emdash 1.0.1 → 1.2.0

package/dist/astro/routes/api/menus/_name_.mjs

@@ -1,26 +1,26 @@
 import "../../../../config-CvmjJcVw.mjs";
 import "../../../../after-PcEvMY_6.mjs";
-import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../object-cache-Bo6DGaC9.mjs";
 import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import { n as handleMenuDelete, r as handleMenuGet, u as handleMenuUpdate } from "../../../../menus-trvc6_fW.mjs";
-import { t as menuTag } from "../../../../chrome-tags-CKELm-bo.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import "../../../../settings-CwcrX-Ay.mjs";
-import "../../../../site-settings-B7vGFRDT.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../error-DIYXAVk4.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-5Y0W39xR.mjs";
-import { b as localeFilterQuery } from "../../../../redirects-1nhdEaTq.mjs";
-import "../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../media-Bs6qmlVl.mjs";
-import "../../../../comments-zrTgWBSg.mjs";
-import "../../../../byline-fields-BYbTptTU.mjs";
-import { d as updateMenuBody } from "../../../../menus-mC_XTxD7.mjs";
-import "../../../../status-C6IrSLMT.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import { n as handleMenuDelete, r as handleMenuGet, u as handleMenuUpdate } from "../../../../menus-CvVYfsuk.mjs";
+import { t as menuTag } from "../../../../chrome-tags-BIKBMZYO.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import "../../../../settings-GaZ5sVgg.mjs";
+import "../../../../site-settings-CDdT4mVm.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../error-DxgQdaZ_.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
+import { b as localeFilterQuery } from "../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../media-CRKsKlfK.mjs";
+import "../../../../comments-BzmIKVb2.mjs";
+import "../../../../byline-fields-Bze3ZdAw.mjs";
+import { d as updateMenuBody } from "../../../../menus-D1HC8npj.mjs";
+import "../../../../status-Dl85BK39.mjs";
 import "../../../../api/schemas/index.mjs";
-import { i as requirePerm } from "../../../../authorize-CTGywswM.mjs";
+import { i as requirePerm } from "../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/menus/[name].ts
 const prerender = false;

package/dist/astro/routes/api/menus/index.mjs

@@ -1,26 +1,26 @@
 import "../../../../config-CvmjJcVw.mjs";
 import "../../../../after-PcEvMY_6.mjs";
-import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../object-cache-Bo6DGaC9.mjs";
 import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import { c as handleMenuList, t as handleMenuCreate } from "../../../../menus-trvc6_fW.mjs";
-import { t as menuTag } from "../../../../chrome-tags-CKELm-bo.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import "../../../../settings-CwcrX-Ay.mjs";
-import "../../../../site-settings-B7vGFRDT.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../error-DIYXAVk4.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-5Y0W39xR.mjs";
-import { b as localeFilterQuery } from "../../../../redirects-1nhdEaTq.mjs";
-import "../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../media-Bs6qmlVl.mjs";
-import "../../../../comments-zrTgWBSg.mjs";
-import "../../../../byline-fields-BYbTptTU.mjs";
-import { t as createMenuBody } from "../../../../menus-mC_XTxD7.mjs";
-import "../../../../status-C6IrSLMT.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import { c as handleMenuList, t as handleMenuCreate } from "../../../../menus-CvVYfsuk.mjs";
+import { t as menuTag } from "../../../../chrome-tags-BIKBMZYO.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import "../../../../settings-GaZ5sVgg.mjs";
+import "../../../../site-settings-CDdT4mVm.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../error-DxgQdaZ_.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
+import { b as localeFilterQuery } from "../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../media-CRKsKlfK.mjs";
+import "../../../../comments-BzmIKVb2.mjs";
+import "../../../../byline-fields-Bze3ZdAw.mjs";
+import { t as createMenuBody } from "../../../../menus-D1HC8npj.mjs";
+import "../../../../status-Dl85BK39.mjs";
 import "../../../../api/schemas/index.mjs";
-import { i as requirePerm } from "../../../../authorize-CTGywswM.mjs";
+import { i as requirePerm } from "../../../../authorize-TdIGpRSE.mjs";
 
 //#region src/astro/routes/api/menus/index.ts
 const prerender = false;

package/dist/astro/routes/api/oauth/authorize.mjs

@@ -1,9 +1,9 @@
-import { r as getPublicOrigin } from "../../../../public-url-7j0cpCFc.mjs";
-import { t as escapeHtml } from "../../../../escape-B1GM0yJU.mjs";
-import { s as isValidScope } from "../../../../api-tokens-B4COohsb.mjs";
-import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "../../../../oauth-clients-BZWZvKXa.mjs";
-import "../../../../oauth-user-lookup-GWojfxRl.mjs";
-import { n as handleAuthorizationApproval, t as buildDeniedRedirect } from "../../../../oauth-authorization-BIHy9SGU.mjs";
+import { i as getPublicOrigin } from "../../../../public-url-uT1Ok2Tu.mjs";
+import { t as escapeHtml } from "../../../../escape-ESFhYzwG.mjs";
+import { s as isValidScope } from "../../../../api-tokens-D2zgAIEt.mjs";
+import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "../../../../oauth-clients-DVjRc9v3.mjs";
+import "../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { n as handleAuthorizationApproval, t as buildDeniedRedirect } from "../../../../oauth-authorization-B6ZJbMd2.mjs";
 
 //#region src/astro/routes/api/oauth/authorize.ts
 const prerender = false;

package/dist/astro/routes/api/oauth/device/authorize.mjs

@@ -1,12 +1,12 @@
-import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../api-tokens-B4COohsb.mjs";
-import "../../../../../oauth-user-lookup-GWojfxRl.mjs";
-import { n as handleDeviceCodeLookup, t as handleDeviceAuthorize } from "../../../../../device-flow-BlV_z24g.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { n as handleDeviceCodeLookup, t as handleDeviceAuthorize } from "../../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/device/authorize.ts

package/dist/astro/routes/api/oauth/device/code.mjs

@@ -1,15 +1,16 @@
-import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-C0eHXPd-.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-7j0cpCFc.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-D0BcE76H.mjs";
-import "../../../../../api-tokens-B4COohsb.mjs";
-import "../../../../../oauth-user-lookup-GWojfxRl.mjs";
-import { r as handleDeviceCodeRequest } from "../../../../../device-flow-BlV_z24g.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-d4Tk6biT.mjs";
+import { i as getPublicOrigin } from "../../../../../public-url-uT1Ok2Tu.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-Dvamvay-.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { r as handleDeviceCodeRequest } from "../../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/device/code.ts

package/dist/astro/routes/api/oauth/device/code.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"code.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/code.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/code\n *\n * Issue a device code + user code for the OAuth Device Flow.\n * This is an unauthenticated endpoint (the CLI doesn't have a token yet).\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceCodeRequest } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceCodeSchema = z.object({\n\tclient_id: z.string().optional(),\n\tscope: z.string().optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals, url }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceCodeSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/code\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Build the verification URI — device page lives inside the admin SPA\n\t\tconst verificationUri = new URL(\n\t\t\t\"/_emdash/admin/device\",\n\t\t\tgetPublicOrigin(url, emdash?.config),\n\t\t).toString();\n\n\t\tconst result = await handleDeviceCodeRequest(emdash.db, body, verificationUri);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create device code\", \"DEVICE_CODE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAEzB,MAAM,mBAAmB,EAAE,OAAO;CACjC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,UAAU;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,eAAe,IAAI,GAAG,EAC7D,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,kBAAkB,IAAI,IAC3B,yBACA,gBAAgB,KAAK,QAAQ,OAAO,CACpC,CAAC,UAAU;AAGZ,SAAO,aADQ,MAAM,wBAAwB,OAAO,IAAI,MAAM,gBAAgB,CACnD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,oBAAoB"}
+{"version":3,"file":"code.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/code.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/code\n *\n * Issue a device code + user code for the OAuth Device Flow.\n * This is an unauthenticated endpoint (the CLI doesn't have a token yet).\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceCodeRequest } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceCodeSchema = z.object({\n\tclient_id: z.string().optional(),\n\tscope: z.string().optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals, url }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceCodeSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/code\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Build the verification URI — device page lives inside the admin SPA\n\t\tconst verificationUri = new URL(\n\t\t\t\"/_emdash/admin/device\",\n\t\t\tgetPublicOrigin(url, emdash?.config),\n\t\t).toString();\n\n\t\tconst result = await handleDeviceCodeRequest(emdash.db, body, verificationUri);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create device code\", \"DEVICE_CODE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAEzB,MAAM,mBAAmB,EAAE,OAAO;CACjC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,UAAU;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,eAAe,IAAI,GAAG,EAC7D,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,kBAAkB,IAAI,IAC3B,yBACA,gBAAgB,KAAK,QAAQ,OAAO,CACpC,CAAC,UAAU;AAGZ,SAAO,aADQ,MAAM,wBAAwB,OAAO,IAAI,MAAM,gBAAgB,CACnD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,oBAAoB"}

package/dist/astro/routes/api/oauth/device/token.mjs

@@ -1,14 +1,15 @@
-import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-C0eHXPd-.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-D0BcE76H.mjs";
-import "../../../../../api-tokens-B4COohsb.mjs";
-import "../../../../../oauth-user-lookup-GWojfxRl.mjs";
-import { i as handleDeviceTokenExchange } from "../../../../../device-flow-BlV_z24g.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-d4Tk6biT.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-Dvamvay-.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { i as handleDeviceTokenExchange } from "../../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/device/token.ts

package/dist/astro/routes/api/oauth/device/token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"token.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/token.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/token\n *\n * CLI polls this endpoint to exchange a device code for tokens.\n * Returns RFC 8628 error codes during the polling phase.\n * This is an unauthenticated endpoint.\n *\n * Rate limited: 12 requests per minute per IP.\n * Also enforces RFC 8628 slow_down: if polled faster than the interval,\n * responds with { error: \"slow_down\", interval: N } and increases the interval by 5s.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceTokenExchange } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceTokenSchema = z.object({\n\tdevice_code: z.string().min(1),\n\tgrant_type: z.string().min(1),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceTokenSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 12 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/token\", 12, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\tconst result = await handleDeviceTokenExchange(emdash.db, body);\n\n\t\t// RFC 8628 requires specific error format for device flow errors\n\t\t// RFC 6749 §5.1 requires Cache-Control: no-store + Pragma: no-cache on token responses\n\t\tif (!result.success && result.deviceFlowError) {\n\t\t\tconst errorBody: { error: string; interval?: number } = { error: result.deviceFlowError };\n\t\t\tif (result.deviceFlowInterval !== undefined) {\n\t\t\t\terrorBody.interval = result.deviceFlowInterval;\n\t\t\t}\n\t\t\treturn Response.json(errorBody, {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"Cache-Control\": \"no-store\",\n\t\t\t\t\tPragma: \"no-cache\",\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to exchange device code\", \"TOKEN_EXCHANGE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAClC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC9B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC7B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,gBAAgB,IAAI,GAAG,EAC9D,QACd,QAAO,kBAAkB,GAAG;EAG7B,MAAM,SAAS,MAAM,0BAA0B,OAAO,IAAI,KAAK;AAI/D,MAAI,CAAC,OAAO,WAAW,OAAO,iBAAiB;GAC9C,MAAM,YAAkD,EAAE,OAAO,OAAO,iBAAiB;AACzF,OAAI,OAAO,uBAAuB,OACjC,WAAU,WAAW,OAAO;AAE7B,UAAO,SAAS,KAAK,WAAW;IAC/B,QAAQ;IACR,SAAS;KACR,gBAAgB;KAChB,iBAAiB;KACjB,QAAQ;KACR;IACD,CAAC;;AAGH,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,uBAAuB"}
+{"version":3,"file":"token.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/token.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/token\n *\n * CLI polls this endpoint to exchange a device code for tokens.\n * Returns RFC 8628 error codes during the polling phase.\n * This is an unauthenticated endpoint.\n *\n * Rate limited: 12 requests per minute per IP.\n * Also enforces RFC 8628 slow_down: if polled faster than the interval,\n * responds with { error: \"slow_down\", interval: N } and increases the interval by 5s.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceTokenExchange } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceTokenSchema = z.object({\n\tdevice_code: z.string().min(1),\n\tgrant_type: z.string().min(1),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceTokenSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 12 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/token\", 12, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\tconst result = await handleDeviceTokenExchange(emdash.db, body);\n\n\t\t// RFC 8628 requires specific error format for device flow errors\n\t\t// RFC 6749 §5.1 requires Cache-Control: no-store + Pragma: no-cache on token responses\n\t\tif (!result.success && result.deviceFlowError) {\n\t\t\tconst errorBody: { error: string; interval?: number } = { error: result.deviceFlowError };\n\t\t\tif (result.deviceFlowInterval !== undefined) {\n\t\t\t\terrorBody.interval = result.deviceFlowInterval;\n\t\t\t}\n\t\t\treturn Response.json(errorBody, {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"Cache-Control\": \"no-store\",\n\t\t\t\t\tPragma: \"no-cache\",\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to exchange device code\", \"TOKEN_EXCHANGE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAClC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC9B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC7B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,gBAAgB,IAAI,GAAG,EAC9D,QACd,QAAO,kBAAkB,GAAG;EAG7B,MAAM,SAAS,MAAM,0BAA0B,OAAO,IAAI,KAAK;AAI/D,MAAI,CAAC,OAAO,WAAW,OAAO,iBAAiB;GAC9C,MAAM,YAAkD,EAAE,OAAO,OAAO,iBAAiB;AACzF,OAAI,OAAO,uBAAuB,OACjC,WAAU,WAAW,OAAO;AAE7B,UAAO,SAAS,KAAK,WAAW;IAC/B,QAAQ;IACR,SAAS;KACR,gBAAgB;KAChB,iBAAiB;KACjB,QAAQ;KACR;IACD,CAAC;;AAGH,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,uBAAuB"}

package/dist/astro/routes/api/oauth/register.mjs

@@ -1,11 +1,12 @@
-import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import { r as handleError, t as apiError } from "../../../../error-DIYXAVk4.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../trusted-proxy-C0eHXPd-.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../rate-limit-D0BcE76H.mjs";
-import { t as handleOAuthClientCreate } from "../../../../oauth-clients-BZWZvKXa.mjs";
+import "../../../../after-PcEvMY_6.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import { r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../trusted-proxy-d4Tk6biT.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../rate-limit-Dvamvay-.mjs";
+import { t as handleOAuthClientCreate } from "../../../../oauth-clients-DVjRc9v3.mjs";
 
 //#region src/astro/routes/api/oauth/register.ts
 const prerender = false;

package/dist/astro/routes/api/oauth/register.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"register.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/register.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/register\n *\n * RFC 7591 Dynamic Client Registration. Public, unauthenticated.\n * MCP clients (e.g. Claude Code) call this to register themselves\n * before starting the OAuth authorization flow.\n *\n * Rate limited: 10 registrations per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { handleOAuthClientCreate } from \"#api/handlers/oauth-clients.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst OAUTH_REGISTRATION_HEADERS: HeadersInit = {\n\t\"Cache-Control\": \"no-store\",\n\tPragma: \"no-cache\",\n\t// RFC 7591 dynamic client registration is called cross-origin by MCP clients,\n\t// CLIs, and native apps. The endpoint is anonymous and carries no ambient\n\t// credentials, so CORS `*` is safe.\n\t\"Access-Control-Allow-Origin\": \"*\",\n};\n\nconst OAUTH_PREFLIGHT_HEADERS: HeadersInit = {\n\t\"Access-Control-Allow-Origin\": \"*\",\n\t\"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n\t\"Access-Control-Allow-Headers\": \"Content-Type\",\n\t\"Access-Control-Max-Age\": \"86400\",\n};\n\nconst SUPPORTED_GRANT_TYPES = new Set([\n\t\"authorization_code\",\n\t\"refresh_token\",\n\t\"urn:ietf:params:oauth:grant-type:device_code\",\n]);\nconst SUPPORTED_RESPONSE_TYPES = new Set([\"code\"]);\n\nfunction registrationError(\n\tdescription: string,\n\tstatus = 400,\n\terror = \"invalid_client_metadata\",\n): Response {\n\treturn Response.json(\n\t\t{\n\t\t\terror,\n\t\t\terror_description: description,\n\t\t},\n\t\t{ status, headers: OAUTH_REGISTRATION_HEADERS },\n\t);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n\treturn Array.isArray(value) && value.every((item) => typeof item === \"string\");\n}\n\nfunction parseScope(value: unknown): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (typeof value === \"string\") {\n\t\tconst scopes = value.split(\" \").filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\tif (isStringArray(value)) {\n\t\tconst scopes = value.filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\treturn registrationError(\"scope must be a string or array of strings\");\n}\n\nfunction parseSupportedStringArray(\n\tvalue: unknown,\n\tfield: string,\n\tsupported: ReadonlySet<string>,\n): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (!isStringArray(value)) {\n\t\treturn registrationError(`${field} must be an array of strings`);\n\t}\n\tconst invalidValue = value.find((item) => !supported.has(item));\n\tif (invalidValue) {\n\t\treturn registrationError(`${field} contains unsupported value: ${invalidValue}`);\n\t}\n\treturn value;\n}\n\nexport const OPTIONS: APIRoute = () => {\n\treturn new Response(null, { status: 204, headers: OAUTH_PREFLIGHT_HEADERS });\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await request.json();\n\t\t} catch {\n\t\t\treturn registrationError(\"Request body must be valid JSON\");\n\t\t}\n\n\t\tif (!isRecord(body)) {\n\t\t\treturn registrationError(\"Request body must be a JSON object\");\n\t\t}\n\n\t\t// redirect_uris is the only required field per RFC 7591 §2\n\t\tif (!isStringArray(body.redirect_uris) || body.redirect_uris.length === 0) {\n\t\t\treturn registrationError(\"redirect_uris must be a non-empty array of strings\");\n\t\t}\n\n\t\tif (\n\t\t\tbody.token_endpoint_auth_method !== undefined &&\n\t\t\tbody.token_endpoint_auth_method !== \"none\"\n\t\t) {\n\t\t\treturn registrationError(\"Only token_endpoint_auth_method=none is supported\");\n\t\t}\n\n\t\tconst grantTypes = parseSupportedStringArray(\n\t\t\tbody.grant_types,\n\t\t\t\"grant_types\",\n\t\t\tSUPPORTED_GRANT_TYPES,\n\t\t);\n\t\tif (grantTypes instanceof Response) {\n\t\t\treturn grantTypes;\n\t\t}\n\n\t\tconst responseTypes = parseSupportedStringArray(\n\t\t\tbody.response_types,\n\t\t\t\"response_types\",\n\t\t\tSUPPORTED_RESPONSE_TYPES,\n\t\t);\n\t\tif (responseTypes instanceof Response) {\n\t\t\treturn responseTypes;\n\t\t}\n\n\t\tconst scopes = parseScope(body.scope);\n\t\tif (scopes instanceof Response) {\n\t\t\treturn scopes;\n\t\t}\n\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"oauth/register\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\tconst response = registrationError(\n\t\t\t\t\"Too many registration requests. Please try again later.\",\n\t\t\t\t429,\n\t\t\t\t\"temporarily_unavailable\",\n\t\t\t);\n\t\t\tresponse.headers.set(\"Retry-After\", \"60\");\n\t\t\treturn response;\n\t\t}\n\n\t\tconst clientId = crypto.randomUUID();\n\t\tconst clientName =\n\t\t\ttypeof body.client_name === \"string\" && body.client_name\n\t\t\t\t? body.client_name\n\t\t\t\t: `dynamic-${clientId.slice(0, 8)}`;\n\n\t\tconst result = await handleOAuthClientCreate(emdash.db, {\n\t\t\tid: clientId,\n\t\t\tname: clientName,\n\t\t\tredirectUris: body.redirect_uris,\n\t\t\tscopes,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\treturn registrationError(result.error.message);\n\t\t}\n\n\t\t// RFC 7591 §3.2.1 response\n\t\treturn Response.json(\n\t\t\t{\n\t\t\t\tclient_id: result.data.id,\n\t\t\t\tclient_id_issued_at: Math.floor(new Date(result.data.createdAt).getTime() / 1000),\n\t\t\t\tredirect_uris: result.data.redirectUris,\n\t\t\t\tclient_name: result.data.name,\n\t\t\t\tgrant_types: grantTypes ?? [\"authorization_code\", \"refresh_token\"],\n\t\t\t\tresponse_types: responseTypes ?? [\"code\"],\n\t\t\t\ttoken_endpoint_auth_method: \"none\",\n\t\t\t\tscope: result.data.scopes ? result.data.scopes.join(\" \") : undefined,\n\t\t\t},\n\t\t\t{ status: 201, headers: OAUTH_REGISTRATION_HEADERS },\n\t\t);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to register OAuth client\", \"CLIENT_REGISTER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAM,6BAA0C;CAC/C,iBAAiB;CACjB,QAAQ;CAIR,+BAA+B;CAC/B;AAED,MAAM,0BAAuC;CAC5C,+BAA+B;CAC/B,gCAAgC;CAChC,gCAAgC;CAChC,0BAA0B;CAC1B;AAED,MAAM,wBAAwB,IAAI,IAAI;CACrC;CACA;CACA;CACA,CAAC;AACF,MAAM,2BAA2B,IAAI,IAAI,CAAC,OAAO,CAAC;AAElD,SAAS,kBACR,aACA,SAAS,KACT,QAAQ,2BACG;AACX,QAAO,SAAS,KACf;EACC;EACA,mBAAmB;EACnB,EACD;EAAE;EAAQ,SAAS;EAA4B,CAC/C;;AAGF,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,cAAc,OAAmC;AACzD,QAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,OAAO,SAAS,OAAO,SAAS,SAAS;;AAG/E,SAAS,WAAW,OAAiD;AACpE,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ;AAC/C,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,KAAI,cAAc,MAAM,EAAE;EACzB,MAAM,SAAS,MAAM,OAAO,QAAQ;AACpC,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,QAAO,kBAAkB,6CAA6C;;AAGvE,SAAS,0BACR,OACA,OACA,WACkC;AAClC,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,CAAC,cAAc,MAAM,CACxB,QAAO,kBAAkB,GAAG,MAAM,8BAA8B;CAEjE,MAAM,eAAe,MAAM,MAAM,SAAS,CAAC,UAAU,IAAI,KAAK,CAAC;AAC/D,KAAI,aACH,QAAO,kBAAkB,GAAG,MAAM,+BAA+B,eAAe;AAEjF,QAAO;;AAGR,MAAa,gBAA0B;AACtC,QAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK,SAAS;EAAyB,CAAC;;AAG7E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,IAAI;AACJ,MAAI;AACH,UAAO,MAAM,QAAQ,MAAM;UACpB;AACP,UAAO,kBAAkB,kCAAkC;;AAG5D,MAAI,CAAC,SAAS,KAAK,CAClB,QAAO,kBAAkB,qCAAqC;AAI/D,MAAI,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,cAAc,WAAW,EACvE,QAAO,kBAAkB,qDAAqD;AAG/E,MACC,KAAK,+BAA+B,UACpC,KAAK,+BAA+B,OAEpC,QAAO,kBAAkB,oDAAoD;EAG9E,MAAM,aAAa,0BAClB,KAAK,aACL,eACA,sBACA;AACD,MAAI,sBAAsB,SACzB,QAAO;EAGR,MAAM,gBAAgB,0BACrB,KAAK,gBACL,kBACA,yBACA;AACD,MAAI,yBAAyB,SAC5B,QAAO;EAGR,MAAM,SAAS,WAAW,KAAK,MAAM;AACrC,MAAI,kBAAkB,SACrB,QAAO;EAGR,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,IAAI,GAAG,EAChE,SAAS;GACvB,MAAM,WAAW,kBAChB,2DACA,KACA,0BACA;AACD,YAAS,QAAQ,IAAI,eAAe,KAAK;AACzC,UAAO;;EAGR,MAAM,WAAW,OAAO,YAAY;EACpC,MAAM,aACL,OAAO,KAAK,gBAAgB,YAAY,KAAK,cAC1C,KAAK,cACL,WAAW,SAAS,MAAM,GAAG,EAAE;EAEnC,MAAM,SAAS,MAAM,wBAAwB,OAAO,IAAI;GACvD,IAAI;GACJ,MAAM;GACN,cAAc,KAAK;GACnB;GACA,CAAC;AAEF,MAAI,CAAC,OAAO,QACX,QAAO,kBAAkB,OAAO,MAAM,QAAQ;AAI/C,SAAO,SAAS,KACf;GACC,WAAW,OAAO,KAAK;GACvB,qBAAqB,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,UAAU,CAAC,SAAS,GAAG,IAAK;GACjF,eAAe,OAAO,KAAK;GAC3B,aAAa,OAAO,KAAK;GACzB,aAAa,cAAc,CAAC,sBAAsB,gBAAgB;GAClE,gBAAgB,iBAAiB,CAAC,OAAO;GACzC,4BAA4B;GAC5B,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,OAAO,KAAK,IAAI,GAAG;GAC3D,EACD;GAAE,QAAQ;GAAK,SAAS;GAA4B,CACpD;UACO,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,wBAAwB"}
+{"version":3,"file":"register.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/register.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/register\n *\n * RFC 7591 Dynamic Client Registration. Public, unauthenticated.\n * MCP clients (e.g. Claude Code) call this to register themselves\n * before starting the OAuth authorization flow.\n *\n * Rate limited: 10 registrations per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { handleOAuthClientCreate } from \"#api/handlers/oauth-clients.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst OAUTH_REGISTRATION_HEADERS: HeadersInit = {\n\t\"Cache-Control\": \"no-store\",\n\tPragma: \"no-cache\",\n\t// RFC 7591 dynamic client registration is called cross-origin by MCP clients,\n\t// CLIs, and native apps. The endpoint is anonymous and carries no ambient\n\t// credentials, so CORS `*` is safe.\n\t\"Access-Control-Allow-Origin\": \"*\",\n};\n\nconst OAUTH_PREFLIGHT_HEADERS: HeadersInit = {\n\t\"Access-Control-Allow-Origin\": \"*\",\n\t\"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n\t\"Access-Control-Allow-Headers\": \"Content-Type\",\n\t\"Access-Control-Max-Age\": \"86400\",\n};\n\nconst SUPPORTED_GRANT_TYPES = new Set([\n\t\"authorization_code\",\n\t\"refresh_token\",\n\t\"urn:ietf:params:oauth:grant-type:device_code\",\n]);\nconst SUPPORTED_RESPONSE_TYPES = new Set([\"code\"]);\n\nfunction registrationError(\n\tdescription: string,\n\tstatus = 400,\n\terror = \"invalid_client_metadata\",\n): Response {\n\treturn Response.json(\n\t\t{\n\t\t\terror,\n\t\t\terror_description: description,\n\t\t},\n\t\t{ status, headers: OAUTH_REGISTRATION_HEADERS },\n\t);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n\treturn Array.isArray(value) && value.every((item) => typeof item === \"string\");\n}\n\nfunction parseScope(value: unknown): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (typeof value === \"string\") {\n\t\tconst scopes = value.split(\" \").filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\tif (isStringArray(value)) {\n\t\tconst scopes = value.filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\treturn registrationError(\"scope must be a string or array of strings\");\n}\n\nfunction parseSupportedStringArray(\n\tvalue: unknown,\n\tfield: string,\n\tsupported: ReadonlySet<string>,\n): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (!isStringArray(value)) {\n\t\treturn registrationError(`${field} must be an array of strings`);\n\t}\n\tconst invalidValue = value.find((item) => !supported.has(item));\n\tif (invalidValue) {\n\t\treturn registrationError(`${field} contains unsupported value: ${invalidValue}`);\n\t}\n\treturn value;\n}\n\nexport const OPTIONS: APIRoute = () => {\n\treturn new Response(null, { status: 204, headers: OAUTH_PREFLIGHT_HEADERS });\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await request.json();\n\t\t} catch {\n\t\t\treturn registrationError(\"Request body must be valid JSON\");\n\t\t}\n\n\t\tif (!isRecord(body)) {\n\t\t\treturn registrationError(\"Request body must be a JSON object\");\n\t\t}\n\n\t\t// redirect_uris is the only required field per RFC 7591 §2\n\t\tif (!isStringArray(body.redirect_uris) || body.redirect_uris.length === 0) {\n\t\t\treturn registrationError(\"redirect_uris must be a non-empty array of strings\");\n\t\t}\n\n\t\tif (\n\t\t\tbody.token_endpoint_auth_method !== undefined &&\n\t\t\tbody.token_endpoint_auth_method !== \"none\"\n\t\t) {\n\t\t\treturn registrationError(\"Only token_endpoint_auth_method=none is supported\");\n\t\t}\n\n\t\tconst grantTypes = parseSupportedStringArray(\n\t\t\tbody.grant_types,\n\t\t\t\"grant_types\",\n\t\t\tSUPPORTED_GRANT_TYPES,\n\t\t);\n\t\tif (grantTypes instanceof Response) {\n\t\t\treturn grantTypes;\n\t\t}\n\n\t\tconst responseTypes = parseSupportedStringArray(\n\t\t\tbody.response_types,\n\t\t\t\"response_types\",\n\t\t\tSUPPORTED_RESPONSE_TYPES,\n\t\t);\n\t\tif (responseTypes instanceof Response) {\n\t\t\treturn responseTypes;\n\t\t}\n\n\t\tconst scopes = parseScope(body.scope);\n\t\tif (scopes instanceof Response) {\n\t\t\treturn scopes;\n\t\t}\n\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"oauth/register\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\tconst response = registrationError(\n\t\t\t\t\"Too many registration requests. Please try again later.\",\n\t\t\t\t429,\n\t\t\t\t\"temporarily_unavailable\",\n\t\t\t);\n\t\t\tresponse.headers.set(\"Retry-After\", \"60\");\n\t\t\treturn response;\n\t\t}\n\n\t\tconst clientId = crypto.randomUUID();\n\t\tconst clientName =\n\t\t\ttypeof body.client_name === \"string\" && body.client_name\n\t\t\t\t? body.client_name\n\t\t\t\t: `dynamic-${clientId.slice(0, 8)}`;\n\n\t\tconst result = await handleOAuthClientCreate(emdash.db, {\n\t\t\tid: clientId,\n\t\t\tname: clientName,\n\t\t\tredirectUris: body.redirect_uris,\n\t\t\tscopes,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\treturn registrationError(result.error.message);\n\t\t}\n\n\t\t// RFC 7591 §3.2.1 response\n\t\treturn Response.json(\n\t\t\t{\n\t\t\t\tclient_id: result.data.id,\n\t\t\t\tclient_id_issued_at: Math.floor(new Date(result.data.createdAt).getTime() / 1000),\n\t\t\t\tredirect_uris: result.data.redirectUris,\n\t\t\t\tclient_name: result.data.name,\n\t\t\t\tgrant_types: grantTypes ?? [\"authorization_code\", \"refresh_token\"],\n\t\t\t\tresponse_types: responseTypes ?? [\"code\"],\n\t\t\t\ttoken_endpoint_auth_method: \"none\",\n\t\t\t\tscope: result.data.scopes ? result.data.scopes.join(\" \") : undefined,\n\t\t\t},\n\t\t\t{ status: 201, headers: OAUTH_REGISTRATION_HEADERS },\n\t\t);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to register OAuth client\", \"CLIENT_REGISTER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAM,6BAA0C;CAC/C,iBAAiB;CACjB,QAAQ;CAIR,+BAA+B;CAC/B;AAED,MAAM,0BAAuC;CAC5C,+BAA+B;CAC/B,gCAAgC;CAChC,gCAAgC;CAChC,0BAA0B;CAC1B;AAED,MAAM,wBAAwB,IAAI,IAAI;CACrC;CACA;CACA;CACA,CAAC;AACF,MAAM,2BAA2B,IAAI,IAAI,CAAC,OAAO,CAAC;AAElD,SAAS,kBACR,aACA,SAAS,KACT,QAAQ,2BACG;AACX,QAAO,SAAS,KACf;EACC;EACA,mBAAmB;EACnB,EACD;EAAE;EAAQ,SAAS;EAA4B,CAC/C;;AAGF,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,cAAc,OAAmC;AACzD,QAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,OAAO,SAAS,OAAO,SAAS,SAAS;;AAG/E,SAAS,WAAW,OAAiD;AACpE,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ;AAC/C,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,KAAI,cAAc,MAAM,EAAE;EACzB,MAAM,SAAS,MAAM,OAAO,QAAQ;AACpC,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,QAAO,kBAAkB,6CAA6C;;AAGvE,SAAS,0BACR,OACA,OACA,WACkC;AAClC,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,CAAC,cAAc,MAAM,CACxB,QAAO,kBAAkB,GAAG,MAAM,8BAA8B;CAEjE,MAAM,eAAe,MAAM,MAAM,SAAS,CAAC,UAAU,IAAI,KAAK,CAAC;AAC/D,KAAI,aACH,QAAO,kBAAkB,GAAG,MAAM,+BAA+B,eAAe;AAEjF,QAAO;;AAGR,MAAa,gBAA0B;AACtC,QAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK,SAAS;EAAyB,CAAC;;AAG7E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,IAAI;AACJ,MAAI;AACH,UAAO,MAAM,QAAQ,MAAM;UACpB;AACP,UAAO,kBAAkB,kCAAkC;;AAG5D,MAAI,CAAC,SAAS,KAAK,CAClB,QAAO,kBAAkB,qCAAqC;AAI/D,MAAI,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,cAAc,WAAW,EACvE,QAAO,kBAAkB,qDAAqD;AAG/E,MACC,KAAK,+BAA+B,UACpC,KAAK,+BAA+B,OAEpC,QAAO,kBAAkB,oDAAoD;EAG9E,MAAM,aAAa,0BAClB,KAAK,aACL,eACA,sBACA;AACD,MAAI,sBAAsB,SACzB,QAAO;EAGR,MAAM,gBAAgB,0BACrB,KAAK,gBACL,kBACA,yBACA;AACD,MAAI,yBAAyB,SAC5B,QAAO;EAGR,MAAM,SAAS,WAAW,KAAK,MAAM;AACrC,MAAI,kBAAkB,SACrB,QAAO;EAGR,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,IAAI,GAAG,EAChE,SAAS;GACvB,MAAM,WAAW,kBAChB,2DACA,KACA,0BACA;AACD,YAAS,QAAQ,IAAI,eAAe,KAAK;AACzC,UAAO;;EAGR,MAAM,WAAW,OAAO,YAAY;EACpC,MAAM,aACL,OAAO,KAAK,gBAAgB,YAAY,KAAK,cAC1C,KAAK,cACL,WAAW,SAAS,MAAM,GAAG,EAAE;EAEnC,MAAM,SAAS,MAAM,wBAAwB,OAAO,IAAI;GACvD,IAAI;GACJ,MAAM;GACN,cAAc,KAAK;GACnB;GACA,CAAC;AAEF,MAAI,CAAC,OAAO,QACX,QAAO,kBAAkB,OAAO,MAAM,QAAQ;AAI/C,SAAO,SAAS,KACf;GACC,WAAW,OAAO,KAAK;GACvB,qBAAqB,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,UAAU,CAAC,SAAS,GAAG,IAAK;GACjF,eAAe,OAAO,KAAK;GAC3B,aAAa,OAAO,KAAK;GACzB,aAAa,cAAc,CAAC,sBAAsB,gBAAgB;GAClE,gBAAgB,iBAAiB,CAAC,OAAO;GACzC,4BAA4B;GAC5B,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,OAAO,KAAK,IAAI,GAAG;GAC3D,EACD;GAAE,QAAQ;GAAK,SAAS;GAA4B,CACpD;UACO,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,wBAAwB"}

package/dist/astro/routes/api/oauth/token/refresh.mjs

@@ -1,12 +1,12 @@
-import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../api-tokens-B4COohsb.mjs";
-import "../../../../../oauth-user-lookup-GWojfxRl.mjs";
-import { a as handleTokenRefresh } from "../../../../../device-flow-BlV_z24g.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { a as handleTokenRefresh } from "../../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/token/refresh.ts

package/dist/astro/routes/api/oauth/token/revoke.mjs

@@ -1,12 +1,12 @@
-import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../api-tokens-B4COohsb.mjs";
-import "../../../../../oauth-user-lookup-GWojfxRl.mjs";
-import { o as handleTokenRevoke } from "../../../../../device-flow-BlV_z24g.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { o as handleTokenRevoke } from "../../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/token/revoke.ts

package/dist/astro/routes/api/oauth/token.mjs

@@ -1,12 +1,12 @@
-import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import { r as handleError, t as apiError } from "../../../../error-DIYXAVk4.mjs";
-import "../../../../api-tokens-B4COohsb.mjs";
-import "../../../../oauth-user-lookup-GWojfxRl.mjs";
-import { r as handleAuthorizationCodeExchange } from "../../../../oauth-authorization-BIHy9SGU.mjs";
-import { a as handleTokenRefresh, i as handleDeviceTokenExchange } from "../../../../device-flow-BlV_z24g.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import { r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
+import "../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { r as handleAuthorizationCodeExchange } from "../../../../oauth-authorization-B6ZJbMd2.mjs";
+import { a as handleTokenRefresh, i as handleDeviceTokenExchange } from "../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/token.ts

package/dist/astro/routes/api/openapi.json.mjs

@@ -1,27 +1,27 @@
 import "../../../dialect-helpers-7_IqPdh9.mjs";
 import "../../../config-CvmjJcVw.mjs";
-import "../../../base64-DvnNgP7e.mjs";
+import "../../../base64-BQBZwXCx.mjs";
 import "../../../url-Dn3IStq8.mjs";
-import "../../../types-j6MBDjlZ.mjs";
-import "../../../errors-CjXd1LgH.mjs";
-import "../../../canonical-CAecl1UQ.mjs";
-import "../../../digest-DiYAoZpf.mjs";
-import "../../../errors-CNvATh_7.mjs";
-import "../../../settings-CwcrX-Ay.mjs";
-import "../../../site-settings-B7vGFRDT.mjs";
-import { r as handleError } from "../../../error-DIYXAVk4.mjs";
-import { T as successEnvelope, _ as deleteResponseSchema, a as notFoundPruneBody, d as redirectsListQuery, f as updateRedirectBody, i as notFoundListResponseSchema, l as redirectListResponseSchema, m as apiErrorSchema, r as notFoundListQuery, s as notFoundSummaryResponseSchema, t as createRedirectBody, u as redirectSchema, x as mediaDeleteResponseSchema } from "../../../redirects-1nhdEaTq.mjs";
-import { $ as activateBlockTypeVersionBody, A as createSectionBody, At as contentItemSchema, B as taxonomyDefTranslationsSchema, C as searchQuery, Ct as updateCollectionBody, D as searchSuggestQuery, Dt as contentCompareResponseSchema, Et as contentAuthorsResponseSchema, Ft as contentResponseSchema, G as termListResponseSchema, Gt as contentTrashQuery, H as taxonomyResponseSchema, Ht as contentTermsResponseSchema, It as contentRestoreResponseSchema, K as termReorderResponseSchema, Kt as contentUpdateBody, L as createTermBody, Lt as contentRevisionConditionBody, M as sectionSchema, Mt as contentListResponseSchema, N as sectionsListQuery, O as settingsUpdateBody, Ot as contentCreateBody, P as updateSectionBody, Pt as contentPublishBody, Q as updateTermBody, R as reorderTermsBody, Rt as contentScheduleBody, S as searchEnableBody, St as updateBlockTypeBody, T as searchResponseSchema, U as termGetResponseSchema, V as taxonomyListResponseSchema, Vt as contentTermsBody, W as termListQuery, Wt as contentTranslationsResponseSchema, Yt as trashedContentListResponseSchema, Z as updateTaxonomyDefBody, _ as userDetailSchema, a as entryLockStatusSchema, at as collectionGetQuery, b as userUpdateBody, c as createWidgetBody, ct as collectionResponseSchema, d as widgetAreaSchema, dt as createBlockTypeBody, f as widgetAreaWithWidgetsAndCountSchema, ft as createCollectionBody, g as allowedDomainUpdateBody, gt as fieldResponseSchema, h as allowedDomainCreateBody, ht as fieldReorderBody, i as entryLockReleaseResponseSchema, j as sectionListResponseSchema, jt as contentListQuery, k as siteSettingsSchema, l as reorderWidgetsBody, m as widgetSchema, mt as fieldListResponseSchema, nt as blockTypeResponseSchema, o as entryMutationConflictSchema, ot as collectionListResponseSchema, p as widgetAreaWithWidgetsSchema, pt as createFieldBody, q as termResponseSchema, s as createWidgetAreaBody, st as collectionReorderBody, t as entryLockAcquireBody, tt as blockTypeListResponseSchema, u as updateWidgetBody, ut as collectionWithFieldsResponseSchema, v as userListResponseSchema, vt as orphanRegisterBody, w as searchRebuildBody, wt as updateFieldBody, x as usersListQuery, y as userSchema, yt as orphanedTableListResponseSchema } from "../../../entry-lock-yIkBduqJ.mjs";
-import { $ as mediaUsageProgressSchema, B as mediaUsageCollectionDeletionListQuery, C as mediaReplaceBody, D as mediaStreamUploadResponseSchema, E as mediaResponseSchema, F as mediaUsageActivationAdvanceResponseSchema, I as mediaUsageActivationConflictSchema, J as mediaUsageDetailsQuery, M as mediaUploadUrlBody, N as mediaUploadUrlResponseSchema, O as mediaUpdateBody, P as mediaUsageActivationAdvanceBody, Q as mediaUsageProgressAdvanceResponseSchema, R as mediaUsageActivationStatusSchema, S as mediaReadResponseSchema, T as mediaReplaceResponseSchema, U as mediaUsageCollectionDeletionRetryBody, V as mediaUsageCollectionDeletionListResponseSchema, W as mediaUsageCollectionDeletionRetryResponseSchema, Y as mediaUsageDetailsResponseSchema, a as mediaConfirmResponseSchema, c as mediaFolderBody, ct as mediaUsageWorkListQuery, d as mediaFolderListResponseSchema, dt as mediaUsageWorkRetryConflictSchema, et as mediaUsageRepairBody, f as mediaFolderResponseSchema, ft as mediaUsageWorkRetryResponseSchema, g as mediaListQuery, i as mediaConfirmBody, j as mediaUploadResponseSchema, l as mediaFolderIdSchema, lt as mediaUsageWorkListResponseSchema, m as mediaGetQuery, n as DEFAULT_MAX_UPLOAD_SIZE, nt as mediaUsageRepairResponseSchema, o as mediaDirectUploadBody, s as mediaExistingResponseSchema, u as mediaFolderListQuery, ut as mediaUsageWorkRetryBody, v as mediaListReadResponseSchema, y as mediaListResponseSchema } from "../../../media-Bs6qmlVl.mjs";
-import { a as commentListQuery, c as createCommentBody, i as commentCountsResponseSchema, n as commentBulkBody, o as commentSchema, r as commentBulkResponseSchema, s as commentStatusBody, t as adminCommentListResponseSchema, u as publicCommentListResponseSchema } from "../../../comments-zrTgWBSg.mjs";
-import { a as menuListItemSchema, c as menuWithItemsSchema, d as updateMenuBody, f as updateMenuItemBody, l as reorderMenuItemsBody, n as createMenuItemBody, r as menuItemSchema, t as createMenuBody } from "../../../menus-mC_XTxD7.mjs";
-import "../../../status-C6IrSLMT.mjs";
-import "../../../kinds-D1A-00-F.mjs";
-import "../../../transformations-BtQdvyly.mjs";
-import "../../../version-CseoDDOd.mjs";
-import "../../../approvals-CVvJSEBF.mjs";
-import "../../../plan-Lw7iGnGD.mjs";
-import { _ as transferOperationListResponseSchema, a as transferCapabilitiesSchema, c as transferFileUploadResponseSchema, d as transferImportCreateResponseSchema, f as transferImportExecuteBody, g as transferMissingFilesResponseSchema, h as transferImportStatusResponseSchema, i as transferApprovalResponseSchema, l as transferImportAnalyzeBody, m as transferImportReceiptResponseSchema, n as transferApprovalListQuery, o as transferExportCreateBody, p as transferImportPlanResponseSchema, r as transferApprovalListResponseSchema, s as transferExportCreateResponseSchema, t as transferAdvanceResponseSchema, u as transferImportAnalyzeResponseSchema, v as transferOperationResponseSchema, y as transferPaginationQuery } from "../../../transfer-9fVSxyrV.mjs";
+import "../../../types-C-Xp0CcN.mjs";
+import "../../../errors-CjtE5aWF.mjs";
+import "../../../canonical-BUcKRYpG.mjs";
+import "../../../digest-xJmyPv2r.mjs";
+import "../../../errors-hskQ0C8G.mjs";
+import "../../../settings-GaZ5sVgg.mjs";
+import "../../../site-settings-CDdT4mVm.mjs";
+import { r as handleError } from "../../../error-DxgQdaZ_.mjs";
+import { T as successEnvelope, _ as deleteResponseSchema, a as notFoundPruneBody, d as redirectsListQuery, f as updateRedirectBody, i as notFoundListResponseSchema, l as redirectListResponseSchema, m as apiErrorSchema, r as notFoundListQuery, s as notFoundSummaryResponseSchema, t as createRedirectBody, u as redirectSchema, x as mediaDeleteResponseSchema } from "../../../redirects-DFT7Wr-e.mjs";
+import { $ as activateBlockTypeVersionBody, A as createSectionBody, B as taxonomyDefTranslationsSchema, C as searchQuery, Ct as updateCollectionBody, D as searchSuggestQuery, Dt as contentAuthorsResponseSchema, Ft as contentPublishBody, G as termListResponseSchema, Gt as contentTranslationsResponseSchema, H as taxonomyResponseSchema, Ht as contentTermsBody, It as contentResponseSchema, K as termReorderResponseSchema, Kt as contentTrashQuery, L as createTermBody, Lt as contentRestoreResponseSchema, M as sectionSchema, Mt as contentListQuery, N as sectionsListQuery, Nt as contentListResponseSchema, O as settingsUpdateBody, Ot as contentCompareResponseSchema, P as updateSectionBody, Q as updateTermBody, R as reorderTermsBody, Rt as contentRevisionConditionBody, S as searchEnableBody, St as updateBlockTypeBody, T as searchResponseSchema, U as termGetResponseSchema, Ut as contentTermsResponseSchema, V as taxonomyListResponseSchema, W as termListQuery, Xt as trashedContentListResponseSchema, Z as updateTaxonomyDefBody, _ as userDetailSchema, a as entryLockStatusSchema, at as collectionGetQuery, b as userUpdateBody, c as createWidgetBody, ct as collectionResponseSchema, d as widgetAreaSchema, dt as createBlockTypeBody, f as widgetAreaWithWidgetsAndCountSchema, ft as createCollectionBody, g as allowedDomainUpdateBody, gt as fieldResponseSchema, h as allowedDomainCreateBody, ht as fieldReorderBody, i as entryLockReleaseResponseSchema, j as sectionListResponseSchema, jt as contentItemSchema, k as siteSettingsSchema, kt as contentCreateBody, l as reorderWidgetsBody, m as widgetSchema, mt as fieldListResponseSchema, nt as blockTypeResponseSchema, o as entryMutationConflictSchema, ot as collectionListResponseSchema, p as widgetAreaWithWidgetsSchema, pt as createFieldBody, q as termResponseSchema, qt as contentUpdateBody, s as createWidgetAreaBody, st as collectionReorderBody, t as entryLockAcquireBody, tt as blockTypeListResponseSchema, u as updateWidgetBody, ut as collectionWithFieldsResponseSchema, v as userListResponseSchema, vt as orphanRegisterBody, w as searchRebuildBody, wt as updateFieldBody, x as usersListQuery, y as userSchema, yt as orphanedTableListResponseSchema, zt as contentScheduleBody } from "../../../entry-lock-Cjz0h45X.mjs";
+import { $ as mediaUsageProgressAdvanceResponseSchema, C as mediaReplaceBody, D as mediaStreamUploadResponseSchema, E as mediaResponseSchema, F as mediaUsageActivationAdvanceBody, G as mediaUsageCollectionDeletionRetryResponseSchema, H as mediaUsageCollectionDeletionListResponseSchema, I as mediaUsageActivationAdvanceResponseSchema, L as mediaUsageActivationConflictSchema, M as mediaUploadResponseSchema, N as mediaUploadUrlBody, O as mediaUpdateBody, P as mediaUploadUrlResponseSchema, S as mediaReadResponseSchema, T as mediaReplaceResponseSchema, V as mediaUsageCollectionDeletionListQuery, W as mediaUsageCollectionDeletionRetryBody, X as mediaUsageDetailsResponseSchema, Y as mediaUsageDetailsQuery, a as mediaConfirmResponseSchema, c as mediaFolderBody, d as mediaFolderListResponseSchema, dt as mediaUsageWorkRetryBody, et as mediaUsageProgressSchema, f as mediaFolderResponseSchema, ft as mediaUsageWorkRetryConflictSchema, g as mediaListQuery, i as mediaConfirmBody, l as mediaFolderIdSchema, lt as mediaUsageWorkListQuery, m as mediaGetQuery, n as DEFAULT_MAX_UPLOAD_SIZE, o as mediaDirectUploadBody, pt as mediaUsageWorkRetryResponseSchema, rt as mediaUsageRepairResponseSchema, s as mediaExistingResponseSchema, tt as mediaUsageRepairBody, u as mediaFolderListQuery, ut as mediaUsageWorkListResponseSchema, v as mediaListReadResponseSchema, y as mediaListResponseSchema, z as mediaUsageActivationStatusSchema } from "../../../media-CRKsKlfK.mjs";
+import { a as commentListQuery, c as createCommentBody, i as commentCountsResponseSchema, n as commentBulkBody, o as commentSchema, r as commentBulkResponseSchema, s as commentStatusBody, t as adminCommentListResponseSchema, u as publicCommentListResponseSchema } from "../../../comments-BzmIKVb2.mjs";
+import { a as menuListItemSchema, c as menuWithItemsSchema, d as updateMenuBody, f as updateMenuItemBody, l as reorderMenuItemsBody, n as createMenuItemBody, r as menuItemSchema, t as createMenuBody } from "../../../menus-D1HC8npj.mjs";
+import "../../../status-Dl85BK39.mjs";
+import "../../../kinds-DT1W4T4Y.mjs";
+import "../../../transformations-De44wqV_.mjs";
+import "../../../version-jhs2BRtl.mjs";
+import "../../../approvals-BXgtXA2s.mjs";
+import "../../../plan-CDY4K8CH.mjs";
+import { _ as transferOperationListResponseSchema, a as transferCapabilitiesSchema, c as transferFileUploadResponseSchema, d as transferImportCreateResponseSchema, f as transferImportExecuteBody, g as transferMissingFilesResponseSchema, h as transferImportStatusResponseSchema, i as transferApprovalResponseSchema, l as transferImportAnalyzeBody, m as transferImportReceiptResponseSchema, n as transferApprovalListQuery, o as transferExportCreateBody, p as transferImportPlanResponseSchema, r as transferApprovalListResponseSchema, s as transferExportCreateResponseSchema, t as transferAdvanceResponseSchema, u as transferImportAnalyzeResponseSchema, v as transferOperationResponseSchema, y as transferPaginationQuery } from "../../../transfer-DDX10hkD.mjs";
 import { z } from "zod";
 import { globalRegistry } from "zod/v4/core";
 import { globalRegistry as globalRegistry$1, object, registry, toJSONSchema } from "zod/v4";
@@ -966,7 +966,7 @@ const contentPaths = {
 					content: { [JSON_CONTENT]: { schema: successEnvelope(contentListResponseSchema) } }
 				},
 				...authErrors,
-				...standardErrors(500)
+				...standardErrors(400, 500)
 			}
 		},
 		post: {
@@ -1353,7 +1353,7 @@ const contentPaths = {
 				content: { [JSON_CONTENT]: { schema: successEnvelope(trashedContentListResponseSchema) } }
 			},
 			...authErrors,
-			...standardErrors(500)
+			...standardErrors(400, 500)
 		}
 	} }
 };