emdash 1.1.0 → 1.3.0

package/dist/oauth-clients-BT0Pg-MO.mjs

@@ -0,0 +1,266 @@
+//#region src/api/oauth/redirect-uri.ts
+/**
+* Validate a redirect URI per OAuth 2.1 security requirements.
+*
+* Allows localhost / loopback redirect URIs over HTTP for native clients,
+* and any HTTPS URL for web-based flows.
+*/
+function validateRedirectUri(uri) {
+	try {
+		const url = new URL(uri);
+		if (uri.startsWith("//")) return "Protocol-relative redirect URIs are not allowed";
+		if (url.protocol === "http:") {
+			const host = url.hostname;
+			if (host === "127.0.0.1" || host === "localhost" || host === "[::1]") return null;
+			return "HTTP redirect URIs are only allowed for localhost";
+		}
+		if (url.protocol === "https:") return null;
+		return `Unsupported redirect URI scheme: ${url.protocol}`;
+	} catch {
+		return "Invalid redirect URI";
+	}
+}
+
+//#endregion
+//#region src/api/handlers/oauth-clients.ts
+/** Parse a JSON string column into a typed value. */
+function parseJsonColumn(value) {
+	return JSON.parse(value);
+}
+function validateRegisteredRedirectUris(redirectUris) {
+	for (const redirectUri of redirectUris) {
+		const error = validateRedirectUri(redirectUri);
+		if (error) return `Invalid redirect URI: ${error}`;
+	}
+	return null;
+}
+/**
+* Create a new OAuth client.
+*/
+async function handleOAuthClientCreate(db, input) {
+	try {
+		if (input.redirectUris.length === 0) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: "At least one redirect URI is required"
+			}
+		};
+		const redirectUriError = validateRegisteredRedirectUris(input.redirectUris);
+		if (redirectUriError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: redirectUriError
+			}
+		};
+		if (await db.selectFrom("_emdash_oauth_clients").select("id").where("id", "=", input.id).executeTakeFirst()) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: "OAuth client with this ID already exists"
+			}
+		};
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await db.insertInto("_emdash_oauth_clients").values({
+			id: input.id,
+			name: input.name,
+			redirect_uris: JSON.stringify(input.redirectUris),
+			scopes: input.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null
+		}).execute();
+		return {
+			success: true,
+			data: {
+				id: input.id,
+				name: input.name,
+				redirectUris: input.redirectUris,
+				scopes: input.scopes && input.scopes.length > 0 ? input.scopes : null,
+				createdAt: now,
+				updatedAt: now
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_CREATE_ERROR",
+				message: "Failed to create OAuth client"
+			}
+		};
+	}
+}
+/**
+* List all registered OAuth clients.
+*/
+async function handleOAuthClientList(db) {
+	try {
+		return {
+			success: true,
+			data: { items: (await db.selectFrom("_emdash_oauth_clients").selectAll().orderBy("created_at", "desc").execute()).map((row) => ({
+				id: row.id,
+				name: row.name,
+				redirectUris: parseJsonColumn(row.redirect_uris),
+				scopes: row.scopes ? parseJsonColumn(row.scopes) : null,
+				createdAt: row.created_at,
+				updatedAt: row.updated_at
+			})) }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_LIST_ERROR",
+				message: "Failed to list OAuth clients"
+			}
+		};
+	}
+}
+/**
+* Get a single OAuth client by ID.
+*/
+async function handleOAuthClientGet(db, clientId) {
+	try {
+		const row = await db.selectFrom("_emdash_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst();
+		if (!row) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found"
+			}
+		};
+		return {
+			success: true,
+			data: {
+				id: row.id,
+				name: row.name,
+				redirectUris: parseJsonColumn(row.redirect_uris),
+				scopes: row.scopes ? parseJsonColumn(row.scopes) : null,
+				createdAt: row.created_at,
+				updatedAt: row.updated_at
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_GET_ERROR",
+				message: "Failed to get OAuth client"
+			}
+		};
+	}
+}
+/**
+* Update an OAuth client.
+*/
+async function handleOAuthClientUpdate(db, clientId, input) {
+	try {
+		if (!await db.selectFrom("_emdash_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst()) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found"
+			}
+		};
+		if (input.redirectUris !== void 0 && input.redirectUris.length === 0) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: "At least one redirect URI is required"
+			}
+		};
+		if (input.redirectUris !== void 0) {
+			const redirectUriError = validateRegisteredRedirectUris(input.redirectUris);
+			if (redirectUriError) return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: redirectUriError
+				}
+			};
+		}
+		const updates = { updated_at: (/* @__PURE__ */ new Date()).toISOString() };
+		if (input.name !== void 0) updates.name = input.name;
+		if (input.redirectUris !== void 0) updates.redirect_uris = JSON.stringify(input.redirectUris);
+		if (input.scopes !== void 0) updates.scopes = input.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null;
+		await db.updateTable("_emdash_oauth_clients").set(updates).where("id", "=", clientId).execute();
+		const updated = await db.selectFrom("_emdash_oauth_clients").selectAll().where("id", "=", clientId).executeTakeFirst();
+		if (!updated) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found after update"
+			}
+		};
+		return {
+			success: true,
+			data: {
+				id: updated.id,
+				name: updated.name,
+				redirectUris: parseJsonColumn(updated.redirect_uris),
+				scopes: updated.scopes ? parseJsonColumn(updated.scopes) : null,
+				createdAt: updated.created_at,
+				updatedAt: updated.updated_at
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_UPDATE_ERROR",
+				message: "Failed to update OAuth client"
+			}
+		};
+	}
+}
+/**
+* Delete an OAuth client.
+*/
+async function handleOAuthClientDelete(db, clientId) {
+	try {
+		if ((await db.deleteFrom("_emdash_oauth_clients").where("id", "=", clientId).executeTakeFirst()).numDeletedRows === 0n) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "OAuth client not found"
+			}
+		};
+		return {
+			success: true,
+			data: { deleted: true }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "CLIENT_DELETE_ERROR",
+				message: "Failed to delete OAuth client"
+			}
+		};
+	}
+}
+/**
+* Look up a registered OAuth client by ID.
+* Returns the client's redirect URIs or null if the client is not registered.
+*/
+async function lookupOAuthClient(db, clientId) {
+	const row = await db.selectFrom("_emdash_oauth_clients").select(["redirect_uris", "scopes"]).where("id", "=", clientId).executeTakeFirst();
+	if (!row) return null;
+	return {
+		redirectUris: parseJsonColumn(row.redirect_uris),
+		scopes: row.scopes ? parseJsonColumn(row.scopes) : null
+	};
+}
+/**
+* Validate that a redirect URI is in the client's registered set.
+*
+* Comparison is exact string match (per RFC 6749 §3.1.2.3).
+* Returns null if valid, or an error message if not.
+*/
+function validateClientRedirectUri(redirectUri, allowedUris) {
+	if (allowedUris.includes(redirectUri)) return null;
+	return "redirect_uri is not registered for this client";
+}
+
+//#endregion
+export { handleOAuthClientUpdate as a, validateRedirectUri as c, handleOAuthClientList as i, handleOAuthClientDelete as n, lookupOAuthClient as o, handleOAuthClientGet as r, validateClientRedirectUri as s, handleOAuthClientCreate as t };
+//# sourceMappingURL=oauth-clients-BT0Pg-MO.mjs.map

package/dist/oauth-clients-BT0Pg-MO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-clients-BT0Pg-MO.mjs","names":[],"sources":["../src/api/oauth/redirect-uri.ts","../src/api/handlers/oauth-clients.ts"],"sourcesContent":["/**\n * Validate a redirect URI per OAuth 2.1 security requirements.\n *\n * Allows localhost / loopback redirect URIs over HTTP for native clients,\n * and any HTTPS URL for web-based flows.\n */\nexport function validateRedirectUri(uri: string): string | null {\n\ttry {\n\t\tconst url = new URL(uri);\n\n\t\t// Reject protocol-relative URLs\n\t\tif (uri.startsWith(\"//\")) {\n\t\t\treturn \"Protocol-relative redirect URIs are not allowed\";\n\t\t}\n\n\t\t// Allow localhost/loopback over HTTP (for desktop MCP clients)\n\t\tif (url.protocol === \"http:\") {\n\t\t\tconst host = url.hostname;\n\t\t\tif (host === \"127.0.0.1\" || host === \"localhost\" || host === \"[::1]\") {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\treturn \"HTTP redirect URIs are only allowed for localhost\";\n\t\t}\n\n\t\t// Allow HTTPS\n\t\tif (url.protocol === \"https:\") {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn `Unsupported redirect URI scheme: ${url.protocol}`;\n\t} catch {\n\t\treturn \"Invalid redirect URI\";\n\t}\n}\n","/**\n * OAuth client management handlers.\n *\n * CRUD operations for registered OAuth clients. Each client has a set\n * of pre-registered redirect URIs. The authorization endpoint rejects\n * any redirect_uri not in the client's registered set.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport { validateRedirectUri } from \"../oauth/redirect-uri.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Parse a JSON string column into a typed value. */\nfunction parseJsonColumn<T>(value: string): T {\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- JSON.parse returns unknown, callers provide the expected shape\n\treturn JSON.parse(value) as T;\n}\n\nfunction validateRegisteredRedirectUris(redirectUris: string[]): string | null {\n\tfor (const redirectUri of redirectUris) {\n\t\tconst error = validateRedirectUri(redirectUri);\n\t\tif (error) {\n\t\t\treturn `Invalid redirect URI: ${error}`;\n\t\t}\n\t}\n\treturn null;\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface OAuthClientInfo {\n\tid: string;\n\tname: string;\n\tredirectUris: string[];\n\tscopes: string[] | null;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new OAuth client.\n */\nexport async function handleOAuthClientCreate(\n\tdb: Kysely<Database>,\n\tinput: {\n\t\tid: string;\n\t\tname: string;\n\t\tredirectUris: string[];\n\t\tscopes?: string[] | null;\n\t},\n): Promise<ApiResult<OAuthClientInfo>> {\n\ttry {\n\t\tif (input.redirectUris.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: \"At least one redirect URI is required\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst redirectUriError = validateRegisteredRedirectUris(input.redirectUris);\n\t\tif (redirectUriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: redirectUriError,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Check for duplicate client ID\n\t\tconst existing = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.select(\"id\")\n\t\t\t.where(\"id\", \"=\", input.id)\n\t\t\t.executeTakeFirst();\n\n\t\tif (existing) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"CONFLICT\", message: \"OAuth client with this ID already exists\" },\n\t\t\t};\n\t\t}\n\n\t\tconst now = new Date().toISOString();\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_oauth_clients\")\n\t\t\t.values({\n\t\t\t\tid: input.id,\n\t\t\t\tname: input.name,\n\t\t\t\tredirect_uris: JSON.stringify(input.redirectUris),\n\t\t\t\tscopes: input.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tid: input.id,\n\t\t\t\tname: input.name,\n\t\t\t\tredirectUris: input.redirectUris,\n\t\t\t\tscopes: input.scopes && input.scopes.length > 0 ? input.scopes : null,\n\t\t\t\tcreatedAt: now,\n\t\t\t\tupdatedAt: now,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all registered OAuth clients.\n */\nexport async function handleOAuthClientList(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<{ items: OAuthClientInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: OAuthClientInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tredirectUris: parseJsonColumn<string[]>(row.redirect_uris),\n\t\t\tscopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tupdatedAt: row.updated_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list OAuth clients\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Get a single OAuth client by ID.\n */\nexport async function handleOAuthClientGet(\n\tdb: Kysely<Database>,\n\tclientId: string,\n): Promise<ApiResult<OAuthClientInfo>> {\n\ttry {\n\t\tconst row = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tid: row.id,\n\t\t\t\tname: row.name,\n\t\t\t\tredirectUris: parseJsonColumn<string[]>(row.redirect_uris),\n\t\t\t\tscopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\tupdatedAt: row.updated_at,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_GET_ERROR\",\n\t\t\t\tmessage: \"Failed to get OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Update an OAuth client.\n */\nexport async function handleOAuthClientUpdate(\n\tdb: Kysely<Database>,\n\tclientId: string,\n\tinput: {\n\t\tname?: string;\n\t\tredirectUris?: string[];\n\t\tscopes?: string[] | null;\n\t},\n): Promise<ApiResult<OAuthClientInfo>> {\n\ttry {\n\t\tconst existing = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!existing) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (input.redirectUris !== undefined && input.redirectUris.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\tmessage: \"At least one redirect URI is required\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tif (input.redirectUris !== undefined) {\n\t\t\tconst redirectUriError = validateRegisteredRedirectUris(input.redirectUris);\n\t\t\tif (redirectUriError) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: redirectUriError,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tconst updates: Record<string, string | null> = {\n\t\t\tupdated_at: new Date().toISOString(),\n\t\t};\n\n\t\tif (input.name !== undefined) {\n\t\t\tupdates.name = input.name;\n\t\t}\n\t\tif (input.redirectUris !== undefined) {\n\t\t\tupdates.redirect_uris = JSON.stringify(input.redirectUris);\n\t\t}\n\t\tif (input.scopes !== undefined) {\n\t\t\tupdates.scopes =\n\t\t\t\tinput.scopes && input.scopes.length > 0 ? JSON.stringify(input.scopes) : null;\n\t\t}\n\n\t\tawait db.updateTable(\"_emdash_oauth_clients\").set(updates).where(\"id\", \"=\", clientId).execute();\n\n\t\t// Fetch the updated row\n\t\tconst updated = await db\n\t\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (!updated) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found after update\" },\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\tid: updated.id,\n\t\t\t\tname: updated.name,\n\t\t\t\tredirectUris: parseJsonColumn<string[]>(updated.redirect_uris),\n\t\t\t\tscopes: updated.scopes ? parseJsonColumn<string[]>(updated.scopes) : null,\n\t\t\t\tcreatedAt: updated.created_at,\n\t\t\t\tupdatedAt: updated.updated_at,\n\t\t\t},\n\t\t};\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_UPDATE_ERROR\",\n\t\t\t\tmessage: \"Failed to update OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete an OAuth client.\n */\nexport async function handleOAuthClientDelete(\n\tdb: Kysely<Database>,\n\tclientId: string,\n): Promise<ApiResult<{ deleted: true }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_oauth_clients\")\n\t\t\t.where(\"id\", \"=\", clientId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"OAuth client not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { deleted: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"CLIENT_DELETE_ERROR\",\n\t\t\t\tmessage: \"Failed to delete OAuth client\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Lookup helpers (used by authorization handler)\n// ---------------------------------------------------------------------------\n\n/**\n * Look up a registered OAuth client by ID.\n * Returns the client's redirect URIs or null if the client is not registered.\n */\nexport async function lookupOAuthClient(\n\tdb: Kysely<Database>,\n\tclientId: string,\n): Promise<{ redirectUris: string[]; scopes: string[] | null } | null> {\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_clients\")\n\t\t.select([\"redirect_uris\", \"scopes\"])\n\t\t.where(\"id\", \"=\", clientId)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\treturn {\n\t\tredirectUris: parseJsonColumn<string[]>(row.redirect_uris),\n\t\tscopes: row.scopes ? parseJsonColumn<string[]>(row.scopes) : null,\n\t};\n}\n\n/**\n * Validate that a redirect URI is in the client's registered set.\n *\n * Comparison is exact string match (per RFC 6749 §3.1.2.3).\n * Returns null if valid, or an error message if not.\n */\nexport function validateClientRedirectUri(\n\tredirectUri: string,\n\tallowedUris: string[],\n): string | null {\n\tif (allowedUris.includes(redirectUri)) {\n\t\treturn null; // OK\n\t}\n\treturn \"redirect_uri is not registered for this client\";\n}\n"],"mappings":";;;;;;;AAMA,SAAgB,oBAAoB,KAA4B;AAC/D,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,IAAI;AAGxB,MAAI,IAAI,WAAW,KAAK,CACvB,QAAO;AAIR,MAAI,IAAI,aAAa,SAAS;GAC7B,MAAM,OAAO,IAAI;AACjB,OAAI,SAAS,eAAe,SAAS,eAAe,SAAS,QAC5D,QAAO;AAER,UAAO;;AAIR,MAAI,IAAI,aAAa,SACpB,QAAO;AAGR,SAAO,oCAAoC,IAAI;SACxC;AACP,SAAO;;;;;;;ACZT,SAAS,gBAAmB,OAAkB;AAE7C,QAAO,KAAK,MAAM,MAAM;;AAGzB,SAAS,+BAA+B,cAAuC;AAC9E,MAAK,MAAM,eAAe,cAAc;EACvC,MAAM,QAAQ,oBAAoB,YAAY;AAC9C,MAAI,MACH,QAAO,yBAAyB;;AAGlC,QAAO;;;;;AAuBR,eAAsB,wBACrB,IACA,OAMsC;AACtC,KAAI;AACH,MAAI,MAAM,aAAa,WAAW,EACjC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAGF,MAAM,mBAAmB,+BAA+B,MAAM,aAAa;AAC3E,MAAI,iBACH,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAUF,MANiB,MAAM,GACrB,WAAW,wBAAwB,CACnC,OAAO,KAAK,CACZ,MAAM,MAAM,KAAK,MAAM,GAAG,CAC1B,kBAAkB,CAGnB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAY,SAAS;IAA4C;GAChF;EAGF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;AAEpC,QAAM,GACJ,WAAW,wBAAwB,CACnC,OAAO;GACP,IAAI,MAAM;GACV,MAAM,MAAM;GACZ,eAAe,KAAK,UAAU,MAAM,aAAa;GACjD,QAAQ,MAAM,UAAU,MAAM,OAAO,SAAS,IAAI,KAAK,UAAU,MAAM,OAAO,GAAG;GACjF,CAAC,CACD,SAAS;AAEX,SAAO;GACN,SAAS;GACT,MAAM;IACL,IAAI,MAAM;IACV,MAAM,MAAM;IACZ,cAAc,MAAM;IACpB,QAAQ,MAAM,UAAU,MAAM,OAAO,SAAS,IAAI,MAAM,SAAS;IACjE,WAAW;IACX,WAAW;IACX;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,sBACrB,IACmD;AACnD,KAAI;AAgBH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QAfnB,MAAM,GACjB,WAAW,wBAAwB,CACnC,WAAW,CACX,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAE2B,KAAK,SAAS;IACnD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,cAAc,gBAA0B,IAAI,cAAc;IAC1D,QAAQ,IAAI,SAAS,gBAA0B,IAAI,OAAO,GAAG;IAC7D,WAAW,IAAI;IACf,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,UACsC;AACtC,KAAI;EACH,MAAM,MAAM,MAAM,GAChB,WAAW,wBAAwB,CACnC,WAAW,CACX,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAC/D;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,IAAI,IAAI;IACR,MAAM,IAAI;IACV,cAAc,gBAA0B,IAAI,cAAc;IAC1D,QAAQ,IAAI,SAAS,gBAA0B,IAAI,OAAO,GAAG;IAC7D,WAAW,IAAI;IACf,WAAW,IAAI;IACf;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,wBACrB,IACA,UACA,OAKsC;AACtC,KAAI;AAOH,MAAI,CANa,MAAM,GACrB,WAAW,wBAAwB,CACnC,WAAW,CACX,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB,CAGnB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAC/D;AAGF,MAAI,MAAM,iBAAiB,UAAa,MAAM,aAAa,WAAW,EACrE,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAGF,MAAI,MAAM,iBAAiB,QAAW;GACrC,MAAM,mBAAmB,+BAA+B,MAAM,aAAa;AAC3E,OAAI,iBACH,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD;;EAIH,MAAM,UAAyC,EAC9C,6BAAY,IAAI,MAAM,EAAC,aAAa,EACpC;AAED,MAAI,MAAM,SAAS,OAClB,SAAQ,OAAO,MAAM;AAEtB,MAAI,MAAM,iBAAiB,OAC1B,SAAQ,gBAAgB,KAAK,UAAU,MAAM,aAAa;AAE3D,MAAI,MAAM,WAAW,OACpB,SAAQ,SACP,MAAM,UAAU,MAAM,OAAO,SAAS,IAAI,KAAK,UAAU,MAAM,OAAO,GAAG;AAG3E,QAAM,GAAG,YAAY,wBAAwB,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,SAAS,CAAC,SAAS;EAG/F,MAAM,UAAU,MAAM,GACpB,WAAW,wBAAwB,CACnC,WAAW,CACX,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB;AAEpB,MAAI,CAAC,QACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAuC;GAC5E;AAGF,SAAO;GACN,SAAS;GACT,MAAM;IACL,IAAI,QAAQ;IACZ,MAAM,QAAQ;IACd,cAAc,gBAA0B,QAAQ,cAAc;IAC9D,QAAQ,QAAQ,SAAS,gBAA0B,QAAQ,OAAO,GAAG;IACrE,WAAW,QAAQ;IACnB,WAAW,QAAQ;IACnB;GACD;SACM;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,wBACrB,IACA,UACwC;AACxC,KAAI;AAMH,OALe,MAAM,GACnB,WAAW,wBAAwB,CACnC,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAA0B;GAC/D;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;AAYH,eAAsB,kBACrB,IACA,UACsE;CACtE,MAAM,MAAM,MAAM,GAChB,WAAW,wBAAwB,CACnC,OAAO,CAAC,iBAAiB,SAAS,CAAC,CACnC,MAAM,MAAM,KAAK,SAAS,CAC1B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAEjB,QAAO;EACN,cAAc,gBAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,SAAS,gBAA0B,IAAI,OAAO,GAAG;EAC7D;;;;;;;;AASF,SAAgB,0BACf,aACA,aACgB;AAChB,KAAI,YAAY,SAAS,YAAY,CACpC,QAAO;AAER,QAAO"}

package/dist/oauth-state-store-CHMn_mwc.mjs

@@ -0,0 +1,50 @@
+//#region src/auth/oauth-state-store.ts
+const OAUTH_STATE_TTL_MS = 600 * 1e3;
+function createOAuthStateStore(db) {
+	return {
+		async set(state, data) {
+			const expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();
+			await db.insertInto("auth_challenges").values({
+				challenge: state,
+				type: "oauth",
+				user_id: null,
+				data: JSON.stringify(data),
+				expires_at: expiresAt
+			}).onConflict((oc) => oc.column("challenge").doUpdateSet({
+				type: "oauth",
+				data: JSON.stringify(data),
+				expires_at: expiresAt
+			})).execute();
+		},
+		async get(state) {
+			const row = await db.selectFrom("auth_challenges").selectAll().where("challenge", "=", state).where("type", "=", "oauth").executeTakeFirst();
+			if (!row) return null;
+			if (new Date(row.expires_at).getTime() < Date.now()) {
+				await this.delete(state);
+				return null;
+			}
+			if (!row.data) return null;
+			try {
+				const parsed = JSON.parse(row.data);
+				if (typeof parsed !== "object" || parsed === null || !("provider" in parsed) || typeof parsed.provider !== "string" || !("redirectUri" in parsed) || typeof parsed.redirectUri !== "string") return null;
+				const oauthState = {
+					provider: parsed.provider,
+					redirectUri: parsed.redirectUri
+				};
+				if ("codeVerifier" in parsed && typeof parsed.codeVerifier === "string") oauthState.codeVerifier = parsed.codeVerifier;
+				if ("nonce" in parsed && typeof parsed.nonce === "string") oauthState.nonce = parsed.nonce;
+				if ("inviteToken" in parsed && typeof parsed.inviteToken === "string") oauthState.inviteToken = parsed.inviteToken;
+				return oauthState;
+			} catch {
+				return null;
+			}
+		},
+		async delete(state) {
+			await db.deleteFrom("auth_challenges").where("challenge", "=", state).where("type", "=", "oauth").execute();
+		}
+	};
+}
+
+//#endregion
+export { createOAuthStateStore as t };
+//# sourceMappingURL=oauth-state-store-CHMn_mwc.mjs.map

package/dist/oauth-state-store-CHMn_mwc.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state-store-CHMn_mwc.mjs","names":[],"sources":["../src/auth/oauth-state-store.ts"],"sourcesContent":["/**\n * OAuth state store\n *\n * Stores OAuth state in the auth_challenges table with automatic expiration.\n * Uses the existing table but with type=\"oauth\" to distinguish from WebAuthn challenges.\n */\n\nimport type { StateStore, OAuthState } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nconst OAUTH_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes\n\nexport function createOAuthStateStore(db: Kysely<Database>): StateStore {\n\treturn {\n\t\tasync set(state: string, data: OAuthState): Promise<void> {\n\t\t\tconst expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge: state,\n\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\tuser_id: null,\n\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(state: string): Promise<OAuthState | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(state);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tif (!row.data) return null;\n\n\t\t\ttry {\n\t\t\t\tconst parsed: unknown = JSON.parse(row.data);\n\t\t\t\tif (\n\t\t\t\t\ttypeof parsed !== \"object\" ||\n\t\t\t\t\tparsed === null ||\n\t\t\t\t\t!(\"provider\" in parsed) ||\n\t\t\t\t\ttypeof parsed.provider !== \"string\" ||\n\t\t\t\t\t!(\"redirectUri\" in parsed) ||\n\t\t\t\t\ttypeof parsed.redirectUri !== \"string\"\n\t\t\t\t) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tconst oauthState: OAuthState = {\n\t\t\t\t\tprovider: parsed.provider,\n\t\t\t\t\tredirectUri: parsed.redirectUri,\n\t\t\t\t};\n\t\t\t\tif (\"codeVerifier\" in parsed && typeof parsed.codeVerifier === \"string\") {\n\t\t\t\t\toauthState.codeVerifier = parsed.codeVerifier;\n\t\t\t\t}\n\t\t\t\tif (\"nonce\" in parsed && typeof parsed.nonce === \"string\") {\n\t\t\t\t\toauthState.nonce = parsed.nonce;\n\t\t\t\t}\n\t\t\t\tif (\"inviteToken\" in parsed && typeof parsed.inviteToken === \"string\") {\n\t\t\t\t\toauthState.inviteToken = parsed.inviteToken;\n\t\t\t\t}\n\t\t\t\treturn oauthState;\n\t\t\t} catch {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\n\t\tasync delete(state: string): Promise<void> {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"auth_challenges\")\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.execute();\n\t\t},\n\t};\n}\n"],"mappings":";AAYA,MAAM,qBAAqB,MAAU;AAErC,SAAgB,sBAAsB,IAAkC;AACvE,QAAO;EACN,MAAM,IAAI,OAAe,MAAiC;GACzD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,mBAAmB,CAAC,aAAa;AAEzE,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM;IACN,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,OAA2C;GACpD,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;AAKjB,OAHkB,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS,GAGpC,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,MAAM;AACxB,WAAO;;AAGR,OAAI,CAAC,IAAI,KAAM,QAAO;AAEtB,OAAI;IACH,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK;AAC5C,QACC,OAAO,WAAW,YAClB,WAAW,QACX,EAAE,cAAc,WAChB,OAAO,OAAO,aAAa,YAC3B,EAAE,iBAAiB,WACnB,OAAO,OAAO,gBAAgB,SAE9B,QAAO;IAER,MAAM,aAAyB;KAC9B,UAAU,OAAO;KACjB,aAAa,OAAO;KACpB;AACD,QAAI,kBAAkB,UAAU,OAAO,OAAO,iBAAiB,SAC9D,YAAW,eAAe,OAAO;AAElC,QAAI,WAAW,UAAU,OAAO,OAAO,UAAU,SAChD,YAAW,QAAQ,OAAO;AAE3B,QAAI,iBAAiB,UAAU,OAAO,OAAO,gBAAgB,SAC5D,YAAW,cAAc,OAAO;AAEjC,WAAO;WACA;AACP,WAAO;;;EAIT,MAAM,OAAO,OAA8B;AAC1C,SAAM,GACJ,WAAW,kBAAkB,CAC7B,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,SAAS;;EAEZ"}

package/dist/oauth-user-lookup-BDgF6IVG.mjs

@@ -0,0 +1,26 @@
+import { toRoleLevel } from "@emdash-cms/auth";
+
+//#region src/api/handlers/oauth-user-lookup.ts
+/**
+* Shared user lookup for OAuth token operations.
+*
+* Extracts user role and disabled status from the database. Used by
+* handleTokenRefresh() to revalidate scopes against the user's current
+* role and reject disabled users.
+*/
+/**
+* Look up a user's current role and disabled status.
+* Returns null if the user doesn't exist.
+*/
+async function lookupUserRoleAndStatus(db, userId) {
+	const row = await db.selectFrom("users").select(["role", "disabled"]).where("id", "=", userId).executeTakeFirst();
+	if (!row) return null;
+	return {
+		role: toRoleLevel(row.role),
+		disabled: row.disabled === 1
+	};
+}
+
+//#endregion
+export { lookupUserRoleAndStatus as t };
+//# sourceMappingURL=oauth-user-lookup-BDgF6IVG.mjs.map

package/dist/oauth-user-lookup-BDgF6IVG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-user-lookup-BDgF6IVG.mjs","names":[],"sources":["../src/api/handlers/oauth-user-lookup.ts"],"sourcesContent":["/**\n * Shared user lookup for OAuth token operations.\n *\n * Extracts user role and disabled status from the database. Used by\n * handleTokenRefresh() to revalidate scopes against the user's current\n * role and reject disabled users.\n */\n\nimport { toRoleLevel, type RoleLevel } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\n\nexport interface UserRoleAndStatus {\n\trole: RoleLevel;\n\tdisabled: boolean;\n}\n\n/**\n * Look up a user's current role and disabled status.\n * Returns null if the user doesn't exist.\n */\nexport async function lookupUserRoleAndStatus(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<UserRoleAndStatus | null> {\n\tconst row = await db\n\t\t.selectFrom(\"users\")\n\t\t.select([\"role\", \"disabled\"])\n\t\t.where(\"id\", \"=\", userId)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\treturn {\n\t\trole: toRoleLevel(row.role),\n\t\tdisabled: row.disabled === 1,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,eAAsB,wBACrB,IACA,QACoC;CACpC,MAAM,MAAM,MAAM,GAChB,WAAW,QAAQ,CACnB,OAAO,CAAC,QAAQ,WAAW,CAAC,CAC5B,MAAM,MAAM,KAAK,OAAO,CACxB,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAEjB,QAAO;EACN,MAAM,YAAY,IAAI,KAAK;EAC3B,UAAU,IAAI,aAAa;EAC3B"}

package/dist/object-cache/memory.d.mts

@@ -1,4 +1,4 @@
-import { t as CreateObjectCacheBackendFn } from "../types-DOfVMPoo.mjs";
+import { t as CreateObjectCacheBackendFn } from "../types-DvqVxZXa.mjs";
 
 //#region src/object-cache/memory.d.ts
 /**

package/dist/options-DJWaq3Ie.d.mts

@@ -0,0 +1,81 @@
+import { t as Database } from "./types-DCFavOii.mjs";
+import { E as ConditionalWriteResult, Kn as VersionedValue, T as ConditionalDeleteResult } from "./types-QoPHm-2w.mjs";
+import { Kysely } from "kysely";
+
+//#region src/database/repositories/options.d.ts
+/**
+ * Options repository for key-value settings storage
+ *
+ * Used for site settings, plugin configuration, and other arbitrary key-value data.
+ * Values are stored as JSON for flexibility.
+ */
+declare class OptionsRepository {
+  private db;
+  constructor(db: Kysely<Database>);
+  /**
+   * Get an option value
+   */
+  get<T = unknown>(name: string): Promise<T | null>;
+  /**
+   * Get an option value with a default
+   */
+  getOrDefault<T>(name: string, defaultValue: T): Promise<T>;
+  /**
+   * Set an option value (creates or updates)
+   */
+  set<T = unknown>(name: string, value: T): Promise<void>;
+  setVersioned<T = unknown>(name: string, value: T): Promise<string>;
+  /**
+   * Set an option value only if no row with that name exists. Atomic at the
+   * database level via INSERT ... ON CONFLICT DO NOTHING, so concurrent
+   * callers can't race past the check.
+   *
+   * Returns true when the row was inserted, false when a row already
+   * existed (regardless of its value — even an empty string or null).
+   */
+  setIfAbsent<T = unknown>(name: string, value: T): Promise<boolean>;
+  getVersioned<T = unknown>(name: string): Promise<VersionedValue<T> | null>;
+  compareAndSet(name: string, expectedRevision: string | null, value: unknown): Promise<ConditionalWriteResult>;
+  compareAndDelete(name: string, expectedRevision: string): Promise<ConditionalDeleteResult>;
+  /**
+   * Delete an option
+   */
+  delete(name: string): Promise<boolean>;
+  /**
+   * Delete multiple options in one statement.
+   */
+  deleteMany(names: string[]): Promise<number>;
+  /**
+   * Check if an option exists
+   */
+  exists(name: string): Promise<boolean>;
+  /**
+   * Get multiple options at once
+   */
+  getMany<T = unknown>(names: string[]): Promise<Map<string, T>>;
+  /**
+   * Set multiple options at once
+   */
+  setMany<T = unknown>(options: Record<string, T>): Promise<void>;
+  /**
+   * Get all options (use sparingly)
+   */
+  getAll(): Promise<Map<string, unknown>>;
+  /**
+   * Get all options matching a prefix
+   */
+  getByPrefix<T = unknown>(prefix: string, options?: {
+    limit?: number;
+  }): Promise<Map<string, T>>;
+  getVersionedByPrefix<T = unknown>(prefix: string, options?: {
+    limit?: number;
+  }): Promise<Map<string, VersionedValue<T>>>;
+  countByPrefix(prefix: string): Promise<number>;
+  /**
+   * Delete all options matching a prefix
+   */
+  deleteByPrefix(prefix: string): Promise<number>;
+}
+//#endregion
+export { OptionsRepository as t };
+//# sourceMappingURL=options-DJWaq3Ie.d.mts.map

package/dist/options-DJWaq3Ie.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options-DJWaq3Ie.d.mts","names":[],"sources":["../src/database/repositories/options.ts"],"mappings":";;;;;;;AAwBA;;;;cAAa,iBAAA;EAAA,QACQ,EAAA;cAAA,EAAA,EAAI,MAAA,CAAO,QAAA;EAoBmB;;;EAf5C,GAAA,aAAA,CAAiB,IAAA,WAAe,OAAA,CAAQ,CAAA;EAuBE;;;EAR1C,YAAA,GAAA,CAAgB,IAAA,UAAc,YAAA,EAAc,CAAA,GAAI,OAAA,CAAQ,CAAA;EAuCN;;;EA/BlD,GAAA,aAAA,CAAiB,IAAA,UAAc,KAAA,EAAO,CAAA,GAAI,OAAA;EAI1C,YAAA,aAAA,CAA0B,IAAA,UAAc,KAAA,EAAO,CAAA,GAAI,OAAA;EA4DtD;;;;;;;;EAjCG,WAAA,aAAA,CAAyB,IAAA,UAAc,KAAA,EAAO,CAAA,GAAI,OAAA;EAkBlD,YAAA,aAAA,CAA0B,IAAA,WAAe,OAAA,CAAQ,cAAA,CAAe,CAAA;EAWhE,aAAA,CACL,IAAA,UACA,gBAAA,iBACA,KAAA,YACE,OAAA,CAAQ,sBAAA;EAuBL,gBAAA,CAAiB,IAAA,UAAc,gBAAA,WAA2B,OAAA,CAAQ,uBAAA;EAiFhD;;;EAlElB,MAAA,CAAO,IAAA,WAAe,OAAA;EAkFzB;;;EAzEG,UAAA,CAAW,KAAA,aAAkB,OAAA;EA8FhC;;;EAlFG,MAAA,CAAO,IAAA,WAAe,OAAA;EAiHiB;;;EApGvC,OAAA,aAAA,CAAqB,KAAA,aAAkB,OAAA,CAAQ,GAAA,SAAY,CAAA;EApKlC;;;EAwLzB,OAAA,aAAA,CAAqB,OAAA,EAAS,MAAA,SAAe,CAAA,IAAK,OAAA;EAnLjC;;;EA+LjB,MAAA,CAAA,GAAU,OAAA,CAAQ,GAAA;EAhLL;;;EA6Lb,WAAA,aAAA,CACL,MAAA,UACA,OAAA;IAAW,KAAA;EAAA,IACT,OAAA,CAAQ,GAAA,SAAY,CAAA;EAkBjB,oBAAA,aAAA,CACL,MAAA,UACA,OAAA;IAAW,KAAA;EAAA,IACT,OAAA,CAAQ,GAAA,SAAY,cAAA,CAAe,CAAA;EAkBhC,aAAA,CAAc,MAAA,WAAiB,OAAA;EA/NA;;;EA4O/B,cAAA,CAAe,MAAA,WAAiB,OAAA;AAAA"}

package/dist/ownership-MiyA7qKO.mjs

@@ -0,0 +1,12 @@
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+
+//#region src/seed/ownership.ts
+const AUTO_SEED_COMPLETE_OPTION = "emdash:seed_complete";
+async function claimExplicitSeedOwnership(db, seed) {
+	if (!seed.collections?.length) return;
+	await new OptionsRepository(db).set(AUTO_SEED_COMPLETE_OPTION, true);
+}
+
+//#endregion
+export { claimExplicitSeedOwnership as n, AUTO_SEED_COMPLETE_OPTION as t };
+//# sourceMappingURL=ownership-MiyA7qKO.mjs.map

package/dist/ownership-MiyA7qKO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership-MiyA7qKO.mjs","names":[],"sources":["../src/seed/ownership.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\nimport type { SeedFile } from \"./types.js\";\n\nexport const AUTO_SEED_COMPLETE_OPTION = \"emdash:seed_complete\";\n\nexport async function claimExplicitSeedOwnership(\n\tdb: Kysely<Database>,\n\tseed: SeedFile,\n): Promise<void> {\n\tif (!seed.collections?.length) return;\n\tawait new OptionsRepository(db).set(AUTO_SEED_COMPLETE_OPTION, true);\n}\n"],"mappings":";;;AAMA,MAAa,4BAA4B;AAEzC,eAAsB,2BACrB,IACA,MACgB;AAChB,KAAI,CAAC,KAAK,aAAa,OAAQ;AAC/B,OAAM,IAAI,kBAAkB,GAAG,CAAC,IAAI,2BAA2B,KAAK"}

package/dist/page/index.d.mts

@@ -1,5 +1,5 @@
-import { Bt as PageMetadataContribution, Lt as PageFragmentContribution, Ut as PageMetadataLinkRel, Wt as PagePlacement, fn as PublicPageContext, n as BreadcrumbItem } from "../types-BT1p3uyb.mjs";
-import { n as SeoSettings } from "../types-CPkQw2T2.mjs";
+import { Bt as PageMetadataContribution, Lt as PageFragmentContribution, Ut as PageMetadataLinkRel, Wt as PagePlacement, fn as PublicPageContext, n as BreadcrumbItem } from "../types-QoPHm-2w.mjs";
+import { n as SeoSettings } from "../types-BA3ey2QH.mjs";
 
 //#region src/page/context.d.ts
 /** Fields shared by both input forms */

package/dist/page/index.mjs

@@ -6,10 +6,15 @@ import "../secrets-Cc_O3Kp-.mjs";
 import "../base64-BQBZwXCx.mjs";
 import "../object-cache-Bo6DGaC9.mjs";
 import "../request-cache-C4CIo5ad.mjs";
-import "../types-C-Xp0CcN.mjs";
-import "../media-BzUDu7nl.mjs";
-import "../loader-1DMiOq5s.mjs";
-import "../settings-m5tIYnF0.mjs";
+import "../types-D2NEXtgB.mjs";
+import "../media-Bws9f18T.mjs";
+import "../loader-CswroUbe.mjs";
+import "../json-recordset-BUjxhr77.mjs";
+import "../errors-B4f4It-2.mjs";
+import "../errors-BOYNdIo3.mjs";
+import "../settings-CWb84sDm.mjs";
+import "../error-CVWeIOku.mjs";
+import "../fence-C3MUitUN.mjs";
 
 //#region src/page/context.ts
 function isAstroInput(input) {