emdash 1.3.0 → 1.3.1

package/dist/default-C0W-PhAp.mjs

@@ -1,81 +0,0 @@
-//#region src/seed/default.ts
-const defaultSeed = {
-	version: "1",
-	meta: {
-		name: "Default",
-		description: "Posts and pages with categories and tags"
-	},
-	collections: [{
-		slug: "posts",
-		label: "Posts",
-		labelSingular: "Post",
-		supports: [
-			"drafts",
-			"revisions",
-			"search"
-		],
-		fields: [
-			{
-				slug: "title",
-				label: "Title",
-				type: "string",
-				required: true,
-				searchable: true
-			},
-			{
-				slug: "featured_image",
-				label: "Featured Image",
-				type: "image"
-			},
-			{
-				slug: "content",
-				label: "Content",
-				type: "portableText",
-				searchable: true
-			},
-			{
-				slug: "excerpt",
-				label: "Excerpt",
-				type: "text"
-			}
-		]
-	}, {
-		slug: "pages",
-		label: "Pages",
-		labelSingular: "Page",
-		supports: [
-			"drafts",
-			"revisions",
-			"search"
-		],
-		fields: [{
-			slug: "title",
-			label: "Title",
-			type: "string",
-			required: true,
-			searchable: true
-		}, {
-			slug: "content",
-			label: "Content",
-			type: "portableText",
-			searchable: true
-		}]
-	}],
-	taxonomies: [{
-		name: "category",
-		label: "Categories",
-		labelSingular: "Category",
-		hierarchical: true,
-		collections: ["posts"]
-	}, {
-		name: "tag",
-		label: "Tags",
-		labelSingular: "Tag",
-		hierarchical: false,
-		collections: ["posts"]
-	}]
-};
-
-//#endregion
-export { defaultSeed as t };
-//# sourceMappingURL=default-C0W-PhAp.mjs.map

package/dist/default-C0W-PhAp.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"default-C0W-PhAp.mjs","names":[],"sources":["../src/seed/default.ts"],"sourcesContent":["/**\n * Default seed applied when no user seed file exists.\n *\n * Provides the baseline schema every EmDash site needs:\n * posts, pages, categories, and tags.\n */\n\nimport type { SeedFile } from \"./types.js\";\n\nexport const defaultSeed: SeedFile = {\n\tversion: \"1\",\n\tmeta: {\n\t\tname: \"Default\",\n\t\tdescription: \"Posts and pages with categories and tags\",\n\t},\n\tcollections: [\n\t\t{\n\t\t\tslug: \"posts\",\n\t\t\tlabel: \"Posts\",\n\t\t\tlabelSingular: \"Post\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"featured_image\",\n\t\t\t\t\tlabel: \"Featured Image\",\n\t\t\t\t\ttype: \"image\",\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"excerpt\",\n\t\t\t\t\tlabel: \"Excerpt\",\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\t{\n\t\t\tslug: \"pages\",\n\t\t\tlabel: \"Pages\",\n\t\t\tlabelSingular: \"Page\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t],\n\ttaxonomies: [\n\t\t{\n\t\t\tname: \"category\",\n\t\t\tlabel: \"Categories\",\n\t\t\tlabelSingular: \"Category\",\n\t\t\thierarchical: true,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t\t{\n\t\t\tname: \"tag\",\n\t\t\tlabel: \"Tags\",\n\t\t\tlabelSingular: \"Tag\",\n\t\t\thierarchical: false,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t],\n};\n"],"mappings":";AASA,MAAa,cAAwB;CACpC,SAAS;CACT,MAAM;EACL,MAAM;EACN,aAAa;EACb;CACD,aAAa,CACZ;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ;GACP;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;EACD,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ,CACP;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,YAAY;GACZ,EACD;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,YAAY;GACZ,CACD;EACD,CACD;CACD,YAAY,CACX;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,CACD;CACD"}

package/dist/deferred-tasks-ZvUECSzI.d.mts

@@ -1,9 +0,0 @@
-//#region src/deferred-tasks.d.ts
-interface DeferredTaskTracker {
-  settled: Promise<void>;
-  track<T>(promise: Promise<T>): Promise<T>;
-  settle(): void;
-}
-//#endregion
-export { DeferredTaskTracker as t };
-//# sourceMappingURL=deferred-tasks-ZvUECSzI.d.mts.map

package/dist/deferred-tasks-ZvUECSzI.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deferred-tasks-ZvUECSzI.d.mts","names":[],"sources":["../src/deferred-tasks.ts"],"mappings":";UAAiB,mBAAA;EAChB,OAAA,EAAS,OAAA;EACT,KAAA,IAAS,OAAA,EAAS,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA;EACvC,MAAA;AAAA"}

package/dist/destination-r2zIAZ2S.mjs

@@ -1,18 +0,0 @@
-//#region src/redirects/destination.ts
-/**
-* Browsers strip tab/CR/LF anywhere in a URL, so `/\t/evil.example` resolves
-* as `//evil.example`. Reject every C0 control and DEL rather than just those.
-*/
-const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
-/**
-* Returns true if `destination` is a single-slash site-relative path, i.e. a
-* browser resolves it on the current origin: no scheme, no `//` or `/\`
-* prefix, and no control characters.
-*/
-function isSiteRelativeDestination(destination) {
-	return destination.startsWith("/") && destination[1] !== "/" && destination[1] !== "\\" && !CONTROL_CHARS.test(destination);
-}
-
-//#endregion
-export { isSiteRelativeDestination as t };
-//# sourceMappingURL=destination-r2zIAZ2S.mjs.map

package/dist/destination-r2zIAZ2S.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"destination-r2zIAZ2S.mjs","names":[],"sources":["../src/redirects/destination.ts"],"sourcesContent":["/**\n * Browsers strip tab/CR/LF anywhere in a URL, so `/\\t/evil.example` resolves\n * as `//evil.example`. Reject every C0 control and DEL rather than just those.\n */\n// eslint-disable-next-line no-control-regex -- matching control characters is the purpose of this regex\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f]/;\n\n/**\n * Returns true if `destination` is a single-slash site-relative path, i.e. a\n * browser resolves it on the current origin: no scheme, no `//` or `/\\`\n * prefix, and no control characters.\n */\nexport function isSiteRelativeDestination(destination: string): boolean {\n\treturn (\n\t\tdestination.startsWith(\"/\") &&\n\t\tdestination[1] !== \"/\" &&\n\t\tdestination[1] !== \"\\\\\" &&\n\t\t!CONTROL_CHARS.test(destination)\n\t);\n}\n"],"mappings":";;;;;AAKA,MAAM,gBAAgB;;;;;;AAOtB,SAAgB,0BAA0B,aAA8B;AACvE,QACC,YAAY,WAAW,IAAI,IAC3B,YAAY,OAAO,OACnB,YAAY,OAAO,QACnB,CAAC,cAAc,KAAK,YAAY"}

package/dist/dev-typegen-EBni_pOQ.mjs

@@ -1,29 +0,0 @@
-//#region src/astro/dev-typegen.ts
-/**
-* Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.
-*
-* Schema mutations send an event over the Vite module runner's hot channel;
-* the Astro integration listens for it in Node and does the filesystem work.
-* The hot channel crosses realms (workerd under the Cloudflare adapter), and
-* runtime modules stay free of Node-only I/O. When HMR is disabled there is
-* no hot channel, so the integration also registers a same-realm global.
-*/
-const DEV_TYPEGEN_REFRESH_EVENT = "emdash:typegen-refresh";
-const DEV_TYPEGEN_REFRESH_GLOBAL = "__emdashDevTypegenRefresh";
-function refreshDevTypes() {
-	if (typeof import.meta.env === "undefined" || !import.meta.env.DEV) return;
-	try {
-		if (import.meta.hot) {
-			import.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);
-			return;
-		}
-		const fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);
-		if (typeof fn === "function") fn();
-	} catch (error) {
-		console.error("[emdash] dev typegen refresh failed:", error);
-	}
-}
-
-//#endregion
-export { DEV_TYPEGEN_REFRESH_GLOBAL as n, refreshDevTypes as r, DEV_TYPEGEN_REFRESH_EVENT as t };
-//# sourceMappingURL=dev-typegen-EBni_pOQ.mjs.map

package/dist/dev-typegen-EBni_pOQ.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-typegen-EBni_pOQ.mjs","names":[],"sources":["../src/astro/dev-typegen.ts"],"sourcesContent":["/**\n * Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.\n *\n * Schema mutations send an event over the Vite module runner's hot channel;\n * the Astro integration listens for it in Node and does the filesystem work.\n * The hot channel crosses realms (workerd under the Cloudflare adapter), and\n * runtime modules stay free of Node-only I/O. When HMR is disabled there is\n * no hot channel, so the integration also registers a same-realm global.\n */\n\nexport const DEV_TYPEGEN_REFRESH_EVENT = \"emdash:typegen-refresh\";\n\nexport const DEV_TYPEGEN_REFRESH_GLOBAL = \"__emdashDevTypegenRefresh\";\n\nexport function refreshDevTypes(): void {\n\tif (typeof import.meta.env === \"undefined\" || !import.meta.env.DEV) return;\n\n\ttry {\n\t\tif (import.meta.hot) {\n\t\t\timport.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);\n\t\t\treturn;\n\t\t}\n\t\tconst fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);\n\t\tif (typeof fn === \"function\") fn();\n\t} catch (error) {\n\t\tconsole.error(\"[emdash] dev typegen refresh failed:\", error);\n\t}\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAa,4BAA4B;AAEzC,MAAa,6BAA6B;AAE1C,SAAgB,kBAAwB;AACvC,KAAI,OAAO,OAAO,KAAK,QAAQ,eAAe,CAAC,OAAO,KAAK,IAAI,IAAK;AAEpE,KAAI;AACH,MAAI,OAAO,KAAK,KAAK;AACpB,UAAO,KAAK,IAAI,KAAK,0BAA0B;AAC/C;;EAED,MAAM,KAAK,QAAQ,IAAI,YAAY,2BAA2B;AAC9D,MAAI,OAAO,OAAO,WAAY,KAAI;UAC1B,OAAO;AACf,UAAQ,MAAM,wCAAwC,MAAM"}

package/dist/device-flow-BkFKBoAn.mjs

@@ -1,521 +0,0 @@
-import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
-import { i as generatePrefixedToken, o as hashApiToken, s as isValidScope, t as TOKEN_PREFIXES } from "./api-tokens-CdP49zVF.mjs";
-import { o as lookupOAuthClient } from "./oauth-clients-BT0Pg-MO.mjs";
-import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-BDgF6IVG.mjs";
-import { clampScopes } from "@emdash-cms/auth";
-import { generateCodeVerifier } from "arctic";
-
-//#region src/api/handlers/device-flow.ts
-/**
-* OAuth Device Flow handlers (RFC 8628).
-*
-* EmDash acts as an OAuth 2.0 authorization server. The CLI requests
-* a device code, displays a URL + user code, and polls for a token.
-* The user opens a browser, logs in, enters the code, and the CLI gets
-* an access + refresh token pair.
-*
-* Uses arctic for code generation and @emdash-cms/auth for token utilities.
-*/
-/** Device codes expire after 15 minutes */
-const DEVICE_CODE_TTL_SECONDS = 900;
-/** Default polling interval in seconds */
-const DEFAULT_INTERVAL = 5;
-/** RFC 8628 §3.5: interval increase on slow_down */
-const SLOW_DOWN_INCREMENT = 5;
-/** Maximum slow_down interval cap (seconds) */
-const MAX_SLOW_DOWN_INTERVAL = 60;
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 3600;
-/** Refresh token TTL: 90 days */
-const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
-/** Default scopes for CLI login */
-const DEFAULT_SCOPES = [
-	"content:read",
-	"content:write",
-	"media:read",
-	"media:write",
-	"schema:read"
-];
-/** Pattern to normalize user codes (strip hyphens) */
-const HYPHEN_PATTERN = /-/g;
-/** Characters for user codes (uppercase, no ambiguous chars like 0/O, 1/I) */
-const USER_CODE_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-/** Generate a short human-readable user code (XXXX-XXXX) */
-function generateUserCode() {
-	const bytes = new Uint8Array(8);
-	crypto.getRandomValues(bytes);
-	const chars = Array.from(bytes, (b) => USER_CODE_CHARS[b % 32]).join("");
-	return `${chars.slice(0, 4)}-${chars.slice(4, 8)}`;
-}
-/** Get an ISO datetime string offset from now */
-function expiresAt(seconds) {
-	return new Date(Date.now() + seconds * 1e3).toISOString();
-}
-/** Validate and normalize scopes. Returns validated scope list. */
-function normalizeScopes(requested) {
-	if (!requested || requested.length === 0) return [...DEFAULT_SCOPES];
-	return [...new Set(requested.filter(isValidScope))];
-}
-/**
-* Scopes an approval by a user with `role` would grant:
-* requested_scopes ∩ scopesForRole(role). Approval and the approval-page
-* lookup must agree, so both go through here.
-*/
-function grantableScopes(requested, role) {
-	return clampScopes(requested, role);
-}
-/** Find a pending device code by user code, ignoring hyphens and case. Does not check expiry. */
-async function findPendingDeviceCode(db, userCode) {
-	const chars = userCode.replace(HYPHEN_PATTERN, "").toUpperCase();
-	if (chars.length !== 8) return void 0;
-	return db.selectFrom("_emdash_device_codes").selectAll().where("user_code", "=", `${chars.slice(0, 4)}-${chars.slice(4)}`).where("status", "=", "pending").executeTakeFirst();
-}
-/**
-* POST /oauth/device/code
-*
-* Issue a device code + user code. The CLI displays the user code
-* and tells the user to open the verification URI.
-*/
-async function handleDeviceCodeRequest(db, input, verificationUri) {
-	try {
-		const scopes = normalizeScopes(input.scope ? input.scope.split(" ").filter(Boolean) : []);
-		if (scopes.length === 0) return {
-			success: false,
-			error: {
-				code: "INVALID_SCOPE",
-				message: "No valid scopes requested"
-			}
-		};
-		const deviceCode = generateCodeVerifier();
-		const userCode = generateUserCode();
-		const expires = expiresAt(DEVICE_CODE_TTL_SECONDS);
-		await db.insertInto("_emdash_device_codes").values({
-			device_code: deviceCode,
-			user_code: userCode,
-			scopes: JSON.stringify(scopes),
-			status: "pending",
-			expires_at: expires,
-			interval: DEFAULT_INTERVAL
-		}).execute();
-		return {
-			success: true,
-			data: {
-				device_code: deviceCode,
-				user_code: userCode,
-				verification_uri: verificationUri,
-				expires_in: DEVICE_CODE_TTL_SECONDS,
-				interval: DEFAULT_INTERVAL
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "DEVICE_CODE_ERROR",
-				message: "Failed to create device code"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/device/token
-*
-* CLI polls this endpoint with the device_code. Returns:
-* - 200 with tokens if authorized
-* - 400 with error "authorization_pending" while waiting
-* - 400 with error "slow_down" if polling too fast
-* - 400 with error "expired_token" if the code expired
-* - 400 with error "access_denied" if the user denied
-*/
-async function handleDeviceTokenExchange(db, input) {
-	try {
-		if (input.grant_type !== "urn:ietf:params:oauth:grant-type:device_code") return {
-			success: false,
-			error: {
-				code: "UNSUPPORTED_GRANT_TYPE",
-				message: "Invalid grant_type"
-			}
-		};
-		const row = await db.selectFrom("_emdash_device_codes").selectAll().where("device_code", "=", input.device_code).executeTakeFirst();
-		if (!row) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid device code"
-			}
-		};
-		const now = /* @__PURE__ */ new Date();
-		if (new Date(row.expires_at) < now) {
-			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).execute();
-			return {
-				success: false,
-				deviceFlowError: "expired_token",
-				error: {
-					code: "expired_token",
-					message: "The device code has expired"
-				}
-			};
-		}
-		if (row.status === "denied") {
-			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).execute();
-			return {
-				success: false,
-				deviceFlowError: "access_denied",
-				error: {
-					code: "access_denied",
-					message: "The user denied the request"
-				}
-			};
-		}
-		if (row.status === "pending") {
-			if (row.last_polled_at) {
-				const lastPolled = new Date(row.last_polled_at);
-				if ((now.getTime() - lastPolled.getTime()) / 1e3 < row.interval) {
-					const newInterval = Math.min(row.interval + SLOW_DOWN_INCREMENT, MAX_SLOW_DOWN_INTERVAL);
-					await db.updateTable("_emdash_device_codes").set({
-						interval: newInterval,
-						last_polled_at: now.toISOString()
-					}).where("device_code", "=", input.device_code).execute();
-					return {
-						success: false,
-						deviceFlowError: "slow_down",
-						deviceFlowInterval: newInterval,
-						error: {
-							code: "slow_down",
-							message: "Polling too fast"
-						}
-					};
-				}
-			}
-			await db.updateTable("_emdash_device_codes").set({ last_polled_at: now.toISOString() }).where("device_code", "=", input.device_code).execute();
-			return {
-				success: false,
-				deviceFlowError: "authorization_pending",
-				error: {
-					code: "authorization_pending",
-					message: "Authorization pending"
-				}
-			};
-		}
-		if (row.status !== "authorized" || !row.user_id) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid device code state"
-			}
-		};
-		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
-		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
-		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
-		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
-		const result = await withTransaction(db, async (trx) => {
-			const consumed = await trx.deleteFrom("_emdash_device_codes").where("device_code", "=", input.device_code).where("status", "=", "authorized").returningAll().executeTakeFirst();
-			if (!consumed) return null;
-			if (!consumed.user_id) return null;
-			const scopes = JSON.parse(consumed.scopes);
-			await trx.insertInto("_emdash_oauth_tokens").values({
-				token_hash: accessToken.hash,
-				token_type: "access",
-				user_id: consumed.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "cli",
-				expires_at: accessExpires,
-				refresh_token_hash: refreshToken.hash
-			}).execute();
-			await trx.insertInto("_emdash_oauth_tokens").values({
-				token_hash: refreshToken.hash,
-				token_type: "refresh",
-				user_id: consumed.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "cli",
-				expires_at: refreshExpires,
-				refresh_token_hash: null
-			}).execute();
-			return { scopes };
-		});
-		if (!result) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Device code already consumed"
-			}
-		};
-		return {
-			success: true,
-			data: {
-				access_token: accessToken.raw,
-				refresh_token: refreshToken.raw,
-				token_type: "Bearer",
-				expires_in: ACCESS_TOKEN_TTL_SECONDS,
-				scope: result.scopes.join(" ")
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_EXCHANGE_ERROR",
-				message: "Failed to exchange device code"
-			}
-		};
-	}
-}
-/**
-* GET /oauth/device/authorize
-*
-* Returns the scopes a pending device code requested, and the subset an
-* approval by this user would grant, so the approval page can show them
-* before the user approves. Reveals nothing else about the device code.
-*/
-async function handleDeviceCodeLookup(db, userRole, input) {
-	try {
-		const match = await findPendingDeviceCode(db, input.user_code);
-		if (!match) return {
-			success: false,
-			error: {
-				code: "INVALID_CODE",
-				message: "Invalid or expired code"
-			}
-		};
-		if (new Date(match.expires_at) < /* @__PURE__ */ new Date()) return {
-			success: false,
-			error: {
-				code: "EXPIRED_CODE",
-				message: "This code has expired"
-			}
-		};
-		const requestedScopes = JSON.parse(match.scopes);
-		return {
-			success: true,
-			data: {
-				requestedScopes,
-				grantedScopes: grantableScopes(requestedScopes, userRole)
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "DEVICE_CODE_LOOKUP_ERROR",
-				message: "Failed to look up device code"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/device/authorize
-*
-* The user submits the user_code after logging in via the browser.
-* This authorizes the device code, allowing the CLI to exchange it for tokens.
-*
-* Scopes are clamped to the user's role at this point. The stored scopes
-* are replaced with the intersection of requested scopes and the scopes
-* the user's role permits. This prevents scope escalation.
-*/
-async function handleDeviceAuthorize(db, userId, userRole, input) {
-	try {
-		const match = await findPendingDeviceCode(db, input.user_code);
-		if (!match) return {
-			success: false,
-			error: {
-				code: "INVALID_CODE",
-				message: "Invalid or expired code"
-			}
-		};
-		if (new Date(match.expires_at) < /* @__PURE__ */ new Date()) {
-			await db.deleteFrom("_emdash_device_codes").where("device_code", "=", match.device_code).execute();
-			return {
-				success: false,
-				error: {
-					code: "EXPIRED_CODE",
-					message: "This code has expired"
-				}
-			};
-		}
-		if ((input.action ?? "approve") === "deny") {
-			await db.updateTable("_emdash_device_codes").set({ status: "denied" }).where("device_code", "=", match.device_code).execute();
-			return {
-				success: true,
-				data: { authorized: false }
-			};
-		}
-		const effectiveScopes = grantableScopes(JSON.parse(match.scopes), userRole);
-		if (effectiveScopes.length === 0) return {
-			success: false,
-			error: {
-				code: "INSUFFICIENT_ROLE",
-				message: "Your role does not permit any of the requested scopes"
-			}
-		};
-		await db.updateTable("_emdash_device_codes").set({
-			status: "authorized",
-			user_id: userId,
-			scopes: JSON.stringify(effectiveScopes)
-		}).where("device_code", "=", match.device_code).execute();
-		return {
-			success: true,
-			data: { authorized: true }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "AUTHORIZE_ERROR",
-				message: "Failed to authorize device"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/token/refresh
-*
-* Exchange a refresh token for a new access token.
-* The refresh token itself is not rotated (per spec: optional rotation).
-*/
-async function handleTokenRefresh(db, input) {
-	try {
-		if (input.grant_type !== "refresh_token") return {
-			success: false,
-			error: {
-				code: "UNSUPPORTED_GRANT_TYPE",
-				message: "Invalid grant_type"
-			}
-		};
-		if (!input.refresh_token.startsWith(TOKEN_PREFIXES.OAUTH_REFRESH)) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid refresh token format"
-			}
-		};
-		const refreshHash = hashApiToken(input.refresh_token);
-		const row = await db.selectFrom("_emdash_oauth_tokens").selectAll().where("token_hash", "=", refreshHash).where("token_type", "=", "refresh").executeTakeFirst();
-		if (!row) return {
-			success: false,
-			error: {
-				code: "INVALID_GRANT",
-				message: "Invalid refresh token"
-			}
-		};
-		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", refreshHash).execute();
-			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "Refresh token expired"
-				}
-			};
-		}
-		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
-		if (!userInfo) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", row.user_id).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "User not found"
-				}
-			};
-		}
-		if (userInfo.disabled) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", row.user_id).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "User account is disabled"
-				}
-			};
-		}
-		let scopes = clampScopes(JSON.parse(row.scopes), userInfo.role);
-		if (row.client_id) {
-			const client = await lookupOAuthClient(db, row.client_id);
-			if (client?.scopes?.length) scopes = scopes.filter((s) => client.scopes.includes(s));
-		}
-		if (scopes.length === 0) {
-			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", refreshHash).execute();
-			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
-			return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "User role no longer supports any of the token's scopes"
-				}
-			};
-		}
-		await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", refreshHash).where("token_type", "=", "access").execute();
-		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
-		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
-		await db.insertInto("_emdash_oauth_tokens").values({
-			token_hash: accessToken.hash,
-			token_type: "access",
-			user_id: row.user_id,
-			scopes: JSON.stringify(scopes),
-			client_type: row.client_type,
-			expires_at: accessExpires,
-			refresh_token_hash: refreshHash
-		}).execute();
-		return {
-			success: true,
-			data: {
-				access_token: accessToken.raw,
-				refresh_token: input.refresh_token,
-				token_type: "Bearer",
-				expires_in: ACCESS_TOKEN_TTL_SECONDS,
-				scope: scopes.join(" ")
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_REFRESH_ERROR",
-				message: "Failed to refresh token"
-			}
-		};
-	}
-}
-/**
-* POST /oauth/token/revoke
-*
-* Revoke an access or refresh token. If a refresh token is revoked,
-* also revoke all associated access tokens.
-*
-* Per RFC 7009, this endpoint always returns 200 (even for invalid tokens).
-*/
-async function handleTokenRevoke(db, input) {
-	try {
-		const hash = hashApiToken(input.token);
-		const row = await db.selectFrom("_emdash_oauth_tokens").select([
-			"token_hash",
-			"token_type",
-			"refresh_token_hash"
-		]).where("token_hash", "=", hash).executeTakeFirst();
-		if (!row) return {
-			success: true,
-			data: { revoked: true }
-		};
-		if (row.token_type === "refresh") {
-			await db.deleteFrom("_emdash_oauth_tokens").where("refresh_token_hash", "=", hash).execute();
-			await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", hash).execute();
-		} else await db.deleteFrom("_emdash_oauth_tokens").where("token_hash", "=", hash).execute();
-		return {
-			success: true,
-			data: { revoked: true }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "TOKEN_REVOKE_ERROR",
-				message: "Failed to revoke token"
-			}
-		};
-	}
-}
-
-//#endregion
-export { handleTokenRefresh as a, handleDeviceTokenExchange as i, handleDeviceCodeLookup as n, handleTokenRevoke as o, handleDeviceCodeRequest as r, handleDeviceAuthorize as t };
-//# sourceMappingURL=device-flow-BkFKBoAn.mjs.map