emdash 1.3.0 → 1.4.0

package/dist/api-tokens-DqSlkDVI.mjs

@@ -0,0 +1,9 @@
+import { TOKEN_PREFIXES, TRANSFER_SCOPES, VALID_SCOPES, generatePrefixedToken, hasScope as hasScope$1, hashPrefixedToken as hashApiToken, isValidScope } from "@emdash-cms/auth";
+
+//#region src/auth/api-tokens.ts
+/** OAuth access token TTL: 1 hour */
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+
+//#endregion
+export { generatePrefixedToken as a, isValidScope as c, VALID_SCOPES as i, TOKEN_PREFIXES as n, hasScope$1 as o, TRANSFER_SCOPES as r, hashApiToken as s, ACCESS_TOKEN_TTL_SECONDS as t };
+//# sourceMappingURL=api-tokens-DqSlkDVI.mjs.map

package/dist/api-tokens-DqSlkDVI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-tokens-DqSlkDVI.mjs","names":[],"sources":["../src/auth/api-tokens.ts"],"sourcesContent":["/**\n * API token generation and hashing utilities.\n *\n * Re-exports from @emdash-cms/auth which owns the implementations.\n * Uses Oslo.js (@oslojs/crypto, @oslojs/encoding) for all crypto.\n *\n * Token format: `ec_pat_<base64url>` (Personal Access Tokens)\n *               `ec_oat_<base64url>` (OAuth Access Tokens)\n *               `ec_ort_<base64url>` (OAuth Refresh Tokens)\n *\n * Prefix makes tokens identifiable in logs and secret scanners.\n * Only the SHA-256 hash is stored server-side.\n */\n\nexport {\n\tTOKEN_PREFIXES,\n\tgeneratePrefixedToken,\n\thashPrefixedToken,\n\thashPrefixedToken as hashApiToken,\n\tVALID_SCOPES,\n\tTRANSFER_SCOPES,\n\tvalidateScopes,\n\tisValidScope,\n\thasScope,\n\tcomputeS256Challenge,\n\ttype ApiTokenScope,\n} from \"@emdash-cms/auth\";\n\n/** OAuth access token TTL: 1 hour */\nexport const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;\n"],"mappings":";;;;AA6BA,MAAa,2BAA2B"}

package/dist/{api-tokens-Bx38ZCQp.mjs → api-tokens-GNCsIegW.mjs}

@@ -1,5 +1,5 @@
-import { t as after } from "./after-PcEvMY_6.mjs";
-import { i as generatePrefixedToken, o as hashApiToken } from "./api-tokens-CdP49zVF.mjs";
+import { t as after } from "./after-32yNRvd2.mjs";
+import { a as generatePrefixedToken, s as hashApiToken } from "./api-tokens-DqSlkDVI.mjs";
 import { ulid } from "ulidx";
 
 //#region src/api/handlers/api-tokens.ts
@@ -170,4 +170,4 @@ async function resolveOAuthToken(db, rawToken) {
 
 //#endregion
 export { resolveApiToken as a, handleApiTokenRevoke as i, handleApiTokenCreate as n, resolveOAuthToken as o, handleApiTokenList as r, deleteApiTokensByName as t };
-//# sourceMappingURL=api-tokens-Bx38ZCQp.mjs.map
+//# sourceMappingURL=api-tokens-GNCsIegW.mjs.map

package/dist/{api-tokens-Bx38ZCQp.mjs.map → api-tokens-GNCsIegW.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"api-tokens-Bx38ZCQp.mjs","names":[],"sources":["../src/api/handlers/api-tokens.ts"],"sourcesContent":["/**\n * API token management handlers.\n *\n * Creates, lists, and revokes Personal Access Tokens (PATs).\n * Token format: ec_pat_<base64url>\n * Only the SHA-256 hash is stored — raw token shown once at creation.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { after } from \"../../after.js\";\nimport { hashApiToken, generatePrefixedToken } from \"../../auth/api-tokens.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface ApiTokenInfo {\n\tid: string;\n\tname: string;\n\tprefix: string;\n\tscopes: string[];\n\tuserId: string;\n\texpiresAt: string | null;\n\tlastUsedAt: string | null;\n\tcreatedAt: string;\n}\n\nexport interface ApiTokenCreateResult {\n\t/** The raw token — shown once, never stored */\n\ttoken: string;\n\t/** Token metadata */\n\tinfo: ApiTokenInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new API token for a user.\n */\nexport async function handleApiTokenCreate(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tinput: {\n\t\tname: string;\n\t\tscopes: string[];\n\t\texpiresAt?: string;\n\t},\n): Promise<ApiResult<ApiTokenCreateResult>> {\n\ttry {\n\t\tconst id = ulid();\n\t\tconst { raw, hash, prefix } = generatePrefixedToken(\"ec_pat_\");\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_api_tokens\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\ttoken_hash: hash,\n\t\t\t\tprefix,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(input.scopes),\n\t\t\t\texpires_at: input.expiresAt ?? null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tconst info: ApiTokenInfo = {\n\t\t\tid,\n\t\t\tname: input.name,\n\t\t\tprefix,\n\t\t\tscopes: input.scopes,\n\t\t\tuserId,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tlastUsedAt: null,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\n\t\treturn { success: true, data: { token: raw, info } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all API tokens for a user (never returns the raw token or hash).\n */\nexport async function handleApiTokenList(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<ApiResult<{ items: ApiTokenInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t\t.select([\n\t\t\t\t\"id\",\n\t\t\t\t\"name\",\n\t\t\t\t\"prefix\",\n\t\t\t\t\"scopes\",\n\t\t\t\t\"user_id\",\n\t\t\t\t\"expires_at\",\n\t\t\t\t\"last_used_at\",\n\t\t\t\t\"created_at\",\n\t\t\t])\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: ApiTokenInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tprefix: row.prefix,\n\t\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t\tuserId: row.user_id,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list API tokens\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Revoke (delete) an API token.\n */\nexport async function handleApiTokenRevoke(\n\tdb: Kysely<Database>,\n\ttokenId: string,\n\tuserId: string,\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t\t.where(\"id\", \"=\", tokenId)\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Token not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete every token with the given name for a user, returning how many were\n * removed. Token names aren't unique, so this is a bulk delete — used by the\n * dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new\n * one on every reset.\n */\nexport async function deleteApiTokensByName(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tname: string,\n): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t.where(\"user_id\", \"=\", userId)\n\t\t.where(\"name\", \"=\", name)\n\t\t.executeTakeFirst();\n\treturn Number(result.numDeletedRows ?? 0n);\n}\n\n/**\n * A resolved bearer token. `tokenId` identifies the credential (not the\n * user) and is safe to store and show: the token row id for a PAT, and for\n * an OAuth token a one-way id of its grant that stays the same across\n * access-token refreshes.\n */\nexport interface ResolvedBearerToken {\n\tuserId: string;\n\tscopes: string[];\n\ttokenId: string;\n}\n\n/**\n * Resolve a raw API token (ec_pat_...) to a user ID and scopes.\n * Updates last_used_at on successful lookup.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveApiToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t.select([\"id\", \"user_id\", \"scopes\", \"expires_at\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (row.expires_at && new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\tafter(async () => {\n\t\ttry {\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_api_tokens\")\n\t\t\t\t.set({ last_used_at: new Date().toISOString() })\n\t\t\t\t.where(\"id\", \"=\", row.id)\n\t\t\t\t.execute();\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[api-tokens] failed to record token use:\", error);\n\t\t}\n\t});\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\ttokenId: row.id,\n\t};\n}\n\n/**\n * Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveOAuthToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t.select([\"user_id\", \"scopes\", \"expires_at\", \"token_type\", \"refresh_token_hash\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t// Hashing the stored hash again keeps the id from being a token lookup key.\n\t\ttokenId: `oauth:${hashApiToken(row.refresh_token_hash ?? hash)}`,\n\t};\n}\n"],"mappings":";;;;;;;;AA6CA,eAAsB,qBACrB,IACA,QACA,OAK2C;AAC3C,KAAI;EACH,MAAM,KAAK,MAAM;EACjB,MAAM,EAAE,KAAK,MAAM,WAAW,sBAAsB,UAAU;AAE9D,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP;GACA,MAAM,MAAM;GACZ,YAAY;GACZ;GACA,SAAS;GACT,QAAQ,KAAK,UAAU,MAAM,OAAO;GACpC,YAAY,MAAM,aAAa;GAC/B,CAAC,CACD,SAAS;AAaX,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE,OAAO;IAAK,MAXjB;KAC1B;KACA,MAAM,MAAM;KACZ;KACA,QAAQ,MAAM;KACd;KACA,WAAW,MAAM,aAAa;KAC9B,YAAY;KACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;KACnC;IAEiD;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,mBACrB,IACA,QACgD;AAChD,KAAI;AA4BH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QA3BnB,MAAM,GACjB,WAAW,qBAAqB,CAChC,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC,CACD,MAAM,WAAW,KAAK,OAAO,CAC7B,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAEwB,KAAK,SAAS;IAChD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;IAC9B,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,QAC2C;AAC3C,KAAI;AAOH,OANe,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,WAAW,KAAK,OAAO,CAC7B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAmB;GACxD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,sBACrB,IACA,QACA,MACkB;CAClB,MAAM,SAAS,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,WAAW,KAAK,OAAO,CAC7B,MAAM,QAAQ,KAAK,KAAK,CACxB,kBAAkB;AACpB,QAAO,OAAO,OAAO,kBAAkB,GAAG;;;;;;;AAoB3C,eAAsB,gBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,qBAAqB,CAChC,OAAO;EAAC;EAAM;EAAW;EAAU;EAAa,CAAC,CACjD,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CAC1D,QAAO;AAGR,OAAM,YAAY;AACjB,MAAI;AACH,SAAM,GACJ,YAAY,qBAAqB,CACjC,IAAI,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE,CAAC,CAC/C,MAAM,MAAM,KAAK,IAAI,GAAG,CACxB,SAAS;WACH,OAAO;AACf,WAAQ,MAAM,4CAA4C,MAAM;;GAEhE;AAEF,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B,SAAS,IAAI;EACb;;;;;;AAOF,eAAsB,kBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;EAAC;EAAW;EAAU;EAAc;EAAc;EAAqB,CAAC,CAC/E,MAAM,cAAc,KAAK,KAAK,CAC9B,MAAM,cAAc,KAAK,SAAS,CAClC,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;AAGR,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAE9B,SAAS,SAAS,aAAa,IAAI,sBAAsB,KAAK;EAC9D"}
+{"version":3,"file":"api-tokens-GNCsIegW.mjs","names":[],"sources":["../src/api/handlers/api-tokens.ts"],"sourcesContent":["/**\n * API token management handlers.\n *\n * Creates, lists, and revokes Personal Access Tokens (PATs).\n * Token format: ec_pat_<base64url>\n * Only the SHA-256 hash is stored — raw token shown once at creation.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { after } from \"../../after.js\";\nimport { hashApiToken, generatePrefixedToken } from \"../../auth/api-tokens.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface ApiTokenInfo {\n\tid: string;\n\tname: string;\n\tprefix: string;\n\tscopes: string[];\n\tuserId: string;\n\texpiresAt: string | null;\n\tlastUsedAt: string | null;\n\tcreatedAt: string;\n}\n\nexport interface ApiTokenCreateResult {\n\t/** The raw token — shown once, never stored */\n\ttoken: string;\n\t/** Token metadata */\n\tinfo: ApiTokenInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new API token for a user.\n */\nexport async function handleApiTokenCreate(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tinput: {\n\t\tname: string;\n\t\tscopes: string[];\n\t\texpiresAt?: string;\n\t},\n): Promise<ApiResult<ApiTokenCreateResult>> {\n\ttry {\n\t\tconst id = ulid();\n\t\tconst { raw, hash, prefix } = generatePrefixedToken(\"ec_pat_\");\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_api_tokens\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\ttoken_hash: hash,\n\t\t\t\tprefix,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(input.scopes),\n\t\t\t\texpires_at: input.expiresAt ?? null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tconst info: ApiTokenInfo = {\n\t\t\tid,\n\t\t\tname: input.name,\n\t\t\tprefix,\n\t\t\tscopes: input.scopes,\n\t\t\tuserId,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tlastUsedAt: null,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\n\t\treturn { success: true, data: { token: raw, info } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all API tokens for a user (never returns the raw token or hash).\n */\nexport async function handleApiTokenList(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<ApiResult<{ items: ApiTokenInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t\t.select([\n\t\t\t\t\"id\",\n\t\t\t\t\"name\",\n\t\t\t\t\"prefix\",\n\t\t\t\t\"scopes\",\n\t\t\t\t\"user_id\",\n\t\t\t\t\"expires_at\",\n\t\t\t\t\"last_used_at\",\n\t\t\t\t\"created_at\",\n\t\t\t])\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: ApiTokenInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tprefix: row.prefix,\n\t\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t\tuserId: row.user_id,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list API tokens\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Revoke (delete) an API token.\n */\nexport async function handleApiTokenRevoke(\n\tdb: Kysely<Database>,\n\ttokenId: string,\n\tuserId: string,\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t\t.where(\"id\", \"=\", tokenId)\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Token not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete every token with the given name for a user, returning how many were\n * removed. Token names aren't unique, so this is a bulk delete — used by the\n * dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new\n * one on every reset.\n */\nexport async function deleteApiTokensByName(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tname: string,\n): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t.where(\"user_id\", \"=\", userId)\n\t\t.where(\"name\", \"=\", name)\n\t\t.executeTakeFirst();\n\treturn Number(result.numDeletedRows ?? 0n);\n}\n\n/**\n * A resolved bearer token. `tokenId` identifies the credential (not the\n * user) and is safe to store and show: the token row id for a PAT, and for\n * an OAuth token a one-way id of its grant that stays the same across\n * access-token refreshes.\n */\nexport interface ResolvedBearerToken {\n\tuserId: string;\n\tscopes: string[];\n\ttokenId: string;\n}\n\n/**\n * Resolve a raw API token (ec_pat_...) to a user ID and scopes.\n * Updates last_used_at on successful lookup.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveApiToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t.select([\"id\", \"user_id\", \"scopes\", \"expires_at\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (row.expires_at && new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\tafter(async () => {\n\t\ttry {\n\t\t\tawait db\n\t\t\t\t.updateTable(\"_emdash_api_tokens\")\n\t\t\t\t.set({ last_used_at: new Date().toISOString() })\n\t\t\t\t.where(\"id\", \"=\", row.id)\n\t\t\t\t.execute();\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[api-tokens] failed to record token use:\", error);\n\t\t}\n\t});\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\ttokenId: row.id,\n\t};\n}\n\n/**\n * Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveOAuthToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<ResolvedBearerToken | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t.select([\"user_id\", \"scopes\", \"expires_at\", \"token_type\", \"refresh_token_hash\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t// Hashing the stored hash again keeps the id from being a token lookup key.\n\t\ttokenId: `oauth:${hashApiToken(row.refresh_token_hash ?? hash)}`,\n\t};\n}\n"],"mappings":";;;;;;;;AA6CA,eAAsB,qBACrB,IACA,QACA,OAK2C;AAC3C,KAAI;EACH,MAAM,KAAK,MAAM;EACjB,MAAM,EAAE,KAAK,MAAM,WAAW,sBAAsB,UAAU;AAE9D,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP;GACA,MAAM,MAAM;GACZ,YAAY;GACZ;GACA,SAAS;GACT,QAAQ,KAAK,UAAU,MAAM,OAAO;GACpC,YAAY,MAAM,aAAa;GAC/B,CAAC,CACD,SAAS;AAaX,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE,OAAO;IAAK,MAXjB;KAC1B;KACA,MAAM,MAAM;KACZ;KACA,QAAQ,MAAM;KACd;KACA,WAAW,MAAM,aAAa;KAC9B,YAAY;KACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;KACnC;IAEiD;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,mBACrB,IACA,QACgD;AAChD,KAAI;AA4BH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QA3BnB,MAAM,GACjB,WAAW,qBAAqB,CAChC,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC,CACD,MAAM,WAAW,KAAK,OAAO,CAC7B,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAEwB,KAAK,SAAS;IAChD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;IAC9B,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,QAC2C;AAC3C,KAAI;AAOH,OANe,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,WAAW,KAAK,OAAO,CAC7B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAmB;GACxD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,sBACrB,IACA,QACA,MACkB;CAClB,MAAM,SAAS,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,WAAW,KAAK,OAAO,CAC7B,MAAM,QAAQ,KAAK,KAAK,CACxB,kBAAkB;AACpB,QAAO,OAAO,OAAO,kBAAkB,GAAG;;;;;;;AAoB3C,eAAsB,gBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,qBAAqB,CAChC,OAAO;EAAC;EAAM;EAAW;EAAU;EAAa,CAAC,CACjD,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CAC1D,QAAO;AAGR,OAAM,YAAY;AACjB,MAAI;AACH,SAAM,GACJ,YAAY,qBAAqB,CACjC,IAAI,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE,CAAC,CAC/C,MAAM,MAAM,KAAK,IAAI,GAAG,CACxB,SAAS;WACH,OAAO;AACf,WAAQ,MAAM,4CAA4C,MAAM;;GAEhE;AAEF,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B,SAAS,IAAI;EACb;;;;;;AAOF,eAAsB,kBACrB,IACA,UACsC;CACtC,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;EAAC;EAAW;EAAU;EAAc;EAAc;EAAqB,CAAC,CAC/E,MAAM,cAAc,KAAK,KAAK,CAC9B,MAAM,cAAc,KAAK,SAAS,CAClC,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;AAGR,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAE9B,SAAS,SAAS,aAAa,IAAI,sBAAsB,KAAK;EAC9D"}

package/dist/{apply-T7ATgzCh.mjs → apply-DVnupNeS.mjs}

@@ -1,27 +1,29 @@
-import { d as __exportAll } from "./runner-C5NeAkBQ.mjs";
-import { o as resolveConfiguredLocale, r as getI18nConfig } from "./config-CvmjJcVw.mjs";
+import { f as __exportAll } from "./runner-Bkkfk4O8.mjs";
+import { c as executeAtomicBatchIfSupported, u as isPostgres } from "./dialect-helpers-B1XN2HGB.mjs";
+import { l as resolveConfiguredLocale, o as getLocaleRank, r as getI18nConfig } from "./config-Cs_AwWXI.mjs";
 import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
-import { t as ContentRepository } from "./content-DQSRZTVw.mjs";
-import { d as invalidateMenuObjectCache, r as coalesceObjectCacheWrites } from "./object-cache-Bo6DGaC9.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-xC4UD5-S.mjs";
-import { t as RevisionRepository } from "./revision-BVp8S0e_.mjs";
-import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
-import { t as MediaRepository } from "./media-Bws9f18T.mjs";
-import { t as TaxonomyRepository } from "./taxonomy-C_C_LBAU.mjs";
-import { t as RedirectRepository } from "./redirect-DiS_3mA4.mjs";
-import { t as BylineRepository } from "./byline-BR1qhyiw.mjs";
-import { t as INTERNAL_MEDIA_PREFIX } from "./normalize-BuWa0lvd.mjs";
-import { t as imageSize } from "./dist-Cfu8mMBs.mjs";
-import { t as FTSManager } from "./fts-manager-Beg3e4bI.mjs";
-import { h as saveTaxonomyStructure, p as findTaxonomyStructure } from "./loader-CswroUbe.mjs";
-import { L as BlockTypeRegistry, U as markContentMediaUsageCollectionStaleSafely, n as SchemaRegistry, t as SchemaError } from "./registry-TUVaid9Z.mjs";
+import { t as ContentRepository } from "./content-BKHUVsE5.mjs";
+import { n as localeMatches, r as localeOrder } from "./query-BFHjCzSh.mjs";
+import { f as invalidateMenuObjectCache, g as invalidateWidgetObjectCache, i as coalesceObjectCacheWrites } from "./object-cache-DmKr09La.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-DiW8VMwz.mjs";
+import { t as RevisionRepository } from "./revision-Dx7Uth1X.mjs";
+import { t as withTransaction } from "./transaction-CkoQ5wqQ.mjs";
+import { t as MediaRepository } from "./media-DepNLhPq.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-CMI5fczd.mjs";
+import { t as RedirectRepository } from "./redirect-DjLdw427.mjs";
+import { t as BylineRepository } from "./byline-DHJS-GGb.mjs";
+import { t as INTERNAL_MEDIA_PREFIX } from "./normalize-Cx-bNwhP.mjs";
+import { t as imageSize } from "./dist-BUmWMTbN.mjs";
+import { t as FTSManager } from "./fts-manager-6861qcwk.mjs";
+import { b as saveTaxonomyStructure, v as findTaxonomyStructure } from "./loader-DhnedqY4.mjs";
+import { R as BlockTypeRegistry, W as markContentMediaUsageCollectionStaleSafely, n as SchemaRegistry, t as SchemaError } from "./registry-B0-O575m.mjs";
 import { n as computeContentHash } from "./hash-BJaeek87.mjs";
-import { a as resolveBlockTypes, i as normalizeBlocksData } from "./block-values-gCX4HBSl.mjs";
-import { m as setReferenceSelection } from "./relations-CA_QuMTU.mjs";
-import { n as createFieldRelation, t as bindReferenceField } from "./schema-DJRfvM_o.mjs";
-import { c as invalidateSiteSettingsCache, l as setSiteSettings } from "./settings-CWb84sDm.mjs";
+import { a as resolveBlockTypes, i as normalizeBlocksData } from "./block-values-Dg0-8PPS.mjs";
+import { m as setReferenceSelection } from "./relations-WIOojTL4.mjs";
+import { n as createFieldRelation, t as bindReferenceField } from "./schema-B-3rntlX.mjs";
+import { c as invalidateSiteSettingsCache, d as setSiteSettings } from "./settings-D932YP2-.mjs";
 import { a as ssrfSafeFetch, s as validateExternalUrl } from "./ssrf-BcYjyM4M.mjs";
-import { n as validateSeed, t as findTaxonomyStructureSource } from "./validate-DxYhJQA-.mjs";
+import { n as validateSeed, t as findTaxonomyStructureSource } from "./validate-Dz-TIOFB.mjs";
 import { ulid } from "ulidx";
 import mime from "mime/lite";
 
@@ -140,6 +142,16 @@ var apply_exports = /* @__PURE__ */ __exportAll({
 	applySeed: () => applySeed,
 	applySeedWithinBudget: () => applySeedWithinBudget
 });
+const SEED_MENU_ITEM_INSERT_BATCH_SIZE = 6;
+const SEED_WIDGET_INSERT_BATCH_SIZE = 10;
+async function replaceSeedChildren(db, parentTable, parentIds, buildStatements) {
+	if (parentIds.length === 0) return;
+	if (await executeAtomicBatchIfSupported(db, buildStatements(db)) !== null) return;
+	await withTransaction(db, async (trx) => {
+		if (isPostgres(trx)) await trx.selectFrom(parentTable).select("id").where("id", "in", parentIds).orderBy("id").forUpdate().execute();
+		for (const statement of buildStatements(trx)) await statement.execute();
+	});
+}
 async function applySiteSettings(db, settings, onConflict, result) {
 	const entries = Object.entries(settings).filter(([, value]) => value !== void 0);
 	if (entries.length === 0) return;
@@ -500,7 +512,7 @@ async function applySeedWrites(db, seed, options, budget) {
 		for (const taxonomy of orderedTaxonomies) {
 			const defLocale = resolveConfiguredLocale(taxonomy.locale ?? defaultLocale);
 			const defsOfName = await db.selectFrom("_emdash_taxonomy_defs").select(["id", "locale"]).where("name", "=", taxonomy.name).execute();
-			const existingDef = defsOfName.find((def) => def.locale === defLocale);
+			const existingDef = defsOfName.filter((def) => resolveConfiguredLocale(def.locale) === defLocale).toSorted((a, b) => getLocaleRank(a.locale, defLocale) - getLocaleRank(b.locale, defLocale) || a.id.localeCompare(b.id))[0];
 			const unclaimed = existingDef !== void 0 && untouchedBuiltInDefIds.has(existingDef.id);
 			if (existingDef && onConflict === "error" && !unclaimed) throw new Error(`Conflict: taxonomy "${taxonomy.name}" (${defLocale}) already exists`);
 			const replacesDef = onConflict === "update" || unclaimed;
@@ -576,7 +588,7 @@ async function applySeedWrites(db, seed, options, budget) {
 			}
 			if (!complete) break;
 		}
-		const { invalidateTaxonomyDefsCache } = await import("./taxonomies-ChnU7Mc8.mjs").then((n) => n.f);
+		const { invalidateTaxonomyDefsCache } = await import("./taxonomies-B__VmCKQ.mjs").then((n) => n.f);
 		invalidateTaxonomyDefsCache();
 	}
 	if (complete && includeContent && seed.bylines) {
@@ -785,16 +797,18 @@ async function applySeedWrites(db, seed, options, budget) {
 	if (seed.menus) {
 		const menuSeedIdMap = /* @__PURE__ */ new Map();
 		const itemSeedIdMap = /* @__PURE__ */ new Map();
+		const menuIds = [];
+		const itemRows = [];
 		try {
 			for (const menu of seed.menus) {
 				const locale = resolveConfiguredLocale(menu.locale ?? defaultLocale);
-				const existingMenu = await db.selectFrom("_emdash_menus").selectAll().where("name", "=", menu.name).where("locale", "=", locale).executeTakeFirst();
+				let lookup = db.selectFrom("_emdash_menus").selectAll().where("name", "=", menu.name).where(localeMatches("locale", locale)).orderBy(localeOrder("locale", locale), "asc").orderBy("id", "asc");
+				const existingMenu = await lookup.executeTakeFirst();
 				let menuId;
 				let translationGroup;
 				if (existingMenu) {
 					menuId = existingMenu.id;
 					translationGroup = existingMenu.translation_group ?? existingMenu.id;
-					await db.deleteFrom("_emdash_menu_items").where("menu_id", "=", menuId).execute();
 				} else {
 					menuId = ulid();
 					translationGroup = menuId;
@@ -803,7 +817,7 @@ async function applySeedWrites(db, seed, options, budget) {
 						if (source) translationGroup = source.translationGroup;
 						else console.warn(`menu "${menu.name}" (${locale}): translationOf "${menu.translationOf}" not found yet; minting a fresh group.`);
 					}
-					await db.insertInto("_emdash_menus").values({
+					if (await db.insertInto("_emdash_menus").values({
 						id: menuId,
 						name: menu.name,
 						label: menu.label,
@@ -811,16 +825,23 @@ async function applySeedWrites(db, seed, options, budget) {
 						updated_at: (/* @__PURE__ */ new Date()).toISOString(),
 						locale,
 						translation_group: translationGroup
-					}).execute();
-					result.menus.created++;
+					}).onConflict((conflict) => conflict.columns(["name", "locale"]).doNothing()).returning("id").executeTakeFirst()) result.menus.created++;
+					else {
+						const concurrentMenu = await lookup.executeTakeFirstOrThrow();
+						menuId = concurrentMenu.id;
+						translationGroup = concurrentMenu.translation_group ?? concurrentMenu.id;
+					}
 				}
 				if (menu.id) menuSeedIdMap.set(menu.id, {
 					id: menuId,
 					translationGroup
 				});
-				const itemCount = await applyMenuItems(db, menuId, locale, menu.items, null, 0, seedIdMap, itemSeedIdMap);
+				menuIds.push(menuId);
+				const itemCount = collectMenuItems(itemRows, menuId, existingMenu?.locale ?? locale, menu.items, null, 0, seedIdMap, itemSeedIdMap);
 				result.menus.items += itemCount;
 			}
+			const buildStatements = (target) => [...menuIds.map((id) => target.deleteFrom("_emdash_menu_items").where("menu_id", "=", id)), ...chunks(itemRows, SEED_MENU_ITEM_INSERT_BATCH_SIZE).map((rows) => target.insertInto("_emdash_menu_items").values(rows))];
+			await replaceSeedChildren(db, "_emdash_menus", menuIds, buildStatements);
 		} finally {
 			invalidateMenuObjectCache();
 		}
@@ -854,27 +875,34 @@ async function applySeedWrites(db, seed, options, budget) {
 			result.redirects.created++;
 		}
 	}
-	if (seed.widgetAreas) for (const area of seed.widgetAreas) {
-		const existingArea = await db.selectFrom("_emdash_widget_areas").selectAll().where("name", "=", area.name).executeTakeFirst();
-		let areaId;
-		if (existingArea) {
-			areaId = existingArea.id;
-			await db.deleteFrom("_emdash_widgets").where("area_id", "=", areaId).execute();
-		} else {
-			areaId = ulid();
-			await db.insertInto("_emdash_widget_areas").values({
-				id: areaId,
-				name: area.name,
-				label: area.label,
-				description: area.description ?? null
-			}).execute();
-			result.widgetAreas.created++;
-		}
-		for (let i = 0; i < area.widgets.length; i++) {
-			const widget = area.widgets[i];
-			await applyWidget(db, areaId, widget, i);
-			result.widgetAreas.widgets++;
+	if (seed.widgetAreas) try {
+		const areaIds = [];
+		const widgetRows = [];
+		for (const area of seed.widgetAreas) {
+			const lookup = db.selectFrom("_emdash_widget_areas").selectAll().where("name", "=", area.name);
+			const existingArea = await lookup.executeTakeFirst();
+			let areaId;
+			if (existingArea) areaId = existingArea.id;
+			else {
+				areaId = ulid();
+				if (await db.insertInto("_emdash_widget_areas").values({
+					id: areaId,
+					name: area.name,
+					label: area.label,
+					description: area.description ?? null
+				}).onConflict((conflict) => conflict.column("name").doNothing()).returning("id").executeTakeFirst()) result.widgetAreas.created++;
+				else areaId = (await lookup.executeTakeFirstOrThrow()).id;
+			}
+			areaIds.push(areaId);
+			for (let i = 0; i < area.widgets.length; i++) {
+				const widget = area.widgets[i];
+				widgetRows.push(createSeedWidgetRow(areaId, widget, i));
+				result.widgetAreas.widgets++;
+			}
 		}
+		await replaceSeedChildren(db, "_emdash_widget_areas", areaIds, (target) => [...areaIds.map((id) => target.deleteFrom("_emdash_widgets").where("area_id", "=", id)), ...chunks(widgetRows, SEED_WIDGET_INSERT_BATCH_SIZE).map((rows) => target.insertInto("_emdash_widgets").values(rows))]);
+	} finally {
+		invalidateWidgetObjectCache();
 	}
 	if (seed.sections) for (const section of seed.sections) {
 		const existing = await db.selectFrom("_emdash_sections").select("id").where("slug", "=", section.slug).executeTakeFirst();
@@ -923,7 +951,7 @@ async function applySeedWrites(db, seed, options, budget) {
 		}
 	}
 	if (result.redirects.created + result.redirects.updated > 0) {
-		const { publishRedirectChanges } = await import("./artifacts-htGyfCSt.mjs").then((n) => n.t);
+		const { publishRedirectChanges } = await import("./artifacts-Dvdp2KK-.mjs").then((n) => n.t);
 		await publishRedirectChanges(db);
 	}
 	await invalidateSeedCaches();
@@ -947,29 +975,44 @@ function seedTermKey(locale, slug) {
 * `seedTermKey`. Each query covers a batch of slugs.
 */
 async function findExistingSeedTerms(db, taxonomyName, terms) {
-	const existing = /* @__PURE__ */ new Map();
+	const selected = /* @__PURE__ */ new Map();
 	for (const batch of chunks([...new Set(terms.map((term) => term.slug))], SQL_BATCH_SIZE)) {
 		const rows = await db.selectFrom("taxonomies").select([
 			"id",
 			"slug",
 			"locale"
 		]).where("name", "=", taxonomyName).where("slug", "in", batch).execute();
-		for (const row of rows) existing.set(seedTermKey(row.locale, row.slug), row.id);
+		for (const row of rows) {
+			const canonicalLocale = resolveConfiguredLocale(row.locale);
+			const key = seedTermKey(canonicalLocale, row.slug);
+			const previous = selected.get(key);
+			if (previous === void 0 || getLocaleRank(row.locale, canonicalLocale) < getLocaleRank(previous.locale, canonicalLocale) || getLocaleRank(row.locale, canonicalLocale) === getLocaleRank(previous.locale, canonicalLocale) && row.id.localeCompare(previous.id) < 0) selected.set(key, {
+				id: row.id,
+				locale: row.locale
+			});
+		}
 	}
-	return existing;
+	return new Map(Array.from(selected, ([key, value]) => [key, value.id]));
 }
 /**
-* Find which seed bylines already exist, as byline ids keyed by slug. A slug
-* in several locales resolves to the lowest locale code, as
-* `BylineRepository.findBySlug` does. Each query covers a batch of slugs.
+* Match seed bylines by slug, preferring a path over its stored code aliases.
+* Across different configured locales, keep the lowest-locale selection.
 */
 async function findExistingSeedBylines(db, slugs) {
 	const existing = /* @__PURE__ */ new Map();
 	for (const batch of chunks([...new Set(slugs)], SQL_BATCH_SIZE)) {
-		const rows = await db.selectFrom("_emdash_bylines").select(["id", "slug"]).where("slug", "in", batch).orderBy("locale", "asc").execute();
-		for (const row of rows) if (!existing.has(row.slug)) existing.set(row.slug, row.id);
+		const rows = await db.selectFrom("_emdash_bylines").select([
+			"id",
+			"slug",
+			"locale"
+		]).where("slug", "in", batch).orderBy("locale", "asc").orderBy("id", "asc").execute();
+		for (const row of rows) {
+			const previous = existing.get(row.slug);
+			const locale = resolveConfiguredLocale(row.locale);
+			if (!previous || resolveConfiguredLocale(previous.locale) === locale && getLocaleRank(row.locale, locale) < getLocaleRank(previous.locale, locale)) existing.set(row.slug, row);
+		}
 	}
-	return existing;
+	return new Map(Array.from(existing, ([slug, row]) => [slug, row.id]));
 }
 /**
 * Invalidate caches that may have been affected by seed data.
@@ -977,9 +1020,9 @@ async function findExistingSeedBylines(db, slugs) {
 * have module-level caches in the hot path.
 */
 async function invalidateSeedCaches() {
-	const { invalidateBylineCache } = await import("./bylines-DxOs9B7z.mjs").then((n) => n.t);
-	const { invalidateRedirectCache } = await import("./cache-CEU9wo_h.mjs").then((n) => n.t);
-	const { invalidateUrlPatternCache } = await import("./query-CpnRlBh8.mjs").then((n) => n.s);
+	const { invalidateBylineCache } = await import("./bylines-f_ZEc6Sn.mjs").then((n) => n.t);
+	const { invalidateRedirectCache } = await import("./cache-5DHbpEWu.mjs").then((n) => n.t);
+	const { invalidateUrlPatternCache } = await import("./query-D62NntCZ.mjs").then((n) => n.s);
 	invalidateBylineCache();
 	invalidateRedirectCache();
 	invalidateUrlPatternCache();
@@ -1369,7 +1412,7 @@ async function applyContentTaxonomies(db, collectionSlug, contentId, entry, isUp
 	if (isUpdate) await termRepo.clearEntryTerms(collectionSlug, contentId);
 	if (!entry.taxonomies) {
 		if (isUpdate) {
-			const { invalidateTermCache } = await import("./taxonomies-ChnU7Mc8.mjs").then((n) => n.f);
+			const { invalidateTermCache } = await import("./taxonomies-B__VmCKQ.mjs").then((n) => n.f);
 			invalidateTermCache();
 		}
 		return;
@@ -1378,18 +1421,18 @@ async function applyContentTaxonomies(db, collectionSlug, contentId, entry, isUp
 		const term = await termRepo.findBySlug(taxonomyName, termSlug);
 		if (term) await termRepo.attachToEntry(collectionSlug, contentId, term.id);
 	}
-	const { invalidateTermCache } = await import("./taxonomies-ChnU7Mc8.mjs").then((n) => n.f);
+	const { invalidateTermCache } = await import("./taxonomies-B__VmCKQ.mjs").then((n) => n.f);
 	invalidateTermCache();
 }
 /**
-* Apply menu items recursively.
+* Collect menu item rows recursively.
 *
 * When a `SeedMenuItem` carries `id`/`translationOf`, the import resolves the
 * source item's `translation_group` so cross-locale "same nav entry" links
 * survive export → apply. Items without `translationOf` get a fresh group
 * (= their own id).
 */
-async function applyMenuItems(db, menuId, locale, items, parentId, startOrder, seedIdMap, itemSeedIdMap) {
+function collectMenuItems(rows, menuId, locale, items, parentId, startOrder, seedIdMap, itemSeedIdMap) {
 	let count = 0;
 	let order = startOrder;
 	for (const item of items) {
@@ -1413,7 +1456,7 @@ async function applyMenuItems(db, menuId, locale, items, parentId, startOrder, s
 			if (source) translationGroup = source.translationGroup;
 			else console.warn(`menu item "${item.label ?? item.url ?? item.ref ?? "(unlabeled)"}" (${itemLocale}): translationOf "${item.translationOf}" not found yet; minting a fresh group.`);
 		}
-		await db.insertInto("_emdash_menu_items").values({
+		rows.push({
 			id: itemId,
 			menu_id: menuId,
 			parent_id: parentId,
@@ -1429,7 +1472,7 @@ async function applyMenuItems(db, menuId, locale, items, parentId, startOrder, s
 			created_at: (/* @__PURE__ */ new Date()).toISOString(),
 			locale: itemLocale,
 			translation_group: translationGroup
-		}).execute();
+		});
 		if (item.id) itemSeedIdMap.set(item.id, {
 			id: itemId,
 			translationGroup
@@ -1437,17 +1480,17 @@ async function applyMenuItems(db, menuId, locale, items, parentId, startOrder, s
 		count++;
 		order++;
 		if (item.children && item.children.length > 0) {
-			const childCount = await applyMenuItems(db, menuId, itemLocale, item.children, itemId, 0, seedIdMap, itemSeedIdMap);
+			const childCount = collectMenuItems(rows, menuId, itemLocale, item.children, itemId, 0, seedIdMap, itemSeedIdMap);
 			count += childCount;
 		}
 	}
 	return count;
 }
 /**
-* Apply a widget
+* Build a widget row
 */
-async function applyWidget(db, areaId, widget, sortOrder) {
-	await db.insertInto("_emdash_widgets").values({
+function createSeedWidgetRow(areaId, widget, sortOrder) {
+	return {
 		id: ulid(),
 		area_id: areaId,
 		sort_order: sortOrder,
@@ -1457,7 +1500,7 @@ async function applyWidget(db, areaId, widget, sortOrder) {
 		menu_name: widget.menuName ?? null,
 		component_id: widget.componentId ?? null,
 		component_props: widget.props ? JSON.stringify(widget.props) : null
-	}).execute();
+	};
 }
 /**
 * Type guard for $media reference
@@ -1546,24 +1589,30 @@ async function deleteMediaRow(db, id) {
 * Resolve a $media reference by downloading and uploading the media
 */
 async function resolveMedia(ref, ctx, result) {
-	const { url, alt, filename, caption } = ref.$media;
+	const { url, alt, filename, caption, libraryCaption } = ref.$media;
 	const cached = ctx.mediaCache.get(url);
 	if (cached) {
 		result.media.skipped++;
 		return {
 			...cached,
-			alt: alt ?? cached.alt
+			alt: alt ?? cached.alt,
+			caption: caption ?? cached.caption
 		};
 	}
 	if (ctx.skipMediaDownload) {
+		const defaultCaption = libraryCaption ?? void 0;
 		const mediaValue = {
 			provider: "external",
 			id: ulid(),
 			src: url,
 			alt: alt ?? void 0,
+			caption: caption ?? defaultCaption,
 			filename: filename ?? void 0
 		};
-		ctx.mediaCache.set(url, mediaValue);
+		ctx.mediaCache.set(url, {
+			...mediaValue,
+			caption: defaultCaption
+		});
 		result.media.skipped++;
 		return mediaValue;
 	}
@@ -1594,13 +1643,17 @@ async function resolveMedia(ref, ctx, result) {
 				provider: "local",
 				id: existing.id,
 				alt: alt ?? existing.alt ?? void 0,
+				caption: caption ?? existing.caption ?? void 0,
 				width: existing.width ?? void 0,
 				height: existing.height ?? void 0,
 				mimeType: existing.mimeType,
 				filename: existing.filename,
 				meta: { storageKey: existing.storageKey }
 			};
-			ctx.mediaCache.set(url, mediaValue);
+			ctx.mediaCache.set(url, {
+				...mediaValue,
+				caption: existing.caption ?? void 0
+			});
 			result.media.skipped++;
 			console.log(`  ✅ Reused: ${existing.filename}`);
 			return mediaValue;
@@ -1620,28 +1673,33 @@ async function resolveMedia(ref, ctx, result) {
 			body,
 			contentType
 		});
+		const media = await mediaRepo.create({
+			filename: finalFilename,
+			mimeType: contentType,
+			size: body.length,
+			width,
+			height,
+			alt,
+			caption: (libraryCaption === void 0 ? caption : libraryCaption) ?? void 0,
+			storageKey,
+			contentHash,
+			status: "ready"
+		});
 		const mediaValue = {
 			provider: "local",
-			id: (await mediaRepo.create({
-				filename: finalFilename,
-				mimeType: contentType,
-				size: body.length,
-				width,
-				height,
-				alt,
-				caption,
-				storageKey,
-				contentHash,
-				status: "ready"
-			})).id,
+			id: media.id,
 			alt: alt ?? void 0,
+			caption: caption ?? media.caption ?? void 0,
 			width,
 			height,
 			mimeType: contentType,
 			filename: finalFilename,
 			meta: { storageKey }
 		};
-		ctx.mediaCache.set(url, mediaValue);
+		ctx.mediaCache.set(url, {
+			...mediaValue,
+			caption: media.caption ?? void 0
+		});
 		result.media.created++;
 		console.log(`  ✅ Uploaded: ${finalFilename}`);
 		return mediaValue;
@@ -1699,4 +1757,4 @@ function getImageDimensions(buffer) {
 
 //#endregion
 export { sanitizeGalleryImages as a, resolveImageMedia as i, applySeedWithinBudget as n, createPublicMediaUrlResolver as o, apply_exports as r, applySeed as t };
-//# sourceMappingURL=apply-T7ATgzCh.mjs.map
+//# sourceMappingURL=apply-DVnupNeS.mjs.map