npm - emdash - Versions diffs - 1.3.0 → 1.4.0 - Mend

emdash 1.3.0 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (970) hide show

package/dist/{menus-BSzwObhV.mjs → menus-uEAxWAm1.mjs} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { t as isSafeHref } from "./url-Dn3IStq8.mjs";
-import { y as localeCode } from "./redirects-BEVSRMa2.mjs";
+import { t as isSafeHref } from "./url-DTfGDJhI.mjs";
+import { y as localeCode } from "./redirects-CyvvZrCJ.mjs";
 import { z } from "zod";
 //#region src/api/schemas/menus.ts
@@ -89,4 +89,4 @@ const menuWithItemsSchema = menuSchema.extend({ items: z.array(menuItemSchema) }
 //#endregion
 export { menuListItemSchema as a, menuWithItemsSchema as c, updateMenuBody as d, updateMenuItemBody as f, menuItemTypeEnum as i, reorderMenuItemsBody as l, createMenuItemBody as n, menuSchema as o, menuItemSchema as r, menuTranslationsSchema as s, createMenuBody as t, safeHref as u };
-//# sourceMappingURL=menus-BSzwObhV.mjs.map
+//# sourceMappingURL=menus-uEAxWAm1.mjs.map

package/dist/{menus-BSzwObhV.mjs.map → menus-uEAxWAm1.mjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"menus-~~BSzwObhV~~.mjs","names":[],"sources":["../src/api/schemas/menus.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { isSafeHref } from \"../../utils/url.js\";\nimport { localeCode } from \"./common.js\";\n\n// ---------------------------------------------------------------------------\n// Menus: Input schemas\n// ---------------------------------------------------------------------------\n\n/*\n Allowed menu item types. `custom` uses `customUrl`; the others resolve a URL\n * from `referenceCollection` + `referenceId` (a translation_group id).\n /\nexport const menuItemTypeEnum = z.enum([\"custom\", \"page\", \"post\", \"taxonomy\", \"collection\"]);\n\nexport const safeHref = z\n\t.string()\n\t.trim()\n\t.refine(\n\t\tisSafeHref,\n\t\t\"URL must use http, https, mailto, tel, a relative path, or a fragment identifier\",\n\t);\n\nexport const createMenuBody = z\n\t.object({\n\t\tname: z.string().min(1),\n\t\tlabel: z.string().min(1),\n\t\tlocale: localeCode.optional(),\n\t\t/* When set, clones the items from the source menu. The new menu joins\n\t\t * the source's translation_group. */\n\t\ttranslationOf: z.string().min(1).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"CreateMenuBody\" });\n\nexport const updateMenuBody = z\n\t.object({\n\t\tlabel: z.string().min(1).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"UpdateMenuBody\" });\n\nexport const createMenuItemBody = z\n\t.object({\n\t\ttype: menuItemTypeEnum,\n\t\tlabel: z.string().min(1),\n\t\treferenceCollection: z.string().optional(),\n\t\treferenceId: z.string().optional(),\n\t\tcustomUrl: safeHref.optional(),\n\t\ttarget: z.string().optional(),\n\t\ttitleAttr: z.string().optional(),\n\t\tcssClasses: z.string().optional(),\n\t\tparentId: z.string().optional(),\n\t\tsortOrder: z.number().int().min(0).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"CreateMenuItemBody\" });\n\nexport const updateMenuItemBody = z\n\t.object({\n\t\tlabel: z.string().min(1).optional(),\n\t\tcustomUrl: safeHref.optional(),\n\t\ttarget: z.string().optional(),\n\t\ttitleAttr: z.string().optional(),\n\t\tcssClasses: z.string().optional(),\n\t\tparentId: z.string().nullish(),\n\t\tsortOrder: z.number().int().min(0).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"UpdateMenuItemBody\" });\n\nexport const reorderMenuItemsBody = z\n\t.object({\n\t\titems: z.array(\n\t\t\tz.object({\n\t\t\t\tid: z.string().min(1),\n\t\t\t\tparentId: z.string().nullable(),\n\t\t\t\tsortOrder: z.number().int().min(0),\n\t\t\t}),\n\t\t),\n\t})\n\t.meta({ id: \"ReorderMenuItemsBody\" });\n\n// ---------------------------------------------------------------------------\n// Menus: Response schemas\n//\n// All responses are camelCase to align with the rest of the EmDash REST API\n// (content, taxonomies, redirects, etc.). The DB columns are snake_case;\n// handlers hydrate rows into the shapes below before returning.\n// ---------------------------------------------------------------------------\n\nexport const menuSchema = z\n\t.object({\n\t\tid: z.string(),\n\t\tname: z.string(),\n\t\tlabel: z.string(),\n\t\tcreatedAt: z.string(),\n\t\tupdatedAt: z.string(),\n\t\tlocale: z.string(),\n\t\ttranslationGroup: z.string().nullable(),\n\t})\n\t.meta({ id: \"Menu\" });\n\nexport const menuItemSchema = z\n\t.object({\n\t\tid: z.string(),\n\t\tmenuId: z.string(),\n\t\tparentId: z.string().nullable(),\n\t\tsortOrder: z.number().int(),\n\t\ttype: z.string(),\n\t\treferenceCollection: z.string().nullable(),\n\t\treferenceId: z.string().nullable(),\n\t\tcustomUrl: z.string().nullable(),\n\t\tlabel: z.string(),\n\t\ttitleAttr: z.string().nullable(),\n\t\ttarget: z.string().nullable(),\n\t\tcssClasses: z.string().nullable(),\n\t\tcreatedAt: z.string(),\n\t\tlocale: z.string(),\n\t\ttranslationGroup: z.string().nullable(),\n\t})\n\t.meta({ id: \"MenuItem\" });\n\nexport const menuTranslationsSchema = z\n\t.object({\n\t\ttranslationGroup: z.string().nullable(),\n\t\ttranslations: z.array(\n\t\t\tz.object({\n\t\t\t\tid: z.string(),\n\t\t\t\tname: z.string(),\n\t\t\t\tlabel: z.string(),\n\t\t\t\tlocale: z.string(),\n\t\t\t\tupdatedAt: z.string(),\n\t\t\t}),\n\t\t),\n\t})\n\t.meta({ id: \"MenuTranslations\" });\n\nexport const menuListItemSchema = menuSchema\n\t.extend({\n\t\titemCount: z.number().int(),\n\t})\n\t.meta({ id: \"MenuListItem\" });\n\nexport const menuWithItemsSchema = menuSchema\n\t.extend({\n\t\titems: z.array(menuItemSchema),\n\t})\n\t.meta({ id: \"MenuWithItems\" });\n"],"mappings":";;;;;;;;;AAaA,MAAa,mBAAmB,EAAE,KAAK;CAAC;CAAU;CAAQ;CAAQ;CAAY;CAAa,CAAC;AAE5F,MAAa,WAAW,EACtB,QAAQ,CACR,MAAM,CACN,OACA,YACA,mFACA;AAEF,MAAa,iBAAiB,EAC5B,OAAO;CACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,QAAQ,WAAW,UAAU;CAG7B,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CAC3C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,kBAAkB,CAAC;AAEhC,MAAa,iBAAiB,EAC5B,OAAO,EACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACnC,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,kBAAkB,CAAC;AAEhC,MAAa,qBAAqB,EAChC,OAAO;CACP,MAAM;CACN,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,WAAW,SAAS,UAAU;CAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,qBAAqB,EAChC,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnC,WAAW,SAAS,UAAU;CAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,uBAAuB,EAClC,OAAO,EACP,OAAO,EAAE,MACR,EAAE,OAAO;CACR,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;CACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE;CAClC,CAAC,CACF,EACD,CAAC,CACD,KAAK,EAAE,IAAI,wBAAwB,CAAC;AAUtC,MAAa,aAAa,EACxB,OAAO;CACP,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,WAAW,EAAE,QAAQ;CACrB,WAAW,EAAE,QAAQ;CACrB,QAAQ,EAAE,QAAQ;CAClB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,CAAC,CACD,KAAK,EAAE,IAAI,QAAQ,CAAC;AAEtB,MAAa,iBAAiB,EAC5B,OAAO;CACP,IAAI,EAAE,QAAQ;CACd,QAAQ,EAAE,QAAQ;CAClB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK;CAC3B,MAAM,EAAE,QAAQ;CAChB,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,OAAO,EAAE,QAAQ;CACjB,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,WAAW,EAAE,QAAQ;CACrB,QAAQ,EAAE,QAAQ;CAClB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,CAAC,CACD,KAAK,EAAE,IAAI,YAAY,CAAC;AAE1B,MAAa,yBAAyB,EACpC,OAAO;CACP,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,cAAc,EAAE,MACf,EAAE,OAAO;EACR,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ;EAChB,OAAO,EAAE,QAAQ;EACjB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,QAAQ;EACrB,CAAC,CACF;CACD,CAAC,CACD,KAAK,EAAE,IAAI,oBAAoB,CAAC;AAElC,MAAa,qBAAqB,WAChC,OAAO,EACP,WAAW,EAAE,QAAQ,CAAC,KAAK,EAC3B,CAAC,CACD,KAAK,EAAE,IAAI,gBAAgB,CAAC;AAE9B,MAAa,sBAAsB,WACjC,OAAO,EACP,OAAO,EAAE,MAAM,eAAe,EAC9B,CAAC,CACD,KAAK,EAAE,IAAI,iBAAiB,CAAC"}
1	+ {"version":3,"file":"menus-uEAxWAm1.mjs","names":[],"sources":["../src/api/schemas/menus.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { isSafeHref } from \"../../utils/url.js\";\nimport { localeCode } from \"./common.js\";\n\n// ---------------------------------------------------------------------------\n// Menus: Input schemas\n// ---------------------------------------------------------------------------\n\n/*\n Allowed menu item types. `custom` uses `customUrl`; the others resolve a URL\n * from `referenceCollection` + `referenceId` (a translation_group id).\n /\nexport const menuItemTypeEnum = z.enum([\"custom\", \"page\", \"post\", \"taxonomy\", \"collection\"]);\n\nexport const safeHref = z\n\t.string()\n\t.trim()\n\t.refine(\n\t\tisSafeHref,\n\t\t\"URL must use http, https, mailto, tel, a relative path, or a fragment identifier\",\n\t);\n\nexport const createMenuBody = z\n\t.object({\n\t\tname: z.string().min(1),\n\t\tlabel: z.string().min(1),\n\t\tlocale: localeCode.optional(),\n\t\t/* When set, clones the items from the source menu. The new menu joins\n\t\t * the source's translation_group. */\n\t\ttranslationOf: z.string().min(1).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"CreateMenuBody\" });\n\nexport const updateMenuBody = z\n\t.object({\n\t\tlabel: z.string().min(1).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"UpdateMenuBody\" });\n\nexport const createMenuItemBody = z\n\t.object({\n\t\ttype: menuItemTypeEnum,\n\t\tlabel: z.string().min(1),\n\t\treferenceCollection: z.string().optional(),\n\t\treferenceId: z.string().optional(),\n\t\tcustomUrl: safeHref.optional(),\n\t\ttarget: z.string().optional(),\n\t\ttitleAttr: z.string().optional(),\n\t\tcssClasses: z.string().optional(),\n\t\tparentId: z.string().optional(),\n\t\tsortOrder: z.number().int().min(0).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"CreateMenuItemBody\" });\n\nexport const updateMenuItemBody = z\n\t.object({\n\t\tlabel: z.string().min(1).optional(),\n\t\tcustomUrl: safeHref.optional(),\n\t\ttarget: z.string().optional(),\n\t\ttitleAttr: z.string().optional(),\n\t\tcssClasses: z.string().optional(),\n\t\tparentId: z.string().nullish(),\n\t\tsortOrder: z.number().int().min(0).optional(),\n\t})\n\t.strict()\n\t.meta({ id: \"UpdateMenuItemBody\" });\n\nexport const reorderMenuItemsBody = z\n\t.object({\n\t\titems: z.array(\n\t\t\tz.object({\n\t\t\t\tid: z.string().min(1),\n\t\t\t\tparentId: z.string().nullable(),\n\t\t\t\tsortOrder: z.number().int().min(0),\n\t\t\t}),\n\t\t),\n\t})\n\t.meta({ id: \"ReorderMenuItemsBody\" });\n\n// ---------------------------------------------------------------------------\n// Menus: Response schemas\n//\n// All responses are camelCase to align with the rest of the EmDash REST API\n// (content, taxonomies, redirects, etc.). The DB columns are snake_case;\n// handlers hydrate rows into the shapes below before returning.\n// ---------------------------------------------------------------------------\n\nexport const menuSchema = z\n\t.object({\n\t\tid: z.string(),\n\t\tname: z.string(),\n\t\tlabel: z.string(),\n\t\tcreatedAt: z.string(),\n\t\tupdatedAt: z.string(),\n\t\tlocale: z.string(),\n\t\ttranslationGroup: z.string().nullable(),\n\t})\n\t.meta({ id: \"Menu\" });\n\nexport const menuItemSchema = z\n\t.object({\n\t\tid: z.string(),\n\t\tmenuId: z.string(),\n\t\tparentId: z.string().nullable(),\n\t\tsortOrder: z.number().int(),\n\t\ttype: z.string(),\n\t\treferenceCollection: z.string().nullable(),\n\t\treferenceId: z.string().nullable(),\n\t\tcustomUrl: z.string().nullable(),\n\t\tlabel: z.string(),\n\t\ttitleAttr: z.string().nullable(),\n\t\ttarget: z.string().nullable(),\n\t\tcssClasses: z.string().nullable(),\n\t\tcreatedAt: z.string(),\n\t\tlocale: z.string(),\n\t\ttranslationGroup: z.string().nullable(),\n\t})\n\t.meta({ id: \"MenuItem\" });\n\nexport const menuTranslationsSchema = z\n\t.object({\n\t\ttranslationGroup: z.string().nullable(),\n\t\ttranslations: z.array(\n\t\t\tz.object({\n\t\t\t\tid: z.string(),\n\t\t\t\tname: z.string(),\n\t\t\t\tlabel: z.string(),\n\t\t\t\tlocale: z.string(),\n\t\t\t\tupdatedAt: z.string(),\n\t\t\t}),\n\t\t),\n\t})\n\t.meta({ id: \"MenuTranslations\" });\n\nexport const menuListItemSchema = menuSchema\n\t.extend({\n\t\titemCount: z.number().int(),\n\t})\n\t.meta({ id: \"MenuListItem\" });\n\nexport const menuWithItemsSchema = menuSchema\n\t.extend({\n\t\titems: z.array(menuItemSchema),\n\t})\n\t.meta({ id: \"MenuWithItems\" });\n"],"mappings":";;;;;;;;;AAaA,MAAa,mBAAmB,EAAE,KAAK;CAAC;CAAU;CAAQ;CAAQ;CAAY;CAAa,CAAC;AAE5F,MAAa,WAAW,EACtB,QAAQ,CACR,MAAM,CACN,OACA,YACA,mFACA;AAEF,MAAa,iBAAiB,EAC5B,OAAO;CACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,QAAQ,WAAW,UAAU;CAG7B,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CAC3C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,kBAAkB,CAAC;AAEhC,MAAa,iBAAiB,EAC5B,OAAO,EACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACnC,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,kBAAkB,CAAC;AAEhC,MAAa,qBAAqB,EAChC,OAAO;CACP,MAAM;CACN,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,WAAW,SAAS,UAAU;CAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,qBAAqB,EAChC,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnC,WAAW,SAAS,UAAU;CAC9B,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,CAAC,CACD,QAAQ,CACR,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,uBAAuB,EAClC,OAAO,EACP,OAAO,EAAE,MACR,EAAE,OAAO;CACR,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;CACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE;CAClC,CAAC,CACF,EACD,CAAC,CACD,KAAK,EAAE,IAAI,wBAAwB,CAAC;AAUtC,MAAa,aAAa,EACxB,OAAO;CACP,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,WAAW,EAAE,QAAQ;CACrB,WAAW,EAAE,QAAQ;CACrB,QAAQ,EAAE,QAAQ;CAClB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,CAAC,CACD,KAAK,EAAE,IAAI,QAAQ,CAAC;AAEtB,MAAa,iBAAiB,EAC5B,OAAO;CACP,IAAI,EAAE,QAAQ;CACd,QAAQ,EAAE,QAAQ;CAClB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK;CAC3B,MAAM,EAAE,QAAQ;CAChB,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,OAAO,EAAE,QAAQ;CACjB,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,WAAW,EAAE,QAAQ;CACrB,QAAQ,EAAE,QAAQ;CAClB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,CAAC,CACD,KAAK,EAAE,IAAI,YAAY,CAAC;AAE1B,MAAa,yBAAyB,EACpC,OAAO;CACP,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,cAAc,EAAE,MACf,EAAE,OAAO;EACR,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ;EAChB,OAAO,EAAE,QAAQ;EACjB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,QAAQ;EACrB,CAAC,CACF;CACD,CAAC,CACD,KAAK,EAAE,IAAI,oBAAoB,CAAC;AAElC,MAAa,qBAAqB,WAChC,OAAO,EACP,WAAW,EAAE,QAAQ,CAAC,KAAK,EAC3B,CAAC,CACD,KAAK,EAAE,IAAI,gBAAgB,CAAC;AAE9B,MAAa,sBAAsB,WACjC,OAAO,EACP,OAAO,EAAE,MAAM,eAAe,EAC9B,CAAC,CACD,KAAK,EAAE,IAAI,iBAAiB,CAAC"}

package/dist/migrations/index.d.mts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { a as MigrationExecutorModule, c as MigrationRequest, i as MigrationExecutorFactoryContext, l as MigrationTarget, n as MigrationExecutor, o as MigrationLockReport, r as MigrationExecutorFactory, s as MigrationReport, t as MigrationAction, u as MigrationTargetOverrides } from "../protocol-79kUO7jP.mjs";
+import { a as MigrationExecutorModule, c as MigrationRequest, i as MigrationExecutorFactoryContext, l as MigrationTarget, n as MigrationExecutor, o as MigrationLockReport, r as MigrationExecutorFactory, s as MigrationReport, t as MigrationAction, u as MigrationTargetOverrides } from "../protocol-PoAfD_9W.mjs";
 import { Dialect } from "kysely";
 //#region src/migrations/direct-executor.d.ts

package/dist/migrations/index.mjs CHANGED Viewed

@@ -1,8 +1,8 @@
-import "../runner-C5NeAkBQ.mjs";
-import "../dialect-helpers-7_IqPdh9.mjs";
-import "../config-CvmjJcVw.mjs";
+import "../runner-Bkkfk4O8.mjs";
+import "../dialect-helpers-B1XN2HGB.mjs";
+import "../config-Cs_AwWXI.mjs";
 import "../datetime-normalization-PeiEdcRY.mjs";
-import { n as fingerprintMigrationSet, r as getCoreMigrationIdentity, t as createCoreMigrationIdentity } from "../identity-Cael5uTT.mjs";
-import { t as createDirectMigrationExecutor } from "../direct-executor-Cbxzg4qe.mjs";
+import { n as fingerprintMigrationSet, r as getCoreMigrationIdentity, t as createCoreMigrationIdentity } from "../identity-CPRRSovU.mjs";
+import { t as createDirectMigrationExecutor } from "../direct-executor-Bs2g0ake.mjs";
 export { createCoreMigrationIdentity, createDirectMigrationExecutor, fingerprintMigrationSet, getCoreMigrationIdentity };

package/dist/{mime-B5M9R53H.mjs → mime-D1We9jUx.mjs} RENAMED Viewed

@@ -78,4 +78,4 @@ function parseAllowedMimeTypes(rawValidation) {
 //#endregion
 export { resolveUploadMimeType as i, normalizeMime as n, parseAllowedMimeTypes as r, matchesMimeAllowlist as t };
-//# sourceMappingURL=mime-B5M9R53H.mjs.map
+//# sourceMappingURL=mime-D1We9jUx.mjs.map

package/dist/{mime-B5M9R53H.mjs.map → mime-D1We9jUx.mjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mime-~~B5M9R53H~~.mjs","names":[],"sources":["../src/media/mime.ts"],"sourcesContent":["import * as path from \"node:path\";\n\nexport function normalizeMime(mime: string): string {\n\treturn mime.split(\";\")[0].trim().toLowerCase();\n}\n\nexport function matchesMimeAllowlist(mime: string, allowList: readonly string[]): boolean {\n\tconst normalized = normalizeMime(mime);\n\tfor (const entry of allowList) {\n\t\tif (!entry \|\| !entry.includes(\"/\")) continue;\n\t\tconst normalizedEntry = normalizeMime(entry);\n\t\tif (normalizedEntry.endsWith(\"/\")) {\n\t\t\tif (normalized.startsWith(normalizedEntry)) return true;\n\t\t} else if (normalized === normalizedEntry) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\nconst UNKNOWN_UPLOAD_TYPES = new Set([\"\", \"application/octet-stream\"]);\n\n/*\n Resolve the MIME type for an uploaded file.\n \n Browsers that don't recognise an extension (e.g. `.jxl`) often report an\n * empty or generic `application/octet-stream` type. In those cases fall back to\n * the extension map so server-side allowlist checks can still identify allowed\n * formats such as `image/jxl`.\n /\nexport function resolveUploadMimeType(filename: string, fileType: string): string {\n\tconst normalized = normalizeMime(fileType);\n\tif (normalized && !UNKNOWN_UPLOAD_TYPES.has(normalized)) {\n\t\treturn normalized;\n\t}\n\treturn EXTENSION_TO_MIME[path.extname(filename).toLowerCase()] ?? \"\";\n}\n\nexport const EXTENSION_TO_MIME: Readonly<Record<string, string>> = {\n\t\".pdf\": \"application/pdf\",\n\t\".png\": \"image/png\",\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".gif\": \"image/gif\",\n\t\".webp\": \"image/webp\",\n\t\".avif\": \"image/avif\",\n\t\".jxl\": \"image/jxl\",\n\t\".svg\": \"image/svg+xml\",\n\t\".mp3\": \"audio/mpeg\",\n\t\".wav\": \"audio/wav\",\n\t\".mp4\": \"video/mp4\",\n\t\".webm\": \"video/webm\",\n\t\".zip\": \"application/zip\",\n\t\".tar\": \"application/x-tar\",\n\t\".gz\": \"application/gzip\",\n\t\".csv\": \"text/csv\",\n\t\".doc\": \"application/msword\",\n\t\".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n\t\".xls\": \"application/vnd.ms-excel\",\n\t\".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n\t\".txt\": \"text/plain\",\n\t\".rtf\": \"application/rtf\",\n\t\".vtt\": \"text/vtt\",\n\t\".srt\": \"application/x-subrip\",\n\t\".woff\": \"font/woff\",\n\t\".woff2\": \"font/woff2\",\n};\n\nconst VALID_MIME_RE = /^[a-z0-9][a-z0-9!#$&^_+\\-.]\\/[a-z0-9!#$&^_+\\-.]$/i;\n\nexport function expandExtensionShorthand(entry: string): string \| null {\n\tconst trimmed = entry.trim();\n\tif (!trimmed) return null;\n\tif (trimmed.includes(\"/\")) return VALID_MIME_RE.test(trimmed) ? trimmed : null;\n\tif (trimmed.startsWith(\".\")) {\n\t\treturn EXTENSION_TO_MIME[trimmed.toLowerCase()] ?? null;\n\t}\n\treturn null;\n}\n\n/\n Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row\n * (raw JSON string). Returns null when the value is missing, malformed, or the\n * list is empty — callers treat that as \"no field-specific constraint\".\n */\nexport function parseAllowedMimeTypes(rawValidation: string \| null \| undefined): string[] \| null {\n\tif (!rawValidation) return null;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(rawValidation);\n\t\tif (typeof parsed !== \"object\" \|\| parsed === null) return null;\n\t\tconst list = (parsed as { allowedMimeTypes?: unknown }).allowedMimeTypes;\n\t\tif (!Array.isArray(list) \|\| list.length === 0) return null;\n\t\treturn list.filter((entry): entry is string => typeof entry === \"string\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;AAEA,SAAgB,cAAc,MAAsB;AACnD,QAAO,KAAK,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa;;AAG/C,SAAgB,qBAAqB,MAAc,WAAuC;CACzF,MAAM,aAAa,cAAc,KAAK;AACtC,MAAK,MAAM,SAAS,WAAW;AAC9B,MAAI,CAAC,SAAS,CAAC,MAAM,SAAS,IAAI,CAAE;EACpC,MAAM,kBAAkB,cAAc,MAAM;AAC5C,MAAI,gBAAgB,SAAS,IAAI,EAChC;OAAI,WAAW,WAAW,gBAAgB,CAAE,QAAO;aACzC,eAAe,gBACzB,QAAO;;AAGT,QAAO;;AAGR,MAAM,uBAAuB,IAAI,IAAI,CAAC,IAAI,2BAA2B,CAAC;;;;;;;;;AAUtE,SAAgB,sBAAsB,UAAkB,UAA0B;CACjF,MAAM,aAAa,cAAc,SAAS;AAC1C,KAAI,cAAc,CAAC,qBAAqB,IAAI,WAAW,CACtD,QAAO;AAER,QAAO,kBAAkB,KAAK,QAAQ,SAAS,CAAC,aAAa,KAAK;;AAGnE,MAAa,oBAAsD;CAClE,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,UAAU;CACV;;;;;;AAmBD,SAAgB,sBAAsB,eAA2D;AAChG,KAAI,CAAC,cAAe,QAAO;AAC3B,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,cAAc;AACjD,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;EAC1D,MAAM,OAAQ,OAA0C;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,WAAW,EAAG,QAAO;AACtD,SAAO,KAAK,QAAQ,UAA2B,OAAO,UAAU,SAAS;SAClE;AACP,SAAO"}
1	+ {"version":3,"file":"mime-D1We9jUx.mjs","names":[],"sources":["../src/media/mime.ts"],"sourcesContent":["import * as path from \"node:path\";\n\nexport function normalizeMime(mime: string): string {\n\treturn mime.split(\";\")[0].trim().toLowerCase();\n}\n\nexport function matchesMimeAllowlist(mime: string, allowList: readonly string[]): boolean {\n\tconst normalized = normalizeMime(mime);\n\tfor (const entry of allowList) {\n\t\tif (!entry \|\| !entry.includes(\"/\")) continue;\n\t\tconst normalizedEntry = normalizeMime(entry);\n\t\tif (normalizedEntry.endsWith(\"/\")) {\n\t\t\tif (normalized.startsWith(normalizedEntry)) return true;\n\t\t} else if (normalized === normalizedEntry) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\nconst UNKNOWN_UPLOAD_TYPES = new Set([\"\", \"application/octet-stream\"]);\n\n/*\n Resolve the MIME type for an uploaded file.\n \n Browsers that don't recognise an extension (e.g. `.jxl`) often report an\n * empty or generic `application/octet-stream` type. In those cases fall back to\n * the extension map so server-side allowlist checks can still identify allowed\n * formats such as `image/jxl`.\n /\nexport function resolveUploadMimeType(filename: string, fileType: string): string {\n\tconst normalized = normalizeMime(fileType);\n\tif (normalized && !UNKNOWN_UPLOAD_TYPES.has(normalized)) {\n\t\treturn normalized;\n\t}\n\treturn EXTENSION_TO_MIME[path.extname(filename).toLowerCase()] ?? \"\";\n}\n\nexport const EXTENSION_TO_MIME: Readonly<Record<string, string>> = {\n\t\".pdf\": \"application/pdf\",\n\t\".png\": \"image/png\",\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".gif\": \"image/gif\",\n\t\".webp\": \"image/webp\",\n\t\".avif\": \"image/avif\",\n\t\".jxl\": \"image/jxl\",\n\t\".svg\": \"image/svg+xml\",\n\t\".mp3\": \"audio/mpeg\",\n\t\".wav\": \"audio/wav\",\n\t\".mp4\": \"video/mp4\",\n\t\".webm\": \"video/webm\",\n\t\".zip\": \"application/zip\",\n\t\".tar\": \"application/x-tar\",\n\t\".gz\": \"application/gzip\",\n\t\".csv\": \"text/csv\",\n\t\".doc\": \"application/msword\",\n\t\".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n\t\".xls\": \"application/vnd.ms-excel\",\n\t\".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n\t\".txt\": \"text/plain\",\n\t\".rtf\": \"application/rtf\",\n\t\".vtt\": \"text/vtt\",\n\t\".srt\": \"application/x-subrip\",\n\t\".woff\": \"font/woff\",\n\t\".woff2\": \"font/woff2\",\n};\n\nconst VALID_MIME_RE = /^[a-z0-9][a-z0-9!#$&^_+\\-.]\\/[a-z0-9!#$&^_+\\-.]$/i;\n\nexport function expandExtensionShorthand(entry: string): string \| null {\n\tconst trimmed = entry.trim();\n\tif (!trimmed) return null;\n\tif (trimmed.includes(\"/\")) return VALID_MIME_RE.test(trimmed) ? trimmed : null;\n\tif (trimmed.startsWith(\".\")) {\n\t\treturn EXTENSION_TO_MIME[trimmed.toLowerCase()] ?? null;\n\t}\n\treturn null;\n}\n\n/\n Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row\n * (raw JSON string). Returns null when the value is missing, malformed, or the\n * list is empty — callers treat that as \"no field-specific constraint\".\n */\nexport function parseAllowedMimeTypes(rawValidation: string \| null \| undefined): string[] \| null {\n\tif (!rawValidation) return null;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(rawValidation);\n\t\tif (typeof parsed !== \"object\" \|\| parsed === null) return null;\n\t\tconst list = (parsed as { allowedMimeTypes?: unknown }).allowedMimeTypes;\n\t\tif (!Array.isArray(list) \|\| list.length === 0) return null;\n\t\treturn list.filter((entry): entry is string => typeof entry === \"string\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;AAEA,SAAgB,cAAc,MAAsB;AACnD,QAAO,KAAK,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa;;AAG/C,SAAgB,qBAAqB,MAAc,WAAuC;CACzF,MAAM,aAAa,cAAc,KAAK;AACtC,MAAK,MAAM,SAAS,WAAW;AAC9B,MAAI,CAAC,SAAS,CAAC,MAAM,SAAS,IAAI,CAAE;EACpC,MAAM,kBAAkB,cAAc,MAAM;AAC5C,MAAI,gBAAgB,SAAS,IAAI,EAChC;OAAI,WAAW,WAAW,gBAAgB,CAAE,QAAO;aACzC,eAAe,gBACzB,QAAO;;AAGT,QAAO;;AAGR,MAAM,uBAAuB,IAAI,IAAI,CAAC,IAAI,2BAA2B,CAAC;;;;;;;;;AAUtE,SAAgB,sBAAsB,UAAkB,UAA0B;CACjF,MAAM,aAAa,cAAc,SAAS;AAC1C,KAAI,cAAc,CAAC,qBAAqB,IAAI,WAAW,CACtD,QAAO;AAER,QAAO,kBAAkB,KAAK,QAAQ,SAAS,CAAC,aAAa,KAAK;;AAGnE,MAAa,oBAAsD;CAClE,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,UAAU;CACV;;;;;;AAmBD,SAAgB,sBAAsB,eAA2D;AAChG,KAAI,CAAC,cAAe,QAAO;AAC3B,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,cAAc;AACjD,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;EAC1D,MAAM,OAAQ,OAA0C;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,WAAW,EAAG,QAAO;AACtD,SAAO,KAAK,QAAQ,UAA2B,OAAO,UAAU,SAAS;SAClE;AACP,SAAO"}

package/dist/{normalize-BuWa0lvd.mjs → normalize-Cx-bNwhP.mjs} RENAMED Viewed

@@ -1,5 +1,25 @@
-import { n as normalizeFocalPoint } from "./focal-point-JX8kcOTQ.mjs";
+import { n as normalizeFocalPoint } from "./focal-point-CgCcr1Ca.mjs";
+//#region src/media/caption.ts
+function getMediaCaption(value) {
+	if (typeof value.caption === "string") return value.caption;
+	if (value.meta && typeof value.meta === "object" && "caption" in value.meta && typeof value.meta.caption === "string") return value.meta.caption;
+}
+/** Keep the legacy metadata alias consistent with the per-use caption. */
+function syncMediaCaption(value) {
+	const caption = getMediaCaption(value);
+	if (caption === void 0) return value;
+	return {
+		...value,
+		caption,
+		...value.meta && Object.hasOwn(value.meta, "caption") ? { meta: {
+			...value.meta,
+			caption
+		} } : {}
+	};
+}
+//#endregion
 //#region src/media/normalize.ts
 /**
 * Media Value Normalization
@@ -26,6 +46,7 @@ function normalizeLegacyExternalMediaValue(value) {
 * Normalize a media field value into a consistent MediaValue shape.
 *
 * - `null`/`undefined` → `null`
+* - Empty or whitespace-only string → `null`
 * - Bare URL string → `{ provider: "external", id: "", src: url }`
 * - Bare internal media URL → resolved via local provider's `get()`
 * - Bare local media ID → resolved via local provider's `get()`
@@ -33,7 +54,10 @@ function normalizeLegacyExternalMediaValue(value) {
 */
 async function normalizeMediaValue(value, getProvider) {
 	if (value == null) return null;
-	if (typeof value === "string") return normalizeStringUrl(value, getProvider);
+	if (typeof value === "string") {
+		if (value.trim() === "") return null;
+		return normalizeStringUrl(value, getProvider);
+	}
 	if (!isRecord(value)) return null;
 	if (!("id" in value) && !("src" in value)) return null;
 	const parsed = normalizeLegacyExternalMediaValue(recordToMediaValue(value));
@@ -100,7 +124,7 @@ async function resolveInternalUrl(url, getProvider) {
 		src: url
 	};
 	const focalPoint = normalizeFocalPoint(item.focalX, item.focalY);
-	return {
+	return syncMediaCaption({
 		provider: "local",
 		id: item.id,
 		filename: item.filename,
@@ -111,8 +135,9 @@ async function resolveInternalUrl(url, getProvider) {
 		blurhash: item.blurhash,
 		dominantColor: item.dominantColor,
 		alt: item.alt,
+		caption: item.caption,
 		meta: item.meta
-	};
+	});
 }
 async function resolveLocalId(id, getProvider) {
 	const localProvider = getProvider("local");
@@ -125,7 +150,7 @@ async function resolveLocalId(id, getProvider) {
 	}
 	if (!item) return null;
 	const focalPoint = normalizeFocalPoint(item.focalX, item.focalY);
-	return {
+	return syncMediaCaption({
 		provider: "local",
 		id: item.id,
 		filename: item.filename,
@@ -136,12 +161,14 @@ async function resolveLocalId(id, getProvider) {
 		blurhash: item.blurhash,
 		dominantColor: item.dominantColor,
 		alt: item.alt,
+		caption: item.caption,
 		meta: item.meta
-	};
+	});
 }
 /**
-* Merge provider data into an existing MediaValue, preserving caller-supplied fields.
-* Caller `alt` takes priority over provider `alt` (per-usage, not per-image).
+* Fill missing media metadata from a provider.
+* Caller captions, including empty strings, take priority over provider captions.
+* Provider alt text fills missing or empty caller alt text.
 */
 function mergeProviderData(existing, item) {
 	const result = { ...existing };
@@ -152,11 +179,12 @@ function mergeProviderData(existing, item) {
 	if (!result.filename && item.filename) result.filename = item.filename;
 	if (!result.mimeType && item.mimeType) result.mimeType = item.mimeType;
 	if (!result.alt && item.alt) result.alt = item.alt;
+	if (result.caption == null && item.caption != null) result.caption = item.caption;
 	if (item.meta) result.meta = {
 		...item.meta,
 		...result.meta
 	};
-	return result;
+	return syncMediaCaption(result);
 }
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -182,10 +210,11 @@ function recordToMediaValue(obj) {
 	if (typeof obj.blurhash === "string") result.blurhash = obj.blurhash;
 	if (typeof obj.dominantColor === "string") result.dominantColor = obj.dominantColor;
 	if (typeof obj.alt === "string") result.alt = obj.alt;
+	if (typeof obj.caption === "string") result.caption = obj.caption;
 	if (isRecord(obj.meta)) result.meta = obj.meta;
-	return result;
+	return syncMediaCaption(result);
 }
 //#endregion
-export { normalizeMediaValue as n, INTERNAL_MEDIA_PREFIX as t };
-//# sourceMappingURL=normalize-BuWa0lvd.mjs.map
+export { syncMediaCaption as i, normalizeMediaValue as n, getMediaCaption as r, INTERNAL_MEDIA_PREFIX as t };
+//# sourceMappingURL=normalize-Cx-bNwhP.mjs.map

package/dist/normalize-Cx-bNwhP.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"normalize-Cx-bNwhP.mjs","names":[],"sources":["../src/media/caption.ts","../src/media/normalize.ts"],"sourcesContent":["interface CaptionedMedia {\n\tcaption?: string;\n\tmeta?: Record<string, unknown>;\n}\n\nexport function getMediaCaption(value: { caption?: unknown; meta?: unknown }): string | undefined {\n\tif (typeof value.caption === \"string\") return value.caption;\n\tif (\n\t\tvalue.meta &&\n\t\ttypeof value.meta === \"object\" &&\n\t\t\"caption\" in value.meta &&\n\t\ttypeof value.meta.caption === \"string\"\n\t) {\n\t\treturn value.meta.caption;\n\t}\n\treturn undefined;\n}\n\n/** Keep the legacy metadata alias consistent with the per-use caption. */\nexport function syncMediaCaption<T extends CaptionedMedia>(value: T): T {\n\tconst caption = getMediaCaption(value);\n\tif (caption === undefined) return value;\n\treturn {\n\t\t...value,\n\t\tcaption,\n\t\t...(value.meta && Object.hasOwn(value.meta, \"caption\")\n\t\t\t? { meta: { ...value.meta, caption } }\n\t\t\t: {}),\n\t};\n}\n","/**\n * Media Value Normalization\n *\n * Normalizes media field values into a consistent shape regardless of\n * creation path (seed scripts, media picker, WP import, URL input).\n *\n * Called at content create/update time when a media provider is available,\n * filling in missing dimensions, storageKey, mimeType, and filename from\n * the provider's `get()` method.\n */\n\nimport { syncMediaCaption } from \"./caption.js\";\nimport { normalizeFocalPoint } from \"./focal-point.js\";\nimport type { MediaProvider, MediaProviderItem, MediaValue } from \"./types.js\";\n\nexport const INTERNAL_MEDIA_PREFIX = \"/_emdash/api/media/file/\";\nconst URL_PATTERN = /^https?:\\/\\//;\n\nexport function normalizeLegacyExternalMediaValue(value: MediaValue): MediaValue {\n\tif (value.provider !== \"external-url\") return value;\n\tconst src = value.src ?? value.previewUrl;\n\treturn {\n\t\t...value,\n\t\tprovider: \"external\",\n\t\t...(src === undefined ? {} : { src }),\n\t};\n}\n\n/**\n * Normalize a media field value into a consistent MediaValue shape.\n *\n * - `null`/`undefined` → `null`\n * - Empty or whitespace-only string → `null`\n * - Bare URL string → `{ provider: \"external\", id: \"\", src: url }`\n * - Bare internal media URL → resolved via local provider's `get()`\n * - Bare local media ID → resolved via local provider's `get()`\n * - Object with `provider` + `id` → enriched with missing fields from provider\n */\nexport async function normalizeMediaValue(\n\tvalue: unknown,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue | null> {\n\tif (value == null) return null;\n\n\t// Bare string URL\n\tif (typeof value === \"string\") {\n\t\tif (value.trim() === \"\") return null;\n\t\treturn normalizeStringUrl(value, getProvider);\n\t}\n\n\t// Not an object — can't normalize\n\tif (!isRecord(value)) return null;\n\n\t// Must have at least an id to be a valid media value\n\tif (!(\"id\" in value) && !(\"src\" in value)) return null;\n\n\tconst parsed = normalizeLegacyExternalMediaValue(recordToMediaValue(value));\n\tconst provider = parsed.provider || \"local\";\n\tconst id = parsed.id;\n\n\t// External URLs — return as-is, no server-side dimension detection\n\tif (provider === \"external\") {\n\t\treturn parsed;\n\t}\n\n\t// Build the base value from the input\n\tconst result: MediaValue = { ...parsed, provider };\n\n\t// For local media, strip `src` — it's derived at display time from storageKey\n\tif (provider === \"local\") {\n\t\tdelete result.src;\n\t}\n\n\t// Determine if we need to call the provider\n\tconst needsDimensions = result.width == null || result.height == null;\n\tconst needsStorageKey = provider === \"local\" && !result.meta?.storageKey;\n\tconst needsFileInfo = !result.mimeType || !result.filename;\n\t// LQIP placeholders are immutable facts of the bytes: if an image record is\n\t// missing them, the provider may have gained them since (e.g. content saved\n\t// before LQIP backfill ran, or the row's blurhash was populated later). Pull\n\t// them on every image lookup so the LQIP backfill in mergeProviderData runs.\n\tconst needsLqip =\n\t\t(result.mimeType ?? \"\").startsWith(\"image/\") &&\n\t\t(result.blurhash == null || result.dominantColor == null);\n\tconst needsLookup = needsDimensions || needsStorageKey || needsFileInfo || needsLqip;\n\n\tif (!needsLookup || !id) return result;\n\n\t// Try to enrich from provider\n\tconst mediaProvider = getProvider(provider);\n\tif (!mediaProvider?.get) return result;\n\n\tlet providerItem: MediaProviderItem | null;\n\ttry {\n\t\tproviderItem = await mediaProvider.get(id);\n\t} catch {\n\t\treturn result;\n\t}\n\n\tif (!providerItem) return result;\n\n\treturn mergeProviderData(result, providerItem);\n}\n\nasync function normalizeStringUrl(\n\turl: string,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue | null> {\n\t// Internal media URL — try to resolve via local provider\n\tif (url.startsWith(INTERNAL_MEDIA_PREFIX)) {\n\t\treturn resolveInternalUrl(url, getProvider);\n\t}\n\n\t// External HTTP(S) URL\n\tif (URL_PATTERN.test(url)) {\n\t\treturn Promise.resolve({\n\t\t\tprovider: \"external\",\n\t\t\tid: \"\",\n\t\t\tsrc: url,\n\t\t});\n\t}\n\n\tconst localMedia = await resolveLocalId(url, getProvider);\n\tif (localMedia) return localMedia;\n\n\t// Unrecognized string — preserve legacy behavior and treat as external\n\treturn {\n\t\tprovider: \"external\",\n\t\tid: \"\",\n\t\tsrc: url,\n\t};\n}\n\nasync function resolveInternalUrl(\n\turl: string,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue> {\n\tconst storageKey = url.slice(INTERNAL_MEDIA_PREFIX.length);\n\tconst localProvider = getProvider(\"local\");\n\n\tif (!localProvider?.get) {\n\t\treturn { provider: \"external\", id: \"\", src: url };\n\t}\n\n\tlet item: MediaProviderItem | null;\n\ttry {\n\t\titem = await localProvider.get(storageKey);\n\t} catch {\n\t\treturn { provider: \"external\", id: \"\", src: url };\n\t}\n\n\tif (!item) {\n\t\treturn { provider: \"external\", id: \"\", src: url };\n\t}\n\n\tconst focalPoint = normalizeFocalPoint(item.focalX, item.focalY);\n\treturn syncMediaCaption({\n\t\tprovider: \"local\",\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\t...focalPoint,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tcaption: item.caption,\n\t\tmeta: item.meta,\n\t});\n}\n\nasync function resolveLocalId(\n\tid: string,\n\tgetProvider: (id: string) => MediaProvider | undefined,\n): Promise<MediaValue | null> {\n\tconst localProvider = getProvider(\"local\");\n\n\tif (!localProvider?.get) return null;\n\n\tlet item: MediaProviderItem | null;\n\ttry {\n\t\titem = await localProvider.get(id);\n\t} catch {\n\t\treturn null;\n\t}\n\n\tif (!item) return null;\n\n\tconst focalPoint = normalizeFocalPoint(item.focalX, item.focalY);\n\treturn syncMediaCaption({\n\t\tprovider: \"local\",\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\t...focalPoint,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tcaption: item.caption,\n\t\tmeta: item.meta,\n\t});\n}\n\n/**\n * Fill missing media metadata from a provider.\n * Caller captions, including empty strings, take priority over provider captions.\n * Provider alt text fills missing or empty caller alt text.\n */\nfunction mergeProviderData(existing: MediaValue, item: MediaProviderItem): MediaValue {\n\tconst result = { ...existing };\n\n\t// Fill missing dimensions\n\tif (result.width == null && item.width != null) result.width = item.width;\n\tif (result.height == null && item.height != null) result.height = item.height;\n\n\t// Fill missing LQIP placeholders (immutable facts of the bytes; caller wins)\n\tif (result.blurhash == null && item.blurhash != null) result.blurhash = item.blurhash;\n\tif (result.dominantColor == null && item.dominantColor != null) {\n\t\tresult.dominantColor = item.dominantColor;\n\t}\n\n\t// Fill missing file info\n\tif (!result.filename && item.filename) result.filename = item.filename;\n\tif (!result.mimeType && item.mimeType) result.mimeType = item.mimeType;\n\n\t// Fill missing alt (provider alt is fallback, not override)\n\tif (!result.alt && item.alt) result.alt = item.alt;\n\n\tif (result.caption == null && item.caption != null) result.caption = item.caption;\n\n\t// Fill missing meta (merge, don't replace)\n\tif (item.meta) {\n\t\tresult.meta = { ...item.meta, ...result.meta };\n\t}\n\n\treturn syncMediaCaption(result);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Extract known MediaValue fields from a runtime-checked record.\n * Avoids unsafe `as MediaValue` cast by reading each property explicitly.\n */\nfunction recordToMediaValue(obj: Record<string, unknown>): MediaValue {\n\tconst result: MediaValue = {\n\t\tid: typeof obj.id === \"string\" ? obj.id : \"\",\n\t};\n\tif (typeof obj.provider === \"string\") result.provider = obj.provider;\n\tif (typeof obj.src === \"string\") result.src = obj.src;\n\tif (typeof obj.previewUrl === \"string\") result.previewUrl = obj.previewUrl;\n\tif (typeof obj.filename === \"string\") result.filename = obj.filename;\n\tif (typeof obj.mimeType === \"string\") result.mimeType = obj.mimeType;\n\tif (typeof obj.width === \"number\") result.width = obj.width;\n\tif (typeof obj.height === \"number\") result.height = obj.height;\n\tconst focalPoint = normalizeFocalPoint(obj.focalX, obj.focalY);\n\tif (focalPoint) {\n\t\tresult.focalX = focalPoint.focalX;\n\t\tresult.focalY = focalPoint.focalY;\n\t}\n\tif (typeof obj.blurhash === \"string\") result.blurhash = obj.blurhash;\n\tif (typeof obj.dominantColor === \"string\") result.dominantColor = obj.dominantColor;\n\tif (typeof obj.alt === \"string\") result.alt = obj.alt;\n\tif (typeof obj.caption === \"string\") result.caption = obj.caption;\n\tif (isRecord(obj.meta)) result.meta = obj.meta;\n\treturn syncMediaCaption(result);\n}\n"],"mappings":";;;AAKA,SAAgB,gBAAgB,OAAkE;AACjG,KAAI,OAAO,MAAM,YAAY,SAAU,QAAO,MAAM;AACpD,KACC,MAAM,QACN,OAAO,MAAM,SAAS,YACtB,aAAa,MAAM,QACnB,OAAO,MAAM,KAAK,YAAY,SAE9B,QAAO,MAAM,KAAK;;;AAMpB,SAAgB,iBAA2C,OAAa;CACvE,MAAM,UAAU,gBAAgB,MAAM;AACtC,KAAI,YAAY,OAAW,QAAO;AAClC,QAAO;EACN,GAAG;EACH;EACA,GAAI,MAAM,QAAQ,OAAO,OAAO,MAAM,MAAM,UAAU,GACnD,EAAE,MAAM;GAAE,GAAG,MAAM;GAAM;GAAS,EAAE,GACpC,EAAE;EACL;;;;;;;;;;;;;;;ACbF,MAAa,wBAAwB;AACrC,MAAM,cAAc;AAEpB,SAAgB,kCAAkC,OAA+B;AAChF,KAAI,MAAM,aAAa,eAAgB,QAAO;CAC9C,MAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,QAAO;EACN,GAAG;EACH,UAAU;EACV,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;EACpC;;;;;;;;;;;;AAaF,eAAsB,oBACrB,OACA,aAC6B;AAC7B,KAAI,SAAS,KAAM,QAAO;AAG1B,KAAI,OAAO,UAAU,UAAU;AAC9B,MAAI,MAAM,MAAM,KAAK,GAAI,QAAO;AAChC,SAAO,mBAAmB,OAAO,YAAY;;AAI9C,KAAI,CAAC,SAAS,MAAM,CAAE,QAAO;AAG7B,KAAI,EAAE,QAAQ,UAAU,EAAE,SAAS,OAAQ,QAAO;CAElD,MAAM,SAAS,kCAAkC,mBAAmB,MAAM,CAAC;CAC3E,MAAM,WAAW,OAAO,YAAY;CACpC,MAAM,KAAK,OAAO;AAGlB,KAAI,aAAa,WAChB,QAAO;CAIR,MAAM,SAAqB;EAAE,GAAG;EAAQ;EAAU;AAGlD,KAAI,aAAa,QAChB,QAAO,OAAO;CAIf,MAAM,kBAAkB,OAAO,SAAS,QAAQ,OAAO,UAAU;CACjE,MAAM,kBAAkB,aAAa,WAAW,CAAC,OAAO,MAAM;CAC9D,MAAM,gBAAgB,CAAC,OAAO,YAAY,CAAC,OAAO;CAKlD,MAAM,aACJ,OAAO,YAAY,IAAI,WAAW,SAAS,KAC3C,OAAO,YAAY,QAAQ,OAAO,iBAAiB;AAGrD,KAAI,EAFgB,mBAAmB,mBAAmB,iBAAiB,cAEvD,CAAC,GAAI,QAAO;CAGhC,MAAM,gBAAgB,YAAY,SAAS;AAC3C,KAAI,CAAC,eAAe,IAAK,QAAO;CAEhC,IAAI;AACJ,KAAI;AACH,iBAAe,MAAM,cAAc,IAAI,GAAG;SACnC;AACP,SAAO;;AAGR,KAAI,CAAC,aAAc,QAAO;AAE1B,QAAO,kBAAkB,QAAQ,aAAa;;AAG/C,eAAe,mBACd,KACA,aAC6B;AAE7B,KAAI,IAAI,WAAW,sBAAsB,CACxC,QAAO,mBAAmB,KAAK,YAAY;AAI5C,KAAI,YAAY,KAAK,IAAI,CACxB,QAAO,QAAQ,QAAQ;EACtB,UAAU;EACV,IAAI;EACJ,KAAK;EACL,CAAC;CAGH,MAAM,aAAa,MAAM,eAAe,KAAK,YAAY;AACzD,KAAI,WAAY,QAAO;AAGvB,QAAO;EACN,UAAU;EACV,IAAI;EACJ,KAAK;EACL;;AAGF,eAAe,mBACd,KACA,aACsB;CACtB,MAAM,aAAa,IAAI,MAAM,GAA6B;CAC1D,MAAM,gBAAgB,YAAY,QAAQ;AAE1C,KAAI,CAAC,eAAe,IACnB,QAAO;EAAE,UAAU;EAAY,IAAI;EAAI,KAAK;EAAK;CAGlD,IAAI;AACJ,KAAI;AACH,SAAO,MAAM,cAAc,IAAI,WAAW;SACnC;AACP,SAAO;GAAE,UAAU;GAAY,IAAI;GAAI,KAAK;GAAK;;AAGlD,KAAI,CAAC,KACJ,QAAO;EAAE,UAAU;EAAY,IAAI;EAAI,KAAK;EAAK;CAGlD,MAAM,aAAa,oBAAoB,KAAK,QAAQ,KAAK,OAAO;AAChE,QAAO,iBAAiB;EACvB,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,GAAG;EACH,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,SAAS,KAAK;EACd,MAAM,KAAK;EACX,CAAC;;AAGH,eAAe,eACd,IACA,aAC6B;CAC7B,MAAM,gBAAgB,YAAY,QAAQ;AAE1C,KAAI,CAAC,eAAe,IAAK,QAAO;CAEhC,IAAI;AACJ,KAAI;AACH,SAAO,MAAM,cAAc,IAAI,GAAG;SAC3B;AACP,SAAO;;AAGR,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,aAAa,oBAAoB,KAAK,QAAQ,KAAK,OAAO;AAChE,QAAO,iBAAiB;EACvB,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,GAAG;EACH,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,SAAS,KAAK;EACd,MAAM,KAAK;EACX,CAAC;;;;;;;AAQH,SAAS,kBAAkB,UAAsB,MAAqC;CACrF,MAAM,SAAS,EAAE,GAAG,UAAU;AAG9B,KAAI,OAAO,SAAS,QAAQ,KAAK,SAAS,KAAM,QAAO,QAAQ,KAAK;AACpE,KAAI,OAAO,UAAU,QAAQ,KAAK,UAAU,KAAM,QAAO,SAAS,KAAK;AAGvE,KAAI,OAAO,YAAY,QAAQ,KAAK,YAAY,KAAM,QAAO,WAAW,KAAK;AAC7E,KAAI,OAAO,iBAAiB,QAAQ,KAAK,iBAAiB,KACzD,QAAO,gBAAgB,KAAK;AAI7B,KAAI,CAAC,OAAO,YAAY,KAAK,SAAU,QAAO,WAAW,KAAK;AAC9D,KAAI,CAAC,OAAO,YAAY,KAAK,SAAU,QAAO,WAAW,KAAK;AAG9D,KAAI,CAAC,OAAO,OAAO,KAAK,IAAK,QAAO,MAAM,KAAK;AAE/C,KAAI,OAAO,WAAW,QAAQ,KAAK,WAAW,KAAM,QAAO,UAAU,KAAK;AAG1E,KAAI,KAAK,KACR,QAAO,OAAO;EAAE,GAAG,KAAK;EAAM,GAAG,OAAO;EAAM;AAG/C,QAAO,iBAAiB,OAAO;;AAGhC,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;AAO5E,SAAS,mBAAmB,KAA0C;CACrE,MAAM,SAAqB,EAC1B,IAAI,OAAO,IAAI,OAAO,WAAW,IAAI,KAAK,IAC1C;AACD,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,QAAQ,SAAU,QAAO,MAAM,IAAI;AAClD,KAAI,OAAO,IAAI,eAAe,SAAU,QAAO,aAAa,IAAI;AAChE,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,UAAU,SAAU,QAAO,QAAQ,IAAI;AACtD,KAAI,OAAO,IAAI,WAAW,SAAU,QAAO,SAAS,IAAI;CACxD,MAAM,aAAa,oBAAoB,IAAI,QAAQ,IAAI,OAAO;AAC9D,KAAI,YAAY;AACf,SAAO,SAAS,WAAW;AAC3B,SAAO,SAAS,WAAW;;AAE5B,KAAI,OAAO,IAAI,aAAa,SAAU,QAAO,WAAW,IAAI;AAC5D,KAAI,OAAO,IAAI,kBAAkB,SAAU,QAAO,gBAAgB,IAAI;AACtE,KAAI,OAAO,IAAI,QAAQ,SAAU,QAAO,MAAM,IAAI;AAClD,KAAI,OAAO,IAAI,YAAY,SAAU,QAAO,UAAU,IAAI;AAC1D,KAAI,SAAS,IAAI,KAAK,CAAE,QAAO,OAAO,IAAI;AAC1C,QAAO,iBAAiB,OAAO"}

package/dist/{oauth-authorization-TpEJrYB7.mjs → oauth-authorization-CPLgBrdo.mjs} RENAMED Viewed

@@ -1,5 +1,6 @@
-import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
-import { i as generatePrefixedToken, o as hashApiToken, s as isValidScope, t as TOKEN_PREFIXES } from "./api-tokens-CdP49zVF.mjs";
+import { f as __exportAll } from "./runner-Bkkfk4O8.mjs";
+import { t as withTransaction } from "./transaction-CkoQ5wqQ.mjs";
+import { a as generatePrefixedToken, c as isValidScope, n as TOKEN_PREFIXES, s as hashApiToken, t as ACCESS_TOKEN_TTL_SECONDS } from "./api-tokens-DqSlkDVI.mjs";
 import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "./oauth-clients-BT0Pg-MO.mjs";
 import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-BDgF6IVG.mjs";
 import { clampScopes, computeS256Challenge, secureCompare } from "@emdash-cms/auth";
@@ -15,10 +16,15 @@ import { generateCodeVerifier } from "arctic";
 * Uses arctic for PKCE challenge generation and @emdash-cms/auth for token
 * utilities. Token infrastructure is shared with the device flow.
 */
+var oauth_authorization_exports = /* @__PURE__ */ __exportAll({
+	buildDeniedRedirect: () => buildDeniedRedirect,
+	cleanupExpiredAuthorizationCodes: () => cleanupExpiredAuthorizationCodes,
+	handleAuthorizationApproval: () => handleAuthorizationApproval,
+	handleAuthorizationCodeExchange: () => handleAuthorizationCodeExchange,
+	validateRedirectUri: () => validateRedirectUri
+});
 /** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */
 const AUTH_CODE_TTL_SECONDS = 600;
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 3600;
 /** Refresh token TTL: 90 days */
 const REFRESH_TOKEN_TTL_SECONDS = 2160 * 60 * 60;
 function expiresAt(seconds) {
@@ -268,7 +274,14 @@ function buildDeniedRedirect(redirectUri, state) {
 	if (state) url.searchParams.set("state", state);
 	return url.toString();
 }
+/**
+* Clean up expired authorization codes.
+*/
+async function cleanupExpiredAuthorizationCodes(db) {
+	const result = await db.deleteFrom("_emdash_authorization_codes").where("expires_at", "<", (/* @__PURE__ */ new Date()).toISOString()).executeTakeFirst();
+	return Number(result.numDeletedRows);
+}
 //#endregion
-export { handleAuthorizationApproval as n, handleAuthorizationCodeExchange as r, buildDeniedRedirect as t };
-//# sourceMappingURL=oauth-authorization-TpEJrYB7.mjs.map
+export { oauth_authorization_exports as i, handleAuthorizationApproval as n, handleAuthorizationCodeExchange as r, buildDeniedRedirect as t };
+//# sourceMappingURL=oauth-authorization-CPLgBrdo.mjs.map

package/dist/oauth-authorization-CPLgBrdo.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"oauth-authorization-CPLgBrdo.mjs","names":[],"sources":["../src/api/handlers/oauth-authorization.ts"],"sourcesContent":["/**\n * OAuth 2.1 Authorization Code + PKCE handlers.\n *\n * Implements the server side of the authorization code grant for MCP clients\n * (Claude Desktop, VS Code, etc.) per the MCP authorization spec (draft).\n *\n * Uses arctic for PKCE challenge generation and @emdash-cms/auth for token\n * utilities. Token infrastructure is shared with the device flow.\n */\n\nimport { clampScopes, computeS256Challenge, secureCompare } from \"@emdash-cms/auth\";\nimport type { RoleLevel } from \"@emdash-cms/auth\";\nimport { generateCodeVerifier } from \"arctic\";\nimport type { Kysely } from \"kysely\";\n\nimport {\n\tACCESS_TOKEN_TTL_SECONDS,\n\tgeneratePrefixedToken,\n\thashApiToken,\n\tisValidScope,\n\tTOKEN_PREFIXES,\n} from \"../../auth/api-tokens.js\";\nimport { withTransaction } from \"../../database/transaction.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { validateRedirectUri } from \"../oauth/redirect-uri.js\";\nimport type { ApiResult } from \"../types.js\";\nimport { lookupOAuthClient, validateClientRedirectUri } from \"./oauth-clients.js\";\nimport { lookupUserRoleAndStatus } from \"./oauth-user-lookup.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */\nconst AUTH_CODE_TTL_SECONDS = 10 * 60;\n\n/** Refresh token TTL: 90 days */\nconst REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface AuthorizationParams {\n\tresponse_type: string;\n\tclient_id: string;\n\tredirect_uri: string;\n\tscope?: string;\n\tstate?: string;\n\tcode_challenge: string;\n\tcode_challenge_method: string;\n\tresource?: string;\n}\n\nexport interface TokenExchangeParams {\n\tgrant_type: string;\n\tcode: string;\n\tredirect_uri: string;\n\tclient_id: string;\n\tcode_verifier: string;\n\tresource?: string;\n}\n\nexport interface TokenResponse {\n\taccess_token: string;\n\trefresh_token: string;\n\ttoken_type: \"Bearer\";\n\texpires_in: number;\n\tscope: string;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction expiresAt(seconds: number): string {\n\treturn new Date(Date.now() + seconds * 1000).toISOString();\n}\n\nexport { validateRedirectUri };\n\n/**\n * Validate and normalize scopes. Returns validated scope list.\n */\nfunction normalizeScopes(requested?: string): string[] {\n\tif (!requested) return [];\n\n\tconst scopes = requested.split(\" \").filter(Boolean).filter(isValidScope);\n\n\treturn scopes;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Process an authorization request after the user approves consent.\n *\n * Generates an authorization code, stores it with the PKCE challenge,\n * and returns the redirect URL with the code appended.\n *\n * Scopes are clamped to the user's role to prevent scope escalation.\n */\nexport async function handleAuthorizationApproval(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tuserRole: RoleLevel,\n\tparams: AuthorizationParams,\n): Promise<ApiResult<{ redirect_url: string }>> {\n\ttry {\n\t\t// Validate response_type\n\t\tif (params.response_type !== \"code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"UNSUPPORTED_RESPONSE_TYPE\",\n\t\t\t\t\tmessage: \"Only response_type=code is supported\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate redirect_uri scheme/host (basic security check)\n\t\tconst uriError = validateRedirectUri(params.redirect_uri);\n\t\tif (uriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REDIRECT_URI\", message: uriError },\n\t\t\t};\n\t\t}\n\n\t\t// Look up the registered OAuth client\n\t\tconst client = await lookupOAuthClient(db, params.client_id);\n\t\tif (!client) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_CLIENT\",\n\t\t\t\t\tmessage: \"Unknown client_id\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate redirect_uri against client's registered URIs\n\t\tconst clientUriError = validateClientRedirectUri(params.redirect_uri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REDIRECT_URI\", message: clientUriError },\n\t\t\t};\n\t\t}\n\n\t\t// Validate code_challenge_method\n\t\tif (params.code_challenge_method !== \"S256\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INVALID_REQUEST\",\n\t\t\t\t\tmessage: \"Only S256 code_challenge_method is supported\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Validate code_challenge is present\n\t\tif (!params.code_challenge) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_REQUEST\", message: \"code_challenge is required\" },\n\t\t\t};\n\t\t}\n\n\t\t// Validate scopes, then clamp to user's role\n\t\tconst userScopes = clampScopes(normalizeScopes(params.scope), userRole);\n\n\t\t// SEC-41: Intersect with client's registered scopes (if restricted).\n\t\t// A client registered with scopes: [\"content:read\"] should never receive\n\t\t// admin or schema:write, regardless of the approving user's role.\n\t\tconst clientScopes = client.scopes;\n\t\tconst scopes = clientScopes?.length\n\t\t\t? userScopes.filter((s: string) => clientScopes.includes(s))\n\t\t\t: userScopes;\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"INVALID_SCOPE\", message: \"No valid scopes requested\" },\n\t\t\t};\n\t\t}\n\n\t\t// Generate authorization code (high entropy, base64url)\n\t\tconst code = generateCodeVerifier(); // 32 bytes random, base64url\n\t\tconst codeHash = hashApiToken(code);\n\n\t\t// Store the authorization code\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_authorization_codes\")\n\t\t\t.values({\n\t\t\t\tcode_hash: codeHash,\n\t\t\t\tclient_id: params.client_id,\n\t\t\t\tredirect_uri: params.redirect_uri,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\tcode_challenge: params.code_challenge,\n\t\t\t\tcode_challenge_method: params.code_challenge_method,\n\t\t\t\tresource: params.resource ?? null,\n\t\t\t\texpires_at: expiresAt(AUTH_CODE_TTL_SECONDS),\n\t\t\t})\n\t\t\t.execute();\n\n\t\t// Build the redirect URL\n\t\tconst redirectUrl = new URL(params.redirect_uri);\n\t\tredirectUrl.searchParams.set(\"code\", code);\n\t\tif (params.state) {\n\t\t\tredirectUrl.searchParams.set(\"state\", params.state);\n\t\t}\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: { redirect_url: redirectUrl.toString() },\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Authorization error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"AUTHORIZATION_ERROR\",\n\t\t\t\tmessage: \"Failed to process authorization\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Exchange an authorization code for access + refresh tokens.\n *\n * Validates the code, verifies PKCE, and issues tokens using the same\n * infrastructure as the device flow (ec_oat_*, ec_ort_*).\n */\nexport async function handleAuthorizationCodeExchange(\n\tdb: Kysely<Database>,\n\tparams: TokenExchangeParams,\n): Promise<ApiResult<TokenResponse>> {\n\ttry {\n\t\t// Validate grant_type\n\t\tif (params.grant_type !== \"authorization_code\") {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"unsupported_grant_type\", message: \"Invalid grant_type\" },\n\t\t\t};\n\t\t}\n\n\t\t// SEC-39: Atomically consume the authorization code using DELETE...RETURNING.\n\t\t// This prevents TOCTOU double-exchange: two concurrent requests with the\n\t\t// same code will race on the DELETE, and only one will get a row back.\n\t\tconst codeHash = hashApiToken(params.code);\n\n\t\tconst row = await db\n\t\t\t.deleteFrom(\"_emdash_authorization_codes\")\n\t\t\t.where(\"code_hash\", \"=\", codeHash)\n\t\t\t.returningAll()\n\t\t\t.executeTakeFirst();\n\n\t\tif (!row) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"Invalid authorization code\" },\n\t\t\t};\n\t\t}\n\n\t\t// Check expiry\n\t\tif (new Date(row.expires_at) < new Date()) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"Authorization code expired\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify redirect_uri matches exactly\n\t\tif (row.redirect_uri !== params.redirect_uri) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"redirect_uri mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify client_id matches\n\t\tif (row.client_id !== params.client_id) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"client_id mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// PKCE verification: SHA256(code_verifier) must match stored code_challenge\n\t\t// Use constant-time comparison to prevent timing side-channels\n\t\tconst derivedChallenge = computeS256Challenge(params.code_verifier);\n\t\tif (!secureCompare(derivedChallenge, row.code_challenge)) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"PKCE verification failed\" },\n\t\t\t};\n\t\t}\n\n\t\t// Verify resource matches (if stored)\n\t\tif (row.resource && params.resource && row.resource !== params.resource) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"resource mismatch\" },\n\t\t\t};\n\t\t}\n\n\t\t// Revalidate user role before issuing tokens (same pattern as handleTokenRefresh).\n\t\t// The user's role may have changed since the authorization code was issued.\n\t\tconst userInfo = await lookupUserRoleAndStatus(db, row.user_id);\n\t\tif (!userInfo) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"User not found\" },\n\t\t\t};\n\t\t}\n\n\t\tif (userInfo.disabled) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"invalid_grant\", message: \"User account is disabled\" },\n\t\t\t};\n\t\t}\n\n\t\t// Re-clamp scopes against the user's current role\n\t\tconst storedScopes = JSON.parse(row.scopes) as string[];\n\t\tlet scopes = clampScopes(storedScopes, userInfo.role);\n\n\t\t// Intersect with client's registered scopes (if restricted)\n\t\tconst client = await lookupOAuthClient(db, row.client_id);\n\t\tif (client?.scopes?.length) {\n\t\t\tscopes = scopes.filter((s: string) => client.scopes!.includes(s));\n\t\t}\n\n\t\tif (scopes.length === 0) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"invalid_grant\",\n\t\t\t\t\tmessage: \"User role no longer supports any of the requested scopes\",\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Issue tokens (same as device flow)\n\t\tconst accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);\n\t\tconst accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);\n\n\t\tconst refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);\n\t\tconst refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);\n\n\t\t// Atomically store both tokens in a transaction\n\t\tawait withTransaction(db, async (trx) => {\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: accessToken.hash,\n\t\t\t\t\ttoken_type: \"access\",\n\t\t\t\t\tuser_id: row.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"mcp\",\n\t\t\t\t\texpires_at: accessExpires,\n\t\t\t\t\trefresh_token_hash: refreshToken.hash,\n\t\t\t\t\tclient_id: row.client_id,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_oauth_tokens\")\n\t\t\t\t.values({\n\t\t\t\t\ttoken_hash: refreshToken.hash,\n\t\t\t\t\ttoken_type: \"refresh\",\n\t\t\t\t\tuser_id: row.user_id,\n\t\t\t\t\tscopes: JSON.stringify(scopes),\n\t\t\t\t\tclient_type: \"mcp\",\n\t\t\t\t\texpires_at: refreshExpires,\n\t\t\t\t\trefresh_token_hash: null,\n\t\t\t\t\tclient_id: row.client_id,\n\t\t\t\t})\n\t\t\t\t.execute();\n\t\t});\n\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tdata: {\n\t\t\t\taccess_token: accessToken.raw,\n\t\t\t\trefresh_token: refreshToken.raw,\n\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\texpires_in: ACCESS_TOKEN_TTL_SECONDS,\n\t\t\t\tscope: scopes.join(\" \"),\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconsole.error(\"Token exchange error:\", error);\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_EXCHANGE_ERROR\",\n\t\t\t\tmessage: \"Failed to exchange authorization code\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Build the authorization denied redirect URL.\n */\nexport function buildDeniedRedirect(redirectUri: string, state?: string): string {\n\tconst url = new URL(redirectUri);\n\turl.searchParams.set(\"error\", \"access_denied\");\n\turl.searchParams.set(\"error_description\", \"The user denied the authorization request\");\n\tif (state) {\n\t\turl.searchParams.set(\"state\", state);\n\t}\n\treturn url.toString();\n}\n\n/**\n * Clean up expired authorization codes.\n */\nexport async function cleanupExpiredAuthorizationCodes(db: Kysely<Database>): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_authorization_codes\")\n\t\t.where(\"expires_at\", \"<\", new Date().toISOString())\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,wBAAwB;;AAG9B,MAAM,4BAA4B,OAAU,KAAK;AAsCjD,SAAS,UAAU,SAAyB;AAC3C,QAAO,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,IAAK,CAAC,aAAa;;;;;AAQ3D,SAAS,gBAAgB,WAA8B;AACtD,KAAI,CAAC,UAAW,QAAO,EAAE;AAIzB,QAFe,UAAU,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,aAAa;;;;;;;;;;AAiBzE,eAAsB,4BACrB,IACA,QACA,UACA,QAC+C;AAC/C,KAAI;AAEH,MAAI,OAAO,kBAAkB,OAC5B,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,WAAW,oBAAoB,OAAO,aAAa;AACzD,MAAI,SACH,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS;IAAU;GAC1D;EAIF,MAAM,SAAS,MAAM,kBAAkB,IAAI,OAAO,UAAU;AAC5D,MAAI,CAAC,OACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,iBAAiB,0BAA0B,OAAO,cAAc,OAAO,aAAa;AAC1F,MAAI,eACH,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAwB,SAAS;IAAgB;GAChE;AAIF,MAAI,OAAO,0BAA0B,OACpC,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;AAIF,MAAI,CAAC,OAAO,eACX,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAmB,SAAS;IAA8B;GACzE;EAIF,MAAM,aAAa,YAAY,gBAAgB,OAAO,MAAM,EAAE,SAAS;EAKvE,MAAM,eAAe,OAAO;EAC5B,MAAM,SAAS,cAAc,SAC1B,WAAW,QAAQ,MAAc,aAAa,SAAS,EAAE,CAAC,GAC1D;AAEH,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA6B;GACtE;EAIF,MAAM,OAAO,sBAAsB;EACnC,MAAM,WAAW,aAAa,KAAK;AAGnC,QAAM,GACJ,WAAW,8BAA8B,CACzC,OAAO;GACP,WAAW;GACX,WAAW,OAAO;GAClB,cAAc,OAAO;GACrB,SAAS;GACT,QAAQ,KAAK,UAAU,OAAO;GAC9B,gBAAgB,OAAO;GACvB,uBAAuB,OAAO;GAC9B,UAAU,OAAO,YAAY;GAC7B,YAAY,UAAU,sBAAsB;GAC5C,CAAC,CACD,SAAS;EAGX,MAAM,cAAc,IAAI,IAAI,OAAO,aAAa;AAChD,cAAY,aAAa,IAAI,QAAQ,KAAK;AAC1C,MAAI,OAAO,MACV,aAAY,aAAa,IAAI,SAAS,OAAO,MAAM;AAGpD,SAAO;GACN,SAAS;GACT,MAAM,EAAE,cAAc,YAAY,UAAU,EAAE;GAC9C;UACO,OAAO;AACf,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,gCACrB,IACA,QACoC;AACpC,KAAI;AAEH,MAAI,OAAO,eAAe,qBACzB,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAA0B,SAAS;IAAsB;GACxE;EAMF,MAAM,WAAW,aAAa,OAAO,KAAK;EAE1C,MAAM,MAAM,MAAM,GAChB,WAAW,8BAA8B,CACzC,MAAM,aAAa,KAAK,SAAS,CACjC,cAAc,CACd,kBAAkB;AAEpB,MAAI,CAAC,IACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA8B;GACvE;AAIF,MAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA8B;GACvE;AAIF,MAAI,IAAI,iBAAiB,OAAO,aAC/B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAyB;GAClE;AAIF,MAAI,IAAI,cAAc,OAAO,UAC5B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAsB;GAC/D;AAMF,MAAI,CAAC,cADoB,qBAAqB,OAAO,cAAc,EAC9B,IAAI,eAAe,CACvD,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA4B;GACrE;AAIF,MAAI,IAAI,YAAY,OAAO,YAAY,IAAI,aAAa,OAAO,SAC9D,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAqB;GAC9D;EAKF,MAAM,WAAW,MAAM,wBAAwB,IAAI,IAAI,QAAQ;AAC/D,MAAI,CAAC,SACJ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAkB;GAC3D;AAGF,MAAI,SAAS,SACZ,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAiB,SAAS;IAA4B;GACrE;EAKF,IAAI,SAAS,YADQ,KAAK,MAAM,IAAI,OAAO,EACJ,SAAS,KAAK;EAGrD,MAAM,SAAS,MAAM,kBAAkB,IAAI,IAAI,UAAU;AACzD,MAAI,QAAQ,QAAQ,OACnB,UAAS,OAAO,QAAQ,MAAc,OAAO,OAAQ,SAAS,EAAE,CAAC;AAGlE,MAAI,OAAO,WAAW,EACrB,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;EAIF,MAAM,cAAc,sBAAsB,eAAe,aAAa;EACtE,MAAM,gBAAgB,UAAU,yBAAyB;EAEzD,MAAM,eAAe,sBAAsB,eAAe,cAAc;EACxE,MAAM,iBAAiB,UAAU,0BAA0B;AAG3D,QAAM,gBAAgB,IAAI,OAAO,QAAQ;AACxC,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,YAAY;IACxB,YAAY;IACZ,SAAS,IAAI;IACb,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB,aAAa;IACjC,WAAW,IAAI;IACf,CAAC,CACD,SAAS;AAEX,SAAM,IACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,YAAY,aAAa;IACzB,YAAY;IACZ,SAAS,IAAI;IACb,QAAQ,KAAK,UAAU,OAAO;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,WAAW,IAAI;IACf,CAAC,CACD,SAAS;IACV;AAEF,SAAO;GACN,SAAS;GACT,MAAM;IACL,cAAc,YAAY;IAC1B,eAAe,aAAa;IAC5B,YAAY;IACZ,YAAY;IACZ,OAAO,OAAO,KAAK,IAAI;IACvB;GACD;UACO,OAAO;AACf,UAAQ,MAAM,yBAAyB,MAAM;AAC7C,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,SAAgB,oBAAoB,aAAqB,OAAwB;CAChF,MAAM,MAAM,IAAI,IAAI,YAAY;AAChC,KAAI,aAAa,IAAI,SAAS,gBAAgB;AAC9C,KAAI,aAAa,IAAI,qBAAqB,4CAA4C;AACtF,KAAI,MACH,KAAI,aAAa,IAAI,SAAS,MAAM;AAErC,QAAO,IAAI,UAAU;;;;;AAMtB,eAAsB,iCAAiC,IAAuC;CAC7F,MAAM,SAAS,MAAM,GACnB,WAAW,8BAA8B,CACzC,MAAM,cAAc,sBAAK,IAAI,MAAM,EAAC,aAAa,CAAC,CAClD,kBAAkB;AAEpB,QAAO,OAAO,OAAO,eAAe"}

package/dist/{oauth-state-store-CHMn_mwc.mjs → oauth-state-store-BndCfRum.mjs} RENAMED Viewed

@@ -47,4 +47,4 @@ function createOAuthStateStore(db) {
 //#endregion
 export { createOAuthStateStore as t };
-//# sourceMappingURL=oauth-state-store-CHMn_mwc.mjs.map
+//# sourceMappingURL=oauth-state-store-BndCfRum.mjs.map

package/dist/{oauth-state-store-CHMn_mwc.mjs.map → oauth-state-store-BndCfRum.mjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-state-store-~~CHMn_mwc~~.mjs","names":[],"sources":["../src/auth/oauth-state-store.ts"],"sourcesContent":["/*\n OAuth state store\n \n Stores OAuth state in the auth_challenges table with automatic expiration.\n * Uses the existing table but with type=\"oauth\" to distinguish from WebAuthn challenges.\n /\n\nimport type { StateStore, OAuthState } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nconst OAUTH_STATE_TTL_MS = 10 60 * 1000; // 10 minutes\n\nexport function createOAuthStateStore(db: Kysely<Database>): StateStore {\n\treturn {\n\t\tasync set(state: string, data: OAuthState): Promise<void> {\n\t\t\tconst expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge: state,\n\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\tuser_id: null,\n\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(state: string): Promise<OAuthState \| null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(state);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tif (!row.data) return null;\n\n\t\t\ttry {\n\t\t\t\tconst parsed: unknown = JSON.parse(row.data);\n\t\t\t\tif (\n\t\t\t\t\ttypeof parsed !== \"object\" \|\|\n\t\t\t\t\tparsed === null \|\|\n\t\t\t\t\t!(\"provider\" in parsed) \|\|\n\t\t\t\t\ttypeof parsed.provider !== \"string\" \|\|\n\t\t\t\t\t!(\"redirectUri\" in parsed) \|\|\n\t\t\t\t\ttypeof parsed.redirectUri !== \"string\"\n\t\t\t\t) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tconst oauthState: OAuthState = {\n\t\t\t\t\tprovider: parsed.provider,\n\t\t\t\t\tredirectUri: parsed.redirectUri,\n\t\t\t\t};\n\t\t\t\tif (\"codeVerifier\" in parsed && typeof parsed.codeVerifier === \"string\") {\n\t\t\t\t\toauthState.codeVerifier = parsed.codeVerifier;\n\t\t\t\t}\n\t\t\t\tif (\"nonce\" in parsed && typeof parsed.nonce === \"string\") {\n\t\t\t\t\toauthState.nonce = parsed.nonce;\n\t\t\t\t}\n\t\t\t\tif (\"inviteToken\" in parsed && typeof parsed.inviteToken === \"string\") {\n\t\t\t\t\toauthState.inviteToken = parsed.inviteToken;\n\t\t\t\t}\n\t\t\t\treturn oauthState;\n\t\t\t} catch {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\n\t\tasync delete(state: string): Promise<void> {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"auth_challenges\")\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.execute();\n\t\t},\n\t};\n}\n"],"mappings":";AAYA,MAAM,qBAAqB,MAAU;AAErC,SAAgB,sBAAsB,IAAkC;AACvE,QAAO;EACN,MAAM,IAAI,OAAe,MAAiC;GACzD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,mBAAmB,CAAC,aAAa;AAEzE,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM;IACN,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,OAA2C;GACpD,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;AAKjB,OAHkB,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS,GAGpC,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,MAAM;AACxB,WAAO;;AAGR,OAAI,CAAC,IAAI,KAAM,QAAO;AAEtB,OAAI;IACH,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK;AAC5C,QACC,OAAO,WAAW,YAClB,WAAW,QACX,EAAE,cAAc,WAChB,OAAO,OAAO,aAAa,YAC3B,EAAE,iBAAiB,WACnB,OAAO,OAAO,gBAAgB,SAE9B,QAAO;IAER,MAAM,aAAyB;KAC9B,UAAU,OAAO;KACjB,aAAa,OAAO;KACpB;AACD,QAAI,kBAAkB,UAAU,OAAO,OAAO,iBAAiB,SAC9D,YAAW,eAAe,OAAO;AAElC,QAAI,WAAW,UAAU,OAAO,OAAO,UAAU,SAChD,YAAW,QAAQ,OAAO;AAE3B,QAAI,iBAAiB,UAAU,OAAO,OAAO,gBAAgB,SAC5D,YAAW,cAAc,OAAO;AAEjC,WAAO;WACA;AACP,WAAO;;;EAIT,MAAM,OAAO,OAA8B;AAC1C,SAAM,GACJ,WAAW,kBAAkB,CAC7B,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,SAAS;;EAEZ"}
1	+ {"version":3,"file":"oauth-state-store-BndCfRum.mjs","names":[],"sources":["../src/auth/oauth-state-store.ts"],"sourcesContent":["/*\n OAuth state store\n \n Stores OAuth state in the auth_challenges table with automatic expiration.\n * Uses the existing table but with type=\"oauth\" to distinguish from WebAuthn challenges.\n /\n\nimport type { StateStore, OAuthState } from \"@emdash-cms/auth\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nconst OAUTH_STATE_TTL_MS = 10 60 * 1000; // 10 minutes\n\nexport function createOAuthStateStore(db: Kysely<Database>): StateStore {\n\treturn {\n\t\tasync set(state: string, data: OAuthState): Promise<void> {\n\t\t\tconst expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge: state,\n\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\tuser_id: null,\n\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\tdata: JSON.stringify(data),\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(state: string): Promise<OAuthState \| null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(state);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tif (!row.data) return null;\n\n\t\t\ttry {\n\t\t\t\tconst parsed: unknown = JSON.parse(row.data);\n\t\t\t\tif (\n\t\t\t\t\ttypeof parsed !== \"object\" \|\|\n\t\t\t\t\tparsed === null \|\|\n\t\t\t\t\t!(\"provider\" in parsed) \|\|\n\t\t\t\t\ttypeof parsed.provider !== \"string\" \|\|\n\t\t\t\t\t!(\"redirectUri\" in parsed) \|\|\n\t\t\t\t\ttypeof parsed.redirectUri !== \"string\"\n\t\t\t\t) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tconst oauthState: OAuthState = {\n\t\t\t\t\tprovider: parsed.provider,\n\t\t\t\t\tredirectUri: parsed.redirectUri,\n\t\t\t\t};\n\t\t\t\tif (\"codeVerifier\" in parsed && typeof parsed.codeVerifier === \"string\") {\n\t\t\t\t\toauthState.codeVerifier = parsed.codeVerifier;\n\t\t\t\t}\n\t\t\t\tif (\"nonce\" in parsed && typeof parsed.nonce === \"string\") {\n\t\t\t\t\toauthState.nonce = parsed.nonce;\n\t\t\t\t}\n\t\t\t\tif (\"inviteToken\" in parsed && typeof parsed.inviteToken === \"string\") {\n\t\t\t\t\toauthState.inviteToken = parsed.inviteToken;\n\t\t\t\t}\n\t\t\t\treturn oauthState;\n\t\t\t} catch {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\n\t\tasync delete(state: string): Promise<void> {\n\t\t\tawait db\n\t\t\t\t.deleteFrom(\"auth_challenges\")\n\t\t\t\t.where(\"challenge\", \"=\", state)\n\t\t\t\t.where(\"type\", \"=\", \"oauth\")\n\t\t\t\t.execute();\n\t\t},\n\t};\n}\n"],"mappings":";AAYA,MAAM,qBAAqB,MAAU;AAErC,SAAgB,sBAAsB,IAAkC;AACvE,QAAO;EACN,MAAM,IAAI,OAAe,MAAiC;GACzD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,mBAAmB,CAAC,aAAa;AAEzE,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM;IACN,MAAM,KAAK,UAAU,KAAK;IAC1B,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,OAA2C;GACpD,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;AAKjB,OAHkB,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS,GAGpC,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,MAAM;AACxB,WAAO;;AAGR,OAAI,CAAC,IAAI,KAAM,QAAO;AAEtB,OAAI;IACH,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK;AAC5C,QACC,OAAO,WAAW,YAClB,WAAW,QACX,EAAE,cAAc,WAChB,OAAO,OAAO,aAAa,YAC3B,EAAE,iBAAiB,WACnB,OAAO,OAAO,gBAAgB,SAE9B,QAAO;IAER,MAAM,aAAyB;KAC9B,UAAU,OAAO;KACjB,aAAa,OAAO;KACpB;AACD,QAAI,kBAAkB,UAAU,OAAO,OAAO,iBAAiB,SAC9D,YAAW,eAAe,OAAO;AAElC,QAAI,WAAW,UAAU,OAAO,OAAO,UAAU,SAChD,YAAW,QAAQ,OAAO;AAE3B,QAAI,iBAAiB,UAAU,OAAO,OAAO,gBAAgB,SAC5D,YAAW,cAAc,OAAO;AAEjC,WAAO;WACA;AACP,WAAO;;;EAIT,MAAM,OAAO,OAA8B;AAC1C,SAAM,GACJ,WAAW,kBAAkB,CAC7B,MAAM,aAAa,KAAK,MAAM,CAC9B,MAAM,QAAQ,KAAK,QAAQ,CAC3B,SAAS;;EAEZ"}

package/dist/object-cache/memory.d.mts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { t as CreateObjectCacheBackendFn } from "../types-DvqVxZXa.mjs";
+import { t as CreateObjectCacheBackendFn } from "../types-CVXHwIBB.mjs";
 //#region src/object-cache/memory.d.ts
 /**

package/dist/{object-cache-Bo6DGaC9.mjs → object-cache-DmKr09La.mjs} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { t as after } from "./after-PcEvMY_6.mjs";
+import { t as after } from "./after-32yNRvd2.mjs";
 import { getRequestContext } from "./request-context.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -337,6 +337,17 @@ async function getEpoch(namespace, backend) {
 * failing `set` is dropped.
 */
 async function cachedQuery(options) {
+	return cachedQueryWithEpochs(options);
+}
+/**
+* {@link cachedQuery} that also passes `onEpochs` the namespace epochs the read
+* is checked against and stored under, in namespace order, before the cached
+* value is returned or `load` runs. Not called when the cache is disabled or
+* bypassed.
+*
+* @internal
+*/
+async function cachedQueryWithEpochs(options) {
 	const backend = await getBackend();
 	if (!backend || shouldBypass()) return options.load();
 	const namespaces = typeof options.namespace === "string" ? [options.namespace] : options.namespace;
@@ -344,6 +355,7 @@ async function cachedQuery(options) {
 	const epochsPromise = Promise.all(namespaces.map((ns) => getEpoch(ns, backend)));
 	const rawPromise = withTimeout(backend.get(fullKey), holder.config.timeout, "read").catch(() => null);
 	const currentEpochs = await epochsPromise;
+	options.onEpochs?.(currentEpochs);
 	const raw = await rawPromise;
 	if (raw !== null) {
 		const decoded = decode(raw);
@@ -523,7 +535,8 @@ const CacheNamespace = {
 	TAXONOMIES: "taxonomies",
 	BYLINES: "bylines",
 	SCHEMA: "schema",
-	COMMENTS: "comments"
+	COMMENTS: "comments",
+	WIDGETS: "widgets"
 };
 /** Namespace for a content collection's cached queries. */
 function contentNamespace(collection) {
@@ -572,6 +585,10 @@ function invalidateBylineObjectCache() {
 function invalidateMenuObjectCache() {
 	invalidateObjectCache(CacheNamespace.MENUS);
 }
+/** Invalidate cached widget areas. */
+function invalidateWidgetObjectCache() {
+	invalidateObjectCache(CacheNamespace.WIDGETS);
+}
 /** Invalidate cached collection schema/metadata reads (e.g. getCollectionInfo). */
 function invalidateSchemaObjectCache() {
 	invalidateObjectCache(CacheNamespace.SCHEMA);
@@ -582,5 +599,5 @@ function invalidateCommentObjectCache() {
 }
 //#endregion
-export { contentNamespace as a, invalidateBylineObjectCache as c, invalidateMenuObjectCache as d, invalidateObjectCache as f, isObjectCacheActive as h, contentCacheNamespaces as i, invalidateCollectionCache as l, invalidateTaxonomyObjectCache as m, cachedQuery as n, contentNamespaces as o, invalidateSchemaObjectCache as p, coalesceObjectCacheWrites as r, getLastContentWriteAt as s, CacheNamespace as t, invalidateCommentObjectCache as u };
-//# sourceMappingURL=object-cache-Bo6DGaC9.mjs.map
+export { isObjectCacheActive as _, contentCacheNamespaces as a, getLastContentWriteAt as c, invalidateCommentObjectCache as d, invalidateMenuObjectCache as f, invalidateWidgetObjectCache as g, invalidateTaxonomyObjectCache as h, coalesceObjectCacheWrites as i, invalidateBylineObjectCache as l, invalidateSchemaObjectCache as m, cachedQuery as n, contentNamespace as o, invalidateObjectCache as p, cachedQueryWithEpochs as r, contentNamespaces as s, CacheNamespace as t, invalidateCollectionCache as u };
+//# sourceMappingURL=object-cache-DmKr09La.mjs.map