emdash 1.1.0 → 1.2.0

package/dist/astro/routes/api/oauth/register.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"register.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/register.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/register\n *\n * RFC 7591 Dynamic Client Registration. Public, unauthenticated.\n * MCP clients (e.g. Claude Code) call this to register themselves\n * before starting the OAuth authorization flow.\n *\n * Rate limited: 10 registrations per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { handleOAuthClientCreate } from \"#api/handlers/oauth-clients.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst OAUTH_REGISTRATION_HEADERS: HeadersInit = {\n\t\"Cache-Control\": \"no-store\",\n\tPragma: \"no-cache\",\n\t// RFC 7591 dynamic client registration is called cross-origin by MCP clients,\n\t// CLIs, and native apps. The endpoint is anonymous and carries no ambient\n\t// credentials, so CORS `*` is safe.\n\t\"Access-Control-Allow-Origin\": \"*\",\n};\n\nconst OAUTH_PREFLIGHT_HEADERS: HeadersInit = {\n\t\"Access-Control-Allow-Origin\": \"*\",\n\t\"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n\t\"Access-Control-Allow-Headers\": \"Content-Type\",\n\t\"Access-Control-Max-Age\": \"86400\",\n};\n\nconst SUPPORTED_GRANT_TYPES = new Set([\n\t\"authorization_code\",\n\t\"refresh_token\",\n\t\"urn:ietf:params:oauth:grant-type:device_code\",\n]);\nconst SUPPORTED_RESPONSE_TYPES = new Set([\"code\"]);\n\nfunction registrationError(\n\tdescription: string,\n\tstatus = 400,\n\terror = \"invalid_client_metadata\",\n): Response {\n\treturn Response.json(\n\t\t{\n\t\t\terror,\n\t\t\terror_description: description,\n\t\t},\n\t\t{ status, headers: OAUTH_REGISTRATION_HEADERS },\n\t);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n\treturn Array.isArray(value) && value.every((item) => typeof item === \"string\");\n}\n\nfunction parseScope(value: unknown): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (typeof value === \"string\") {\n\t\tconst scopes = value.split(\" \").filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\tif (isStringArray(value)) {\n\t\tconst scopes = value.filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\treturn registrationError(\"scope must be a string or array of strings\");\n}\n\nfunction parseSupportedStringArray(\n\tvalue: unknown,\n\tfield: string,\n\tsupported: ReadonlySet<string>,\n): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (!isStringArray(value)) {\n\t\treturn registrationError(`${field} must be an array of strings`);\n\t}\n\tconst invalidValue = value.find((item) => !supported.has(item));\n\tif (invalidValue) {\n\t\treturn registrationError(`${field} contains unsupported value: ${invalidValue}`);\n\t}\n\treturn value;\n}\n\nexport const OPTIONS: APIRoute = () => {\n\treturn new Response(null, { status: 204, headers: OAUTH_PREFLIGHT_HEADERS });\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await request.json();\n\t\t} catch {\n\t\t\treturn registrationError(\"Request body must be valid JSON\");\n\t\t}\n\n\t\tif (!isRecord(body)) {\n\t\t\treturn registrationError(\"Request body must be a JSON object\");\n\t\t}\n\n\t\t// redirect_uris is the only required field per RFC 7591 §2\n\t\tif (!isStringArray(body.redirect_uris) || body.redirect_uris.length === 0) {\n\t\t\treturn registrationError(\"redirect_uris must be a non-empty array of strings\");\n\t\t}\n\n\t\tif (\n\t\t\tbody.token_endpoint_auth_method !== undefined &&\n\t\t\tbody.token_endpoint_auth_method !== \"none\"\n\t\t) {\n\t\t\treturn registrationError(\"Only token_endpoint_auth_method=none is supported\");\n\t\t}\n\n\t\tconst grantTypes = parseSupportedStringArray(\n\t\t\tbody.grant_types,\n\t\t\t\"grant_types\",\n\t\t\tSUPPORTED_GRANT_TYPES,\n\t\t);\n\t\tif (grantTypes instanceof Response) {\n\t\t\treturn grantTypes;\n\t\t}\n\n\t\tconst responseTypes = parseSupportedStringArray(\n\t\t\tbody.response_types,\n\t\t\t\"response_types\",\n\t\t\tSUPPORTED_RESPONSE_TYPES,\n\t\t);\n\t\tif (responseTypes instanceof Response) {\n\t\t\treturn responseTypes;\n\t\t}\n\n\t\tconst scopes = parseScope(body.scope);\n\t\tif (scopes instanceof Response) {\n\t\t\treturn scopes;\n\t\t}\n\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"oauth/register\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\tconst response = registrationError(\n\t\t\t\t\"Too many registration requests. Please try again later.\",\n\t\t\t\t429,\n\t\t\t\t\"temporarily_unavailable\",\n\t\t\t);\n\t\t\tresponse.headers.set(\"Retry-After\", \"60\");\n\t\t\treturn response;\n\t\t}\n\n\t\tconst clientId = crypto.randomUUID();\n\t\tconst clientName =\n\t\t\ttypeof body.client_name === \"string\" && body.client_name\n\t\t\t\t? body.client_name\n\t\t\t\t: `dynamic-${clientId.slice(0, 8)}`;\n\n\t\tconst result = await handleOAuthClientCreate(emdash.db, {\n\t\t\tid: clientId,\n\t\t\tname: clientName,\n\t\t\tredirectUris: body.redirect_uris,\n\t\t\tscopes,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\treturn registrationError(result.error.message);\n\t\t}\n\n\t\t// RFC 7591 §3.2.1 response\n\t\treturn Response.json(\n\t\t\t{\n\t\t\t\tclient_id: result.data.id,\n\t\t\t\tclient_id_issued_at: Math.floor(new Date(result.data.createdAt).getTime() / 1000),\n\t\t\t\tredirect_uris: result.data.redirectUris,\n\t\t\t\tclient_name: result.data.name,\n\t\t\t\tgrant_types: grantTypes ?? [\"authorization_code\", \"refresh_token\"],\n\t\t\t\tresponse_types: responseTypes ?? [\"code\"],\n\t\t\t\ttoken_endpoint_auth_method: \"none\",\n\t\t\t\tscope: result.data.scopes ? result.data.scopes.join(\" \") : undefined,\n\t\t\t},\n\t\t\t{ status: 201, headers: OAUTH_REGISTRATION_HEADERS },\n\t\t);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to register OAuth client\", \"CLIENT_REGISTER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAM,6BAA0C;CAC/C,iBAAiB;CACjB,QAAQ;CAIR,+BAA+B;CAC/B;AAED,MAAM,0BAAuC;CAC5C,+BAA+B;CAC/B,gCAAgC;CAChC,gCAAgC;CAChC,0BAA0B;CAC1B;AAED,MAAM,wBAAwB,IAAI,IAAI;CACrC;CACA;CACA;CACA,CAAC;AACF,MAAM,2BAA2B,IAAI,IAAI,CAAC,OAAO,CAAC;AAElD,SAAS,kBACR,aACA,SAAS,KACT,QAAQ,2BACG;AACX,QAAO,SAAS,KACf;EACC;EACA,mBAAmB;EACnB,EACD;EAAE;EAAQ,SAAS;EAA4B,CAC/C;;AAGF,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,cAAc,OAAmC;AACzD,QAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,OAAO,SAAS,OAAO,SAAS,SAAS;;AAG/E,SAAS,WAAW,OAAiD;AACpE,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ;AAC/C,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,KAAI,cAAc,MAAM,EAAE;EACzB,MAAM,SAAS,MAAM,OAAO,QAAQ;AACpC,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,QAAO,kBAAkB,6CAA6C;;AAGvE,SAAS,0BACR,OACA,OACA,WACkC;AAClC,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,CAAC,cAAc,MAAM,CACxB,QAAO,kBAAkB,GAAG,MAAM,8BAA8B;CAEjE,MAAM,eAAe,MAAM,MAAM,SAAS,CAAC,UAAU,IAAI,KAAK,CAAC;AAC/D,KAAI,aACH,QAAO,kBAAkB,GAAG,MAAM,+BAA+B,eAAe;AAEjF,QAAO;;AAGR,MAAa,gBAA0B;AACtC,QAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK,SAAS;EAAyB,CAAC;;AAG7E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,IAAI;AACJ,MAAI;AACH,UAAO,MAAM,QAAQ,MAAM;UACpB;AACP,UAAO,kBAAkB,kCAAkC;;AAG5D,MAAI,CAAC,SAAS,KAAK,CAClB,QAAO,kBAAkB,qCAAqC;AAI/D,MAAI,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,cAAc,WAAW,EACvE,QAAO,kBAAkB,qDAAqD;AAG/E,MACC,KAAK,+BAA+B,UACpC,KAAK,+BAA+B,OAEpC,QAAO,kBAAkB,oDAAoD;EAG9E,MAAM,aAAa,0BAClB,KAAK,aACL,eACA,sBACA;AACD,MAAI,sBAAsB,SACzB,QAAO;EAGR,MAAM,gBAAgB,0BACrB,KAAK,gBACL,kBACA,yBACA;AACD,MAAI,yBAAyB,SAC5B,QAAO;EAGR,MAAM,SAAS,WAAW,KAAK,MAAM;AACrC,MAAI,kBAAkB,SACrB,QAAO;EAGR,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,IAAI,GAAG,EAChE,SAAS;GACvB,MAAM,WAAW,kBAChB,2DACA,KACA,0BACA;AACD,YAAS,QAAQ,IAAI,eAAe,KAAK;AACzC,UAAO;;EAGR,MAAM,WAAW,OAAO,YAAY;EACpC,MAAM,aACL,OAAO,KAAK,gBAAgB,YAAY,KAAK,cAC1C,KAAK,cACL,WAAW,SAAS,MAAM,GAAG,EAAE;EAEnC,MAAM,SAAS,MAAM,wBAAwB,OAAO,IAAI;GACvD,IAAI;GACJ,MAAM;GACN,cAAc,KAAK;GACnB;GACA,CAAC;AAEF,MAAI,CAAC,OAAO,QACX,QAAO,kBAAkB,OAAO,MAAM,QAAQ;AAI/C,SAAO,SAAS,KACf;GACC,WAAW,OAAO,KAAK;GACvB,qBAAqB,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,UAAU,CAAC,SAAS,GAAG,IAAK;GACjF,eAAe,OAAO,KAAK;GAC3B,aAAa,OAAO,KAAK;GACzB,aAAa,cAAc,CAAC,sBAAsB,gBAAgB;GAClE,gBAAgB,iBAAiB,CAAC,OAAO;GACzC,4BAA4B;GAC5B,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,OAAO,KAAK,IAAI,GAAG;GAC3D,EACD;GAAE,QAAQ;GAAK,SAAS;GAA4B,CACpD;UACO,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,wBAAwB"}
+{"version":3,"file":"register.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/register.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/register\n *\n * RFC 7591 Dynamic Client Registration. Public, unauthenticated.\n * MCP clients (e.g. Claude Code) call this to register themselves\n * before starting the OAuth authorization flow.\n *\n * Rate limited: 10 registrations per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, handleError } from \"#api/error.js\";\nimport { handleOAuthClientCreate } from \"#api/handlers/oauth-clients.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst OAUTH_REGISTRATION_HEADERS: HeadersInit = {\n\t\"Cache-Control\": \"no-store\",\n\tPragma: \"no-cache\",\n\t// RFC 7591 dynamic client registration is called cross-origin by MCP clients,\n\t// CLIs, and native apps. The endpoint is anonymous and carries no ambient\n\t// credentials, so CORS `*` is safe.\n\t\"Access-Control-Allow-Origin\": \"*\",\n};\n\nconst OAUTH_PREFLIGHT_HEADERS: HeadersInit = {\n\t\"Access-Control-Allow-Origin\": \"*\",\n\t\"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n\t\"Access-Control-Allow-Headers\": \"Content-Type\",\n\t\"Access-Control-Max-Age\": \"86400\",\n};\n\nconst SUPPORTED_GRANT_TYPES = new Set([\n\t\"authorization_code\",\n\t\"refresh_token\",\n\t\"urn:ietf:params:oauth:grant-type:device_code\",\n]);\nconst SUPPORTED_RESPONSE_TYPES = new Set([\"code\"]);\n\nfunction registrationError(\n\tdescription: string,\n\tstatus = 400,\n\terror = \"invalid_client_metadata\",\n): Response {\n\treturn Response.json(\n\t\t{\n\t\t\terror,\n\t\t\terror_description: description,\n\t\t},\n\t\t{ status, headers: OAUTH_REGISTRATION_HEADERS },\n\t);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n\treturn Array.isArray(value) && value.every((item) => typeof item === \"string\");\n}\n\nfunction parseScope(value: unknown): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (typeof value === \"string\") {\n\t\tconst scopes = value.split(\" \").filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\tif (isStringArray(value)) {\n\t\tconst scopes = value.filter(Boolean);\n\t\treturn scopes.length > 0 ? scopes : undefined;\n\t}\n\treturn registrationError(\"scope must be a string or array of strings\");\n}\n\nfunction parseSupportedStringArray(\n\tvalue: unknown,\n\tfield: string,\n\tsupported: ReadonlySet<string>,\n): string[] | Response | undefined {\n\tif (value === undefined) return undefined;\n\tif (!isStringArray(value)) {\n\t\treturn registrationError(`${field} must be an array of strings`);\n\t}\n\tconst invalidValue = value.find((item) => !supported.has(item));\n\tif (invalidValue) {\n\t\treturn registrationError(`${field} contains unsupported value: ${invalidValue}`);\n\t}\n\treturn value;\n}\n\nexport const OPTIONS: APIRoute = () => {\n\treturn new Response(null, { status: 204, headers: OAUTH_PREFLIGHT_HEADERS });\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await request.json();\n\t\t} catch {\n\t\t\treturn registrationError(\"Request body must be valid JSON\");\n\t\t}\n\n\t\tif (!isRecord(body)) {\n\t\t\treturn registrationError(\"Request body must be a JSON object\");\n\t\t}\n\n\t\t// redirect_uris is the only required field per RFC 7591 §2\n\t\tif (!isStringArray(body.redirect_uris) || body.redirect_uris.length === 0) {\n\t\t\treturn registrationError(\"redirect_uris must be a non-empty array of strings\");\n\t\t}\n\n\t\tif (\n\t\t\tbody.token_endpoint_auth_method !== undefined &&\n\t\t\tbody.token_endpoint_auth_method !== \"none\"\n\t\t) {\n\t\t\treturn registrationError(\"Only token_endpoint_auth_method=none is supported\");\n\t\t}\n\n\t\tconst grantTypes = parseSupportedStringArray(\n\t\t\tbody.grant_types,\n\t\t\t\"grant_types\",\n\t\t\tSUPPORTED_GRANT_TYPES,\n\t\t);\n\t\tif (grantTypes instanceof Response) {\n\t\t\treturn grantTypes;\n\t\t}\n\n\t\tconst responseTypes = parseSupportedStringArray(\n\t\t\tbody.response_types,\n\t\t\t\"response_types\",\n\t\t\tSUPPORTED_RESPONSE_TYPES,\n\t\t);\n\t\tif (responseTypes instanceof Response) {\n\t\t\treturn responseTypes;\n\t\t}\n\n\t\tconst scopes = parseScope(body.scope);\n\t\tif (scopes instanceof Response) {\n\t\t\treturn scopes;\n\t\t}\n\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"oauth/register\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\tconst response = registrationError(\n\t\t\t\t\"Too many registration requests. Please try again later.\",\n\t\t\t\t429,\n\t\t\t\t\"temporarily_unavailable\",\n\t\t\t);\n\t\t\tresponse.headers.set(\"Retry-After\", \"60\");\n\t\t\treturn response;\n\t\t}\n\n\t\tconst clientId = crypto.randomUUID();\n\t\tconst clientName =\n\t\t\ttypeof body.client_name === \"string\" && body.client_name\n\t\t\t\t? body.client_name\n\t\t\t\t: `dynamic-${clientId.slice(0, 8)}`;\n\n\t\tconst result = await handleOAuthClientCreate(emdash.db, {\n\t\t\tid: clientId,\n\t\t\tname: clientName,\n\t\t\tredirectUris: body.redirect_uris,\n\t\t\tscopes,\n\t\t});\n\n\t\tif (!result.success) {\n\t\t\treturn registrationError(result.error.message);\n\t\t}\n\n\t\t// RFC 7591 §3.2.1 response\n\t\treturn Response.json(\n\t\t\t{\n\t\t\t\tclient_id: result.data.id,\n\t\t\t\tclient_id_issued_at: Math.floor(new Date(result.data.createdAt).getTime() / 1000),\n\t\t\t\tredirect_uris: result.data.redirectUris,\n\t\t\t\tclient_name: result.data.name,\n\t\t\t\tgrant_types: grantTypes ?? [\"authorization_code\", \"refresh_token\"],\n\t\t\t\tresponse_types: responseTypes ?? [\"code\"],\n\t\t\t\ttoken_endpoint_auth_method: \"none\",\n\t\t\t\tscope: result.data.scopes ? result.data.scopes.join(\" \") : undefined,\n\t\t\t},\n\t\t\t{ status: 201, headers: OAUTH_REGISTRATION_HEADERS },\n\t\t);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to register OAuth client\", \"CLIENT_REGISTER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAM,6BAA0C;CAC/C,iBAAiB;CACjB,QAAQ;CAIR,+BAA+B;CAC/B;AAED,MAAM,0BAAuC;CAC5C,+BAA+B;CAC/B,gCAAgC;CAChC,gCAAgC;CAChC,0BAA0B;CAC1B;AAED,MAAM,wBAAwB,IAAI,IAAI;CACrC;CACA;CACA;CACA,CAAC;AACF,MAAM,2BAA2B,IAAI,IAAI,CAAC,OAAO,CAAC;AAElD,SAAS,kBACR,aACA,SAAS,KACT,QAAQ,2BACG;AACX,QAAO,SAAS,KACf;EACC;EACA,mBAAmB;EACnB,EACD;EAAE;EAAQ,SAAS;EAA4B,CAC/C;;AAGF,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,cAAc,OAAmC;AACzD,QAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,OAAO,SAAS,OAAO,SAAS,SAAS;;AAG/E,SAAS,WAAW,OAAiD;AACpE,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,UAAU;EAC9B,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,OAAO,QAAQ;AAC/C,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,KAAI,cAAc,MAAM,EAAE;EACzB,MAAM,SAAS,MAAM,OAAO,QAAQ;AACpC,SAAO,OAAO,SAAS,IAAI,SAAS;;AAErC,QAAO,kBAAkB,6CAA6C;;AAGvE,SAAS,0BACR,OACA,OACA,WACkC;AAClC,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,CAAC,cAAc,MAAM,CACxB,QAAO,kBAAkB,GAAG,MAAM,8BAA8B;CAEjE,MAAM,eAAe,MAAM,MAAM,SAAS,CAAC,UAAU,IAAI,KAAK,CAAC;AAC/D,KAAI,aACH,QAAO,kBAAkB,GAAG,MAAM,+BAA+B,eAAe;AAEjF,QAAO;;AAGR,MAAa,gBAA0B;AACtC,QAAO,IAAI,SAAS,MAAM;EAAE,QAAQ;EAAK,SAAS;EAAyB,CAAC;;AAG7E,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,IAAI;AACJ,MAAI;AACH,UAAO,MAAM,QAAQ,MAAM;UACpB;AACP,UAAO,kBAAkB,kCAAkC;;AAG5D,MAAI,CAAC,SAAS,KAAK,CAClB,QAAO,kBAAkB,qCAAqC;AAI/D,MAAI,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,cAAc,WAAW,EACvE,QAAO,kBAAkB,qDAAqD;AAG/E,MACC,KAAK,+BAA+B,UACpC,KAAK,+BAA+B,OAEpC,QAAO,kBAAkB,oDAAoD;EAG9E,MAAM,aAAa,0BAClB,KAAK,aACL,eACA,sBACA;AACD,MAAI,sBAAsB,SACzB,QAAO;EAGR,MAAM,gBAAgB,0BACrB,KAAK,gBACL,kBACA,yBACA;AACD,MAAI,yBAAyB,SAC5B,QAAO;EAGR,MAAM,SAAS,WAAW,KAAK,MAAM;AACrC,MAAI,kBAAkB,SACrB,QAAO;EAGR,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,kBAAkB,IAAI,GAAG,EAChE,SAAS;GACvB,MAAM,WAAW,kBAChB,2DACA,KACA,0BACA;AACD,YAAS,QAAQ,IAAI,eAAe,KAAK;AACzC,UAAO;;EAGR,MAAM,WAAW,OAAO,YAAY;EACpC,MAAM,aACL,OAAO,KAAK,gBAAgB,YAAY,KAAK,cAC1C,KAAK,cACL,WAAW,SAAS,MAAM,GAAG,EAAE;EAEnC,MAAM,SAAS,MAAM,wBAAwB,OAAO,IAAI;GACvD,IAAI;GACJ,MAAM;GACN,cAAc,KAAK;GACnB;GACA,CAAC;AAEF,MAAI,CAAC,OAAO,QACX,QAAO,kBAAkB,OAAO,MAAM,QAAQ;AAI/C,SAAO,SAAS,KACf;GACC,WAAW,OAAO,KAAK;GACvB,qBAAqB,KAAK,MAAM,IAAI,KAAK,OAAO,KAAK,UAAU,CAAC,SAAS,GAAG,IAAK;GACjF,eAAe,OAAO,KAAK;GAC3B,aAAa,OAAO,KAAK;GACzB,aAAa,cAAc,CAAC,sBAAsB,gBAAgB;GAClE,gBAAgB,iBAAiB,CAAC,OAAO;GACzC,4BAA4B;GAC5B,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,OAAO,KAAK,IAAI,GAAG;GAC3D,EACD;GAAE,QAAQ;GAAK,SAAS;GAA4B,CACpD;UACO,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,wBAAwB"}

package/dist/astro/routes/api/oauth/token/refresh.mjs

@@ -1,12 +1,12 @@
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../api-tokens-BLz2MtQs.mjs";
-import "../../../../../oauth-user-lookup-BNp1aFAr.mjs";
-import { a as handleTokenRefresh } from "../../../../../device-flow-Ma5P5d2e.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { a as handleTokenRefresh } from "../../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/token/refresh.ts

package/dist/astro/routes/api/oauth/token/revoke.mjs

@@ -1,12 +1,12 @@
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../api-tokens-BLz2MtQs.mjs";
-import "../../../../../oauth-user-lookup-BNp1aFAr.mjs";
-import { o as handleTokenRevoke } from "../../../../../device-flow-Ma5P5d2e.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { o as handleTokenRevoke } from "../../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/token/revoke.ts

package/dist/astro/routes/api/oauth/token.mjs

@@ -1,12 +1,12 @@
 import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../errors-CuHQRiBW.mjs";
-import "../../../../errors-DTE6C3K_.mjs";
-import { r as handleError, t as apiError } from "../../../../error-B0rgPgsQ.mjs";
-import "../../../../api-tokens-BLz2MtQs.mjs";
-import "../../../../oauth-user-lookup-BNp1aFAr.mjs";
-import { r as handleAuthorizationCodeExchange } from "../../../../oauth-authorization-BtYQ80uU.mjs";
-import { a as handleTokenRefresh, i as handleDeviceTokenExchange } from "../../../../device-flow-Ma5P5d2e.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import { r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
+import "../../../../api-tokens-D2zgAIEt.mjs";
+import "../../../../oauth-user-lookup-Dz1_R5vT.mjs";
+import { r as handleAuthorizationCodeExchange } from "../../../../oauth-authorization-B6ZJbMd2.mjs";
+import { a as handleTokenRefresh, i as handleDeviceTokenExchange } from "../../../../device-flow-CzDJmQ1q.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/token.ts

package/dist/astro/routes/api/openapi.json.mjs

@@ -3,25 +3,25 @@ import "../../../config-CvmjJcVw.mjs";
 import "../../../base64-BQBZwXCx.mjs";
 import "../../../url-Dn3IStq8.mjs";
 import "../../../types-C-Xp0CcN.mjs";
-import "../../../errors-CuHQRiBW.mjs";
-import "../../../canonical-Y1dpjCnp.mjs";
-import "../../../digest-xIpR3o64.mjs";
-import "../../../errors-DTE6C3K_.mjs";
-import "../../../settings-WHr45II1.mjs";
-import "../../../site-settings-KJOqJW6W.mjs";
-import { r as handleError } from "../../../error-B0rgPgsQ.mjs";
-import { T as successEnvelope, _ as deleteResponseSchema, a as notFoundPruneBody, d as redirectsListQuery, f as updateRedirectBody, i as notFoundListResponseSchema, l as redirectListResponseSchema, m as apiErrorSchema, r as notFoundListQuery, s as notFoundSummaryResponseSchema, t as createRedirectBody, u as redirectSchema, x as mediaDeleteResponseSchema } from "../../../redirects-D4EWeXAo.mjs";
-import { $ as activateBlockTypeVersionBody, A as createSectionBody, B as taxonomyDefTranslationsSchema, C as searchQuery, Ct as updateCollectionBody, D as searchSuggestQuery, Dt as contentAuthorsResponseSchema, Ft as contentPublishBody, G as termListResponseSchema, Gt as contentTranslationsResponseSchema, H as taxonomyResponseSchema, Ht as contentTermsBody, It as contentResponseSchema, K as termReorderResponseSchema, Kt as contentTrashQuery, L as createTermBody, Lt as contentRestoreResponseSchema, M as sectionSchema, Mt as contentListQuery, N as sectionsListQuery, Nt as contentListResponseSchema, O as settingsUpdateBody, Ot as contentCompareResponseSchema, P as updateSectionBody, Q as updateTermBody, R as reorderTermsBody, Rt as contentRevisionConditionBody, S as searchEnableBody, St as updateBlockTypeBody, T as searchResponseSchema, U as termGetResponseSchema, Ut as contentTermsResponseSchema, V as taxonomyListResponseSchema, W as termListQuery, Xt as trashedContentListResponseSchema, Z as updateTaxonomyDefBody, _ as userDetailSchema, a as entryLockStatusSchema, at as collectionGetQuery, b as userUpdateBody, c as createWidgetBody, ct as collectionResponseSchema, d as widgetAreaSchema, dt as createBlockTypeBody, f as widgetAreaWithWidgetsAndCountSchema, ft as createCollectionBody, g as allowedDomainUpdateBody, gt as fieldResponseSchema, h as allowedDomainCreateBody, ht as fieldReorderBody, i as entryLockReleaseResponseSchema, j as sectionListResponseSchema, jt as contentItemSchema, k as siteSettingsSchema, kt as contentCreateBody, l as reorderWidgetsBody, m as widgetSchema, mt as fieldListResponseSchema, nt as blockTypeResponseSchema, o as entryMutationConflictSchema, ot as collectionListResponseSchema, p as widgetAreaWithWidgetsSchema, pt as createFieldBody, q as termResponseSchema, qt as contentUpdateBody, s as createWidgetAreaBody, st as collectionReorderBody, t as entryLockAcquireBody, tt as blockTypeListResponseSchema, u as updateWidgetBody, ut as collectionWithFieldsResponseSchema, v as userListResponseSchema, vt as orphanRegisterBody, w as searchRebuildBody, wt as updateFieldBody, x as usersListQuery, y as userSchema, yt as orphanedTableListResponseSchema, zt as contentScheduleBody } from "../../../entry-lock-sxz2PGAT.mjs";
-import { $ as mediaUsageProgressSchema, B as mediaUsageCollectionDeletionListQuery, C as mediaReplaceBody, D as mediaStreamUploadResponseSchema, E as mediaResponseSchema, F as mediaUsageActivationAdvanceResponseSchema, I as mediaUsageActivationConflictSchema, J as mediaUsageDetailsQuery, M as mediaUploadUrlBody, N as mediaUploadUrlResponseSchema, O as mediaUpdateBody, P as mediaUsageActivationAdvanceBody, Q as mediaUsageProgressAdvanceResponseSchema, R as mediaUsageActivationStatusSchema, S as mediaReadResponseSchema, T as mediaReplaceResponseSchema, U as mediaUsageCollectionDeletionRetryBody, V as mediaUsageCollectionDeletionListResponseSchema, W as mediaUsageCollectionDeletionRetryResponseSchema, Y as mediaUsageDetailsResponseSchema, a as mediaConfirmResponseSchema, c as mediaFolderBody, ct as mediaUsageWorkListQuery, d as mediaFolderListResponseSchema, dt as mediaUsageWorkRetryConflictSchema, et as mediaUsageRepairBody, f as mediaFolderResponseSchema, ft as mediaUsageWorkRetryResponseSchema, g as mediaListQuery, i as mediaConfirmBody, j as mediaUploadResponseSchema, l as mediaFolderIdSchema, lt as mediaUsageWorkListResponseSchema, m as mediaGetQuery, n as DEFAULT_MAX_UPLOAD_SIZE, nt as mediaUsageRepairResponseSchema, o as mediaDirectUploadBody, s as mediaExistingResponseSchema, u as mediaFolderListQuery, ut as mediaUsageWorkRetryBody, v as mediaListReadResponseSchema, y as mediaListResponseSchema } from "../../../media-aahnKHze.mjs";
-import { a as commentListQuery, c as createCommentBody, i as commentCountsResponseSchema, n as commentBulkBody, o as commentSchema, r as commentBulkResponseSchema, s as commentStatusBody, t as adminCommentListResponseSchema, u as publicCommentListResponseSchema } from "../../../comments-BRtp992B.mjs";
-import { a as menuListItemSchema, c as menuWithItemsSchema, d as updateMenuBody, f as updateMenuItemBody, l as reorderMenuItemsBody, n as createMenuItemBody, r as menuItemSchema, t as createMenuBody } from "../../../menus-BQKqf0Up.mjs";
-import "../../../status-D39Fpy8R.mjs";
-import "../../../kinds-BQl5gN6e.mjs";
-import "../../../transformations-Ddx7UtrY.mjs";
-import "../../../version-BwEGkqkx.mjs";
-import "../../../approvals-DycwI6lZ.mjs";
-import "../../../plan-CuQOeU9g.mjs";
-import { _ as transferOperationListResponseSchema, a as transferCapabilitiesSchema, c as transferFileUploadResponseSchema, d as transferImportCreateResponseSchema, f as transferImportExecuteBody, g as transferMissingFilesResponseSchema, h as transferImportStatusResponseSchema, i as transferApprovalResponseSchema, l as transferImportAnalyzeBody, m as transferImportReceiptResponseSchema, n as transferApprovalListQuery, o as transferExportCreateBody, p as transferImportPlanResponseSchema, r as transferApprovalListResponseSchema, s as transferExportCreateResponseSchema, t as transferAdvanceResponseSchema, u as transferImportAnalyzeResponseSchema, v as transferOperationResponseSchema, y as transferPaginationQuery } from "../../../transfer-BcCVxDgf.mjs";
+import "../../../errors-CjtE5aWF.mjs";
+import "../../../canonical-BUcKRYpG.mjs";
+import "../../../digest-xJmyPv2r.mjs";
+import "../../../errors-hskQ0C8G.mjs";
+import "../../../settings-GaZ5sVgg.mjs";
+import "../../../site-settings-CDdT4mVm.mjs";
+import { r as handleError } from "../../../error-DxgQdaZ_.mjs";
+import { T as successEnvelope, _ as deleteResponseSchema, a as notFoundPruneBody, d as redirectsListQuery, f as updateRedirectBody, i as notFoundListResponseSchema, l as redirectListResponseSchema, m as apiErrorSchema, r as notFoundListQuery, s as notFoundSummaryResponseSchema, t as createRedirectBody, u as redirectSchema, x as mediaDeleteResponseSchema } from "../../../redirects-DFT7Wr-e.mjs";
+import { $ as activateBlockTypeVersionBody, A as createSectionBody, B as taxonomyDefTranslationsSchema, C as searchQuery, Ct as updateCollectionBody, D as searchSuggestQuery, Dt as contentAuthorsResponseSchema, Ft as contentPublishBody, G as termListResponseSchema, Gt as contentTranslationsResponseSchema, H as taxonomyResponseSchema, Ht as contentTermsBody, It as contentResponseSchema, K as termReorderResponseSchema, Kt as contentTrashQuery, L as createTermBody, Lt as contentRestoreResponseSchema, M as sectionSchema, Mt as contentListQuery, N as sectionsListQuery, Nt as contentListResponseSchema, O as settingsUpdateBody, Ot as contentCompareResponseSchema, P as updateSectionBody, Q as updateTermBody, R as reorderTermsBody, Rt as contentRevisionConditionBody, S as searchEnableBody, St as updateBlockTypeBody, T as searchResponseSchema, U as termGetResponseSchema, Ut as contentTermsResponseSchema, V as taxonomyListResponseSchema, W as termListQuery, Xt as trashedContentListResponseSchema, Z as updateTaxonomyDefBody, _ as userDetailSchema, a as entryLockStatusSchema, at as collectionGetQuery, b as userUpdateBody, c as createWidgetBody, ct as collectionResponseSchema, d as widgetAreaSchema, dt as createBlockTypeBody, f as widgetAreaWithWidgetsAndCountSchema, ft as createCollectionBody, g as allowedDomainUpdateBody, gt as fieldResponseSchema, h as allowedDomainCreateBody, ht as fieldReorderBody, i as entryLockReleaseResponseSchema, j as sectionListResponseSchema, jt as contentItemSchema, k as siteSettingsSchema, kt as contentCreateBody, l as reorderWidgetsBody, m as widgetSchema, mt as fieldListResponseSchema, nt as blockTypeResponseSchema, o as entryMutationConflictSchema, ot as collectionListResponseSchema, p as widgetAreaWithWidgetsSchema, pt as createFieldBody, q as termResponseSchema, qt as contentUpdateBody, s as createWidgetAreaBody, st as collectionReorderBody, t as entryLockAcquireBody, tt as blockTypeListResponseSchema, u as updateWidgetBody, ut as collectionWithFieldsResponseSchema, v as userListResponseSchema, vt as orphanRegisterBody, w as searchRebuildBody, wt as updateFieldBody, x as usersListQuery, y as userSchema, yt as orphanedTableListResponseSchema, zt as contentScheduleBody } from "../../../entry-lock-Cjz0h45X.mjs";
+import { $ as mediaUsageProgressAdvanceResponseSchema, C as mediaReplaceBody, D as mediaStreamUploadResponseSchema, E as mediaResponseSchema, F as mediaUsageActivationAdvanceBody, G as mediaUsageCollectionDeletionRetryResponseSchema, H as mediaUsageCollectionDeletionListResponseSchema, I as mediaUsageActivationAdvanceResponseSchema, L as mediaUsageActivationConflictSchema, M as mediaUploadResponseSchema, N as mediaUploadUrlBody, O as mediaUpdateBody, P as mediaUploadUrlResponseSchema, S as mediaReadResponseSchema, T as mediaReplaceResponseSchema, V as mediaUsageCollectionDeletionListQuery, W as mediaUsageCollectionDeletionRetryBody, X as mediaUsageDetailsResponseSchema, Y as mediaUsageDetailsQuery, a as mediaConfirmResponseSchema, c as mediaFolderBody, d as mediaFolderListResponseSchema, dt as mediaUsageWorkRetryBody, et as mediaUsageProgressSchema, f as mediaFolderResponseSchema, ft as mediaUsageWorkRetryConflictSchema, g as mediaListQuery, i as mediaConfirmBody, l as mediaFolderIdSchema, lt as mediaUsageWorkListQuery, m as mediaGetQuery, n as DEFAULT_MAX_UPLOAD_SIZE, o as mediaDirectUploadBody, pt as mediaUsageWorkRetryResponseSchema, rt as mediaUsageRepairResponseSchema, s as mediaExistingResponseSchema, tt as mediaUsageRepairBody, u as mediaFolderListQuery, ut as mediaUsageWorkListResponseSchema, v as mediaListReadResponseSchema, y as mediaListResponseSchema, z as mediaUsageActivationStatusSchema } from "../../../media-CRKsKlfK.mjs";
+import { a as commentListQuery, c as createCommentBody, i as commentCountsResponseSchema, n as commentBulkBody, o as commentSchema, r as commentBulkResponseSchema, s as commentStatusBody, t as adminCommentListResponseSchema, u as publicCommentListResponseSchema } from "../../../comments-BzmIKVb2.mjs";
+import { a as menuListItemSchema, c as menuWithItemsSchema, d as updateMenuBody, f as updateMenuItemBody, l as reorderMenuItemsBody, n as createMenuItemBody, r as menuItemSchema, t as createMenuBody } from "../../../menus-D1HC8npj.mjs";
+import "../../../status-Dl85BK39.mjs";
+import "../../../kinds-DT1W4T4Y.mjs";
+import "../../../transformations-De44wqV_.mjs";
+import "../../../version-jhs2BRtl.mjs";
+import "../../../approvals-BXgtXA2s.mjs";
+import "../../../plan-CDY4K8CH.mjs";
+import { _ as transferOperationListResponseSchema, a as transferCapabilitiesSchema, c as transferFileUploadResponseSchema, d as transferImportCreateResponseSchema, f as transferImportExecuteBody, g as transferMissingFilesResponseSchema, h as transferImportStatusResponseSchema, i as transferApprovalResponseSchema, l as transferImportAnalyzeBody, m as transferImportReceiptResponseSchema, n as transferApprovalListQuery, o as transferExportCreateBody, p as transferImportPlanResponseSchema, r as transferApprovalListResponseSchema, s as transferExportCreateResponseSchema, t as transferAdvanceResponseSchema, u as transferImportAnalyzeResponseSchema, v as transferOperationResponseSchema, y as transferPaginationQuery } from "../../../transfer-DDX10hkD.mjs";
 import { z } from "zod";
 import { globalRegistry } from "zod/v4/core";
 import { globalRegistry as globalRegistry$1, object, registry, toJSONSchema } from "zod/v4";
@@ -966,7 +966,7 @@ const contentPaths = {
 					content: { [JSON_CONTENT]: { schema: successEnvelope(contentListResponseSchema) } }
 				},
 				...authErrors,
-				...standardErrors(500)
+				...standardErrors(400, 500)
 			}
 		},
 		post: {
@@ -1353,7 +1353,7 @@ const contentPaths = {
 				content: { [JSON_CONTENT]: { schema: successEnvelope(trashedContentListResponseSchema) } }
 			},
 			...authErrors,
-			...standardErrors(500)
+			...standardErrors(400, 500)
 		}
 	} }
 };