);
-				return null;
-			}
-			if (!row.data) return null;
-			try {
-				const parsed = JSON.parse(row.data);
-				if (typeof parsed !== "object" || parsed === null || !("provider" in parsed) || typeof parsed.provider !== "string" || !("redirectUri" in parsed) || typeof parsed.redirectUri !== "string") return null;
-				const oauthState = {
-					provider: parsed.provider,
-					redirectUri: parsed.redirectUri
-				};
-				if ("codeVerifier" in parsed && typeof parsed.codeVerifier === "string") oauthState.codeVerifier = parsed.codeVerifier;
-				if ("nonce" in parsed && typeof parsed.nonce === "string") oauthState.nonce = parsed.nonce;
-				if ("inviteToken" in parsed && typeof parsed.inviteToken === "string") oauthState.inviteToken = parsed.inviteToken;
-				return oauthState;
-			} catch {
-				return null;
-			}
-		},
-		async delete(state) {
-			await db.deleteFrom("auth_challenges").where("challenge", "=", state).where("type", "=", "oauth").execute();
-		}
-	};
-}
-
-//#endregion
-export { createOAuthStateStore as t };
-//# sourceMappingURL=oauth-state-store-CxXTjXdI.mjs.map

package/dist/oauth-state-store-CxXTjXdI.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-state-store-CxXTjXdI.mjs","names":[],"sources":["../src/auth/oauth-state-store.ts"],"sourcesContent":["/**\n * OAuth state store\n *\n * Stores OAuth state in the auth_challenges table with automatic expiration.\n * Uses the existing table but with type=\"oauth\" to distinguish from WebAuthn challenges.\n */\n\nimport type { StateStore, OAuthState } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nconst OAUTH_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes\n\nexport function createOAuthStateStore(db: Kysely<Database>): StateStore {\n\treturn {\n\t\tasync set(state: string, data: OAuthState): Promise<void> {\n\t\t\tconst expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge: state,\n\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\tuser_id: null,\n\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(state: string): Promise<OAuthState | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(state);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tif (!row.data) return null;\n\n\t\t\ttry {\n\t\t\t\tconst parsed: unknown = JSON.parse(row.data);\n\t\t\t\tif (\n\t\t\t\t\ttypeof parsed !== \"object\" ||\n\t\t\t\t\tparsed === null ||\n\t\t\t\t\t!(\"provider\" in parsed) ||\n\t\t\t\t\ttypeof parsed.provider !== \"string\" ||\n\t\t\t\t\t!(\"redirectUri\" in parsed) ||\n\t\t\t\t\ttypeof parsed.redirectUri !== \"string\"\n\t\t\t\t) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tconst oauthState: OAuthState = {\n\t\t\t\t\tprovider: parsed.provider,\n\t\t\t\t\tredirectUri: parsed.redirectUri,\n\t\t\t\t};\n\t\t\t\tif (\"codeVerifier\" in parsed && typeof parsed.codeVerifier === \"string\") {\n\t\t\t\t\toauthState.codeVerifier = parsed.codeVerifier;\n\t\t\t\t}\n\t\t\t\tif (\"nonce\" in parsed && typeof parsed.nonce === \"string\") {\n\t\t\t\t\toauthState.nonce = parsed.nonce;\n\t\t\t\t}\n\t\t\t\tif (\"inviteToken\" in parsed && typeof parsed.inviteToken === \"string\") {\n\t\t\t\t\toauthState.inviteToken = parsed.inviteToken;\n\t\t\t\t}\n\t\t\t\treturn oauthState;\n\t\t\t} catch {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\n\t\tasync delete(state: string): Promise<void> {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"auth_challenges\")\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.execute();\n\t\t},\n\t};\n}\n"],"mappings":";AAYA,MAAM,qBAAqB,MAAU;AAErC,SAAgB,sBAAsB,IAAkC;AACvE,QAAO;EACN,MAAM,IAAI,OAAe,MAAiC;GACzD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,mBAAmB,CAAC,aAAa;AAEzE,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM;IACN,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,OAA2C;GACpD,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;AAKjB,OAHkB,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS,GAGpC,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,MAAM;AACxB,WAAO;;AAGR,OAAI,CAAC,IAAI,KAAM,QAAO;AAEtB,OAAI;IACH,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK;AAC5C,QACC,OAAO,WAAW,YAClB,WAAW,QACX,EAAE,cAAc,WAChB,OAAO,OAAO,aAAa,YAC3B,EAAE,iBAAiB,WACnB,OAAO,OAAO,gBAAgB,SAE9B,QAAO;IAER,MAAM,aAAyB;KAC9B,UAAU,OAAO;KACjB,aAAa,OAAO;KACpB;AACD,QAAI,kBAAkB,UAAU,OAAO,OAAO,iBAAiB,SAC9D,YAAW,eAAe,OAAO;AAElC,QAAI,WAAW,UAAU,OAAO,OAAO,UAAU,SAChD,YAAW,QAAQ,OAAO;AAE3B,QAAI,iBAAiB,UAAU,OAAO,OAAO,gBAAgB,SAC5D,YAAW,cAAc,OAAO;AAEjC,WAAO;WACA;AACP,WAAO;;;EAIT,MAAM,OAAO,OAA8B;AAC1C,SAAM,GACJ,WAAW,kBAAkB,CAC7B,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,SAAS;;EAEZ"}

package/dist/oauth-user-lookup-GWojfxRl.mjs

@@ -1,26 +0,0 @@
-import { toRoleLevel } from "@emdash-cms/auth";
-
-//#region src/api/handlers/oauth-user-lookup.ts
-/**
-* Shared user lookup for OAuth token operations.
-*
-* Extracts user role and disabled status from the database. Used by
-* handleTokenRefresh() to revalidate scopes against the user's current
-* role and reject disabled users.
-*/
-/**
-* Look up a user's current role and disabled status.
-* Returns null if the user doesn't exist.
-*/
-async function lookupUserRoleAndStatus(db, userId) {
-	const row = await db.selectFrom("users").select(["role", "disabled"]).where("id", "=", userId).executeTakeFirst();
-	if (!row) return null;
-	return {
-		role: toRoleLevel(row.role),
-		disabled: row.disabled === 1
-	};
-}
-
-//#endregion
-export { lookupUserRoleAndStatus as t };
-//# sourceMappingURL=oauth-user-lookup-GWojfxRl.mjs.map

package/dist/oauth-user-lookup-GWojfxRl.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-user-lookup-GWojfxRl.mjs","names":[],"sources":["../src/api/handlers/oauth-user-lookup.ts"],"sourcesContent":["/**\n * Shared user lookup for OAuth token operations.\n *\n * Extracts user role and disabled status from the database. Used by\n * handleTokenRefresh() to revalidate scopes against the user's current\n * role and reject disabled users.\n */\n\nimport { toRoleLevel, type RoleLevel } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\n\nexport interface UserRoleAndStatus {\n\trole: RoleLevel;\n\tdisabled: boolean;\n}\n\n/**\n * Look up a user's current role and disabled status.\n * Returns null if the user doesn't exist.\n */\nexport async function lookupUserRoleAndStatus(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<UserRoleAndStatus | null> {\n\tconst row = await db\n\t\t.selectFrom(\"users\")\n\t\t.select([\"role\", \"disabled\"])\n\t\t.where(\"id\", \"=\", userId)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\treturn {\n\t\trole: toRoleLevel(row.role),\n\t\tdisabled: row.disabled === 1,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,eAAsB,wBACrB,IACA,QACoC;CACpC,MAAM,MAAM,MAAM,GAChB,WAAW,QAAQ,CACnB,OAAO,CAAC,QAAQ,WAAW,CAAC,CAC5B,MAAM,MAAM,KAAK,OAAO,CACxB,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAEjB,QAAO;EACN,MAAM,YAAY,IAAI,KAAK;EAC3B,UAAU,IAAI,aAAa;EAC3B"}

package/dist/options-DRF6dlXY.d.mts

@@ -1,81 +0,0 @@
-import { t as Database } from "./types-ibtP7GEA.mjs";
-import { E as ConditionalWriteResult, Gn as VersionedValue, T as ConditionalDeleteResult } from "./types-BYVIYOlD.mjs";
-import { Kysely } from "kysely";
-
-//#region src/database/repositories/options.d.ts
-/**
- * Options repository for key-value settings storage
- *
- * Used for site settings, plugin configuration, and other arbitrary key-value data.
- * Values are stored as JSON for flexibility.
- */
-declare class OptionsRepository {
-  private db;
-  constructor(db: Kysely<Database>);
-  /**
-   * Get an option value
-   */
-  get<T = unknown>(name: string): Promise<T | null>;
-  /**
-   * Get an option value with a default
-   */
-  getOrDefault<T>(name: string, defaultValue: T): Promise<T>;
-  /**
-   * Set an option value (creates or updates)
-   */
-  set<T = unknown>(name: string, value: T): Promise<void>;
-  setVersioned<T = unknown>(name: string, value: T): Promise<string>;
-  /**
-   * Set an option value only if no row with that name exists. Atomic at the
-   * database level via INSERT ... ON CONFLICT DO NOTHING, so concurrent
-   * callers can't race past the check.
-   *
-   * Returns true when the row was inserted, false when a row already
-   * existed (regardless of its value — even an empty string or null).
-   */
-  setIfAbsent<T = unknown>(name: string, value: T): Promise<boolean>;
-  getVersioned<T = unknown>(name: string): Promise<VersionedValue<T> | null>;
-  compareAndSet(name: string, expectedRevision: string | null, value: unknown): Promise<ConditionalWriteResult>;
-  compareAndDelete(name: string, expectedRevision: string): Promise<ConditionalDeleteResult>;
-  /**
-   * Delete an option
-   */
-  delete(name: string): Promise<boolean>;
-  /**
-   * Delete multiple options in one statement.
-   */
-  deleteMany(names: string[]): Promise<number>;
-  /**
-   * Check if an option exists
-   */
-  exists(name: string): Promise<boolean>;
-  /**
-   * Get multiple options at once
-   */
-  getMany<T = unknown>(names: string[]): Promise<Map<string, T>>;
-  /**
-   * Set multiple options at once
-   */
-  setMany<T = unknown>(options: Record<string, T>): Promise<void>;
-  /**
-   * Get all options (use sparingly)
-   */
-  getAll(): Promise<Map<string, unknown>>;
-  /**
-   * Get all options matching a prefix
-   */
-  getByPrefix<T = unknown>(prefix: string, options?: {
-    limit?: number;
-  }): Promise<Map<string, T>>;
-  getVersionedByPrefix<T = unknown>(prefix: string, options?: {
-    limit?: number;
-  }): Promise<Map<string, VersionedValue<T>>>;
-  countByPrefix(prefix: string): Promise<number>;
-  /**
-   * Delete all options matching a prefix
-   */
-  deleteByPrefix(prefix: string): Promise<number>;
-}
-//#endregion
-export { OptionsRepository as t };
-//# sourceMappingURL=options-DRF6dlXY.d.mts.map

package/dist/options-DRF6dlXY.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"options-DRF6dlXY.d.mts","names":[],"sources":["../src/database/repositories/options.ts"],"mappings":";;;;;;;AAwBA;;;;cAAa,iBAAA;EAAA,QACQ,EAAA;cAAA,EAAA,EAAI,MAAA,CAAO,QAAA;EAoBmB;;;EAf5C,GAAA,aAAA,CAAiB,IAAA,WAAe,OAAA,CAAQ,CAAA;EAuBE;;;EAR1C,YAAA,GAAA,CAAgB,IAAA,UAAc,YAAA,EAAc,CAAA,GAAI,OAAA,CAAQ,CAAA;EAuCN;;;EA/BlD,GAAA,aAAA,CAAiB,IAAA,UAAc,KAAA,EAAO,CAAA,GAAI,OAAA;EAI1C,YAAA,aAAA,CAA0B,IAAA,UAAc,KAAA,EAAO,CAAA,GAAI,OAAA;EA4DtD;;;;;;;;EAjCG,WAAA,aAAA,CAAyB,IAAA,UAAc,KAAA,EAAO,CAAA,GAAI,OAAA;EAkBlD,YAAA,aAAA,CAA0B,IAAA,WAAe,OAAA,CAAQ,cAAA,CAAe,CAAA;EAWhE,aAAA,CACL,IAAA,UACA,gBAAA,iBACA,KAAA,YACE,OAAA,CAAQ,sBAAA;EAuBL,gBAAA,CAAiB,IAAA,UAAc,gBAAA,WAA2B,OAAA,CAAQ,uBAAA;EAiFhD;;;EAlElB,MAAA,CAAO,IAAA,WAAe,OAAA;EAkFzB;;;EAzEG,UAAA,CAAW,KAAA,aAAkB,OAAA;EA8FhC;;;EAlFG,MAAA,CAAO,IAAA,WAAe,OAAA;EAiHiB;;;EApGvC,OAAA,aAAA,CAAqB,KAAA,aAAkB,OAAA,CAAQ,GAAA,SAAY,CAAA;EApKlC;;;EAwLzB,OAAA,aAAA,CAAqB,OAAA,EAAS,MAAA,SAAe,CAAA,IAAK,OAAA;EAnLjC;;;EA+LjB,MAAA,CAAA,GAAU,OAAA,CAAQ,GAAA;EAhLL;;;EA6Lb,WAAA,aAAA,CACL,MAAA,UACA,OAAA;IAAW,KAAA;EAAA,IACT,OAAA,CAAQ,GAAA,SAAY,CAAA;EAkBjB,oBAAA,aAAA,CACL,MAAA,UACA,OAAA;IAAW,KAAA;EAAA,IACT,OAAA,CAAQ,GAAA,SAAY,cAAA,CAAe,CAAA;EAkBhC,aAAA,CAAc,MAAA,WAAiB,OAAA;EA/NA;;;EA4O/B,cAAA,CAAe,MAAA,WAAiB,OAAA;AAAA"}

package/dist/ownership-Bd77AmJz.mjs

@@ -1,12 +0,0 @@
-import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
-
-//#region src/seed/ownership.ts
-const AUTO_SEED_COMPLETE_OPTION = "emdash:seed_complete";
-async function claimExplicitSeedOwnership(db, seed) {
-	if (!seed.collections?.length) return;
-	await new OptionsRepository(db).set(AUTO_SEED_COMPLETE_OPTION, true);
-}
-
-//#endregion
-export { claimExplicitSeedOwnership as n, AUTO_SEED_COMPLETE_OPTION as t };
-//# sourceMappingURL=ownership-Bd77AmJz.mjs.map

package/dist/ownership-Bd77AmJz.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ownership-Bd77AmJz.mjs","names":[],"sources":["../src/seed/ownership.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\nimport type { SeedFile } from \"./types.js\";\n\nexport const AUTO_SEED_COMPLETE_OPTION = \"emdash:seed_complete\";\n\nexport async function claimExplicitSeedOwnership(\n\tdb: Kysely<Database>,\n\tseed: SeedFile,\n): Promise<void> {\n\tif (!seed.collections?.length) return;\n\tawait new OptionsRepository(db).set(AUTO_SEED_COMPLETE_OPTION, true);\n}\n"],"mappings":";;;AAMA,MAAa,4BAA4B;AAEzC,eAAsB,2BACrB,IACA,MACgB;AAChB,KAAI,CAAC,KAAK,aAAa,OAAQ;AAC/B,OAAM,IAAI,kBAAkB,GAAG,CAAC,IAAI,2BAA2B,KAAK"}

package/dist/parse-5Y0W39xR.mjs

@@ -1,81 +0,0 @@
-import { t as apiError } from "./error-DIYXAVk4.mjs";
-import { z } from "zod";
-
-//#region src/api/parse.ts
-/** Maximum allowed JSON request body size (10 MB). */
-const MAX_BODY_SIZE = 10 * 1024 * 1024;
-/**
-* Parse and validate a JSON request body against a Zod schema.
-*
-* Returns the validated data on success, or a 400 Response on failure.
-* Replaces all `(await request.json()) as T` casts.
-*/
-async function parseBody(request, schema) {
-	const contentLength = request.headers.get("Content-Length");
-	if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) return apiError("PAYLOAD_TOO_LARGE", "Request body too large", 413);
-	let raw;
-	try {
-		raw = await request.json();
-	} catch {
-		return apiError("INVALID_JSON", "Request body must be valid JSON", 400);
-	}
-	return validate(schema, raw);
-}
-/**
-* Parse and validate an optional JSON request body.
-*
-* Returns `defaultValue` if the body is empty, or the validated data if present.
-* For endpoints where the body is optional (e.g., preview-url, confirm).
-*/
-async function parseOptionalBody(request, schema, defaultValue) {
-	const contentLength = request.headers.get("Content-Length");
-	if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) return apiError("PAYLOAD_TOO_LARGE", "Request body too large", 413);
-	let text;
-	try {
-		text = await request.text();
-	} catch {
-		return defaultValue;
-	}
-	if (!text.trim()) return defaultValue;
-	let raw;
-	try {
-		raw = JSON.parse(text);
-	} catch {
-		return apiError("INVALID_JSON", "Request body must be valid JSON", 400);
-	}
-	return validate(schema, raw);
-}
-/**
-* Parse and validate URL search params against a Zod schema.
-*
-* Converts searchParams to a plain object before validation.
-* Zod coercion handles string -> number/boolean conversion.
-* Replaces manual `url.searchParams.get()` + `parseInt()` patterns.
-*/
-function parseQuery(url, schema) {
-	const raw = {};
-	for (const [key, value] of url.searchParams) raw[key] = value;
-	return validate(schema, raw);
-}
-/**
-* Validate raw data against a schema. Returns data or error Response.
-*/
-function validate(schema, data) {
-	const result = schema.safeParse(data);
-	if (result.success) return result.data;
-	return apiError("VALIDATION_ERROR", "Invalid request data", 400, { issues: result.error.issues.map((issue) => ({
-		path: issue.path.join("."),
-		message: issue.message
-	})) });
-}
-/**
-* Type guard to check if a ParseResult is an error Response.
-* Usage: `if (isParseError(result)) return result;`
-*/
-function isParseError(result) {
-	return result instanceof Response;
-}
-
-//#endregion
-export { parseQuery as i, parseBody as n, parseOptionalBody as r, isParseError as t };
-//# sourceMappingURL=parse-5Y0W39xR.mjs.map

package/dist/parse-5Y0W39xR.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"parse-5Y0W39xR.mjs","names":[],"sources":["../src/api/parse.ts"],"sourcesContent":["/**\n * Request body and query parameter parsing with Zod validation.\n *\n * All API routes should use these utilities instead of `request.json() as T`\n * or raw `url.searchParams.get()` with manual coercion.\n */\n\nimport { z } from \"zod\";\n\nimport { apiError } from \"./error.js\";\n\n/** Maximum allowed JSON request body size (10 MB). */\nconst MAX_BODY_SIZE = 10 * 1024 * 1024;\n\n/**\n * Result of parsing: either the validated data or an error Response.\n * Routes should check `if (result instanceof Response) return result;`\n */\nexport type ParseResult<T> = T | Response;\n\n/**\n * Parse and validate a JSON request body against a Zod schema.\n *\n * Returns the validated data on success, or a 400 Response on failure.\n * Replaces all `(await request.json()) as T` casts.\n */\nexport async function parseBody<T extends z.ZodType>(\n\trequest: Request,\n\tschema: T,\n): Promise<ParseResult<z.infer<T>>> {\n\t// Best-effort size check via Content-Length (can be absent with chunked encoding)\n\tconst contentLength = request.headers.get(\"Content-Length\");\n\tif (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) {\n\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Request body too large\", 413);\n\t}\n\n\tlet raw: unknown;\n\ttry {\n\t\traw = await request.json();\n\t} catch {\n\t\treturn apiError(\"INVALID_JSON\", \"Request body must be valid JSON\", 400);\n\t}\n\n\treturn validate(schema, raw);\n}\n\n/**\n * Parse and validate an optional JSON request body.\n *\n * Returns `defaultValue` if the body is empty, or the validated data if present.\n * For endpoints where the body is optional (e.g., preview-url, confirm).\n */\nexport async function parseOptionalBody<T extends z.ZodType>(\n\trequest: Request,\n\tschema: T,\n\tdefaultValue: z.infer<T>,\n): Promise<ParseResult<z.infer<T>>> {\n\t// Best-effort size check via Content-Length (can be absent with chunked encoding)\n\tconst contentLength = request.headers.get(\"Content-Length\");\n\tif (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) {\n\t\treturn apiError(\"PAYLOAD_TOO_LARGE\", \"Request body too large\", 413);\n\t}\n\n\tlet text: string;\n\ttry {\n\t\ttext = await request.text();\n\t} catch {\n\t\treturn defaultValue;\n\t}\n\n\tif (!text.trim()) {\n\t\treturn defaultValue;\n\t}\n\n\tlet raw: unknown;\n\ttry {\n\t\traw = JSON.parse(text);\n\t} catch {\n\t\treturn apiError(\"INVALID_JSON\", \"Request body must be valid JSON\", 400);\n\t}\n\n\treturn validate(schema, raw);\n}\n\n/**\n * Parse and validate URL search params against a Zod schema.\n *\n * Converts searchParams to a plain object before validation.\n * Zod coercion handles string -> number/boolean conversion.\n * Replaces manual `url.searchParams.get()` + `parseInt()` patterns.\n */\nexport function parseQuery<T extends z.ZodType>(url: URL, schema: T): ParseResult<z.infer<T>> {\n\tconst raw: Record<string, string> = {};\n\tfor (const [key, value] of url.searchParams) {\n\t\traw[key] = value;\n\t}\n\treturn validate(schema, raw);\n}\n\n/**\n * Validate raw data against a schema. Returns data or error Response.\n */\nfunction validate<T extends z.ZodType>(schema: T, data: unknown): ParseResult<z.infer<T>> {\n\tconst result = schema.safeParse(data);\n\n\tif (result.success) {\n\t\treturn result.data;\n\t}\n\n\t// Format Zod errors into a readable structure\n\tconst issues = result.error.issues.map((issue: z.core.$ZodIssue) => ({\n\t\tpath: issue.path.join(\".\"),\n\t\tmessage: issue.message,\n\t}));\n\n\treturn apiError(\"VALIDATION_ERROR\", \"Invalid request data\", 400, { issues });\n}\n\n/**\n * Type guard to check if a ParseResult is an error Response.\n * Usage: `if (isParseError(result)) return result;`\n */\nexport function isParseError<T>(result: ParseResult<T>): result is Response {\n\treturn result instanceof Response;\n}\n"],"mappings":";;;;;AAYA,MAAM,gBAAgB,KAAK,OAAO;;;;;;;AAclC,eAAsB,UACrB,SACA,QACmC;CAEnC,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,KAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,0BAA0B,IAAI;CAGpE,IAAI;AACJ,KAAI;AACH,QAAM,MAAM,QAAQ,MAAM;SACnB;AACP,SAAO,SAAS,gBAAgB,mCAAmC,IAAI;;AAGxE,QAAO,SAAS,QAAQ,IAAI;;;;;;;;AAS7B,eAAsB,kBACrB,SACA,QACA,cACmC;CAEnC,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,KAAI,iBAAiB,SAAS,eAAe,GAAG,GAAG,cAClD,QAAO,SAAS,qBAAqB,0BAA0B,IAAI;CAGpE,IAAI;AACJ,KAAI;AACH,SAAO,MAAM,QAAQ,MAAM;SACpB;AACP,SAAO;;AAGR,KAAI,CAAC,KAAK,MAAM,CACf,QAAO;CAGR,IAAI;AACJ,KAAI;AACH,QAAM,KAAK,MAAM,KAAK;SACf;AACP,SAAO,SAAS,gBAAgB,mCAAmC,IAAI;;AAGxE,QAAO,SAAS,QAAQ,IAAI;;;;;;;;;AAU7B,SAAgB,WAAgC,KAAU,QAAoC;CAC7F,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,KAAK,UAAU,IAAI,aAC9B,KAAI,OAAO;AAEZ,QAAO,SAAS,QAAQ,IAAI;;;;;AAM7B,SAAS,SAA8B,QAAW,MAAwC;CACzF,MAAM,SAAS,OAAO,UAAU,KAAK;AAErC,KAAI,OAAO,QACV,QAAO,OAAO;AASf,QAAO,SAAS,oBAAoB,wBAAwB,KAAK,EAAE,QALpD,OAAO,MAAM,OAAO,KAAK,WAA6B;EACpE,MAAM,MAAM,KAAK,KAAK,IAAI;EAC1B,SAAS,MAAM;EACf,EAAE,EAEwE,CAAC;;;;;;AAO7E,SAAgB,aAAgB,QAA4C;AAC3E,QAAO,kBAAkB"}